# PhishDestroy domain threat record: covoruloltenesc.ro

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/covoruloltenesc.ro/
Machine-readable companion: https://phishdestroy.io/domain/covoruloltenesc.ro/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 21:35:23 UTC
- Last availability or vendor check: 2026-10-22 10:26:52 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 185.240.253.203
- Registrar in stored WHOIS data: Webrasoft SRL
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2016-06-06 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a127bd-2a96-755f-9a11-e428fed7b1d1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/covoruloltenesc.ro
- Certificate Transparency search: https://crt.sh/?q=%25.covoruloltenesc.ro
- Web Archive lookup: https://web.archive.org/web/*/https://covoruloltenesc.ro/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
covoruloltenesc.ro presents itself as "Covorul Oltenesc", a name that evokes traditional Oltenian carpets and is aimed at Romanian-speaking customers looking for that brand online. PhishDestroy classifies it as an impersonation phishing page and first flagged it on 2026-10-10. As of 2026-10-19 the site was still online and serving content, so anyone landing on it now sees a working page.

How the scam works
Impersonation pages of this kind copy the name, look and product presentation of a real business so visitors believe they are dealing with the genuine seller. The goal is to get the visitor to act: place an order and pay, type card details into a checkout form, or create an account with an email and password. Payments typically go to the operators with nothing delivered, and card numbers, addresses, phone numbers and reused passwords become material for further fraud.

Evidence
On 2026-10-16, 7 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, Seclookup, SOCRadar, URLQuery and VIPRE. That is a minority, but these seven are independent vendors reaching the same verdict, which matters because new or low-profile phishing pages often score low at first. The domain also appears in 34 AlienVault OTX threat pulses, showing it is circulating in shared threat intelligence, and it is listed on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2016-06-07 through Webrasoft SRL, roughly ten years before PhishDestroy detected it. Because it has such a long history, it can look more trustworthy to reputation filters and to visitors than a freshly registered domain would. It resolves to 185.240.253.203 on the AMC Websoft SRL network in Romania, so it is hosted locally alongside the audience it targets. The Let's Encrypt certificate only means the connection is encrypted. It shows nothing about who runs the site.

What to do
If you paid for an order here, contact your bank or card issuer right away to dispute the charge, and ask them to reissue the card if you typed its number into the site. If you created an account, change that password everywhere you reused it, turn on two-factor authentication, and treat follow-up emails, SMS or calls about your "order" as phishing. Keep screenshots and payment receipts, and report the site to Romanian consumer and cybercrime authorities. Defenders should block covoruloltenesc.ro and its IP address at the DNS and proxy level and alert Romanian-facing customer and support teams to the lookalike brand.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a127bd-2a96-755f-9a11-e428fed7b1d1/
VirusTotal report: https://www.virustotal.com/gui/domain/covoruloltenesc.ro
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=covoruloltenesc.ro
Archived copy: https://web.archive.org/web/20261010213449/https://covoruloltenesc.ro/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:37 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/DPgTXgB0/a012a6020350.png
  Captured: 2026-10-10 21:35:23 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a127bd-2a96-755f-9a11-e428fed7b1d1.png
  Captured: 2026-10-10 21:35:23 UTC
  Source report: https://urlscan.io/result/01a127bd-2a96-755f-9a11-e428fed7b1d1/
- URLScan capture 2: https://urlscan.io/screenshots/01a0c157-6e10-7167-92b5-9381d2a2be86.png
  Captured: 2026-10-10 21:34:09 UTC
  Source report: https://urlscan.io/result/01a127bd-2a96-755f-9a11-e428fed7b1d1/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/516f71f9-fd1c-4a5a-bf96-5a0bd7bce70c.png
  Captured: 2026-10-12 11:52:34 UTC
  Source report: https://radar.cloudflare.com/scan/516f71f9-fd1c-4a5a-bf96-5a0bd7bce70c
  SHA-256: 402f0db56b9fad756ed9adbb6ef7f4bdfae8e9bf6a15d0fd4cc2f4f4b6a779d8
- URLQuery: https://screenshots.phishdestroy.io/uq/98b733b6-53e0-474c-a146-626af19c1392.png
  Source report: https://urlquery.net/report/98b733b6-53e0-474c-a146-626af19c1392
  SHA-256: f74b9d44b0510a28928e8abe639d233e0d806b352f71ea2bba3245aaad6359f1
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c157-6e10-7167-92b5-9381d2a2be86.png
  Captured: 2026-09-21 00:22:16 UTC
  Source report: https://urlscan.io/result/01a0c157-6e10-7167-92b5-9381d2a2be86/
  SHA-256: f8bf690146f9ed8916168e155aa643f6c075f4d86a9217111918a898a9b8ac14
- URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a13e97-b95c-71bf-bc37-1cab1b7c35a7.png
  Captured: 2026-10-15 08:05:02 UTC
  Source report: https://urlscan.io/result/01a13e97-b95c-71bf-bc37-1cab1b7c35a7/
  SHA-256: f8bf690146f9ed8916168e155aa643f6c075f4d86a9217111918a898a9b8ac14

