collarbones.co.za - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 156.38.200.58, located in Johannesburg, South Africa and belongs to xneelo, ZA. The main domain is collarbones.co.za.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 8th 2022. Valid for: 3 months.

This is the only time collarbones.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Stewart Title (Insurance)

Domain & IP information

	IP Address	AS Autonomous System
2	156.38.200.58 156.38.200.58	37153 (xneelo) (xneelo)
3	72.32.60.139 72.32.60.139	33070 (RMH-14) (RMH-14)
1	2a02:26f0:fb:... 2a02:26f0:fb:59b::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	3

2 156.38.200.58 (Johannesburg, South Africa)

ASN37153 (xneelo, ZA)
PTR: hera.thishost.co.za

collarbones.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 72.32.60.139 (United States)

ASN33070 (RMH-14, US)
PTR: web.realnetsoftware.com

stewartforeverfarm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:fb:59b::1931 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

i.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	stewartforeverfarm.com stewartforeverfarm.com	11 KB
2	collarbones.co.za collarbones.co.za	13 KB
1	pinimg.com i.pinimg.com — Cisco Umbrella Rank: 669	21 KB
6	3

	Domain	Requested by
3	stewartforeverfarm.com	collarbones.co.za
2	collarbones.co.za	collarbones.co.za
1	i.pinimg.com	collarbones.co.za
6	3

This site contains links to these domains. Also see Links.

Domain
newhomepage.com

Subject Issuer	Validity	Valid
collarbones.co.za cPanel, Inc. Certification Authority	`2022-01-08` - `2022-04-08`	3 months	crt.sh
stewartforeverfarm.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2021-09-17` - `2022-09-17`	a year	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-26` - `2022-08-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://collarbones.co.za/ST/stewartforeverfarm.shtml
Frame ID: 06B2A1B842764948A4D973693DF0F8E7
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Stewart Title | Log In

Page Statistics

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

46 kB
Transfer

403 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: http://newhomepage.com/
Title: Website Design and Website Hosting by Custom Software Creators NewHomePage.com

Search URL Search Domain Scan URL

URL: http://newhomepage.com/Terms-of-Service.pdf
Title: Terms Of Use

Search URL Search Domain Scan URL

URL: http://newhomepage.com/Cookie-Policy.pdf
Title: Cookie Policy |

Search URL Search Domain Scan URL

URL: http://newhomepage.com/California-Privacy.pdf
Title: California Privacy Policy

