www.all-terraintyres.co.za Open in urlscan Pro
41.78.28.171  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request NediBarlars~STROKE~SPONONO~PASSY.htm Show response www.all-terraintyres.co.za/database/	251 KB 13 KB	1322ms 359ms	Document text/html	41.78.28.171 IMAGINET
General Check archive.org Show headers Download Go to Full URL https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 41.78.28.171 , South Africa, ASN37159 (IMAGINET, ZA), Reverse DNS linuxweb02.imagi-hosting.co.za Software nginx / PleskLin Resource Hash 6157b37c5c548aa1ff42810c02f0190408a4c6700648925297be96882edbfbf1 Request headers :method GET :authority www.all-terraintyres.co.za :scheme https :path /database/NediBarlars~STROKE~SPONONO~PASSY.htm pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server nginx date Fri, 26 Mar 2021 12:04:50 GMT content-type text/html last-modified Fri, 26 Mar 2021 07:37:54 GMT vary Accept-Encoding etag W/"605d8f52-3ea6d" x-powered-by PleskLin content-encoding br
GET H2	200	styles.css www.all-terraintyres.co.za/database/stylesx/	173 KB 27 KB	417ms 206ms	Stylesheet text/css	41.78.28.171 IMAGINET
General Check archive.org Show headers Download Go to Full URL https://www.all-terraintyres.co.za/database/stylesx/styles.css Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 41.78.28.171 , South Africa, ASN37159 (IMAGINET, ZA), Reverse DNS linuxweb02.imagi-hosting.co.za Software nginx / PleskLin Resource Hash 8887a3e0dea10c649e723d160fcac04d7432910580a8c0f2726c0c27ef8ee9cc Request headers Referer https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 26 Mar 2021 12:04:51 GMT content-encoding br last-modified Wed, 08 Jan 2020 12:47:12 GMT server nginx x-powered-by PleskLin etag W/"5e15cf50-2b40c" vary Accept-Encoding content-type text/css
GET H2	200	jquery.min.js Show response www.all-terraintyres.co.za/database/stylesx/	95 KB 32 KB	638ms 382ms	Script application/javascript	41.78.28.171 IMAGINET
General Check archive.org Show headers Download Go to Full URL https://www.all-terraintyres.co.za/database/stylesx/jquery.min.js Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 41.78.28.171 , South Africa, ASN37159 (IMAGINET, ZA), Reverse DNS linuxweb02.imagi-hosting.co.za Software nginx / PleskLin Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Request headers Referer https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 26 Mar 2021 12:04:51 GMT content-encoding br last-modified Wed, 08 Jan 2020 12:47:12 GMT server nginx x-powered-by PleskLin etag W/"5e15cf50-17b8b" vary Accept-Encoding content-type application/javascript
GET H2	404	s.php www.all-terraintyres.co.za/database/scriptsx/	0 0	835ms 579ms	Script text/html	41.78.28.171 IMAGINET
General Check archive.org Show headers Download Go to Full URL https://www.all-terraintyres.co.za/database/scriptsx/s.php Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 41.78.28.171 , South Africa, ASN37159 (IMAGINET, ZA), Reverse DNS linuxweb02.imagi-hosting.co.za Software nginx / PHP/7.4.16 Resource Hash Request headers Referer https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 26 Mar 2021 12:04:51 GMT content-encoding br server nginx x-powered-by PHP/7.4.16 vary Accept-Encoding access-control-allow-methods GET,PUT,POST,DELETE content-type text/html; charset=UTF-8 access-control-allow-origin * access-control-allow-headers Content-Type, Authorization
GET H2	404	s.php www.all-terraintyres.co.za/database/scriptsx/	0 0	414ms 197ms	Script text/html	41.78.28.171 IMAGINET
General Check archive.org Show headers Download Go to Full URL https://www.all-terraintyres.co.za/database/scriptsx/s.php Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 41.78.28.171 , South Africa, ASN37159 (IMAGINET, ZA), Reverse DNS linuxweb02.imagi-hosting.co.za Software nginx / PHP/7.4.16 Resource Hash Request headers Referer https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 26 Mar 2021 12:04:52 GMT content-encoding br server nginx x-powered-by PHP/7.4.16 vary Accept-Encoding access-control-allow-methods GET,PUT,POST,DELETE content-type text/html; charset=UTF-8 access-control-allow-origin * access-control-allow-headers Content-Type, Authorization
GET H/1.1	200 OK	NedbankIcon.ef111dcaf7b1952d120f.svg secured.nedbank.co.za/	0 0	4826ms 233ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/NedbankIcon.ef111dcaf7b1952d120f.svg Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.all-terraintyres.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H/1.1	200 OK	location-blank-green.4b8e66bca4aac4a2aad6.svg secured.nedbank.co.za/	0 0	4722ms 234ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/location-blank-green.4b8e66bca4aac4a2aad6.svg Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.all-terraintyres.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H/1.1	200 OK	contact-blank-green.a180fba4b897921edd0b.svg secured.nedbank.co.za/	0 0	4711ms 234ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/contact-blank-green.a180fba4b897921edd0b.svg Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.all-terraintyres.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H2	200	NedbankLogin_v2.png www.all-terraintyres.co.za/database/imagesx/	100 KB 100 KB	1404ms 385ms	Image image/png	41.78.28.171 IMAGINET
