tecnowash.ro Open in urlscan Pro
89.42.111.163 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Submission: On March 24 via automatic, source phishtank (March 24th 2020, 6:18:55 am UTC)

Summary HTTP 18 Redirects Links 14 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 18 HTTP transactions. The main IP is 89.42.111.163, located in Romania and belongs to SIMPLIQ-AS, RO. The main domain is tecnowash.ro.

This is the only time tecnowash.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ABSA (Banking)

Domain & IP information

	IP Address		AS Autonomous System
11	89.42.111.163 89.42.111.163		39758 (SIMPLIQ-AS) (SIMPLIQ-AS)
1	2a00:1450:400... 2a00:1450:4001:824::200a		15169 (GOOGLE) (GOOGLE)
6	169.202.9.74 169.202.9.74		14115 (AMALGAMAT...) (AMALGAMATED-BSA)
18	3

11 89.42.111.163 (Romania)

ASN39758 (SIMPLIQ-AS, RO)
PTR: server.kyoinc.net

tecnowash.ro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 169.202.9.74 (South Africa)

ASN14115 (AMALGAMATED-BSA, ZA)
PTR: ib.absa.co.za

ib.absa.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	tecnowash.ro tecnowash.ro	221 KB
6	absa.co.za ib.absa.co.za	87 KB
1	googleapis.com ajax.googleapis.com	34 KB
18	3

	Domain	Requested by
11	tecnowash.ro	tecnowash.ro
6	ib.absa.co.za	tecnowash.ro ajax.googleapis.com
1	ajax.googleapis.com	tecnowash.ro
18	3

This site contains links to these domains. Also see Links.

Domain
ib.absa.co.za
www.absa.co.za

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
ib.absa.co.za DigiCert SHA2 Extended Validation Server CA	`2019-06-11` - `2021-07-03`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Frame ID: D0CD875212E56352939C545423667652
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

18
Requests

39 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

341 kB
Transfer

396 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://ib.absa.co.za/absa-online/registration/?lang=en
Title: Registration

Search URL Search Domain Scan URL

URL: http://www.absa.co.za/
Title: Absa home page

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/security-centre/online-security
Title: Absa's online security measures

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/security-centre/scams/
Title: Latest scams

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/security-centre/absa-tools/
Title: Latest internet security software

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/media-centre/press-statements/2016/old-interface-switched-off/
Title: Old interface switched off

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/media-centre/press-statements/2016/absa-listed-beneficiaries-accounts-closed/
Title: Absa Listed Beneficiaries - accounts closed

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/media-centre/press-statements/absa-online-payments-issue-notice
Title: Inter-Bank Payment delay

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/talk-to-us/
Title: Contact us

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/offers/safety-and-security/

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/offers/faq-on-the-improved-online-banking-design/

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/legal-and-compliance/terms-of-use/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/legal-and-compliance/browser-requirements
Title: Software requirements

Search URL Search Domain Scan URL

URL: https://www.absa.co.za/about-us/absa-bank/corporate-information
Title: Banking regulations

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request ~AbsaOnline%206.htm Show response
tecnowash.ro/.well-known/ib.extracted/ 48 KB
49 KB 281ms
156ms Document
text/html 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.1
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 /
Resource Hash: d0fc0488b912ac2986739f13edd995ef418586fbd9fedbef81c19fa3cdf60c66

Request headers

Host: tecnowash.ro
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:36 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
Last-Modified: Sun, 22 Mar 2020 13:18:17 GMT
ETag: "bdd248-c081-5a1715a01d840"
Accept-Ranges: bytes
Content-Length: 49281
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK absa.css
tecnowash.ro/.well-known/ib.extracted/css/ 157 KB
158 KB 113ms
98ms Stylesheet
text/css 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://tecnowash.ro/.well-known/ib.extracted/css/absa.css
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.1
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 /
Resource Hash: 9a4820348e37a82731f02777daa451ba3772aafe23aa8936ab1351979589f538

