collarbones.co.za Open in urlscan Pro
156.38.175.59  Malicious Activity! Public Scan

URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml
Submission: On April 23 via manual from US

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 156.38.175.59, located in Johannesburg, South Africa and belongs to xneelo, ZA. The main domain is collarbones.co.za.
TLS certificate: Issued by R3 on February 26th 2021. Valid for: 3 months.
This is the only time collarbones.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Stewart Title (Insurance)

Domain & IP information

IP Address AS Autonomous System
2 156.38.175.59 37153 (xneelo)
3 72.32.60.139 33070 (RMH-14)
1 2a02:26f0:710... 20940 (AKAMAI-ASN1)
6 3
Domain Requested by
3 stewartforeverfarm.com collarbones.co.za
2 collarbones.co.za collarbones.co.za
1 i.pinimg.com collarbones.co.za
6 3

This site contains links to these domains. Also see Links.

Domain
newhomepage.com
Subject Issuer Validity Valid
www.collarbones.co.za
R3
2021-02-26 -
2021-05-27
3 months crt.sh
stewartforeverfarm.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1
2020-12-22 -
2021-12-22
a year crt.sh
*.pinterest.com
DigiCert SHA2 High Assurance Server CA
2020-07-16 -
2021-08-04
a year crt.sh

This page contains 1 frames:

Primary Page: https://collarbones.co.za/ST/stewartforeverfarm.shtml
Frame ID: C165BF0C3DB26402855C52D9A235E0AD
Requests: 6 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

7501 kB
Transfer

7506 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request stewartforeverfarm.shtml
collarbones.co.za/ST/
9 KB
3 KB
Document
General
Full URL
https://collarbones.co.za/ST/stewartforeverfarm.shtml
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
156.38.175.59 Johannesburg, South Africa, ASN37153 (xneelo, ZA),
Reverse DNS
hestia.thishost.co.za
Software
LiteSpeed /
Resource Hash
a00eaf3c3f9854fe78db8b06d5146c93d5e1188fd537b66d4f819af218611bdc

Request headers

:method
GET
:authority
collarbones.co.za
:scheme
https
:path
/ST/stewartforeverfarm.shtml
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type
text/html
content-length
2951
content-encoding
gzip
vary
Accept-Encoding
date
Fri, 23 Apr 2021 14:06:33 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
Stewart%20logo.png
stewartforeverfarm.com/
9 KB
9 KB
Image
General
Full URL
https://stewartforeverfarm.com/Stewart%20logo.png
Requested by
Host: collarbones.co.za
URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
72.32.60.139 , United States, ASN33070 (RMH-14, US),
Reverse DNS
web.realnetsoftware.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
6a652ef5e98f3222ab7f71cc4df69308efe3a5ab1db1b18b6b2518010d16de67

Request headers

Referer
https://collarbones.co.za/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 23 Apr 2021 14:06:34 GMT
Last-Modified
Tue, 02 Mar 2021 23:32:57 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"afb65560bcfd71:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
9020
da3aa7a36976feb8d8db5ad5383382cd.png
i.pinimg.com/originals/da/3a/a7/
21 KB
21 KB
Image
General
Full URL
https://i.pinimg.com/originals/da/3a/a7/da3aa7a36976feb8d8db5ad5383382cd.png
Requested by
Host: collarbones.co.za
URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100:18a::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f02bd85a7434e7d7378ebc4f053cb2c66508fa874a5b2aa07dc77ef6df3d35a1

Request headers

Referer
https://collarbones.co.za/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cache-control
immutable, max-age=31536000
x-cdn
akamai
accept-ranges
bytes
etag
"cd726effd4829e48f880b40e31c485e2"
content-length
21639
vary
Origin
content-type
image/png
login.png
stewartforeverfarm.com/images/
2 KB
2 KB
Image
General
Full URL
https://stewartforeverfarm.com/images/login.png
Requested by
Host: collarbones.co.za
URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
72.32.60.139 , United States, ASN33070 (RMH-14, US),
Reverse DNS
web.realnetsoftware.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
696f06310bca8843f400540ab43c62e5bab6ab7a4e9dbae7596fe8c929a45c75

Request headers

Referer
https://collarbones.co.za/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 23 Apr 2021 14:06:34 GMT
Last-Modified
Thu, 05 Jul 2018 23:17:46 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"b4c22b62b614d41:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
1988
video.mp4
stewartforeverfarm.com/StewartTitle/Video/
7 MB
7 MB
Media
General
Full URL
https://stewartforeverfarm.com/StewartTitle/Video/video.mp4
Requested by
Host: collarbones.co.za
URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
72.32.60.139 , United States, ASN33070 (RMH-14, US),
Reverse DNS
web.realnetsoftware.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

Referer
https://collarbones.co.za/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range
bytes=0-

Response headers

Date
Fri, 23 Apr 2021 14:06:34 GMT
Last-Modified
Fri, 26 Jun 2020 16:33:29 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"d4a61e86d74bd61:0"
Content-Type
video/mp4
Content-Range
bytes 0-7633705/7633706
Accept-Ranges
bytes
Content-Length
7633706
bgEmpire.jpg
collarbones.co.za/ST/StewartTitle/images/StewartTitle/
10 KB
10 KB
Image
General
Full URL
https://collarbones.co.za/ST/StewartTitle/images/StewartTitle/bgEmpire.jpg
Requested by
Host: collarbones.co.za
URL: https://collarbones.co.za/ST/stewartforeverfarm.shtml
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
156.38.175.59 Johannesburg, South Africa, ASN37153 (xneelo, ZA),
Reverse DNS
hestia.thishost.co.za
Software
LiteSpeed /
Resource Hash
4b553e31ec79c9cdfc4f45047667e3e3c8891a089edd058ab8a970c8ebc88a58

Request headers

:path
/ST/StewartTitle/images/StewartTitle/bgEmpire.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
collarbones.co.za
referer
https://collarbones.co.za/ST/stewartforeverfarm.shtml
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://collarbones.co.za/ST/stewartforeverfarm.shtml
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 23 Apr 2021 14:06:34 GMT
content-encoding
gzip
server
LiteSpeed
vary
Accept-Encoding
content-type
text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Stewart Title (Insurance)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| vid object| pauseButton function| vidFade object| video object| btn function| myFunction

0 Cookies