General Check archive.org Show headers Download Go to Show image Full URL https://www.all-terraintyres.co.za/database/imagesx/NedbankLogin_v2.png Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 41.78.28.171 , South Africa, ASN37159 (IMAGINET, ZA), Reverse DNS linuxweb02.imagi-hosting.co.za Software nginx / PleskLin Resource Hash 354cb0a75fdc0745134b7809a64030764e4b22c5161d679fdd9ad01b4d8386ca Request headers Referer https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 26 Mar 2021 12:04:54 GMT last-modified Wed, 30 Dec 2020 20:17:42 GMT server nginx x-powered-by PleskLin etag "5fece066-19100" content-type image/png accept-ranges bytes content-length 102656
GET H2	404	Eye-Show.e1de9570f043be4db21c.svg www.all-terraintyres.co.za/database/stylesx/	808 B 808 B	1565ms 545ms	Image text/html	41.78.28.171 IMAGINET
General Check archive.org Show headers Download Go to Show image Full URL https://www.all-terraintyres.co.za/database/stylesx/Eye-Show.e1de9570f043be4db21c.svg Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/stylesx/styles.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 41.78.28.171 , South Africa, ASN37159 (IMAGINET, ZA), Reverse DNS linuxweb02.imagi-hosting.co.za Software nginx / Resource Hash b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187 Request headers Referer https://www.all-terraintyres.co.za/database/stylesx/styles.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 26 Mar 2021 12:04:54 GMT content-encoding br last-modified Fri, 26 Mar 2021 06:21:19 GMT server nginx etag W/"328-5be6a8a5000c6" vary Accept-Encoding content-type text/html
GET H/1.1	200 OK	contact-footer.ff0deb4d99b5c501e332.svg secured.nedbank.co.za/	0 0	4706ms 230ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/contact-footer.ff0deb4d99b5c501e332.svg Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.all-terraintyres.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H/1.1	200 OK	location-blank.e36d304f8628a21886d3.svg secured.nedbank.co.za/	0 0	5388ms 239ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/location-blank.e36d304f8628a21886d3.svg Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.all-terraintyres.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H/1.1	200 OK	phoneicon.d20aa97e94487e70b840.svg secured.nedbank.co.za/	0 0	4704ms 229ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/phoneicon.d20aa97e94487e70b840.svg Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.all-terraintyres.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H/1.1	200 OK	tncs.04b64534a4bbcb7c2676.svg secured.nedbank.co.za/	0 0	3690ms 230ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/tncs.04b64534a4bbcb7c2676.svg Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.all-terraintyres.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H2	200	FontFont%20-%20MarkPro.12d6724a254d3be629fc.otf www.all-terraintyres.co.za/database/fontsx/	162 KB 162 KB	885ms 275ms	Font application/font-sfnt	41.78.28.171 IMAGINET
General Check archive.org Show headers Download Go to Full URL https://www.all-terraintyres.co.za/database/fontsx/FontFont%20-%20MarkPro.12d6724a254d3be629fc.otf Requested by Host: www.all-terraintyres.co.za URL: https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 41.78.28.171 , South Africa, ASN37159 (IMAGINET, ZA), Reverse DNS linuxweb02.imagi-hosting.co.za Software nginx / PleskLin Resource Hash eaa561f9f8ef5b69bd39e15e332dc3700decacebf48e08b0640ad3a5d8711f65 Request headers Origin https://www.all-terraintyres.co.za Referer https://www.all-terraintyres.co.za/database/NediBarlars~STROKE~SPONONO~PASSY.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 26 Mar 2021 12:04:53 GMT last-modified Wed, 08 Jan 2020 12:47:12 GMT server nginx x-powered-by PleskLin etag "5e15cf50-28614" content-type application/font-sfnt accept-ranges bytes content-length 165396

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nedbank (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery string| site_Url

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

secured.nedbank.co.za
www.all-terraintyres.co.za
168.142.204.82
41.78.28.171
354cb0a75fdc0745134b7809a64030764e4b22c5161d679fdd9ad01b4d8386ca
6157b37c5c548aa1ff42810c02f0190408a4c6700648925297be96882edbfbf1
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
8887a3e0dea10c649e723d160fcac04d7432910580a8c0f2726c0c27ef8ee9cc
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaa561f9f8ef5b69bd39e15e332dc3700decacebf48e08b0640ad3a5d8711f65