siaf.sg - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 113.11.252.41, located in Singapore and belongs to USONYX-AS-AP USONYX PTE LTD, SG. The main domain is siaf.sg.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 29th 2018. Valid for: 3 months.

This is the only time siaf.sg was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	185.208.164.123 185.208.164.123	41079 (SUPERHOST...) (SUPERHOST-PL-AS)
1 6	113.11.252.41 113.11.252.41	38532 (USONYX-AS...) (USONYX-AS-AP USONYX PTE LTD)
6	2

2 185.208.164.123 (None, ) 1 redirects

ASN41079 (SUPERHOST-PL-AS, PL)
PTR: s23.hekko.net.pl

www.tacolibre.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 113.11.252.41 (Singapore) 1 redirects

ASN38532 (USONYX-AS-AP USONYX PTE LTD, SG)
PTR: secure.maxwell-chambers.com

siaf.sg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	siaf.sg 1 redirects siaf.sg	248 KB
2	tacolibre.pl 1 redirects www.tacolibre.pl	779 B
6	2

	Domain	Requested by
6	siaf.sg	1 redirects siaf.sg
2	www.tacolibre.pl	1 redirects
6	2

This site contains no links.

Subject Issuer	Validity	Valid
siaf.sg cPanel, Inc. Certification Authority	`2018-03-29` - `2018-06-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en
Frame ID: E47BB3AB5C65B3686A052BE8DF2F7587
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.tacolibre.pl//components/com_jxtc/ HTTP 302
http://www.tacolibre.pl//components/com_jxtc/urls.php Page URL
https://siaf.sg/components/com_mailto/helpers/VR/ HTTP 302
https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

248 kB
Transfer

247 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.tacolibre.pl//components/com_jxtc/ HTTP 302
http://www.tacolibre.pl//components/com_jxtc/urls.php Page URL
https://siaf.sg/components/com_mailto/helpers/VR/ HTTP 302
https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.tacolibre.pl//components/com_jxtc/ HTTP 302
http://www.tacolibre.pl//components/com_jxtc/urls.php

