vanadio.co.za Open in urlscan Pro
188.166.172.73  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request test.html Show response vanadio.co.za/files/fume/auth/	404 KB 405 KB	224ms 108ms	Document text/html	188.166.172.73 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://vanadio.co.za/files/fume/auth/test.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 188.166.172.73 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS server.bnonlinehosting.com Software Apache / Resource Hash 0ef4030ff484fca8bd447e330a6785cd8b993b10930bd8f3fc94b38a169898f3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 413966 Content-Type text/html Date Fri, 03 Jun 2022 15:36:43 GMT Keep-Alive timeout=5, max=100 Last-Modified Wed, 01 Jun 2022 21:56:35 GMT Server Apache X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block
GET DATA	200 OK	truncated /	661 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fb0651bcae0b66fa7a3dd5a550e3b654edbfe6c01267ecca6f68a4f9bec67fb1 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/	85 KB 28 KB	148ms 56ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: vanadio.co.za URL: https://vanadio.co.za/files/fume/auth/test.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://vanadio.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers date Fri, 03 Jun 2022 15:36:44 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 19034151 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27433 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-1538f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9rutop35Zf9Z7JXs7BZa5%2Fix4hmfhHKaBxrXAgUJjr%2BYffiCvSB6%2B9j0BqKtSGDmYH2Hkce3dD%2BGSc1ijfDrYoCI0oETEr5kJHY37%2Frv3FSea6eOS38PtOByNhkLEKrml1vhqp9THZwNm2JT0tL2oBio"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 7159818be8d975e3-LHR expires Wed, 24 May 2023 15:36:44 GMT
GET DATA	200 OK	truncated /	296 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 66a27cd81491a2dae81d5e1068bd4ec848c4512ecc205f1200a8fdccce1dcdaa Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| $ function| jQuery object| filter function| search object| modal number| count string| dot

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
vanadio.co.za
188.166.172.73
2606:4700::6811:190e
0ef4030ff484fca8bd447e330a6785cd8b993b10930bd8f3fc94b38a169898f3
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
66a27cd81491a2dae81d5e1068bd4ec848c4512ecc205f1200a8fdccce1dcdaa
fb0651bcae0b66fa7a3dd5a550e3b654edbfe6c01267ecca6f68a4f9bec67fb1