Search URL Search Domain Scan URL

URL: http://newhomepage.com/Nevada-Privacy.pdf
Title: Nevada Privacy Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request stewartforeverfarm.shtml Show response collarbones.co.za/ST/	9 KB 3 KB	1333ms 315ms	Document text/html	156.38.200.58 xneelo
General Check archive.org Show headers Download Go to Full URL https://collarbones.co.za/ST/stewartforeverfarm.shtml Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 156.38.200.58 Johannesburg, South Africa, ASN37153 (xneelo, ZA), Reverse DNS hera.thishost.co.za Software LiteSpeed / Resource Hash `a00eaf3c3f9854fe78db8b06d5146c93d5e1188fd537b66d4f819af218611bdc` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html content-length 2951 content-encoding gzip vary Accept-Encoding date Mon, 17 Jan 2022 10:21:18 GMT server LiteSpeed alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET H/1.1	200 OK	Stewart%20logo.png stewartforeverfarm.com/	9 KB 9 KB	1026ms 261ms	Image image/png	72.32.60.139 RMH-14
General Check archive.org Show headers Download Go to Show image Full URL https://stewartforeverfarm.com/Stewart%20logo.png Requested by Host: collarbones.co.za URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 72.32.60.139 , United States, ASN33070 (RMH-14, US), Reverse DNS web.realnetsoftware.com Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `6a652ef5e98f3222ab7f71cc4df69308efe3a5ab1db1b18b6b2518010d16de67` Request headers Accept-Language de-DE,de;q=0.9 Referer https://collarbones.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 17 Jan 2022 10:21:20 GMT Last-Modified Tue, 02 Mar 2021 23:32:57 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "afb65560bcfd71:0" Content-Type image/png Accept-Ranges bytes Content-Length 9020
GET H2	200	da3aa7a36976feb8d8db5ad5383382cd.png i.pinimg.com/originals/da/3a/a7/	21 KB 21 KB	769ms 659ms	Image image/png	2a02:26f0:fb:59b::1931 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://i.pinimg.com/originals/da/3a/a7/da3aa7a36976feb8d8db5ad5383382cd.png Requested by Host: collarbones.co.za URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:fb:59b::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash `f02bd85a7434e7d7378ebc4f053cb2c66508fa874a5b2aa07dc77ef6df3d35a1` Request headers Accept-Language de-DE,de;q=0.9 Referer https://collarbones.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-cdn akamai akamai-grn 0.8499645f.1642414879.a854ddb etag "cd726effd4829e48f880b40e31c485e2" vary Origin content-type image/png cache-control immutable, max-age=31536000 accept-ranges bytes content-length 21639
GET H/1.1	200 OK	login.png stewartforeverfarm.com/images/	2 KB 2 KB	897ms 131ms	Image image/png	72.32.60.139 RMH-14
General Check archive.org Show headers Download Go to Show image Full URL https://stewartforeverfarm.com/images/login.png Requested by Host: collarbones.co.za URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 72.32.60.139 , United States, ASN33070 (RMH-14, US), Reverse DNS web.realnetsoftware.com Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `696f06310bca8843f400540ab43c62e5bab6ab7a4e9dbae7596fe8c929a45c75` Request headers Accept-Language de-DE,de;q=0.9 Referer https://collarbones.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Mon, 17 Jan 2022 10:21:20 GMT Last-Modified Thu, 05 Jul 2018 23:17:46 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "b4c22b62b614d41:0" Content-Type image/png Accept-Ranges bytes Content-Length 1988
GET H2	404	bgEmpire.jpg collarbones.co.za/ST/StewartTitle/images/StewartTitle/	10 KB 10 KB	293ms 293ms	Image text/html	156.38.200.58 xneelo
General Check archive.org Show headers Download Go to Show image Full URL https://collarbones.co.za/ST/StewartTitle/images/StewartTitle/bgEmpire.jpg Requested by Host: collarbones.co.za URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 156.38.200.58 Johannesburg, South Africa, ASN37153 (xneelo, ZA), Reverse DNS hera.thishost.co.za Software LiteSpeed / Resource Hash `91fbd5a9967c47f12e230177315a93e7ddcf2bf1b169f85ce130f6db223ea878` Request headers Accept-Language de-DE,de;q=0.9 Referer https://collarbones.co.za/ST/stewartforeverfarm.shtml User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Mon, 17 Jan 2022 10:21:19 GMT content-encoding gzip server LiteSpeed vary Accept-Encoding content-type text/html
GET H/1.1	206 Partial Content	video.mp4 stewartforeverfarm.com/StewartTitle/Video/	352 KB 0	1135ms 386ms	Media video/mp4	72.32.60.139 RMH-14
General Check archive.org Show headers Download Go to Full URL https://stewartforeverfarm.com/StewartTitle/Video/video.mp4 Requested by Host: collarbones.co.za URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 72.32.60.139 , United States, ASN33070 (RMH-14, US), Reverse DNS web.realnetsoftware.com Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Referer https://collarbones.co.za/ Accept-Encoding identity;q=1, ;q=0 Accept-Language* de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Range bytes=0- Response headers Date Mon, 17 Jan 2022 10:21:20 GMT Last-Modified Fri, 26 Jun 2020 16:33:29 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "d4a61e86d74bd61:0" Content-Type video/mp4 Content-Range bytes 0-7633705/7633706 Accept-Ranges bytes Content-Length 7633706

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Stewart Title (Insurance)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://collarbones.co.za/ST/StewartTitle/images/StewartTitle/bgEmpire.jpg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

collarbones.co.za
i.pinimg.com
stewartforeverfarm.com
156.38.200.58
2a02:26f0:fb:59b::1931
72.32.60.139
696f06310bca8843f400540ab43c62e5bab6ab7a4e9dbae7596fe8c929a45c75
6a652ef5e98f3222ab7f71cc4df69308efe3a5ab1db1b18b6b2518010d16de67
91fbd5a9967c47f12e230177315a93e7ddcf2bf1b169f85ce130f6db223ea878
a00eaf3c3f9854fe78db8b06d5146c93d5e1188fd537b66d4f819af218611bdc
f02bd85a7434e7d7378ebc4f053cb2c66508fa874a5b2aa07dc77ef6df3d35a1

collarbones.co.za Open in urlscan Pro 156.38.200.58 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

46 kBTransfer

403 kBSize

0 Cookies

5 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

collarbones.co.za Open in urlscan Pro
156.38.200.58 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

46 kB
Transfer

403 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!