dffg.co.za Open in urlscan Pro
102.177.158.46  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index2.htm Show response dffg.co.za/adobes/0d592756bce5ed711a3d4bb2fd79b4b0/	206 KB 206 KB	474ms 453ms	Document text/html	102.177.158.46 EvoNet-AS
General Check archive.org Show headers Download Go to Full URL http://dffg.co.za/adobes/0d592756bce5ed711a3d4bb2fd79b4b0/index2.htm Protocol HTTP/1.1 Server 102.177.158.46 Johannesburg, South Africa, ASN328239 (EvoNet-AS, ZA), Reverse DNS Software Apache / Resource Hash 48b2204223fd99f48c6efc0776bbaed5b679fdddb3820772f543f12056084b0d Request headers Host dffg.co.za Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 18 Sep 2019 00:24:55 GMT Server Apache Last-Modified Tue, 03 Sep 2019 16:15:58 GMT Accept-Ranges bytes Content-Length 211203 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H2	200	ath5djs.js Show response use.typekit.net/	19 KB 7 KB	121ms 40ms	Script text/javascript	104.109.64.186 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/ath5djs.js Requested by Host: dffg.co.za URL: http://dffg.co.za/adobes/0d592756bce5ed711a3d4bb2fd79b4b0/index2.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.64.186 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-109-64-186.deploy.static.akamaitechnologies.com Software nginx / Resource Hash 1ea40ab24141f710f3f1a789b3156a1ee167218f01245d68ec2386d71236b3ff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers Sec-Fetch-Mode no-cors Referer http://dffg.co.za/adobes/0d592756bce5ed711a3d4bb2fd79b4b0/index2.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip server nginx status 200 date Wed, 18 Sep 2019 00:24:57 GMT vary Accept-Encoding content-type text/javascript;charset=utf-8 access-control-allow-origin * cache-control public, max-age=600, stale-while-revalidate=604800 timing-allow-origin * content-length 7400
GET H2	200	l use.typekit.net/af/cb695f/000000000000000000017701/27/	29 KB 29 KB	113ms 38ms	Font application/font-woff2	104.109.64.186 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?subset_id=2&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/ath5djs.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.64.186 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-109-64-186.deploy.static.akamaitechnologies.com Software nginx / Resource Hash 8b7eb699aedbbf4d04907b45f4348e6b54119a6567b4b9f1be4943ba80c5af19 Request headers Sec-Fetch-Mode cors Referer http://dffg.co.za/adobes/0d592756bce5ed711a3d4bb2fd79b4b0/index2.htm Origin http://dffg.co.za User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Sep 2019 00:24:57 GMT server nginx etag "fae41ba404dda76663c7e537ab5cab2de69de329" status 200 content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 timing-allow-origin * content-length 29924
GET H2	200	l use.typekit.net/af/eaf09c/000000000000000000017703/27/	29 KB 30 KB	141ms 66ms	Font application/font-woff2	104.109.64.186 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?subset_id=2&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/ath5djs.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.64.186 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-109-64-186.deploy.static.akamaitechnologies.com Software nginx / Resource Hash b97b6df8ca413ee1df0b9cc4dcccbf40bd8539ec54ede0bf9efd06cd94175e04 Request headers Sec-Fetch-Mode cors Referer http://dffg.co.za/adobes/0d592756bce5ed711a3d4bb2fd79b4b0/index2.htm Origin http://dffg.co.za User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Sep 2019 00:24:57 GMT server nginx etag "43c835b2f5dd7a9e7fea805e0e9631e337d18a90" status 200 content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 timing-allow-origin * content-length 29988
GET H2	200	l use.typekit.net/af/40207f/0000000000000000000176ff/27/	29 KB 29 KB	159ms 85ms	Font application/font-woff2	104.109.64.186 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?subset_id=2&fvd=n3&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/ath5djs.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.64.186 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-109-64-186.deploy.static.akamaitechnologies.com Software nginx / Resource Hash 683d777e2f11e4a19371359c4bf66b2d0c861aa9a561e6c257a4c49804694e35 Request headers Sec-Fetch-Mode cors Referer http://dffg.co.za/adobes/0d592756bce5ed711a3d4bb2fd79b4b0/index2.htm Origin http://dffg.co.za User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Sep 2019 00:24:57 GMT server nginx etag "fd4970a0ef1a58daf4039ec623a0f43c55c4f6d2" status 200 content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 timing-allow-origin * content-length 29756
GET DATA	200 OK	truncated /	36 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d4d7467a56ebdf0abdff0bf413f070c236abe05f480147571a329438e28b799d Request headers Referer http://dffg.co.za/adobes/0d592756bce5ed711a3d4bb2fd79b4b0/index2.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	p.gif p.typekit.net/	35 B 201 B	41ms 40ms	Image image/gif	104.109.64.186 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://p.typekit.net/p.gif?s=1&k=ath5djs&ht=tk&h=dffg.co.za&f=7180.7182.7184&a=1164490&js=1.19.2&app=typekit&e=js&_=1568766297725 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.64.186 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a104-109-64-186.deploy.static.akamaitechnologies.com Software nginx / Resource Hash 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39 Request headers Sec-Fetch-Mode no-cors Referer http://dffg.co.za/adobes/0d592756bce5ed711a3d4bb2fd79b4b0/index2.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 18 Sep 2019 00:24:57 GMT last-modified Mon, 04 Feb 2019 20:25:20 GMT server nginx etag "5c589fb0-23" status 200 content-type image/gif access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes content-length 35 expires Tue, 07 May 2019 18:30:39 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| Typekit string| special_day_char function| css_browser_selector function| Visitor function| AppMeasurement function| s_gi function| s_pgicq number| CSSBS number| CSSBS_webkit number| CSSBS_chrome number| CSSBS_mac number| CSSBS_js number| CSSBS_portrait object| html5 object| Modernizr function| yepnope number| s_objectID number| s_giq object| adobeid_only_domains

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dffg.co.za
p.typekit.net
use.typekit.net
102.177.158.46
104.109.64.186
1ea40ab24141f710f3f1a789b3156a1ee167218f01245d68ec2386d71236b3ff
48b2204223fd99f48c6efc0776bbaed5b679fdddb3820772f543f12056084b0d
683d777e2f11e4a19371359c4bf66b2d0c861aa9a561e6c257a4c49804694e35
8b7eb699aedbbf4d04907b45f4348e6b54119a6567b4b9f1be4943ba80c5af19
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
b97b6df8ca413ee1df0b9cc4dcccbf40bd8539ec54ede0bf9efd06cd94175e04
d4d7467a56ebdf0abdff0bf413f070c236abe05f480147571a329438e28b799d