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Last-Modified: Tue, 10 Mar 2020 03:42:36 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
ETag: "da8a45-27405-5a077e91b8300"
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type, Authorization
Content-Length: 160773
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK login.css
tecnowash.ro/.well-known/ib.extracted/css/ 5 KB
5 KB 114ms
100ms Stylesheet
text/css 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://tecnowash.ro/.well-known/ib.extracted/css/login.css
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.1
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 /
Resource Hash: 2b81626a0c511884a4d30664076f620ec536fd058085b19efb513f5c6d9eee49

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Last-Modified: Tue, 10 Mar 2020 03:42:18 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
ETag: "da8a43-135b-5a077e808da80"
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type, Authorization
Content-Length: 4955
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK jcaptcha.css
tecnowash.ro/.well-known/ib.extracted/css/ 1 KB
2 KB 117ms
102ms Stylesheet
text/css 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://tecnowash.ro/.well-known/ib.extracted/css/jcaptcha.css
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.1
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 /
Resource Hash: cfc8d1cac57c28080424e0352c91061277f42b819ac9280ec163095e9ed5d61b

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Last-Modified: Tue, 10 Mar 2020 03:42:18 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
ETag: "da8a49-5c7-5a077e808da80"
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: text/css
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type, Authorization
Content-Length: 1479
Keep-Alive: timeout=5, max=100

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ 95 KB
34 KB 19ms
6ms Script
text/javascript 2a00:1450:4001:824::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js

Requested by

Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 23 Jan 2020 10:02:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5256961
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 33951
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jan 2021 10:02:37 GMT

GET
H/1.0 404
Not Found absajslogo.php
tecnowash.ro/.well-known/ib.extracted/js/ 0
0 147ms
132ms Script
text/html 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://tecnowash.ro/.well-known/ib.extracted/js/absajslogo.php?r=
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.0
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 / PHP/5.2.17
Resource Hash

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
Connection: close
X-Powered-By: PHP/5.2.17
Content-Length: 0
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK ajax-loader-2.gif
tecnowash.ro/.well-known/ib.extracted/images/ 3 KB
4 KB 115ms
101ms Image
image/gif 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://tecnowash.ro/.well-known/ib.extracted/images/ajax-loader-2.gif
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.1
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 /
Resource Hash: b6b693de4c17c014dad29abe5294359606104283674d45ee8348e9dc731ff540

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Last-Modified: Tue, 10 Mar 2020 03:43:22 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
ETag: "da8bd0-c88-5a077ebd96a80"
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/gif
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type, Authorization
Content-Length: 3208
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK logo-red.png
tecnowash.ro/.well-known/ib.extracted/images/ 2 KB
3 KB 175ms
56ms Image
image/png 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://tecnowash.ro/.well-known/ib.extracted/images/logo-red.png
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.1
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 /
Resource Hash: 86c3ec119fc6352ca80ccc5b6e2e8fa76c924adecaf33de65da1b892e7b1aa3e

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Last-Modified: Tue, 10 Mar 2020 03:43:20 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
ETag: "da8bd4-81f-5a077ebbae600"
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type, Authorization
Content-Length: 2079
Keep-Alive: timeout=5, max=99

GET
H/1.0 404
Not Found campaigne_1_ENG.png
tecnowash.ro/absa-online/assets/Assets/Richmedia/Absaonline/Images/ 0
395 B 87ms
86ms Image
text/html 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://tecnowash.ro/absa-online/assets/Assets/Richmedia/Absaonline/Images/campaigne_1_ENG.png
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.0
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 / PHP/5.2.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
Connection: close
X-Powered-By: PHP/5.2.17
Content-Length: 0
Content-Type: text/html; charset=utf-8

GET
H/1.0 404
Not Found campaigne_3_post_golive_EN.jpg
tecnowash.ro/absa-online/assets/Assets/Richmedia/Absaonline/CampaignImages/Eng/ 0
395 B 75ms
74ms Image
text/html 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://tecnowash.ro/absa-online/assets/Assets/Richmedia/Absaonline/CampaignImages/Eng/campaigne_3_post_golive_EN.jpg
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.0
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 / PHP/5.2.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
Connection: close
X-Powered-By: PHP/5.2.17
Content-Length: 0
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK campaigne_3_post_golive_EN.jpg
ib.absa.co.za/absa-online/assets/Assets/Richmedia/Absaonline/CampaignImages/Eng/ 82 KB
82 KB 893ms
211ms Image
image/jpeg 169.202.9.74
AMALGAMATED-BSA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.absa.co.za/absa-online/assets/Assets/Richmedia/Absaonline/CampaignImages/Eng/campaigne_3_post_golive_EN.jpg

