www.hellyhansenromania.net
Open in
urlscan Pro
196.244.193.131
Malicious Activity!
Public Scan
Submitted URL: http://hellyhansenromania.net/favicon.ico
Effective URL: https://www.hellyhansenromania.net/favicon.ico
Submission: On October 25 via api from US — Scanned from FI
Effective URL: https://www.hellyhansenromania.net/favicon.ico
Submission: On October 25 via api from US — Scanned from FI
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 21 HTTP transactions.
The main IP is 196.244.193.131, located in
Helsinki, Finland and
belongs to PACKETEXCHANGE, GB.
The main domain is www.hellyhansenromania.net.
TLS certificate: Issued by ZeroSSL ECC Domain Secure Site CA on August 28th 2024. Valid for: 3 months.
This is the only time www.hellyhansenromania.net was scanned on urlscan.io!
TLS certificate: Issued by ZeroSSL ECC Domain Secure Site CA on August 28th 2024. Valid for: 3 months.
This is the only time www.hellyhansenromania.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Fake Shop (Fashion)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 21 | 196.244.193.131 196.244.193.131 | 58065 (PACKETEXC...) (PACKETEXCHANGE) | |
| 1 | 151.101.130.137 151.101.130.137 | 54113 (FASTLY) (FASTLY) | |
| 21 | 3 |
21
196.244.193.131
(Helsinki, Finland)
ASN58065 (PACKETEXCHANGE, GB)
ASN58065 (PACKETEXCHANGE, GB)
| hellyhansenromania.net | |
| www.hellyhansenromania.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 21 |
hellyhansenromania.net
1 redirects
hellyhansenromania.net www.hellyhansenromania.net |
1 MB |
| 1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 791 |
30 KB |
| 21 | 2 |
| Domain | Requested by | |
|---|---|---|
| 20 | www.hellyhansenromania.net |
www.hellyhansenromania.net
|
| 1 | code.jquery.com |
www.hellyhansenromania.net
|
| 1 | hellyhansenromania.net | 1 redirects |
| 21 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| hellyhansenromania.net ZeroSSL ECC Domain Secure Site CA |
2024-08-28 - 2024-11-26 |
3 months | crt.sh |
| *.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.hellyhansenromania.net/favicon.ico
Frame ID: 6AFA4D3D0C93F72CB5095DF3D9E3D383
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
Pagina nu exista : Helly Hansen Romania-Helly Hansen geaca la modă și confortabil - O reducere mare la toate helly hansen ghete și helly hansen geaca dama.Page URL History Show full URLs
-
http://hellyhansenromania.net/favicon.ico
HTTP 307
https://hellyhansenromania.net/favicon.ico HTTP 301
https://www.hellyhansenromania.net/favicon.ico Page URL
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Lightbox
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- lightbox(?:-plus-jquery)?.{0,32}\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://hellyhansenromania.net/favicon.ico
HTTP 307
https://hellyhansenromania.net/favicon.ico HTTP 301
https://www.hellyhansenromania.net/favicon.ico Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
favicon.ico
www.hellyhansenromania.net/ Redirect Chain
|
31 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.min.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/font-awesome/css/ |
492 KB 120 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style_bootstrap_icons.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/ |
84 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style_plugins.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/ |
216 KB 47 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style_zp.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/ |
38 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
stylesheet.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/ |
28 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
stylesheet_colors.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/ |
7 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
stylesheet_css_buttons.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jscript_matchHeight-min.js
www.hellyhansenromania.net/includes/templates/hellyhansenromania/jscript/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jscript_zlightbox.js
www.hellyhansenromania.net/includes/templates/hellyhansenromania/jscript/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
print_stylesheet.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/ |
719 B 708 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
responsive.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
responsive_default.css
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/ |
35 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.png
www.hellyhansenromania.net/includes/templates/hellyhansenromania/images/home/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bushwacker_cizme_de_drume_ie_helly_tech_decoltate_pentru_b_rba_i_Helly_Hansen_6RXD401141.png
www.hellyhansenromania.net/images/barba-i/incaltaminte/bocanci/ |
109 KB 109 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
negru_carac_pantofi_de_alergare_featherswift_pentru_b_rba_i_Helly_Hansen_6RXD401140.png
www.hellyhansenromania.net/images/barba-i/incaltaminte/bocanci/ |
162 KB 163 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
43 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap-icons.woff2
www.hellyhansenromania.net/includes/templates/hellyhansenromania/fonts/ |
127 KB 128 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
annimex-icons.ttf
www.hellyhansenromania.net/includes/templates/hellyhansenromania/fonts/ |
137 KB 138 KB |
Font
application/x-font-ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fa-solid-900.woff2
www.hellyhansenromania.net/includes/templates/hellyhansenromania/css/font-awesome/webfonts/ |
313 KB 313 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
www.hellyhansenromania.net/ |
31 KB 7 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Fake Shop (Fashion)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| lightbox object| zcJS1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .www.hellyhansenromania.net/ | Name: zenid Value: rlo2m7m02ljamu25nko5gcojjo |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
hellyhansenromania.net
www.hellyhansenromania.net
151.101.130.137
196.244.193.131
0d3b4e028de28f9427193fb6877cad425d61e6abf85fe8d3095eded4a7a3210b
1fafb37f597b9c8b601b6293c2ffbbb556682ca4b26c9db7571f0d9211521993
46d2c07611e5408e0ae3b5c5ac86b8056fb5c925855deb5b8711788b6991a4b4
476adf42b40325098fcfa8b36ab3e769186bb4f6ce6a249753e2e1a9c22bf99e
4d651bfcf2873ecfc1059424d916759e9d316d1cd5079f034334658a373ef9fc
70029b459b62bf70c97cd8f2a3c397c36fe0aa13f4a29b88e268eb8c35569898
7ff7696dd85c78ef679093ae53c2ee11ee35396884640596666911c0c8a8d2ea
924025d175bc0292a137b2b46a4ee48e77c8618c3ea19e44214b6abf30f16005
98230fdb158775dd646587538dada11bb259c81156428185a6c7ab008ee060a7
af5ddaf7d1b92d461fbd2bfa9bdfd18cd49ab115c5cea0c21c9b88a089bfc754
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b39add2833fb121a60c80bbd9f804d6e4dff9509a08b9e8624ba03b9c3bd9119
babb91ace2a0a528aa24617ccb68dd8830122a04b7843c3d6c423224a88684bb
c0fd7653283e19ac86a3245bfd82feab6bc58794511975e68af222fa3800e455
c9bf5e25646c5defe4e8c4b81c116ead1ac6e87bb8b26e657096118a4c1c0fca
d1baf6647a6c4f82cfc88d732438356d3ce45c584e6abe4f6c5235607f56a8d3
dee5daded4ae567d5138a13e35ff390519ff056be7276031486660b58d3d8be9
e5e97b3e0486db4a08a6a423c8b7e7c482b906d16b481eb01096a26c74666483
f35212a62380a11c8d98e550e548bf009b6bd6769f0cc93693f1d165906770cc
f3c76228bbc9e8f4910d8149b554fe50038eb1ab8feaf43afe2061ef69949893
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fcc177126535137af9ec23f887c994fd01464fcb212aa47a723917631a2b59d5