samsungs22.sbs Open in urlscan Pro
41.185.8.76 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://samsungs22.sbs/243eca1313dca1/app/index.php
Submission Tags: @phish_report
Submission: On April 15 via api (April 15th 2024, 8:16:00 am UTC) from FI — Scanned from FI

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 41.185.8.76, located in South Africa and belongs to ZA-1-Grid, ZA. The main domain is samsungs22.sbs.
TLS certificate: Issued by R3 on March 8th 2024. Valid for: 3 months.

This is the only time samsungs22.sbs was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	41.185.8.76 41.185.8.76	36943 (ZA-1-Grid) (ZA-1-Grid)
3	75.2.62.89 75.2.62.89	16509 (AMAZON-02) (AMAZON-02)
10	3

5 41.185.8.76 (South Africa)

ASN36943 (ZA-1-Grid, ZA)
PTR: srv78.hostserv.co.za

samsungs22.sbs	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 75.2.62.89 (United States)

ASN16509 (AMAZON-02, US)
PTR: ab74f959c776f2071.awsglobalaccelerator.com

pay.ozow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	samsungs22.sbs samsungs22.sbs	206 KB
3	ozow.com pay.ozow.com Failed	86 KB
10	2

	Domain	Requested by
5	samsungs22.sbs	samsungs22.sbs
3	pay.ozow.com	samsungs22.sbs
10	2

This site contains no links.

Subject Issuer	Validity	Valid
www.samsungs22ultra.sbs.abresellerhost.info R3	`2024-03-08` - `2024-06-06`	3 months	crt.sh
pay.ozow.com Amazon RSA 2048 M02	`2024-03-10` - `2025-04-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://samsungs22.sbs/243eca1313dca1/app/index.php
Frame ID: 21B27985866AB27F0C3C54162F28174E
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ozow Instant Secure EFT Payments

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

10
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

291 kB
Transfer

494 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.php Show response
samsungs22.sbs/243eca1313dca1/app/ 4 KB
2 KB 1297ms
803ms Document
text/html 41.185.8.76
ZA-1-Grid

General

Check archive.org

Show headers Download Go to

Full URL: https://samsungs22.sbs/243eca1313dca1/app/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 41.185.8.76 , South Africa, ASN36943 (ZA-1-Grid, ZA),
Reverse DNS: srv78.hostserv.co.za
Software: nginx / PHP/7.1.33
Resource Hash: 880e0645287d2b393b958701ab9881cc15ef69656f7f4adb083fcd0960b485bb

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 1219
content-type: text/html; charset=UTF-8
date: Mon, 15 Apr 2024 08:15:55 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/7.1.33
x-turbo-charged-by: LiteSpeed

GET
H2 200 main.6e8e127e.chunk.css
samsungs22.sbs/243eca1313dca1/app/index_files/ 231 KB
35 KB 439ms
438ms Stylesheet
text/css 41.185.8.76
ZA-1-Grid

General

Check archive.org

Show headers Download Go to

Full URL: https://samsungs22.sbs/243eca1313dca1/app/index_files/main.6e8e127e.chunk.css
Requested by: Host: samsungs22.sbs
URL: https://samsungs22.sbs/243eca1313dca1/app/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 41.185.8.76 , South Africa, ASN36943 (ZA-1-Grid, ZA),
Reverse DNS: srv78.hostserv.co.za
Software: nginx /
Resource Hash: fa8c79c9e9d62a341382f577fa45ca9eeecce673c1f7223d4b0083f4ac2563fc

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://samsungs22.sbs/243eca1313dca1/app/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 15 Apr 2024 08:15:55 GMT
content-encoding: br
last-modified: Mon, 26 Feb 2024 11:39:44 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 35415
expires: Mon, 22 Apr 2024 08:15:55 GMT

GET
H2 200 inxxlogo.png
samsungs22.sbs/243eca1313dca1/app/ 164 KB
165 KB 623ms
623ms Image
image/png 41.185.8.76
ZA-1-Grid

