urlscan.io logo urlscan.io
SecurityTrails logo

www.markadomains.com Open in urlscan Pro
160.153.210.72  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Submission: On July 23 via api from TW
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 4 countries across 4 domains to perform 25 HTTP transactions. The main IP is 160.153.210.72, located in Scottsdale, United States and belongs to GODADDY-AMS, DE. The main domain is www.markadomains.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 5th 2020. Valid for: 2 years.
This is the only time www.markadomains.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ABSA (Banking)

Domain & IP information

IP Address AS Autonomous System
7 160.153.210.72 21501 (GODADDY-AMS)
1 2a00:1450:400... 15169 (GOOGLE)
11 2606:4700:20:... 13335 (CLOUDFLAR...)
1 169.202.9.74 14115 (AMALGAMAT...)
1 109.74.203.44 63949 (LINODE-AP...)
25 6
7    160.153.210.72 (Scottsdale, United States)

ASN21501 (GODADDY-AMS, DE)
PTR: ip-160-153-210-72.ip.secureserver.net
www.markadomains.com
markadomains.com
1    2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
11    2606:4700:20::681a:97f (United States)

ASN13335 (CLOUDFLARENET, US)
static.revechat.com
1    169.202.9.74 (South Africa)

ASN14115 (AMALGAMATED-BSA, ZA)
PTR: ib.absa.co.za
ib.absa.co.za
1    109.74.203.44 (London, United Kingdom)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li150-44.members.linode.com
file.revechat.com
Domain Requested by
11 static.revechat.com www.markadomains.com
static.revechat.com
6 markadomains.com www.markadomains.com
1 file.revechat.com www.markadomains.com
1 ib.absa.co.za ajax.googleapis.com
1 ajax.googleapis.com www.markadomains.com
1 www.markadomains.com
25 6

This site contains links to these domains. Also see Links.

Domain
ib.absa.co.za
www.absa.co.za
Subject Issuer Validity Valid
markadomains.com
Go Daddy Secure Certificate Authority - G2		 2020-03-05 -
2022-03-05		 2 years crt.sh
upload.video.google.com
GTS CA 1O1		 2020-07-07 -
2020-09-29		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-19 -
2021-07-19		 a year crt.sh
ib.absa.co.za
DigiCert SHA2 Extended Validation Server CA		 2019-06-11 -
2021-07-03		 2 years crt.sh
*.revechat.com
Sectigo RSA Domain Validation Secure Server CA		 2019-08-11 -
2020-08-10		 a year crt.sh

This page contains 2 frames:

Primary Page: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Frame ID: 308E5D6CD7E026BE230867E5EB563E70
Requests: 15 HTTP requests in this frame

Frame: https://static.revechat.com/client/images/queue-screen-img.png
Frame ID: 0A392CEA5C07AAFD7ACFAD3C085EF850
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

25
Requests

60 %
HTTPS

40 %
IPv6

4
Domains

6
Subdomains

6
IPs

4
Countries

499 kB
Transfer

1544 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request AbsaLogin.htm
www.markadomains.com/AbsaOnline/ 		57 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.210.72 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
ip-160-153-210-72.ip.secureserver.net
Software
Apache /
Resource Hash
db7c8983979d1001e85a473c9bc1693dd7c6e8ec0c0634b854ff3930f96e9d50

Request headers

:method
GET
:authority
www.markadomains.com
:scheme
https
:path
/AbsaOnline/AbsaLogin.htm
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Thu, 23 Jul 2020 21:18:21 GMT
server
Apache
last-modified
Tue, 23 Jun 2020 09:33:25 GMT
etag
"3400c4-e3f4-5a8bd0d1f2398-gzip"
accept-ranges
bytes
vary
Accept-Encoding,User-Agent
content-encoding
gzip
access-control-allow-origin
*
access-control-allow-methods
GET,PUT,POST,DELETE
access-control-allow-headers
Content-Type, Authorization
content-length
9497
content-type
text/html
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 12 Jun 2020 00:08:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3618619
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33951
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 12 Jun 2021 00:08:02 GMT
ajax-loader-2.gif
markadomains.com/AbsaOnline/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://markadomains.com/AbsaOnline/images/ajax-loader-2.gif
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
HTTP/1.1
Server
160.153.210.72 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
ip-160-153-210-72.ip.secureserver.net
Software
Apache /
Resource Hash
b6b693de4c17c014dad29abe5294359606104283674d45ee8348e9dc731ff540

