![](/screenshots/8a0790da-1689-44e3-b73d-7536c5b98b66.png)
alpha.thinkcraft.co.za
Open in
urlscan Pro
129.232.138.142
Malicious Activity!
Public Scan
Effective URL: https://alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/singin.php?websrc=5ff501b3b01ce6c0152e3605b9378a77&d...
Submission: On June 03 via api from BE
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on April 13th 2019. Valid for: 3 months.
This is the only time alpha.thinkcraft.co.za was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 68.66.248.14 68.66.248.14 | 55293 (A2HOSTING) (A2HOSTING - A2 Hosting) | |
1 16 | 129.232.138.142 129.232.138.142 | 37153 (HETZNER) (HETZNER) | |
1 | 2620:0:862:ed... 2620:0:862:ed1a::2:b | 14907 (WIKIMEDIA) (WIKIMEDIA - Wikimedia Foundation Inc.) | |
17 | 3 |
ASN55293 (A2HOSTING - A2 Hosting, Inc., US)
PTR: nl1-sr2.supercp.com
www.saservicesdirectory.co.za |
ASN37153 (HETZNER, ZA)
PTR: www115.jnb2.host-h.net
alpha.thinkcraft.co.za |
ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US)
upload.wikimedia.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
thinkcraft.co.za
1 redirects
alpha.thinkcraft.co.za |
377 KB |
1 |
wikimedia.org
upload.wikimedia.org |
7 KB |
1 |
saservicesdirectory.co.za
www.saservicesdirectory.co.za |
370 B |
17 | 3 |
Domain | Requested by | |
---|---|---|
16 | alpha.thinkcraft.co.za |
1 redirects
alpha.thinkcraft.co.za
|
1 | upload.wikimedia.org |
alpha.thinkcraft.co.za
|
1 | www.saservicesdirectory.co.za | |
17 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
saservicesdirectory.co.za Let's Encrypt Authority X3 |
2019-05-23 - 2019-08-21 |
3 months | crt.sh |
alpha.thinkcraft.co.za Let's Encrypt Authority X3 |
2019-04-13 - 2019-07-12 |
3 months | crt.sh |
*.wikipedia.org GlobalSign Organization Validation CA - SHA256 - G2 |
2018-11-08 - 2019-11-22 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/singin.php?websrc=5ff501b3b01ce6c0152e3605b9378a77&dispatched=65&id=977257
Frame ID: C97E0280EE05D81138FB391796ABF161
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/8a0790da-1689-44e3-b73d-7536c5b98b66.png)
Page URL History Show full URLs
- https://www.saservicesdirectory.co.za/language/overrides/simi9e2.php Page URL
-
https://alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/
HTTP 302
https://alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/singin.php?websrc=5ff501b3b01ce6... Page URL
Detected technologies
Detected patterns
- url /\.php(?:$|\?)/i
![](/vendor/wappa/icons/ZURB Foundation.png)
Detected patterns
- html /<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://www.saservicesdirectory.co.za/language/overrides/simi9e2.php Page URL
-
https://alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/
HTTP 302
https://alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/singin.php?websrc=5ff501b3b01ce6c0152e3605b9378a77&dispatched=65&id=977257 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
simi9e2.php
www.saservicesdirectory.co.za/language/overrides/ |
141 B 370 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
singin.php
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/ Redirect Chain
|
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/file/ |
68 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fonts.css
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/file/ |
4 KB 797 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fonts-din.css
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/file/ |
2 KB 823 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KRXCSS.css
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/file/ |
250 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/JS/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shop.css
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/file/ |
2 KB 886 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MENA-bcf981467b5f620115471eaf4113478f65ff8482c72eac977ebfcbf0f6d53c8d.jpg
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/file/ |
327 KB 327 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
450px-Netflix_2014_logo.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/0/0c/Netflix_2014_logo.svg/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.css
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/file/ |
32 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CircularStd-Book.woff
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/f/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flama-light.woff
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/f/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flama-light.ttf
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/f/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CircularStd-Book.ttf
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/f/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ge-ss-two-light.woff
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/f/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ge-ss-two-light.ttf
alpha.thinkcraft.co.za/wp-content/plugins/wp-trim/secu850e/Netflix/f/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| Pace1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
alpha.thinkcraft.co.za/ | Name: PHPSESSID Value: 9dm6qvpi3e92gk9b610h9c3u13 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
alpha.thinkcraft.co.za
upload.wikimedia.org
www.saservicesdirectory.co.za
129.232.138.142
2620:0:862:ed1a::2:b
68.66.248.14
01a258c2778fcbaf6f04ae201001eecc0da2c0e2dfbc94e0403370b28fb92853
2f3114dc0f2276c1eb76806a86f27b1812491837658aba1643ff2878676b2162
3f76205d6492b3c0c8dae4ee27de9ae0a016cea597a3a31d55cac01afd26532c
4cbba1ebb19001b232e9ca75a271ceb1aaa9e87a78d46716c00208e20af20f93
53da5eb0301749c4a8008a43de1f487c7aee6944e79a53e2e5fddaf9d9133043
5b5cc718704634518901a47d9748b628f5f4dc21b850175938cf11a1fb046759
736e6f46e5020f0d1279957c6a9976d99054e801e3fab12e4f5ce291c28ae98e
8c480a265afdbd264e8d86e74cd7d8bdc47cc3b89b8984389b5bef5d5477c8fe
c057d8eacadb653211719047182160ca01a1d39cbe85a9c75f71737109d344f8
ce6dc4b967412a3f0eba3bfa6c71aad6ddfe91c5191d4667ddcb8507031a3acb
ea26e37b3153da4c55e17d3b807a0aa1056516dac9838054bb57a1f03cb69ccc