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://samsungs22.sbs/243eca1313dca1/app/inxxlogo.png
Requested by: Host: samsungs22.sbs
URL: https://samsungs22.sbs/243eca1313dca1/app/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 41.185.8.76 , South Africa, ASN36943 (ZA-1-Grid, ZA),
Reverse DNS: srv78.hostserv.co.za
Software: nginx /
Resource Hash: f9ca61e78906b58c85752daa5355ac9b1a736d7ce59047cfd08180540bf24909

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://samsungs22.sbs/243eca1313dca1/app/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 15 Apr 2024 08:15:55 GMT
last-modified: Mon, 26 Feb 2024 11:39:38 GMT
server: nginx
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 168140
expires: Mon, 22 Apr 2024 08:15:55 GMT

GET
H2 200 pci-cropped.15e67a49.svg
samsungs22.sbs/243eca1313dca1/app/index_files/ 6 KB
3 KB 821ms
820ms Image
image/svg+xml 41.185.8.76
ZA-1-Grid

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://samsungs22.sbs/243eca1313dca1/app/index_files/pci-cropped.15e67a49.svg
Requested by: Host: samsungs22.sbs
URL: https://samsungs22.sbs/243eca1313dca1/app/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 41.185.8.76 , South Africa, ASN36943 (ZA-1-Grid, ZA),
Reverse DNS: srv78.hostserv.co.za
Software: nginx /
Resource Hash: 714565eaade12378555e91d7ce7d29af678906e0be61e147e9d0e7fc4b8bbb0e

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://samsungs22.sbs/243eca1313dca1/app/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 15 Apr 2024 08:15:55 GMT
content-encoding: br
last-modified: Mon, 26 Feb 2024 11:39:44 GMT
server: nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 2226
expires: Mon, 22 Apr 2024 08:15:55 GMT

GET payment-flow-bg-blue-v2.199172f8.svg
pay.ozow.com/static/media/ 0
0

GET payment-flow-bg-green.4b6d4bd9.svg
pay.ozow.com/static/media/ 0
0

GET
H2 200 gordita-bold-webfont.723c321c.woff2
pay.ozow.com/static/media/ 25 KB
25 KB 324ms
135ms Font
font/woff2 75.2.62.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.ozow.com/static/media/gordita-bold-webfont.723c321c.woff2

Requested by

Host: samsungs22.sbs
URL: https://samsungs22.sbs/243eca1313dca1/app/index_files/main.6e8e127e.chunk.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

75.2.62.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ab74f959c776f2071.awsglobalaccelerator.com

Software

nginx /

Resource Hash

9fdf054d2897262d6253b45c9b02aa109fce16c472ee9f927e64cfe7b0c390ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://samsungs22.sbs/
Origin: https://samsungs22.sbs
Accept-Language: fi-FI,fi;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 15 Apr 2024 08:15:56 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 05 Apr 2024 08:48:13 GMT
server: nginx
etag: "1da8735fe486194"
content-type: font/woff2
access-control-allow-origin: *
accept-ranges: bytes
content-length: 25876

GET
H2 200 gordita-regular-webfont.36efb75f.woff2
pay.ozow.com/static/media/ 26 KB
26 KB 337ms
149ms Font
font/woff2 75.2.62.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.ozow.com/static/media/gordita-regular-webfont.36efb75f.woff2

Requested by

Host: samsungs22.sbs
URL: https://samsungs22.sbs/243eca1313dca1/app/index_files/main.6e8e127e.chunk.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

75.2.62.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ab74f959c776f2071.awsglobalaccelerator.com

Software

nginx /

Resource Hash

22237f27917139001deaf6dfebbd67ef296e9920f247ba540b0c940c5706e57e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://samsungs22.sbs/
Origin: https://samsungs22.sbs
Accept-Language: fi-FI,fi;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 15 Apr 2024 08:15:56 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 05 Apr 2024 08:48:13 GMT
server: nginx
etag: "1da8735fe486ca4"
content-type: font/woff2
access-control-allow-origin: *
accept-ranges: bytes
content-length: 26660