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 21:18:21 GMT
Last-Modified
Sat, 16 May 2020 07:51:34 GMT
Server
Apache
ETag
"3825a6-c88-5a5bf32d96d80"
Access-Control-Allow-Methods
GET,PUT,POST,DELETE
Upgrade
h2,h2c
Access-Control-Allow-Origin
*
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
image/gif
Access-Control-Allow-Headers
Content-Type, Authorization
Content-Length
3208
Keep-Alive
timeout=5
logo-red.png
markadomains.com/AbsaOnline/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://markadomains.com/AbsaOnline/images/logo-red.png
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
HTTP/1.1
Server
160.153.210.72 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
ip-160-153-210-72.ip.secureserver.net
Software
Apache /
Resource Hash
86c3ec119fc6352ca80ccc5b6e2e8fa76c924adecaf33de65da1b892e7b1aa3e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 21:18:21 GMT
Last-Modified
Sat, 16 May 2020 07:51:43 GMT
Server
Apache
ETag
"3825b8-81f-5a5bf3362c1c0"
Access-Control-Allow-Methods
GET,PUT,POST,DELETE
Upgrade
h2,h2c
Access-Control-Allow-Origin
*
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Access-Control-Allow-Headers
Content-Type, Authorization
Content-Length
2079
Keep-Alive
timeout=5
dot_002.gif
markadomains.com/AbsaOnline/images/ 		43 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://markadomains.com/AbsaOnline/images/dot_002.gif
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
HTTP/1.1
Server
160.153.210.72 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
ip-160-153-210-72.ip.secureserver.net
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 21:18:21 GMT
Last-Modified
Sat, 16 May 2020 07:51:36 GMT
Server
Apache
ETag
"3825b7-2b-5a5bf32f7f200"
Access-Control-Allow-Methods
GET,PUT,POST,DELETE
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
Content-Type, Authorization
Content-Length
43
Keep-Alive
timeout=5
locale_en.gif
markadomains.com/AbsaOnline/images/ 		70 B
503 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://markadomains.com/AbsaOnline/images/locale_en.gif
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
HTTP/1.1
Server
160.153.210.72 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
ip-160-153-210-72.ip.secureserver.net
Software
Apache /
Resource Hash
3c243a2d63452b7a8392cdf93e637ec423b3241149831b2082283063d1e34413

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 21:18:21 GMT
Last-Modified
Sat, 16 May 2020 07:51:42 GMT
Server
Apache
ETag
"3825ad-46-5a5bf33537f80"
Access-Control-Allow-Methods
GET,PUT,POST,DELETE
Upgrade
h2,h2c
Access-Control-Allow-Origin
*
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
image/gif
Access-Control-Allow-Headers
Content-Type, Authorization
Content-Length
70
Keep-Alive
timeout=5
campaigne_1_ENG.png
markadomains.com/AbsaOnline/images/ 		45 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://markadomains.com/AbsaOnline/images/campaigne_1_ENG.png
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
HTTP/1.1
Server
160.153.210.72 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
ip-160-153-210-72.ip.secureserver.net
Software
Apache /
Resource Hash
cb45d428c00e88ea0e73eca797ebb0222173c4bb22a86935a4d94137695a42ef

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 21:18:21 GMT
Last-Modified
Sat, 16 May 2020 07:51:35 GMT
Server
Apache
ETag
"3825b6-b5c4-5a5bf32e8afc0"
Access-Control-Allow-Methods
GET,PUT,POST,DELETE
Upgrade
h2,h2c
Access-Control-Allow-Origin
*
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Access-Control-Allow-Headers
Content-Type, Authorization
Content-Length
46532
Keep-Alive
timeout=5
campaigne_3_post_golive_EN.jpg
markadomains.com/AbsaOnline/images/ 		37 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://markadomains.com/AbsaOnline/images/campaigne_3_post_golive_EN.jpg
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
HTTP/1.1
Server
160.153.210.72 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE),
Reverse DNS
ip-160-153-210-72.ip.secureserver.net
Software
Apache /
Resource Hash
f1cf91e4161358590319b72b7dc5e1f9dfa75b4b8406e33b635118d6bde0c933

