mailsxr.ga Open in urlscan Pro
104.168.173.135  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response mailsxr.ga/nedbank.co.za/	85 KB 85 KB	693ms 170ms	Document text/html	104.168.173.135 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL http://mailsxr.ga/nedbank.co.za/ Protocol HTTP/1.1 Server 104.168.173.135 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS seans5.masterns.com Software Apache / Resource Hash 0e21fdb52b0154f3c0c1acd17e86b630caf8e0e28990d1d084a49d7e52c12639 Request headers Host mailsxr.ga Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 06:32:55 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Last-Modified Sat, 13 Jul 2019 15:15:00 GMT Accept-Ranges bytes Content-Length 86548 Vary Accept-Encoding Keep-Alive timeout=5, max=1000 Content-Type text/html
GET H/1.1	200 OK	styles.css mailsxr.ga/nedbank.co.za/Nedbank_Money_files/	173 KB 173 KB	170ms 170ms	Stylesheet text/css	104.168.173.135 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/styles.css Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/ Protocol HTTP/1.1 Security , , Server 104.168.173.135 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS seans5.masterns.com Software Apache / Resource Hash 8887a3e0dea10c649e723d160fcac04d7432910580a8c0f2726c0c27ef8ee9cc Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 06:32:55 GMT Last-Modified Mon, 24 Jun 2019 13:49:36 GMT Server Apache Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=999 Content-Length 177164
GET H/1.1	200 OK	jquery.min.js.download Show response mailsxr.ga/nedbank.co.za/Nedbank_Money_files/	95 KB 95 KB	339ms 170ms	Script application/javascript	104.168.173.135 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/ Protocol HTTP/1.1 Security , , Server 104.168.173.135 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS seans5.masterns.com Software Apache / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 06:32:55 GMT Last-Modified Mon, 24 Jun 2019 13:49:36 GMT Server Apache Vary Accept-Encoding Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type application/javascript Keep-Alive timeout=5, max=1000 Content-Length 97163
GET H/1.1	200 OK	s.php Show response mailsxr.ga/nedbank.co.za/Nedbank_Money_files/	4 KB 4 KB	689ms 174ms	Script text/html	104.168.173.135 Hostwinds LLC.
General Check archive.org Show headers Download Go to Full URL http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/s.php Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/ Protocol HTTP/1.1 Security , , Server 104.168.173.135 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS seans5.masterns.com Software Apache / Resource Hash 64dd2a05ed983e0f3ee37cc7ed92174325365690e50697d4d91a73fb71bb4bc4 Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 06:32:56 GMT Transfer-Encoding chunked Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=998 Vary Accept-Encoding Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	logo.PNG mailsxr.ga/nedbank.co.za/Nedbank_Money_files/	50 KB 50 KB	861ms 170ms	Image image/png	104.168.173.135 Hostwinds LLC.
General Check archive.org Show headers Download Go to Show image Full URL http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/logo.PNG Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/ Protocol HTTP/1.1 Security , , Server 104.168.173.135 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS seans5.masterns.com Software Apache / Resource Hash 387eb324b928bd34df5a8e5ec66bd548c64598c979c16a4bd100269d46940c0d Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 06:32:56 GMT Last-Modified Sat, 13 Jul 2019 15:08:14 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=997 Content-Length 51356
GET H/1.1	200 OK	NedbankIcon.ef111dcaf7b1952d120f.svg secured.nedbank.co.za/	0 0	2651ms 180ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/NedbankIcon.ef111dcaf7b1952d120f.svg Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 , South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	location-blank-green.4b8e66bca4aac4a2aad6.svg secured.nedbank.co.za/	0 0	2833ms 182ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/location-blank-green.4b8e66bca4aac4a2aad6.svg Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 , South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	contact-blank-green.a180fba4b897921edd0b.svg secured.nedbank.co.za/	0 0	3014ms 180ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/contact-blank-green.a180fba4b897921edd0b.svg Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 , South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	NedbankLogin_v2.png secured.nedbank.co.za/assets/png/	100 KB 101 KB	3202ms 188ms	Image image/png	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/assets/png/NedbankLogin_v2.png Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 , South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash 354cb0a75fdc0745134b7809a64030764e4b22c5161d679fdd9ad01b4d8386ca Security Headers Name Value Content-Security-Policy default-src * 'self' data: 'unsafe-inline' 'unsafe-eval' * Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY,SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Content-Security-Policy default-src * 'self' data: 'unsafe-inline' 'unsafe-eval' * X-Content-Type-Options nosniff Last-Modified Sat, 22 Jun 2019 01:59:17 GMT ETag "3b05c199e28d51:0" X-Frame-Options DENY,SAMEORIGIN Content-Type image/png Cache-Control no-cache, no-store, must-revalidate Date Mon, 15 Jul 2019 06:32:59 GMT Strict-Transport-Security max-age=31536000 Accept-Ranges bytes Content-Length 102656 X-XSS-Protection 1; mode=block Expires Wed, 05 Jul 2017 00:00:00 GMT,0
GET H/1.1	404 Not Found	Eye-Show.e1de9570f043be4db21c.svg mailsxr.ga/nedbank.co.za/Nedbank_Money_files/	384 B 384 B	170ms 169ms	Image text/html	104.168.173.135 Hostwinds LLC.
