businessbureau.co.za

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 170.10.160.51, located in Spokane, United States and belongs to STEADFAST - Steadfast, US. The main domain is businessbureau.co.za.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 23rd 2018. Valid for: 3 months.

This is the only time businessbureau.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Postmaster (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	170.10.160.51 170.10.160.51	32748 (STEADFAST) (STEADFAST - Steadfast)
1	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
5	2

4 170.10.160.51 (Spokane, United States)

ASN32748 (STEADFAST - Steadfast, US)
PTR: mediaxtreme.co.za

businessbureau.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	businessbureau.co.za businessbureau.co.za	17 KB
1	gstatic.com encrypted-tbn0.gstatic.com	7 KB
5	2

	Domain	Requested by
4	businessbureau.co.za	businessbureau.co.za
1	encrypted-tbn0.gstatic.com	businessbureau.co.za
5	2

This site contains no links.

Subject Issuer	Validity	Valid
businessbureau.co.za cPanel, Inc. Certification Authority	`2018-07-23` - `2018-10-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
Frame ID: 8F7D4903C4A2EBF924C817CF1F797A9A
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

5
Requests

80 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

24 kB
Transfer

26 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set viewer.php Show response
businessbureau.co.za/zv1/mi/products/ 4 KB
2 KB 404ms
185ms Document
text/html 170.10.160.51
Steadfast

General

Check archive.org

Show headers Download Go to

Full URL: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 170.10.160.51 Spokane, United States, ASN32748 (STEADFAST - Steadfast, US),
Reverse DNS: mediaxtreme.co.za
Software: Apache /
Resource Hash: f91687fd1dd5844432045b157a4ca809e0a68c359f16bc5ae489f220d6be6f50

Request headers

Host: businessbureau.co.za
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 8F7D4903C4A2EBF924C817CF1F797A9A

Response headers

Date: Thu, 02 Aug 2018 05:50:37 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=cpcm1oe1l3p1fobk56j1ak18k3; path=/
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 1949
Keep-Alive: timeout=5, max=150
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.css
businessbureau.co.za/zv1/mi/products/images/ 2 KB
876 B 171ms
170ms Stylesheet
text/css 170.10.160.51
Steadfast

General

Check archive.org

Show headers Download Go to

Full URL: https://businessbureau.co.za/zv1/mi/products/images/style.css
Requested by: Host: businessbureau.co.za
URL: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 170.10.160.51 Spokane, United States, ASN32748 (STEADFAST - Steadfast, US),
Reverse DNS: mediaxtreme.co.za
Software: Apache /
Resource Hash: 07cf6945dbcb431ccd3eedf930ecde159aaf75110830bea0ba830d44d9e91490

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: businessbureau.co.za
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
Cookie: PHPSESSID=cpcm1oe1l3p1fobk56j1ak18k3
Connection: keep-alive
Cache-Control: no-cache
Referer: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 02 Aug 2018 05:50:37 GMT
Content-Encoding: gzip
Last-Modified: Sun, 27 Jul 2014 20:30:36 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 577

GET
S 200 images
encrypted-tbn0.gstatic.com/ 7 KB
7 KB 36ms
14ms Image
image/png 2a00:1450:4001:81d::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcQi6D31ZeAnIP1_8F5BzAucADUKKWARTvnpQatKWlU21XYS9N0zyA

Requested by

Host: businessbureau.co.za
URL: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com

Protocol

SPDY

Server

2a00:1450:4001:81d::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

e3b9036ad0aade182e6ab5f918f95e6ddded575b961747c0a7f9718f61274321

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Thu, 02 Aug 2018 05:50:37 GMT
x-content-type-options: nosniff
last-modified: Thu, 10 Aug 2017 12:14:58 GMT
server: sffe
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
content-length: 7379
x-xss-protection: 1; mode=block
expires: Fri, 02 Aug 2019 05:50:37 GMT

GET
H/1.1 200
OK postmaster.png
businessbureau.co.za/zv1/mi/hellion/ 5 KB
6 KB 316ms
183ms Image
image/png 170.10.160.51
Steadfast

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://businessbureau.co.za/zv1/mi/hellion/postmaster.png
Requested by: Host: businessbureau.co.za
URL: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 170.10.160.51 Spokane, United States, ASN32748 (STEADFAST - Steadfast, US),
Reverse DNS: mediaxtreme.co.za
Software: Apache /
Resource Hash: 9241453e99644ed913735907d62b2ce5c6ef51c18f0780e95857fc345ba511d3

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: businessbureau.co.za
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
Cookie: PHPSESSID=cpcm1oe1l3p1fobk56j1ak18k3
Connection: keep-alive
Cache-Control: no-cache
Referer: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 02 Aug 2018 05:50:37 GMT
Last-Modified: Thu, 19 Nov 2015 18:18:46 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=148
Content-Length: 5496

GET
H/1.1 404
Not Found Hydrangeas.jpg
businessbureau.co.za/Pictures/ 8 KB
8 KB 1475ms
1291ms Image
text/html 170.10.160.51
Steadfast

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://businessbureau.co.za/Pictures/Hydrangeas.jpg
Requested by: Host: businessbureau.co.za
URL: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 170.10.160.51 Spokane, United States, ASN32748 (STEADFAST - Steadfast, US),
Reverse DNS: mediaxtreme.co.za
Software: Apache /
Resource Hash: 777e8cf12c038fd07a96fb112c414cb7d9bbf2dadd8c4c3bfc5cd73c302bbf5c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: businessbureau.co.za
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
Cookie: PHPSESSID=cpcm1oe1l3p1fobk56j1ak18k3
Connection: keep-alive
Cache-Control: no-cache
Referer: https://businessbureau.co.za/zv1/mi/products/viewer.php?l=_JeHFUq_VJOXK0QWHtoGYDw_Product-UserID&userid=12@qq.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 02 Aug 2018 05:50:37 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Transfer-Encoding: chunked
Connection: Keep-Alive
Link: <https://businessbureau.co.za/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=150
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Postmaster (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

businessbureau.co.za
encrypted-tbn0.gstatic.com
170.10.160.51
2a00:1450:4001:81d::200e
07cf6945dbcb431ccd3eedf930ecde159aaf75110830bea0ba830d44d9e91490
777e8cf12c038fd07a96fb112c414cb7d9bbf2dadd8c4c3bfc5cd73c302bbf5c
9241453e99644ed913735907d62b2ce5c6ef51c18f0780e95857fc345ba511d3
e3b9036ad0aade182e6ab5f918f95e6ddded575b961747c0a7f9718f61274321
f91687fd1dd5844432045b157a4ca809e0a68c359f16bc5ae489f220d6be6f50

businessbureau.co.za Open in urlscan Pro 170.10.160.51 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

24 kBTransfer

26 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

businessbureau.co.za Open in urlscan Pro
170.10.160.51 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

24 kB
Transfer

26 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!