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:34:05Z",
        "uuid": "01a127bd-2a96-755f-9a11-e428fed7b1d1",
        "scanned_at": "2026-10-10T21:34:41Z",
        "final_url": "https://covoruloltenesc.ro/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://covoruloltenesc.ro/",
                "from": "http://covoruloltenesc.ro/",
                "status": 307
            }
        ],
        "ip": "185.240.253.203",
        "ptr": "covoruloltenesc.ro",
        "domains": [
            "www.gstatic.com",
            "fonts.gstatic.com",
            "www.google.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.157.119",
            "192.178.183.94",
            "142.251.13.94",
            "142.250.154.95",
            "142.251.155.119",
            "185.240.253.203"
        ],
        "asns": [
            "15169",
            "42296"
        ],
        "countries": [
            "US",
            "RO"
        ],
        "link_domains": [
            "www.facebook.com",
            "www.youtube.com",
            "amcwebsoft.ro"
        ],
        "social": [
            "https://www.facebook.com/covoruloltenesc",
            "https://www.youtube.com/channel/UCQs8v-gYwzzqTm2kyxfq3XA"
        ],
        "doc_hash": "6e9f4207f53e7ee17733226a30fd21d2e1fe70bb7b0746cde1723312644a7638",
        "script_hashes": [
            "874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4",
            "4a10219bee747aadeeda78f166d787adf32583f361f88d44b472f6f3da798083",
            "d68fd4007c20ea9b67e5ac430615bba1f352c3a9d8324b4aa57c50d5b8fc1d16",
            "d618d4869738e0dc22360f0ec0cbb6433257843f24723fac240dda0906685238",
            "fe2a2226123a364a140e44b206bbbb2595065c642176697a6a6042dc0a537f90",
            "5220bfc9416c5b55c41b39baaf1744ed2ce2bec1b0e77382067dea40eec68ba2",
            "20ff3f81febf026d2114bc8fb03bd47b44e54d0e16cd2c5d4e809e3049521a1c",
            "fd19cee1b26e95626f99d4949d4bc5d07a5a9f564a79a065cc8e9b7bf2548987",
            "d5a83a37fab737d4f7c6809dc5fbeb8767f8bd89ba5b07f675afc0dd25f9dbb0",
            "ac43e22a18299cde5371f6fb536eb38a721046d9c1871efc74e7fe0397f61ce1"
        ],
        "globals": [
            "$",
            "jQuery",
            "Swiper",
            "ptlogin",
            "moment",
            "checkGDPR",
            "addGDPRSection",
            "addGDPRCookie",
            "checkPolicyAcceptance",
            "getURLVar",
            "cart",
            "voucher",
            "wishlist",
            "compare",
            "___grecaptcha_cfg",
            "grecaptcha",
            "__recaptcha_api",
            "__google_recaptcha_client",
            "product_slides_359",
            "testimonial_slides",
            "testimonial_thumbs",
            "testimonialGoToSlide",
            "recaptcha",
            "closure_lm_271848",
            "scrypt"
        ],
        "cookies": [
            "OCSESSID",
            "language",
            "currency"
        ],
        "tls": {
            "san": [
                "*.covoruloltenesc.ro",
                "covoruloltenesc.ro"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "*.covoruloltenesc.ro",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-05T03:12:51Z",
            "valid_from": "2026-08-07T03:12:52Z"
        },
        "domain_age_days": 3580,
        "apex_age_days": 3580,
        "tls_age_days": 64,
        "tls_valid_days": 89,
        "requests": 86,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 66,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:22Z",
        "uuid": "516f71f9-fd1c-4a5a-bf96-5a0bd7bce70c",
        "scanned_at": "2026-10-12T11:52:34Z",
        "final_url": "https://covoruloltenesc.ro/",
        "status": 200,
        "history": [
            {
                "url": "https://covoruloltenesc.ro/",
                "status": 200
            }
        ],
        "dom_hash": "6e801de2b7e5539fc1ea0572cf7e127ed5182097d81fb9469aeab40a8aa123c7",
        "doc_hash": "e5a00a798dd980c05eef1ee0f875fa32e7029c5940d13c302699173d61bf9aea",
        "domain_risks": [
            "Ecommerce",
            "Shopping & Auctions",
            "Business",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "covoruloltenesc.ro",
                "type": "A",
                "value": "185.240.253.203"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.240.253.203",
        "whois": {
            "registrar": "Webrasoft SRL",
            "created": "2016-06-07T00:00:00Z",
            "nameservers": [
                "ns1.amcwebsoft.ro",
                "ns2.amcwebsoft.ro",
                "ns3.amcwebsoft.ro"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:39:17Z",
        "analysis_at": "2026-10-16T02:01:07Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "BitDefender": "business",
            "alphaMountain.ai": "Business/Economy, Information Technology, Malicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "Webrasoft SRL",
        "first_seen": "2023-10-01T01:04:07Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns3.amcwebsoft.ro"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.amcwebsoft.ro"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:185.240.253.253 +ip4:185.240.253.203 +ip4:185.240.253.2 ~all"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "185.240.253.203"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.amcwebsoft.ro"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "root.hostxn.amcwebsoft.ro",
                "value": "ns1.amcwebsoft.ro"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "covoruloltenesc.ro",
                "priority": 0
            }
        ],
        "dns_at": "2026-10-16T02:01:23Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.covoruloltenesc.ro",
                "covoruloltenesc.ro"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "663a26ae507a1e15a9c7f3d29add0ecfb77",
            "sha256": "55e7630b13670b390504e60316477400c023b393ac2591b34d63313908529bfd",
            "subject": "*.covoruloltenesc.ro",
            "valid_to": "2027-01-10T06:28:38Z",
            "valid_from": "2026-10-12T06:28:39Z"
        },
        "whois": {
            "registrar": "Webrasoft SRL",
            "status": [
                "OK"
            ],
            "dnssec": "Inactive"
        }
    }
}
```