innovationmediadesign.co.za

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 154.0.171.91, located in South Africa and belongs to Afrihost, ZA. The main domain is innovationmediadesign.co.za.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 25th 2021. Valid for: 3 months.

This is the only time innovationmediadesign.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.237.47.157 34.237.47.157	14618 (AMAZON-AES) (AMAZON-AES)
4	154.0.171.91 154.0.171.91	37611 (Afrihost) (Afrihost)
4	1

1 34.237.47.157 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-237-47-157.compute-1.amazonaws.com

shared.outlook.inky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 154.0.171.91 (South Africa)

ASN37611 (Afrihost, ZA)
PTR: taymacmedia.dedicated.co.za

innovationmediadesign.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	innovationmediadesign.co.za innovationmediadesign.co.za	8 KB
1	inky.com 1 redirects shared.outlook.inky.com	533 B
4	2

	Domain	Requested by
4	innovationmediadesign.co.za	innovationmediadesign.co.za
1	shared.outlook.inky.com	1 redirects
4	2

This site contains links to these domains. Also see Links.

Domain
privacy.microsoft.com
go.microsoft.com

Subject Issuer	Validity	Valid
innovationmediadesign.co.za cPanel, Inc. Certification Authority	`2021-10-25` - `2022-01-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://innovationmediadesign.co.za/wespay/Authenticationpage/
Frame ID: B9A43E2BDA42A2CBFA352EA3A0816ED1
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Authentification de messages chiffrés

Page URL History Show full URLs

https://shared.outlook.inky.com/link?domain=innovationmediadesign.co.za&t=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1Ni... HTTP 303
https://innovationmediadesign.co.za/wespay/Authenticationpage/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

8 kB
Transfer

13 kB
Size

2
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://privacy.microsoft.com/en-us/privacystatement
Title: Confidentiality declaration

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?linkid=2121428
Title: Accessibility: partially compliant

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://shared.outlook.inky.com/link?domain=innovationmediadesign.co.za&t=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eJxVUE1vgkAU_C97NqIGDiUxkdaWlAS4YC2GxDzgCQu7C9ldUGj637va9NDrvPl4M19EI3BaEpfArVM5iJYsCBUapQBG3AswhQuC5t7mtGgvnSx3V1Q9TMtOVoZ7l_4DBml0pNa6V25mZRYVohtB005wLCmUqGgllkW3nCGzfpWZ5Q26RqFp8SD2UGFmGa_4QFwxMLYgupYI-sxwRGO_Nj_eg9PPeiw2QZ1zNRb-muHxYypWzzX6T3PK3waYnCbfrMbQP0xh4k2n5HAN9559SgIe771bnKRzdHx3Ts2rEydBE83pGBos3rfXsGmd-MW2o2q7vddSKM_IgbIzlKVEpUx-z3FCqXZ_25lanHz_AED5drk.MEUCIH6FRHOJ9oW9cuTdM3P4BIPnfF8Xdbsh4hBOe_wyIkggAiEAuzH4qD4062kYTa18BuXDJx5LDMxy0FDWNKfTcdf4l0Q HTTP 303
https://innovationmediadesign.co.za/wespay/Authenticationpage/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
innovationmediadesign.co.za/wespay/Authenticationpage/
Redirect Chain

https://shared.outlook.inky.com/link?domain=innovationmediadesign.co.za&t=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eJxVUE1vgkAU_C97NqIGDiUxkdaWlAS4YC2GxDzgCQu7C9ldUGj637va9NDrvPl4M19EI3BaEpfArVM5iJYsCB...
https://innovationmediadesign.co.za/wespay/Authenticationpage/

6 KB
2 KB

1316ms
194ms

Document
text/html

154.0.171.91
Afrihost

General

Check archive.org

Show headers Download Go to

Full URL

https://innovationmediadesign.co.za/wespay/Authenticationpage/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

154.0.171.91 , South Africa, ASN37611 (Afrihost, ZA),

Reverse DNS

taymacmedia.dedicated.co.za

Software

nginx /

Resource Hash

1949c8d01aaed4777ed4971d62ae5547e36e6f30337a05e3e995cb4bd61ee5e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
date: Tue, 07 Dec 2021 19:58:01 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: MISS
x-server-powered-by: Engintron
content-encoding: gzip

Redirect headers

date: Tue, 07 Dec 2021 19:58:00 GMT
content-type: text/html
location: https://innovationmediadesign.co.za/wespay/Authenticationpage/
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains;
x-xss-protection: 1; mode=block
x-robots-tag: noindex, nofollow

GET
H2 200 authentication.css
innovationmediadesign.co.za/wespay/Authenticationpage/sources/ 3 KB
1 KB 197ms
197ms Stylesheet
text/css 154.0.171.91
Afrihost

General

Check archive.org

Show headers Download Go to

Full URL

https://innovationmediadesign.co.za/wespay/Authenticationpage/sources/authentication.css