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 21:18:21 GMT
Last-Modified
Sat, 16 May 2020 07:51:36 GMT
Server
Apache
ETag
"3825b5-9508-5a5bf32f7f200"
Access-Control-Allow-Methods
GET,PUT,POST,DELETE
Upgrade
h2,h2c
Access-Control-Allow-Origin
*
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
image/jpeg
Access-Control-Allow-Headers
Content-Type, Authorization
Content-Length
38152
Keep-Alive
timeout=5
new-livechat.js
static.revechat.com/widget/scripts/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.revechat.com/widget/scripts/new-livechat.js?1595539101850
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f43733f2e49c646ce8eb73e7b1caa23e7ccd1dd2593123e993a0a7cc5cad4e6

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 21:18:21 GMT
content-encoding
br
cf-cache-status
HIT
age
45879
status
200
cf-request-id
041f23b0da0000e003c3046200000001
last-modified
Thu, 23 Jul 2020 08:32:56 GMT
server
cloudflare
etag
W/"5f194b38-2166"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
expires
Fri, 23 Jul 2021 08:33:12 GMT
cache-control
max-age=31536000
access-control-allow-credentials
true
cf-ray
5b786efafeece003-FRA
access-control-allow-headers
Content-Type,Accept
cf-bgj
minify
absa.css
markadomains.com/AbsaOnline/css/ 		0
0
login.css
markadomains.com/AbsaOnline/css/ 		0
0
jcaptcha.css
markadomains.com/AbsaOnline/css/ 		0
0
absajslogo.php
markadomains.com/AbsaOnline/php/ 		0
0
icon-questionmark-grey_2019.png
ib.absa.co.za/absa-online/static/style/resources/ 		362 B
664 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.absa.co.za/absa-online/static/style/resources/icon-questionmark-grey_2019.png
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 , South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
79fb86c959989a8d2c920e6e4550c396fcee47ec4deda2549b237aca12dd981d

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 21:18:46 GMT
Last-Modified
Wed, 22 Jul 2020 15:29:10 GMT
Content-Language
en-US
Cache-Control
max-age=2678400
Connection
Keep-Alive
Content-Type
image/png
Keep-Alive
timeout=10, max=100
Content-Length
362
Expires
Sun, 23 Aug 2020 21:18:46 GMT
client_version_2.html
static.revechat.com/widget/d/html/ 		1 MB
299 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.revechat.com/widget/d/html/client_version_2.html?707080602211111
Requested by
Host: static.revechat.com
URL: https://static.revechat.com/widget/scripts/new-livechat.js?1595539101850
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9becc2e62d518a65dca3188e7f15a8b12c89aff31c44937ff8af48df61992c29

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 21:18:21 GMT
content-encoding
br
cf-cache-status
HIT
age
41080
status
200
cf-request-id
041f23b0fc00001f1d878b1200000001
last-modified
Thu, 23 Jul 2020 08:32:36 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
cf-ray
5b786efb2c241f1d-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 08:33:39 GMT
queue-screen-img.png
static.revechat.com/client/images/ Frame 0A39 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.revechat.com/client/images/queue-screen-img.png
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ccc121834f08f32a202ac7c7fba4139187ccfa36deb1d61c98ea7fb5f374a8f

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 21:18:22 GMT
cf-cache-status
HIT
age
45877
status
200
content-length
2442
cf-request-id
041f23b1e70000e003c305c200000001
last-modified
Mon, 22 Oct 2018 04:17:09 GMT
server
cloudflare
etag
"5bcd4f45-98a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
5b786efcaa05e003-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 08:33:13 GMT
audio-call-avatar.png
static.revechat.com/client/images/ Frame 0A39 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.revechat.com/client/images/audio-call-avatar.png
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e184aa2fb6981193c40848a3ce8dc984cd0d84478bcbd7e95bcf429d17276fd