General Check archive.org Show headers Download Go to Show image Full URL http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/Eye-Show.e1de9570f043be4db21c.svg Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol HTTP/1.1 Security , , Server 104.168.173.135 Seattle, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US), Reverse DNS seans5.masterns.com Software Apache / Resource Hash f841b05761a9d470cb127ffca2ef5e1ea2d1e82122fe07772415469259e70244 Request headers Referer http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/styles.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 06:32:56 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=996 Content-Length 384 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	contact-footer.ff0deb4d99b5c501e332.svg secured.nedbank.co.za/	0 0	3734ms 181ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/contact-footer.ff0deb4d99b5c501e332.svg Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 , South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	location-blank.e36d304f8628a21886d3.svg secured.nedbank.co.za/	0 0	3915ms 180ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/location-blank.e36d304f8628a21886d3.svg Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 , South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	phoneicon.d20aa97e94487e70b840.svg secured.nedbank.co.za/	0 0	2453ms 179ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/phoneicon.d20aa97e94487e70b840.svg Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 , South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	tncs.04b64534a4bbcb7c2676.svg secured.nedbank.co.za/	0 0	2273ms 190ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/tncs.04b64534a4bbcb7c2676.svg Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 , South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://mailsxr.ga/nedbank.co.za/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H2	200	FontFont%20-%20MarkPro.12d6724a254d3be629fc.otf walideqp.com/nouitio/secominuo/fonts/	162 KB 163 KB	627ms 125ms	Font font/otf	103.21.58.60 PDR
General Check archive.org Show headers Download Go to Full URL https://walideqp.com/nouitio/secominuo/fonts/FontFont%20-%20MarkPro.12d6724a254d3be629fc.otf Requested by Host: mailsxr.ga URL: http://mailsxr.ga/nedbank.co.za/Nedbank_Money_files/jquery.min.js.download Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 103.21.58.60 Mumbai, India, ASN394695 (PUBLIC-DOMAIN-REGISTRY - PDR, US), Reverse DNS bh-in-4.webhostbox.net Software Apache/2.4.39 (cPanel) OpenSSL/1.0.2r mod_bwlimited/1.4 Phusion_Passenger/5.3.7 / Resource Hash eaa561f9f8ef5b69bd39e15e332dc3700decacebf48e08b0640ad3a5d8711f65 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://mailsxr.ga/nedbank.co.za/ Origin http://mailsxr.ga Response headers date Mon, 15 Jul 2019 06:32:57 GMT last-modified Fri, 21 Jun 2019 05:48:20 GMT server Apache/2.4.39 (cPanel) OpenSSL/1.0.2r mod_bwlimited/1.4 Phusion_Passenger/5.3.7 access-control-allow-origin * etag "21201d7-28614-58bcf028ecb6a" access-control-allow-methods GET,PUT,POST,DELETE content-type font/otf status 200 accept-ranges bytes access-control-allow-headers Content-Type, Authorization content-length 165396

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nedbank (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask string| key function| hJKm string| source function| $ function| jQuery function| ajax_jsonp_call function| isNumberKey function| validatePassword function| untouched function| untouched2 string| site_Url

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mailsxr.ga
secured.nedbank.co.za
walideqp.com
103.21.58.60
104.168.173.135
168.142.204.82
0e21fdb52b0154f3c0c1acd17e86b630caf8e0e28990d1d084a49d7e52c12639
354cb0a75fdc0745134b7809a64030764e4b22c5161d679fdd9ad01b4d8386ca
387eb324b928bd34df5a8e5ec66bd548c64598c979c16a4bd100269d46940c0d
64dd2a05ed983e0f3ee37cc7ed92174325365690e50697d4d91a73fb71bb4bc4
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
8887a3e0dea10c649e723d160fcac04d7432910580a8c0f2726c0c27ef8ee9cc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaa561f9f8ef5b69bd39e15e332dc3700decacebf48e08b0640ad3a5d8711f65
f841b05761a9d470cb127ffca2ef5e1ea2d1e82122fe07772415469259e70244