GET
H2 200 on-white.0f8e3df6.svg
samsungs22.sbs/243eca1313dca1/app/index_files/ 4 KB
2 KB 359ms
359ms Image
image/svg+xml 41.185.8.76
ZA-1-Grid

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://samsungs22.sbs/243eca1313dca1/app/index_files/on-white.0f8e3df6.svg
Requested by: Host: samsungs22.sbs
URL: https://samsungs22.sbs/243eca1313dca1/app/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 41.185.8.76 , South Africa, ASN36943 (ZA-1-Grid, ZA),
Reverse DNS: srv78.hostserv.co.za
Software: nginx /
Resource Hash: ec36a5b9babb74b54468d7911e46f8d059f3177fc06a8985a158d20a75a8ac67

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://samsungs22.sbs/243eca1313dca1/app/index.php
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 15 Apr 2024 08:15:55 GMT
content-encoding: br
last-modified: Mon, 26 Feb 2024 11:39:44 GMT
server: nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1448
expires: Mon, 22 Apr 2024 08:15:55 GMT

GET
H2 200 favicon.ico
pay.ozow.com/ 34 KB
34 KB 122ms
122ms Other
image/x-icon 75.2.62.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.ozow.com/favicon.ico

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

75.2.62.89 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ab74f959c776f2071.awsglobalaccelerator.com

Software

nginx /

Resource Hash

a24aa1ad36ba69ba2d02d67a914b0cec5e71968ec32c55b519b4eca7aa9e7e59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: fi-FI,fi;q=0.9;q=0.9
Referer: https://samsungs22.sbs/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 15 Apr 2024 08:15:56 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 05 Apr 2024 08:46:46 GMT
server: nginx
etag: "1da8735ca6c59be"
content-type: image/x-icon
cache-control: max-age=86400
accept-ranges: bytes
content-length: 34494
expires: Tue, 16 Apr 2024 08:15:56 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pay.ozow.com
URL: https://pay.ozow.com/static/media/payment-flow-bg-blue-v2.199172f8.svg

Domain: pay.ozow.com
URL: https://pay.ozow.com/static/media/payment-flow-bg-green.4b6d4bd9.svg

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			samsungs22.sbs/	1969-12-31 23:59:59	Name: PHPSESSID Value: 71aab688e20664a49050760c6bbe4069

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://samsungs22.sbs/243eca1313dca1/app/index.php(Line 3) Message: The key "target-densitydpi" is not supported.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pay.ozow.com
samsungs22.sbs
pay.ozow.com
41.185.8.76
75.2.62.89
22237f27917139001deaf6dfebbd67ef296e9920f247ba540b0c940c5706e57e
714565eaade12378555e91d7ce7d29af678906e0be61e147e9d0e7fc4b8bbb0e
880e0645287d2b393b958701ab9881cc15ef69656f7f4adb083fcd0960b485bb
9fdf054d2897262d6253b45c9b02aa109fce16c472ee9f927e64cfe7b0c390ac
a24aa1ad36ba69ba2d02d67a914b0cec5e71968ec32c55b519b4eca7aa9e7e59
ec36a5b9babb74b54468d7911e46f8d059f3177fc06a8985a158d20a75a8ac67
f9ca61e78906b58c85752daa5355ac9b1a736d7ce59047cfd08180540bf24909
fa8c79c9e9d62a341382f577fa45ca9eeecce673c1f7223d4b0083f4ac2563fc

samsungs22.sbs Open in urlscan Pro 41.185.8.76 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

80 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

291 kBTransfer

494 kBSize

1 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

samsungs22.sbs Open in urlscan Pro
41.185.8.76 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

291 kB
Transfer

494 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions