www.twagen.co.za Open in urlscan Pro
164.160.91.12  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.twagen.co.za/ppl/index.php?country.x=NL&locale.x=en_NL%3E&client=6530c05a77265cadb789d8a77a6997fc Page URL
2. https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	index.php Show response www.twagen.co.za/ppl/	126 B 213 B	703ms 702ms	Document text/html	164.160.91.12 Elitehost
General Check archive.org Show headers Download Go to Full URL https://www.twagen.co.za/ppl/index.php?country.x=NL&locale.x=en_NL%3E&client=6530c05a77265cadb789d8a77a6997fc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 164.160.91.12 Johannesburg, South Africa, ASN328037 (Elitehost, ZA), Reverse DNS cp19-jhb.za-dns.com Software www.fbi.gov / PHP/5.6.40 Resource Hash 8cbb2550274b39178f37ead9e441429e951a3c18db7ede549f9b643689e18bb5 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers :method GET :authority www.twagen.co.za :scheme https :path /ppl/index.php?country.x=NL&locale.x=en_NL%3E&client=6530c05a77265cadb789d8a77a6997fc pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers status 200 x-powered-by PHP/5.6.40 set-cookie PHPSESSID=1qve1j7itl1vf1j3ni9jvsq887; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache content-type text/html; charset=UTF-8 content-length 103 content-encoding br vary Accept-Encoding date Wed, 24 Jul 2019 22:06:52 GMT server www.fbi.gov x-content-type nosniff x_forwarded_for 104.16.77.187 remote_addr 104.16.77.187 host www.fbi.gov origin https://www.fbi.gov referer https://www.fbi.gov x-forwarded-host www.fbi.gov x-forwarded-proto https x-xss-protection 1; mode=block alt-svc quic=":443"; ma=2592000; v="35,39,43,44"
GET H2	200	Primary Request index.php Show response www.twagen.co.za/ppl/	2 KB 1 KB	193ms 193ms	Document text/html	164.160.91.12 Elitehost
General Check archive.org Show headers Download Go to Full URL https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 Requested by Host: www.twagen.co.za URL: https://www.twagen.co.za/ppl/index.php?country.x=NL&locale.x=en_NL%3E&client=6530c05a77265cadb789d8a77a6997fc Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 164.160.91.12 Johannesburg, South Africa, ASN328037 (Elitehost, ZA), Reverse DNS cp19-jhb.za-dns.com Software www.fbi.gov / PHP/5.6.40 Resource Hash d8d9d9e4d8aa786e3714a5036d73394ee16dc3319817a60329c8d0d3476208b1 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers :method GET :authority www.twagen.co.za :scheme https :path /ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 referer https://www.twagen.co.za/ppl/index.php?country.x=NL&locale.x=en_NL%3E&client=6530c05a77265cadb789d8a77a6997fc accept-encoding gzip, deflate, br cookie PHPSESSID=1qve1j7itl1vf1j3ni9jvsq887 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Referer https://www.twagen.co.za/ppl/index.php?country.x=NL&locale.x=en_NL%3E&client=6530c05a77265cadb789d8a77a6997fc Response headers status 200 x-powered-by PHP/5.6.40 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache content-type text/html; charset=UTF-8 content-length 990 content-encoding br vary Accept-Encoding date Wed, 24 Jul 2019 22:06:52 GMT server www.fbi.gov x-content-type nosniff x_forwarded_for 104.16.77.187 remote_addr 104.16.77.187 host www.fbi.gov origin https://www.fbi.gov referer https://www.fbi.gov x-forwarded-host www.fbi.gov x-forwarded-proto https x-xss-protection 1; mode=block alt-svc quic=":443"; ma=2592000; v="35,39,43,44"
GET H2	200	master.css www.twagen.co.za/ppl/assets/css/	32 KB 5 KB	188ms 188ms	Stylesheet text/css	164.160.91.12 Elitehost
General Check archive.org Show headers Download Go to Full URL https://www.twagen.co.za/ppl/assets/css/master.css Requested by Host: www.twagen.co.za URL: https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 164.160.91.12 Johannesburg, South Africa, ASN328037 (Elitehost, ZA), Reverse DNS cp19-jhb.za-dns.com Software www.fbi.gov / Resource Hash 263012469d3314a4978f3dc9f9974ba0e5413a923d9e0fdaa3eb0b62879459d8 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers date Wed, 24 Jul 2019 22:06:52 GMT content-encoding br origin https://www.fbi.gov host www.fbi.gov status 200 x-forwarded-host www.fbi.gov x-forwarded-proto https alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 4742 x-xss-protection 1; mode=block x-content-type nosniff remote_addr 104.16.77.187 last-modified Wed, 22 Mar 2017 12:39:40 GMT server www.fbi.gov x_forwarded_for 104.16.77.187 vary Accept-Encoding content-type text/css cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 31 Jul 2019 22:06:52 GMT
GET H2	200	master.js Show response www.twagen.co.za/ppl/assets/js/	3 KB 660 B	192ms 192ms	Script application/javascript	164.160.91.12 Elitehost
General Check archive.org Show headers Download Go to Full URL https://www.twagen.co.za/ppl/assets/js/master.js Requested by Host: www.twagen.co.za URL: https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 164.160.91.12 Johannesburg, South Africa, ASN328037 (Elitehost, ZA), Reverse DNS cp19-jhb.za-dns.com Software www.fbi.gov / Resource Hash 808ba9b9ec55e6440e0cd75ed57a7d34c6f9d4eba35d2d3d6e884948cbec73f2 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers date Wed, 24 Jul 2019 22:06:52 GMT content-encoding br origin https://www.fbi.gov host www.fbi.gov status 200 x-forwarded-host www.fbi.gov x-forwarded-proto https alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 612 x-xss-protection 1; mode=block x-content-type nosniff remote_addr 104.16.77.187 last-modified Mon, 20 Mar 2017 18:22:14 GMT server www.fbi.gov x_forwarded_for 104.16.77.187 vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 31 Jul 2019 22:06:52 GMT
GET H2	200	b64.min.js Show response www.twagen.co.za/ppl/assets/js/	2 KB 618 B	196ms 196ms	Script application/javascript	164.160.91.12 Elitehost
General Check archive.org Show headers Download Go to Full URL https://www.twagen.co.za/ppl/assets/js/b64.min.js Requested by Host: www.twagen.co.za URL: https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 164.160.91.12 Johannesburg, South Africa, ASN328037 (Elitehost, ZA), Reverse DNS cp19-jhb.za-dns.com Software www.fbi.gov / Resource Hash b9986feccdb9b6c99cc338802fad3d6335b3fd5ecdb12ee5b3abed91e0073036 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers date Wed, 24 Jul 2019 22:06:52 GMT content-encoding br origin https://www.fbi.gov host www.fbi.gov status 200 x-forwarded-host www.fbi.gov x-forwarded-proto https alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 570 x-xss-protection 1; mode=block x-content-type nosniff remote_addr 104.16.77.187 last-modified Wed, 22 Mar 2017 12:50:42 GMT server www.fbi.gov x_forwarded_for 104.16.77.187 vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 31 Jul 2019 22:06:52 GMT
GET H2	200	css fonts.googleapis.com/	2 KB 599 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:820::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans Requested by Host: www.twagen.co.za URL: https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash 3af0ae27f1791aea9da60e94e1cf03291881d516c6b62575a8b7a402b96d299c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 24 Jul 2019 22:06:52 GMT server ESF access-control-allow-origin * date Wed, 24 Jul 2019 22:06:52 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43,39" cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin x-xss-protection 0 expires Wed, 24 Jul 2019 22:06:52 GMT
GET H2	200	css fonts.googleapis.com/	3 KB 572 B	15ms 15ms	Stylesheet text/css	2a00:1450:4001:820::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans+Condensed:300 Requested by Host: www.twagen.co.za URL: https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash 7248649b1867bc2fbdbce50bcc87e468f8a55edb242b26028a951ede7520859e Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Wed, 24 Jul 2019 22:06:52 GMT server ESF access-control-allow-origin * date Wed, 24 Jul 2019 22:06:52 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43,39" cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin x-xss-protection 0 expires Wed, 24 Jul 2019 22:06:52 GMT
GET H2	200	logo.svg www.twagen.co.za/ppl/assets/img/	5 KB 2 KB	185ms 185ms	Image image/svg+xml	164.160.91.12 Elitehost
General Check archive.org Show headers Download Go to Show image Full URL https://www.twagen.co.za/ppl/assets/img/logo.svg Requested by Host: www.twagen.co.za URL: https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 164.160.91.12 Johannesburg, South Africa, ASN328037 (Elitehost, ZA), Reverse DNS cp19-jhb.za-dns.com Software www.fbi.gov / Resource Hash f09f6c5b8970779be19412b98e8ce4df8db12777ade87d28d20ef2b2fb92c757 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://www.twagen.co.za/ppl/assets/css/master.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers date Wed, 24 Jul 2019 22:06:52 GMT content-encoding br origin https://www.fbi.gov host www.fbi.gov status 200 x-forwarded-host www.fbi.gov x-forwarded-proto https alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 1795 x-xss-protection 1; mode=block x-content-type nosniff remote_addr 104.16.77.187 last-modified Thu, 16 Mar 2017 20:33:48 GMT server www.fbi.gov x_forwarded_for 104.16.77.187 vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 31 Jul 2019 22:06:52 GMT
GET H2	200	notif.png www.twagen.co.za/ppl/assets/img/	5 KB 5 KB	189ms 189ms	Image image/png	164.160.91.12 Elitehost
General Check archive.org Show headers Download Go to Show image Full URL https://www.twagen.co.za/ppl/assets/img/notif.png Requested by Host: www.twagen.co.za URL: https://www.twagen.co.za/ppl/index.php?country.x=DE&locale.x=en_DE%3E&client=48db65ba9de546c9139f7211387e26e8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 164.160.91.12 Johannesburg, South Africa, ASN328037 (Elitehost, ZA), Reverse DNS cp19-jhb.za-dns.com Software www.fbi.gov / Resource Hash 54436312813c5ba0070898ec0ac998a94e0486d12417a8fa4602cc501a94029e Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://www.twagen.co.za/ppl/assets/css/master.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers date Wed, 24 Jul 2019 22:06:53 GMT origin https://www.fbi.gov host www.fbi.gov status 200 x-forwarded-host www.fbi.gov x-forwarded-proto https alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 4675 x-xss-protection 1; mode=block x-content-type nosniff remote_addr 104.16.77.187 last-modified Fri, 17 Mar 2017 18:52:54 GMT server www.fbi.gov x_forwarded_for 104.16.77.187 content-type image/png cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Wed, 31 Jul 2019 22:06:53 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| logine object| Base64 number| c2 number| c1

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.twagen.co.za/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1qve1j7itl1vf1j3ni9jvsq887

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
www.twagen.co.za
164.160.91.12
2a00:1450:4001:820::200a
263012469d3314a4978f3dc9f9974ba0e5413a923d9e0fdaa3eb0b62879459d8
3af0ae27f1791aea9da60e94e1cf03291881d516c6b62575a8b7a402b96d299c
54436312813c5ba0070898ec0ac998a94e0486d12417a8fa4602cc501a94029e
7248649b1867bc2fbdbce50bcc87e468f8a55edb242b26028a951ede7520859e
808ba9b9ec55e6440e0cd75ed57a7d34c6f9d4eba35d2d3d6e884948cbec73f2
8cbb2550274b39178f37ead9e441429e951a3c18db7ede549f9b643689e18bb5
b9986feccdb9b6c99cc338802fad3d6335b3fd5ecdb12ee5b3abed91e0073036
d8d9d9e4d8aa786e3714a5036d73394ee16dc3319817a60329c8d0d3476208b1
f09f6c5b8970779be19412b98e8ce4df8db12777ade87d28d20ef2b2fb92c757