lunca-serv.ro Open in urlscan Pro
192.185.12.209 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://lunca-serv.ro/estates/CD-File/Wrongpassword.php
Submission: On April 13 via manual (April 13th 2021, 8:05:53 pm UTC) from US

Summary HTTP 11 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 11 HTTP transactions. The main IP is 192.185.12.209, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is lunca-serv.ro.
TLS certificate: Issued by R3 on February 14th 2021. Valid for: 3 months.

This is the only time lunca-serv.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address		AS Autonomous System
1	192.185.12.209 192.185.12.209		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
9	208.67.16.107 208.67.16.107		3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
1	104.198.104.86 104.198.104.86		15169 (GOOGLE) (GOOGLE)
11	3

1 192.185.12.209 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-12-209.unifiedlayer.com

lunca-serv.ro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 208.67.16.107 (United States)

ASN3257 (GTT-BACKBONE GTT, US)
PTR: vps796.plesklogin.net

faminc.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.198.104.86 (The Dalles, United States)

ASN15169 (GOOGLE, US)
PTR: 86.104.198.104.bc.googleusercontent.com

www.entranceconsulting.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	faminc.biz faminc.biz	78 KB
1	entranceconsulting.com www.entranceconsulting.com	37 KB
1	lunca-serv.ro lunca-serv.ro	2 KB
11	3

	Domain	Requested by
9	faminc.biz	lunca-serv.ro
1	www.entranceconsulting.com	lunca-serv.ro
1	lunca-serv.ro
11	3

This site contains no links.

Subject Issuer	Validity	Valid
autodiscover.lunca-serv.ro R3	`2021-02-14` - `2021-05-15`	3 months	crt.sh
faminc.biz Sectigo RSA Domain Validation Secure Server CA	`2020-07-27` - `2021-07-27`	a year	crt.sh
www.entranceconsulting.com R3	`2021-03-21` - `2021-06-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php
Frame ID: 830F1C557D1501A039C060BDCC8A1B09
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