Requested by

Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

169.202.9.74 , South Africa, ASN14115 (AMALGAMATED-BSA, ZA),

Reverse DNS

Software

/

Resource Hash

e9062cb53b9fed83242811975d2aa71719ea623b3633d9e00429054678d18df5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Tue, 24 Mar 2020 05:54:12 GMT
X-Frame-Options: SAMEORIGIN
Content-Language: en-US
Cache-Control: no-cache, no-store
Transfer-Encoding: chunked
Connection: Keep-Alive
Content-Type: image/jpeg
Keep-Alive: timeout=10, max=20
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.0 404
Not Found absajslogo.php
tecnowash.ro/.well-known/ib.extracted/js/ 0
0 90ms
89ms Script
text/html 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://tecnowash.ro/.well-known/ib.extracted/js/absajslogo.php?r=
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.0
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 / PHP/5.2.17
Resource Hash

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
Connection: close
X-Powered-By: PHP/5.2.17
Content-Length: 0
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK sprite-corners-rounded.png
ib.absa.co.za/absa-online/static/style/resources/ 246 B
547 B 837ms
201ms Image
image/png 169.202.9.74
AMALGAMATED-BSA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.absa.co.za/absa-online/static/style/resources/sprite-corners-rounded.png
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 169.202.9.74 , South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS: ib.absa.co.za
Software: /
Resource Hash: 6a1423dcdc9a531df9d5dfc5a1ea720eec868eda0a56e1580a0c71c69e79b8fe

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/css/absa.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 24 Mar 2020 05:54:12 GMT
Last-Modified: Sat, 22 Feb 2020 19:55:32 GMT
Content-Language: en-US
Cache-Control: max-age=2678400
Connection: Keep-Alive
Content-Type: image/png
Keep-Alive: timeout=10, max=20
Content-Length: 246
Expires: Fri, 24 Apr 2020 05:54:12 GMT

GET
H/1.1 200
OK keyboard-bg.gif
ib.absa.co.za/absa-online/static/style/www.absa.co.za.2009.ui/keyboard/ 601 B
902 B 846ms
207ms Image
image/gif 169.202.9.74
AMALGAMATED-BSA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.absa.co.za/absa-online/static/style/www.absa.co.za.2009.ui/keyboard/keyboard-bg.gif
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 169.202.9.74 , South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS: ib.absa.co.za
Software: /
Resource Hash: c24b7f5254d1a8a99f1995f372018b2e199709447f0d979c079648bc96627793

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/css/absa.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 24 Mar 2020 05:54:12 GMT
Last-Modified: Sat, 22 Feb 2020 19:55:32 GMT
Content-Language: en-US
Cache-Control: max-age=2678400
Connection: Keep-Alive
Content-Type: image/gif
Keep-Alive: timeout=10, max=20
Content-Length: 601
Expires: Fri, 24 Apr 2020 05:54:12 GMT

GET
H/1.1 200
OK key-button-long.gif
ib.absa.co.za/absa-online/static/style/www.absa.co.za.2009.ui/resources/ 2 KB
2 KB 862ms
202ms Image
image/gif 169.202.9.74
AMALGAMATED-BSA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.absa.co.za/absa-online/static/style/www.absa.co.za.2009.ui/resources/key-button-long.gif
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 169.202.9.74 , South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS: ib.absa.co.za
Software: /
Resource Hash: b2ca32f64e61217bb884ba0bf121a4ab0fba35ebc73d7831bb7eef2b3dd37452

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/css/absa.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 24 Mar 2020 05:54:12 GMT
Last-Modified: Sat, 22 Feb 2020 19:55:32 GMT
Content-Language: en-US
Cache-Control: max-age=2678400
Connection: Keep-Alive
Content-Type: image/gif
Keep-Alive: timeout=10, max=20
Content-Length: 1575
Expires: Fri, 24 Apr 2020 05:54:12 GMT

