myemabiz.co.za
Open in
urlscan Pro
162.219.248.247
Malicious Activity!
Public Scan
Effective URL: https://myemabiz.co.za/a/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=de5341b6a54dc7c2d56ba2bfe7b066f831d0fedad86ac6...
Submission: On January 22 via manual from NL
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 30th 2019. Valid for: 3 months.
This is the only time myemabiz.co.za was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 198.23.213.237 198.23.213.237 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
1 2 | 162.219.248.247 162.219.248.247 | 33494 (IHNET) (IHNET) | |
1 | 2606:4700::68... 2606:4700::6811:4104 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:3c01::f0... 2600:3c01::f03c:91ff:fe79:43b | 63949 (LINODE-AP...) (LINODE-AP Linode) | |
3 | 4 |
ASN36352 (AS-COLOCROSSING, US)
PTR: 198-23-213-237-host.colocrossing.com
thewiter.gq |
ASN33494 (IHNET, US)
PTR: mets.unisonplatform.com
myemabiz.co.za |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
myemabiz.co.za
1 redirects
myemabiz.co.za |
274 KB |
2 |
thewiter.gq
2 redirects
thewiter.gq |
481 B |
1 |
jsonip.com
jsonip.com |
487 B |
1 |
cloudflare.com
cdnjs.cloudflare.com |
73 KB |
3 | 4 |
Domain | Requested by | |
---|---|---|
2 | myemabiz.co.za | 1 redirects |
2 | thewiter.gq | 2 redirects |
1 | jsonip.com |
cdnjs.cloudflare.com
|
1 | cdnjs.cloudflare.com |
myemabiz.co.za
|
3 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
myemabiz.co.za cPanel, Inc. Certification Authority |
2019-12-30 - 2020-03-29 |
3 months | crt.sh |
cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
jsonip.com Let's Encrypt Authority X3 |
2019-12-21 - 2020-03-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://myemabiz.co.za/a/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=de5341b6a54dc7c2d56ba2bfe7b066f831d0fedad86ac6e0f468ef3265b86f67178851c6
Frame ID: 60485A828F8CAD22230579C46BA69D82
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://thewiter.gq/a/auth
HTTP 301
https://thewiter.gq/a/auth/ HTTP 302
https://myemabiz.co.za/a/?email= HTTP 303
https://myemabiz.co.za/a/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=de5341b6a54dc7c2d56ba2bfe7... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://thewiter.gq/a/auth
HTTP 301
https://thewiter.gq/a/auth/ HTTP 302
https://myemabiz.co.za/a/?email= HTTP 303
https://myemabiz.co.za/a/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=de5341b6a54dc7c2d56ba2bfe7b066f831d0fedad86ac6e0f468ef3265b86f67178851c6 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
myemabiz.co.za/a/s/ Redirect Chain
|
273 KB 274 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/ |
257 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
182 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
jsonip.com/ |
186 B 487 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| getIPAddress string| x2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
myemabiz.co.za/ | Name: PHPSESSID Value: oqdhu7b6c78pfefa30r34fhbu3 |
|
myemabiz.co.za/a/s | Name: ip11 Value: 2a01:4f8:192:5414::2 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubdomains; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
jsonip.com
myemabiz.co.za
thewiter.gq
162.219.248.247
198.23.213.237
2600:3c01::f03c:91ff:fe79:43b
2606:4700::6811:4104
3d3e50246422508778f9e614b32d8003d0bb8c878381230d2bab946b84864644
55806fd62d8686da5b097c65e7e573824b2cc88531b9283abfd0cc7ca4e26938
8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a
90533edb8c99ef3776d0de40d4552a80a05f1307b98e11a9209aa3a4ce003ce7
9bed3b57942153a390b3ab6ab8af6e20ac83cf4a13ba58b71127695770889065
a1df4f9e13e1c577fe6bf7b2eb000aeaf33265c2338be98417dd6ee42280eed1
b19da3f83b013d4ce0a1b054c31df001fcca42476905e41072d6cf1f2a897080