116 kB
Transfer

248 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request Wrongpassword.php Show response lunca-serv.ro/estates/CD-File/	4 KB 2 KB	506ms 256ms	Document text/html	192.185.12.209 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.12.209 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-12-209.unifiedlayer.com Software Apache / Resource Hash `f45f51d1c41f89f8efc031a7fd173c0ec6583ceabd2058fbb7491472de40b630` Request headers :method GET :authority lunca-serv.ro :scheme https :path /estates/CD-File/Wrongpassword.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:37 GMT server Apache vary Accept-Encoding content-encoding gzip content-length 1634 content-type text/html; charset=UTF-8
GET H2	200	jquery.js Show response faminc.biz/wp-includes/js/jquery/	95 KB 32 KB	289ms 286ms	Script application/javascript	208.67.16.107 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://faminc.biz/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 208.67.16.107 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS vps796.plesklogin.net Software LiteSpeed / Resource Hash `fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:34 GMT content-encoding br last-modified Wed, 28 Nov 2018 03:19:04 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 32857 expires Tue, 20 Apr 2021 20:05:34 GMT
GET H2	200	jquery-migrate.min.js Show response faminc.biz/wp-includes/js/jquery/	10 KB 4 KB	425ms 422ms	Script application/javascript	208.67.16.107 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://faminc.biz/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1 Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 208.67.16.107 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS vps796.plesklogin.net Software LiteSpeed / Resource Hash `48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:34 GMT content-encoding br last-modified Wed, 28 Nov 2018 03:19:04 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 3823 expires Tue, 20 Apr 2021 20:05:34 GMT
GET H2	200	force-zxcvbn.min.js Show response faminc.biz/wp-content/mu-plugins/force-strong-passwords/	227 B 258 B	563ms 560ms	Script application/javascript	208.67.16.107 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://faminc.biz/wp-content/mu-plugins/force-strong-passwords/force-zxcvbn.min.js?ver=1.7 Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 208.67.16.107 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS vps796.plesklogin.net Software LiteSpeed / Resource Hash `8f2a9d404f9d0555d9843c8a42fc4be424a188aac72eeff03258680dc35378e6` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:34 GMT last-modified Wed, 28 Nov 2018 03:19:24 GMT server LiteSpeed content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 227 expires Tue, 20 Apr 2021 20:05:34 GMT
GET H2	200	js-admin.min.js Show response faminc.biz/wp-content/mu-plugins/force-strong-passwords/	432 B 287 B	563ms 561ms	Script application/javascript	208.67.16.107 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://faminc.biz/wp-content/mu-plugins/force-strong-passwords/js-admin.min.js?ver=1.7 Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 208.67.16.107 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS vps796.plesklogin.net Software LiteSpeed / Resource Hash `c7591bf7ecde06f7a8336e46c650119f9d53a7f2b151de409ff1cc7a3666f4c2` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:34 GMT content-encoding br last-modified Wed, 28 Nov 2018 03:19:24 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 253 expires Tue, 20 Apr 2021 20:05:34 GMT
GET H2	200	dashicons.min.css faminc.biz/wp-includes/css/	45 KB 28 KB	425ms 423ms	Stylesheet text/css	208.67.16.107 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://faminc.biz/wp-includes/css/dashicons.min.css?ver=5.2.4 Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 208.67.16.107 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS vps796.plesklogin.net Software LiteSpeed / Resource Hash `d0df2ff25fded9e43a0cfa5159393d4482725bfb390e8ca94f34da85b5304117` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:34 GMT content-encoding br last-modified Wed, 28 Nov 2018 03:19:04 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 28437 expires Tue, 20 Apr 2021 20:05:34 GMT
GET H2	200	buttons.min.css faminc.biz/wp-includes/css/	6 KB 1 KB	438ms 436ms	Stylesheet text/css	208.67.16.107 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://faminc.biz/wp-includes/css/buttons.min.css?ver=5.2.4 Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 208.67.16.107 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS vps796.plesklogin.net Software LiteSpeed / Resource Hash `2e483dbf40a1c11bf1ec3e80a61fd4ed5e5684c9f3787e13dc979ba0a0e7f14c` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:34 GMT content-encoding br last-modified Wed, 28 Nov 2018 03:19:04 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 1317 expires Tue, 20 Apr 2021 20:05:34 GMT
GET H2	200	forms.min.css faminc.biz/wp-admin/css/	21 KB 5 KB	438ms 436ms	Stylesheet text/css	208.67.16.107 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://faminc.biz/wp-admin/css/forms.min.css?ver=5.2.4 Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 208.67.16.107 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS vps796.plesklogin.net Software LiteSpeed / Resource Hash `b9f3931d0ae236b024ad7c28531770808e53b5abdeeba68fe2515e1eda8b348e` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:34 GMT content-encoding br last-modified Wed, 28 Nov 2018 03:19:24 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 5085 expires Tue, 20 Apr 2021 20:05:34 GMT
GET H2	200	l10n.min.css faminc.biz/wp-admin/css/	2 KB 640 B	561ms 559ms	Stylesheet text/css	208.67.16.107 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://faminc.biz/wp-admin/css/l10n.min.css?ver=5.2.4 Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 208.67.16.107 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS vps796.plesklogin.net Software LiteSpeed / Resource Hash `23c5a631e73d2e0fe3d0b2c48377ca210b476f152facfaff7672e1fd424e69f9` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:34 GMT content-encoding br last-modified Wed, 28 Nov 2018 03:19:24 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 611 expires Tue, 20 Apr 2021 20:05:34 GMT
GET H2	200	login.min.css faminc.biz/wp-admin/css/	27 KB 6 KB	561ms 560ms	Stylesheet text/css	208.67.16.107 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://faminc.biz/wp-admin/css/login.min.css?ver=5.2.4 Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 208.67.16.107 , United States, ASN3257 (GTT-BACKBONE GTT, US), Reverse DNS vps796.plesklogin.net Software LiteSpeed / Resource Hash `6e5f26d95dbd358ff1ff481b92e5491fcaa7ec19e1a00f8f9a8c8b86e46a646a` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:34 GMT content-encoding br last-modified Wed, 28 Nov 2018 03:19:24 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 6454 expires Tue, 20 Apr 2021 20:05:34 GMT
GET H2	200	Office365.jpg www.entranceconsulting.com/wp-content/uploads/2017/08/	37 KB 37 KB	154ms 153ms	Image image/jpeg	104.198.104.86 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.entranceconsulting.com/wp-content/uploads/2017/08/Office365.jpg Requested by Host: lunca-serv.ro URL: https://lunca-serv.ro/estates/CD-File/Wrongpassword.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.104.86 The Dalles, United States, ASN15169 (GOOGLE, US), Reverse DNS 86.104.198.104.bc.googleusercontent.com Software nginx / Resource Hash `e826d92ed6c1e79b4661766ee4fe1781b1d1c2f601700ed3a679e12aef20e2a7` Request headers Referer https://lunca-serv.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 13 Apr 2021 20:05:37 GMT last-modified Thu, 31 Aug 2017 19:15:33 GMT server nginx etag "59a86055-925d" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 37469

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated undefined| $ function| jQuery function| wp_attempt_focus object| d

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://faminc.biz/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

faminc.biz
lunca-serv.ro
www.entranceconsulting.com
104.198.104.86
192.185.12.209
208.67.16.107
23c5a631e73d2e0fe3d0b2c48377ca210b476f152facfaff7672e1fd424e69f9
2e483dbf40a1c11bf1ec3e80a61fd4ed5e5684c9f3787e13dc979ba0a0e7f14c
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
6e5f26d95dbd358ff1ff481b92e5491fcaa7ec19e1a00f8f9a8c8b86e46a646a
8f2a9d404f9d0555d9843c8a42fc4be424a188aac72eeff03258680dc35378e6
b9f3931d0ae236b024ad7c28531770808e53b5abdeeba68fe2515e1eda8b348e
c7591bf7ecde06f7a8336e46c650119f9d53a7f2b151de409ff1cc7a3666f4c2
d0df2ff25fded9e43a0cfa5159393d4482725bfb390e8ca94f34da85b5304117
e826d92ed6c1e79b4661766ee4fe1781b1d1c2f601700ed3a679e12aef20e2a7
f45f51d1c41f89f8efc031a7fd173c0ec6583ceabd2058fbb7491472de40b630
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e