urlscan.io logo urlscan.io
SecurityTrails logo

itunes.ro Open in urlscan Pro
185.179.159.46  Public Scan

Go To Rescan Add Verdict Report
URL: https://itunes.ro/
Submission Tags: @phishunt_io
Submission: On November 10 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 185.179.159.46, located in Romania and belongs to TES-AS, RO. The main domain is itunes.ro.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 10th 2021. Valid for: 3 months.
This is the only time itunes.ro was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 185.179.159.46 50937 (TES-AS)
1 5.57.17.220 43996 (BOOKING-B...)
3 2
Apex Domain
Subdomains		 Transfer
2 itunes.ro
itunes.ro
450 B
1 booking.com
www.booking.com
1 KB
3 2
Domain Requested by
2 itunes.ro itunes.ro
1 www.booking.com itunes.ro
3 2

This site contains no links.

Subject Issuer Validity Valid
itunes.ro
cPanel, Inc. Certification Authority		 2021-11-10 -
2022-02-08		 3 months crt.sh
*.booking.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-28 -
2022-09-28		 a year crt.sh

This page contains 3 frames:

Primary Page: https://itunes.ro/
Frame ID: 81B593170B2A99E6F8509D34BD274146
Requests: 1 HTTP requests in this frame

Frame: https://itunes.ro/logip.php
Frame ID: B876F2957FA4095957497B5B77DA1FEA
Requests: 1 HTTP requests in this frame

Frame: https://www.booking.com/index.html?aid=322163
Frame ID: 4FAE9CDE33405779FBDC4C69E24982FE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

iTunes

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

2 kB
Transfer

1 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
itunes.ro/ 		363 B
277 B 		Document
General
Check archive.org
Download Go to
Full URL
https://itunes.ro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.179.159.46 , Romania, ASN50937 (TES-AS, RO),
Reverse DNS
Software
LiteSpeed /
Resource Hash
5476d674ff488ab9a2ce6fbaa5cee8c9bcc479a2747524fc4e269112ca78b8fd

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

content-type
text/html
last-modified
Sun, 15 Sep 2019 11:22:32 GMT
accept-ranges
bytes
content-encoding
br
vary
Accept-Encoding
content-length
164
date
Wed, 10 Nov 2021 06:49:10 GMT
server
LiteSpeed
logip.php
itunes.ro/ Frame B876 		122 B
173 B 		Document
General
Check archive.org
Download Go to
Full URL
https://itunes.ro/logip.php
Requested by
Host: itunes.ro
URL: https://itunes.ro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.179.159.46 , Romania, ASN50937 (TES-AS, RO),
Reverse DNS
Software
LiteSpeed /
Resource Hash
de2bb41687adff38cf924c45d6844ba1bf0d3aece78b9b0f14cbdd467e015501

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://itunes.ro/

Response headers

content-type
text/html; charset=UTF-8
content-length
94
content-encoding
br
vary
Accept-Encoding
date
Wed, 10 Nov 2021 06:49:11 GMT
server
LiteSpeed
index.html
www.booking.com/ Frame 4FAE 		92 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.booking.com/index.html?aid=322163
Requested by
Host: itunes.ro
URL: https://itunes.ro/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
5.57.17.220 Amsterdam, Netherlands, ASN43996 (BOOKING-BV Booking.com, NL),
Reverse DNS
www.booking.com
Software
nginx /
Resource Hash
7d26825701e040fa9ba7c9a9eb6320778dc105367f1c72df4a2c4cdc32b3c4ae
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://itunes.ro/

Response headers

server
nginx
date
Wed, 10 Nov 2021 06:49:11 GMT
content-type
text/html; charset=UTF-8
content-length
56
cache-control
private
vary
Accept-Encoding, User-Agent
content-encoding
br
nel
{"report_to":"default","max_age":604800}
report-to
{"group":"default","endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800}
strict-transport-security
max-age=604800
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

1 Cookies

Domain/Path Name / Value
.booking.com/ Name: bkng
Value: 11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeePdzBD1%2FmM3rRUf5X0giFRkWTIk5lWxtAIupKmj9JjSqDc5qklVpOqDXbU1ZgXBSy1rA0wwkDBI9x7GtzW6jh8dZpWOduIezCOUIyUzqrgwnNzOXqWvsU%2FUKNjXxVkCMfgPVn3Ye6fqr5NHMc8k8tTnjGCrcz4CF4%3D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

itunes.ro
www.booking.com
185.179.159.46
5.57.17.220
5476d674ff488ab9a2ce6fbaa5cee8c9bcc479a2747524fc4e269112ca78b8fd
7d26825701e040fa9ba7c9a9eb6320778dc105367f1c72df4a2c4cdc32b3c4ae
de2bb41687adff38cf924c45d6844ba1bf0d3aece78b9b0f14cbdd467e015501