Requested by

Host: innovationmediadesign.co.za
URL: https://innovationmediadesign.co.za/wespay/Authenticationpage/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

154.0.171.91 , South Africa, ASN37611 (Afrihost, ZA),

Reverse DNS

taymacmedia.dedicated.co.za

Software

nginx /

Resource Hash

08a857eeec64d9c6b3ece76762eed837929e0e6f8a29d1315a04d38c3053b4b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://innovationmediadesign.co.za/wespay/Authenticationpage/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 19:58:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 29 Oct 2021 02:33:44 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
expires: Thu, 06 Jan 2022 19:58:01 GMT
cache-control: max-age=2592000
x-server-powered-by: Engintron
x-xss-protection: 1; mode=block
x-nginx-upstream-cache-status: MISS

GET
H2 200 lock.png
innovationmediadesign.co.za/wespay/Authenticationpage/sources/ 1 KB
1 KB 201ms
201ms Image
image/png 154.0.171.91
Afrihost

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://innovationmediadesign.co.za/wespay/Authenticationpage/sources/lock.png

Requested by

Host: innovationmediadesign.co.za
URL: https://innovationmediadesign.co.za/wespay/Authenticationpage/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

154.0.171.91 , South Africa, ASN37611 (Afrihost, ZA),

Reverse DNS

taymacmedia.dedicated.co.za

Software

nginx /

Resource Hash

55400220f8792e5146328487b0dbbb259a3f558e8fd51f2b445a5ddb6bc1608e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://innovationmediadesign.co.za/wespay/Authenticationpage/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 19:58:01 GMT
x-content-type-options: nosniff
last-modified: Fri, 29 Oct 2021 02:33:44 GMT
server: nginx
content-type: image/png
expires: Sat, 05 Feb 2022 19:58:01 GMT
cache-control: max-age=5184000
x-server-powered-by: Engintron
accept-ranges: bytes
content-length: 1100
x-xss-protection: 1; mode=block
x-nginx-upstream-cache-status: MISS

GET
H2 200 liveid.png
innovationmediadesign.co.za/wespay/Authenticationpage/sources/ 3 KB
3 KB 199ms
199ms Image
image/png 154.0.171.91
Afrihost

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://innovationmediadesign.co.za/wespay/Authenticationpage/sources/liveid.png

Requested by

Host: innovationmediadesign.co.za
URL: https://innovationmediadesign.co.za/wespay/Authenticationpage/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

154.0.171.91 , South Africa, ASN37611 (Afrihost, ZA),

Reverse DNS

taymacmedia.dedicated.co.za

Software

nginx /

Resource Hash

da7b1e7c0e95a9caba46be191f562268cee236556f67e4b10f2b3a05785b9cad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://innovationmediadesign.co.za/wespay/Authenticationpage/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 07 Dec 2021 19:58:01 GMT
x-content-type-options: nosniff
last-modified: Fri, 29 Oct 2021 02:33:44 GMT
server: nginx
content-type: image/png
expires: Sat, 05 Feb 2022 19:58:01 GMT
cache-control: max-age=5184000
x-server-powered-by: Engintron
accept-ranges: bytes
content-length: 2955
x-xss-protection: 1; mode=block
x-nginx-upstream-cache-status: MISS

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			shared.outlook.inky.com/	1970-01-19 23:25:11	Name: AWSALB Value: fe9/eCbwy6SDMKIk6GxsYvP7ERaw4Z2GAoSekSkg3Fc1RqtzT1fOW4QsXCwKGl/Mh1pJy9RJyoDBsjDQjZkXBCPFnMceBigv1MyY0tabB7R0rfCG1knQOxEhUUEP
			shared.outlook.inky.com/	1970-01-19 23:25:11	Name: AWSALBCORS Value: fe9/eCbwy6SDMKIk6GxsYvP7ERaw4Z2GAoSekSkg3Fc1RqtzT1fOW4QsXCwKGl/Mh1pJy9RJyoDBsjDQjZkXBCPFnMceBigv1MyY0tabB7R0rfCG1knQOxEhUUEP

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

innovationmediadesign.co.za
shared.outlook.inky.com
154.0.171.91
34.237.47.157
08a857eeec64d9c6b3ece76762eed837929e0e6f8a29d1315a04d38c3053b4b6
1949c8d01aaed4777ed4971d62ae5547e36e6f30337a05e3e995cb4bd61ee5e8
55400220f8792e5146328487b0dbbb259a3f558e8fd51f2b445a5ddb6bc1608e
da7b1e7c0e95a9caba46be191f562268cee236556f67e4b10f2b3a05785b9cad

innovationmediadesign.co.za Open in urlscan Pro 154.0.171.91 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

8 kBTransfer

13 kBSize

2 Cookies

2 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

innovationmediadesign.co.za Open in urlscan Pro
154.0.171.91 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

8 kB
Transfer

13 kB
Size

2
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!