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	urls.php Show response www.tacolibre.pl//components/com_jxtc/ Redirect Chain http://www.tacolibre.pl//components/com_jxtc/ http://www.tacolibre.pl//components/com_jxtc/urls.php	185 B 386 B	72ms 37ms	Document text/html	185.208.164.123 SUPERHOST-PL-AS
General Check archive.org Show headers Download Go to Full URL http://www.tacolibre.pl//components/com_jxtc/urls.php Protocol HTTP/1.1 Server 185.208.164.123 -, , ASN41079 (SUPERHOST-PL-AS, PL), Reverse DNS s23.hekko.net.pl Software LiteSpeed / Resource Hash `69731cfa0652a2ad468050e679cf3a05bc03716b94520becead032c7b7bb9981` Request headers Host www.tacolibre.pl Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Cookie PHPSESSID=3rnai88i4qchhvvjl6oov6tm07 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id E47BB3AB5C65B3686A052BE8DF2F7587 Response headers Content-Type text/html; charset=UTF-8 Content-Length 162 Content-Encoding gzip Vary Accept-Encoding Date Tue, 05 Jun 2018 07:35:15 GMT Accept-Ranges bytes Server LiteSpeed Connection close Redirect headers Set-Cookie PHPSESSID=3rnai88i4qchhvvjl6oov6tm07; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-cache, no-store, must-revalidate, max-age=0 Pragma no-cache location urls.php Content-Type text/html; charset=UTF-8 Content-Length 0 Date Tue, 05 Jun 2018 07:35:15 GMT Accept-Ranges bytes Server LiteSpeed Connection close
GET H/1.1	200 OK	Primary Request signin.php Show response siaf.sg/components/com_mailto/helpers/VR/ Redirect Chain https://siaf.sg/components/com_mailto/helpers/VR/ https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en	5 KB 5 KB	195ms 194ms	Document text/html	113.11.252.41 USONYX-AS-AP USON...
General Check archive.org Show headers Download Go to Full URL https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 113.11.252.41 , Singapore, ASN38532 (USONYX-AS-AP USONYX PTE LTD, SG), Reverse DNS secure.maxwell-chambers.com Software Apache / Resource Hash `c14cd3a63de4624b3ef00d6664b9ecb456bdffb098088a7ecc0e045db90eb2e6` Request headers Host siaf.sg Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://www.tacolibre.pl//components/com_jxtc/urls.php Accept-Encoding gzip, deflate Cookie PHPSESSID=ls79nld2rm2q0nl79sveka19r3 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id E47BB3AB5C65B3686A052BE8DF2F7587 Referer http://www.tacolibre.pl//components/com_jxtc/urls.php Response headers Date Tue, 05 Jun 2018 07:35:18 GMT Server Apache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Tue, 05 Jun 2018 07:35:18 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie PHPSESSID=ls79nld2rm2q0nl79sveka19r3; path=/ location signin.php?country=-&lang=en Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	css.css siaf.sg/components/com_mailto/helpers/VR/img/	84 KB 84 KB	182ms 182ms	Stylesheet text/css	113.11.252.41 USONYX-AS-AP USON...
General Check archive.org Show headers Download Go to Full URL https://siaf.sg/components/com_mailto/helpers/VR/img/css.css Requested by Host: siaf.sg URL: https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 113.11.252.41 , Singapore, ASN38532 (USONYX-AS-AP USONYX PTE LTD, SG), Reverse DNS secure.maxwell-chambers.com Software Apache / Resource Hash `5aaab1b70e6a1a14a15d1b40c097895b464f0ae87f412da6e53dc9514e7bf83f` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host siaf.sg User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/css,/;q=0.1 Referer https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en Cookie PHPSESSID=ls79nld2rm2q0nl79sveka19r3 Connection keep-alive Cache-Control no-cache Referer https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Tue, 05 Jun 2018 07:35:18 GMT Last-Modified Sun, 11 Feb 2018 06:11:06 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 86199
GET H/1.1	200 OK	FB-f-Logo__blue_57.png siaf.sg/components/com_mailto/helpers/VR/img/	1 KB 2 KB	182ms 182ms	Image image/png	113.11.252.41 USONYX-AS-AP USON...
General Check archive.org Show headers Download Go to Show image Full URL https://siaf.sg/components/com_mailto/helpers/VR/img/FB-f-Logo__blue_57.png Requested by Host: siaf.sg URL: https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 113.11.252.41 , Singapore, ASN38532 (USONYX-AS-AP USONYX PTE LTD, SG), Reverse DNS secure.maxwell-chambers.com Software Apache / Resource Hash `3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host siaf.sg User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en Cookie PHPSESSID=ls79nld2rm2q0nl79sveka19r3 Connection keep-alive Cache-Control no-cache Referer https://siaf.sg/components/com_mailto/helpers/VR/signin.php?country=-&lang=en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Tue, 05 Jun 2018 07:35:18 GMT Last-Modified Sun, 11 Feb 2018 05:19:04 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1455
GET H/1.1	200 OK	login-the-crown_2-1500x1000.jpg siaf.sg/components/com_mailto/helpers/VR/img/	84 KB 84 KB	182ms 182ms	Image image/jpeg	113.11.252.41 USONYX-AS-AP USON...
General Check archive.org Show headers Download Go to Show image Full URL https://siaf.sg/components/com_mailto/helpers/VR/img/login-the-crown_2-1500x1000.jpg Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 113.11.252.41 , Singapore, ASN38532 (USONYX-AS-AP USONYX PTE LTD, SG), Reverse DNS secure.maxwell-chambers.com Software Apache / Resource Hash `baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host siaf.sg User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://siaf.sg/components/com_mailto/helpers/VR/img/css.css Cookie PHPSESSID=ls79nld2rm2q0nl79sveka19r3 Connection keep-alive Cache-Control no-cache Referer https://siaf.sg/components/com_mailto/helpers/VR/img/css.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Tue, 05 Jun 2018 07:35:19 GMT Last-Modified Sun, 11 Feb 2018 06:06:54 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 86226
GET H/1.1	200 OK	nf-icon-v1-93.woff siaf.sg/components/com_mailto/helpers/VR/img/fonts/	72 KB 72 KB	182ms 181ms	Font font/woff	113.11.252.41 USONYX-AS-AP USON...
General Check archive.org Show headers Download Go to Full URL https://siaf.sg/components/com_mailto/helpers/VR/img/fonts/nf-icon-v1-93.woff Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 113.11.252.41 , Singapore, ASN38532 (USONYX-AS-AP USONYX PTE LTD, SG), Reverse DNS secure.maxwell-chambers.com Software Apache / Resource Hash `98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d` Request headers Pragma no-cache Origin https://siaf.sg Accept-Encoding gzip, deflate Host siaf.sg User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept / Referer https://siaf.sg/components/com_mailto/helpers/VR/img/css.css Cookie PHPSESSID=ls79nld2rm2q0nl79sveka19r3 Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Referer https://siaf.sg/components/com_mailto/helpers/VR/img/css.css Origin https://siaf.sg Response headers Date Tue, 05 Jun 2018 07:35:19 GMT Last-Modified Sun, 11 Feb 2018 06:08:00 GMT Server Apache Content-Type font/woff Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 73572

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			siaf.sg/	1969-12-31 23:59:59	Name: PHPSESSID Value: ls79nld2rm2q0nl79sveka19r3

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

siaf.sg
www.tacolibre.pl
113.11.252.41
185.208.164.123
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
5aaab1b70e6a1a14a15d1b40c097895b464f0ae87f412da6e53dc9514e7bf83f
69731cfa0652a2ad468050e679cf3a05bc03716b94520becead032c7b7bb9981
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
c14cd3a63de4624b3ef00d6664b9ecb456bdffb098088a7ecc0e045db90eb2e6

siaf.sg Open in urlscan Pro 113.11.252.41 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

248 kBTransfer

247 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

siaf.sg Open in urlscan Pro
113.11.252.41 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

248 kB
Transfer

247 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!