GET
H/1.1 200
OK keypad-backspace.png
ib.absa.co.za/absa-online/static/style/www.absa.co.za.2009.ui/resources/ 209 B
510 B 866ms
202ms Image
image/png 169.202.9.74
AMALGAMATED-BSA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.absa.co.za/absa-online/static/style/www.absa.co.za.2009.ui/resources/keypad-backspace.png
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 169.202.9.74 , South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS: ib.absa.co.za
Software: /
Resource Hash: 1723fd2bd8c98417e8739ab2853cb92dfb0e50113a7a9726d2cceb69d00eea05

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/css/absa.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 24 Mar 2020 05:54:12 GMT
Last-Modified: Sat, 22 Feb 2020 19:55:32 GMT
Content-Language: en-US
Cache-Control: max-age=2678400
Connection: Keep-Alive
Content-Type: image/png
Keep-Alive: timeout=10, max=20
Content-Length: 209
Expires: Fri, 24 Apr 2020 05:54:12 GMT

GET
H/1.1 200
OK key-button.gif
ib.absa.co.za/absa-online/static/style/www.absa.co.za.2009.ui/resources/ 379 B
680 B 876ms
204ms Image
image/gif 169.202.9.74
AMALGAMATED-BSA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.absa.co.za/absa-online/static/style/www.absa.co.za.2009.ui/resources/key-button.gif
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 169.202.9.74 , South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS: ib.absa.co.za
Software: /
Resource Hash: d3dbb7567bec3fa266960ee53ee72d534e1834e481ff502a0901fcb32af7ff23

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/css/absa.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Tue, 24 Mar 2020 05:54:12 GMT
Last-Modified: Sat, 22 Feb 2020 19:55:32 GMT
Content-Language: en-US
Cache-Control: max-age=2678400
Connection: Keep-Alive
Content-Type: image/gif
Keep-Alive: timeout=10, max=20
Content-Length: 379
Expires: Fri, 24 Apr 2020 05:54:12 GMT

GET
H/1.0 404
Not Found campaigne_3_post_golive_EN.jpg
tecnowash.ro/absa-online/assets/Assets/Richmedia/Absaonline/CampaignImages/Eng/ 0
395 B 71ms
70ms Image
text/html 89.42.111.163
SIMPLIQ-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://tecnowash.ro/absa-online/assets/Assets/Richmedia/Absaonline/CampaignImages/Eng/campaigne_3_post_golive_EN.jpg
Requested by: Host: tecnowash.ro
URL: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
Protocol: HTTP/1.0
Server: 89.42.111.163 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS: server.kyoinc.net
Software: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17 / PHP/5.2.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://tecnowash.ro/.well-known/ib.extracted/~AbsaOnline%206.htm
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Mar 2020 06:18:37 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 PHP/5.2.17
Connection: close
X-Powered-By: PHP/5.2.17
Content-Length: 0
Content-Type: text/html; charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ABSA (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
ib.absa.co.za
tecnowash.ro
169.202.9.74
2a00:1450:4001:824::200a
89.42.111.163
1723fd2bd8c98417e8739ab2853cb92dfb0e50113a7a9726d2cceb69d00eea05
2b81626a0c511884a4d30664076f620ec536fd058085b19efb513f5c6d9eee49
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6a1423dcdc9a531df9d5dfc5a1ea720eec868eda0a56e1580a0c71c69e79b8fe
86c3ec119fc6352ca80ccc5b6e2e8fa76c924adecaf33de65da1b892e7b1aa3e
9a4820348e37a82731f02777daa451ba3772aafe23aa8936ab1351979589f538
b2ca32f64e61217bb884ba0bf121a4ab0fba35ebc73d7831bb7eef2b3dd37452
b6b693de4c17c014dad29abe5294359606104283674d45ee8348e9dc731ff540
c24b7f5254d1a8a99f1995f372018b2e199709447f0d979c079648bc96627793
cfc8d1cac57c28080424e0352c91061277f42b819ac9280ec163095e9ed5d61b
d0fc0488b912ac2986739f13edd995ef418586fbd9fedbef81c19fa3cdf60c66
d3dbb7567bec3fa266960ee53ee72d534e1834e481ff502a0901fcb32af7ff23
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9062cb53b9fed83242811975d2aa71719ea623b3633d9e00429054678d18df5