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 21:18:22 GMT
cf-cache-status
HIT
age
45877
status
200
content-length
4733
cf-request-id
041f23b1e70000e003c305d200000001
last-modified
Wed, 30 Oct 2019 04:38:20 GMT
server
cloudflare
etag
"5db913bc-127d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
5b786efcaa06e003-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 08:33:13 GMT
co-browse.png
static.revechat.com/client/images/ Frame 0A39 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.revechat.com/client/images/co-browse.png?9
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42efe3f909b70f89c678f88f7083e5429e0f8ff5eb3709a3f22113cd0a7435eb

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 21:18:22 GMT
cf-cache-status
HIT
age
45877
status
200
content-length
2334
cf-request-id
041f23b1e70000e003c305e200000001
last-modified
Mon, 29 Jul 2019 11:36:42 GMT
server
cloudflare
etag
"5d3eda4a-91e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
5b786efcaa07e003-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 08:33:13 GMT
notify.mp3
static.revechat.com/client/sound/ Frame 0A39 		10 KB
10 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://static.revechat.com/client/sound/notify.mp3
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2606c1b94eca77f98e01efb7d66e296d0feb23bae173b82313e56ed0178d2462

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=0-

Response headers

date
Thu, 23 Jul 2020 21:18:22 GMT
cf-cache-status
HIT
age
45877
status
206
Content-Length
10448
cf-request-id
041f23b1f20000e003c305f200000001
Content-Range
bytes 0-10447/10448
last-modified
Sun, 14 Apr 2013 12:48:04 GMT
server
cloudflare
etag
"516aa584-28d0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
audio/mpeg
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
cf-ray
5b786efcba25e003-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 08:33:13 GMT
queue-screen-img.png
static.revechat.com/client/images/ Frame 0A39 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.revechat.com/client/images/queue-screen-img.png
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ccc121834f08f32a202ac7c7fba4139187ccfa36deb1d61c98ea7fb5f374a8f

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 21:18:22 GMT
cf-cache-status
HIT
age
45877
status
200
content-length
2442
cf-request-id
041f23b2b40000e003c306a200000001
last-modified
Mon, 22 Oct 2018 04:17:09 GMT
server
cloudflare
etag
"5bcd4f45-98a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
5b786efdecd1e003-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 08:33:13 GMT
audio-call-avatar.png
static.revechat.com/client/images/ Frame 0A39 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.revechat.com/client/images/audio-call-avatar.png
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e184aa2fb6981193c40848a3ce8dc984cd0d84478bcbd7e95bcf429d17276fd

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 21:18:22 GMT
cf-cache-status
HIT
age
45877
status
200
content-length
4733
cf-request-id
041f23b2b50000e003c306b200000001
last-modified
Wed, 30 Oct 2019 04:38:20 GMT
server
cloudflare
etag
"5db913bc-127d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
5b786efdecd2e003-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 08:33:13 GMT
co-browse.png
static.revechat.com/client/images/ Frame 0A39 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.revechat.com/client/images/co-browse.png?9
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42efe3f909b70f89c678f88f7083e5429e0f8ff5eb3709a3f22113cd0a7435eb

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 21:18:22 GMT
cf-cache-status
HIT
age
45877
status
200
content-length
2334
cf-request-id
041f23b2b50000e003c306c200000001
last-modified
Mon, 29 Jul 2019 11:36:42 GMT
server
cloudflare
etag
"5d3eda4a-91e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
5b786efdecd4e003-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 08:33:13 GMT
revechat.ttf
static.revechat.com/test/test/revechat/fonts/ Frame 0A39 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.revechat.com/test/test/revechat/fonts/revechat.ttf?3mtvlk
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d698291a33c257e3e51418e5c44ae594d521ec094cf054e8050df1e6c1671e74

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Origin
https://www.markadomains.com

Response headers

date
Thu, 23 Jul 2020 21:18:22 GMT
cf-cache-status
HIT
age
41073
status
200
content-length
25428
cf-request-id
041f23b2de00001f1d878ea200000001
last-modified
Wed, 01 Jul 2020 16:38:04 GMT
server
cloudflare
etag
"5efcbbec-6354"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
5b786efe39c81f1d-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 09:03:43 GMT
close.png
static.revechat.com/client/images/eye-catcher/ Frame 0A39 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.revechat.com/client/images/eye-catcher/close.png
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:97f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8747d08e6a5c4f14ce2fe68d487a51cb3d0d026510dc928825377a4ce74c5936

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 23 Jul 2020 21:18:22 GMT
cf-cache-status
HIT
age
43384
status
200
content-length
1239
cf-request-id
041f23b2f70000e003c3078200000001
last-modified
Wed, 18 Apr 2018 05:31:02 GMT
server
cloudflare
etag
"5ad6d816-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
cf-ray
5b786efe5dcae003-FRA
access-control-allow-headers
Content-Type,Accept
expires
Fri, 23 Jul 2021 08:33:41 GMT
small-eye-catcher-bright-red-2.png
file.revechat.com/eye-catcher/image/ Frame 0A39 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://file.revechat.com/eye-catcher/image/small-eye-catcher-bright-red-2.png
Requested by
Host: www.markadomains.com
URL: https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
109.74.203.44 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li150-44.members.linode.com
Software
nginx/1.16.1 /
Resource Hash
60700dd8efa9ed51adc5dc48cecdb1dca2df57520e0d01b864a26652cc815507

Request headers

Referer
https://www.markadomains.com/AbsaOnline/AbsaLogin.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Thu, 23 Jul 2020 21:17:53 GMT
Last-Modified
Wed, 25 Dec 2019 16:35:40 GMT
Server
nginx/1.16.1
ETag
"5e038fdc-154b"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5451

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
markadomains.com
URL
http://markadomains.com/AbsaOnline/css/absa.css
Domain
markadomains.com
URL
http://markadomains.com/AbsaOnline/css/login.css
Domain
markadomains.com
URL
http://markadomains.com/AbsaOnline/css/jcaptcha.css
Domain
markadomains.com
URL
http://markadomains.com/AbsaOnline/php/absajslogo.php?r=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ABSA (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $_REVECHAT_API string| __revechat_account number| __revechat_version function| $ function| jQuery function| reve_chat_ie_fallback function| objectSize function| isIE

3 Cookies

Domain/Path Name / Value
www.markadomains.com/ Name: _reve_chat_vid
Value: 0001595539072982-f23c920a4cc8-0001
www.markadomains.com/ Name: _reve_chat_aid
Value: 9447870
www.markadomains.com/ Name: _reve_chat_sid
Value: 999f7b3b-14c5-4220-b229-9cfb7ad3ee19

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
file.revechat.com
ib.absa.co.za
markadomains.com
static.revechat.com
www.markadomains.com
markadomains.com
109.74.203.44
160.153.210.72
169.202.9.74
2606:4700:20::681a:97f
2a00:1450:4001:824::200a
0e184aa2fb6981193c40848a3ce8dc984cd0d84478bcbd7e95bcf429d17276fd
2606c1b94eca77f98e01efb7d66e296d0feb23bae173b82313e56ed0178d2462
3c243a2d63452b7a8392cdf93e637ec423b3241149831b2082283063d1e34413
42efe3f909b70f89c678f88f7083e5429e0f8ff5eb3709a3f22113cd0a7435eb
60700dd8efa9ed51adc5dc48cecdb1dca2df57520e0d01b864a26652cc815507
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6f43733f2e49c646ce8eb73e7b1caa23e7ccd1dd2593123e993a0a7cc5cad4e6
79fb86c959989a8d2c920e6e4550c396fcee47ec4deda2549b237aca12dd981d
86c3ec119fc6352ca80ccc5b6e2e8fa76c924adecaf33de65da1b892e7b1aa3e
8747d08e6a5c4f14ce2fe68d487a51cb3d0d026510dc928825377a4ce74c5936
9becc2e62d518a65dca3188e7f15a8b12c89aff31c44937ff8af48df61992c29
9ccc121834f08f32a202ac7c7fba4139187ccfa36deb1d61c98ea7fb5f374a8f
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6b693de4c17c014dad29abe5294359606104283674d45ee8348e9dc731ff540
cb45d428c00e88ea0e73eca797ebb0222173c4bb22a86935a4d94137695a42ef
d698291a33c257e3e51418e5c44ae594d521ec094cf054e8050df1e6c1671e74
db7c8983979d1001e85a473c9bc1693dd7c6e8ec0c0634b854ff3930f96e9d50
f1cf91e4161358590319b72b7dc5e1f9dfa75b4b8406e33b635118d6bde0c933