URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Submission: On January 24 via automatic, source openphish

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 22 HTTP transactions. The main IP is 185.209.160.67, located in and belongs to HOSTING-SOLUTIONS - Hosting Solution Ltd., US. The main domain is dotsecure.cf.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 21st 2019. Valid for: 3 months.
This is the only time dotsecure.cf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ABSA (Banking)

Domain & IP information

IP Address AS Autonomous System
12 185.209.160.67 14576 (HOSTING-S...)
10 169.202.9.74 14115 (AMALGAMAT...)
22 2
Apex Domain
Subdomains
Transfer
12 dotsecure.cf
dotsecure.cf
1 MB
10 absa.co.za
ib.absa.co.za
63 KB
22 2
Domain Requested by
12 dotsecure.cf dotsecure.cf
10 ib.absa.co.za dotsecure.cf
22 2

This site contains links to these domains. Also see Links.

Domain
ib.absa.co.za
www.absa.co.za
www.barclays.com
Subject Issuer Validity Valid
dotsecure.cf
cPanel, Inc. Certification Authority
2019-01-21 -
2019-04-21
3 months crt.sh
ib.absa.co.za
DigiCert SHA2 Extended Validation Server CA
2018-08-14 -
2019-07-04
a year crt.sh

This page contains 1 frames:

Primary Page: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Frame ID: E3009B0B1549CCF0CBBE9A309C6D4627
Requests: 22 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • env /^Raphael$/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

22
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1142 kB
Transfer

1243 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index2.php
dotsecure.cf/jps/absaa/wp-content/cp/
322 KB
322 KB
Document
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
76762251d490ac519fe0bdb95202ee7fdf12a12061deea76187aa8f880d88ed6

Request headers

Host
dotsecure.cf
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
absa.css
ib.absa.co.za/absa-online/static/style/
125 KB
20 KB
Stylesheet
General
Full URL
https://ib.absa.co.za/absa-online/static/style/absa.css?v=0.1.0-2013-10-11-14-37-54
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
f0975b5b48e4b063d3af61d4ed68c913e0962c70341eab089333bf4dedf56b89

Request headers

Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:44 GMT
Content-Encoding
gzip
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Vary
Accept-Encoding,User-Agent
Content-Language
en-US
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
Keep-Alive
Content-Type
text/css
Keep-Alive
timeout=10, max=14
Expires
Sun, 24 Feb 2019 10:53:44 GMT
login.css
ib.absa.co.za/absa-online/static/style/
3 KB
1 KB
Stylesheet
General
Full URL
https://ib.absa.co.za/absa-online/static/style/login.css?v=0.1.0-2013-10-11-14-37-54
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
50a67bf5b7e45c9779dd68140dff2c87c9877e8984bc64d845e99d4e6b58786d

Request headers

Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:44 GMT
Content-Encoding
gzip
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Vary
Accept-Encoding,User-Agent
Content-Language
en-US
Cache-Control
max-age=2678400
Transfer-Encoding
chunked
Connection
Keep-Alive
Content-Type
text/css
Keep-Alive
timeout=10, max=12
Expires
Sun, 24 Feb 2019 10:53:44 GMT
backbase.js
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
255 KB
256 KB
Script
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/backbase.js
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
7c3001abae8540d4d87da6796f56812d702ec61a8b7c3bb2fd967729a80ea6c1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
261431
absa-all-base.js
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
289 KB
289 KB
Script
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/absa-all-base.js
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
9438da458b05b442162ce297d583972a12ca23b076b2265a88ffcd6934469e95

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
296043
login.js
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
15 KB
15 KB
Script
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/login.js
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
65d43dece9520e9928f64cfcfdd1144bedcf04c3c07931167d6509b3d4110b2d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
14877
absa.js
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
3 KB
3 KB
Script
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/absa.js
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
1617f9443945fdd7e3ff09558dbc3e5ecfaf2e24bb6daf56d170913a3ee136d7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3249
absa-logo.png
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
1 KB
2 KB
Image
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/absa-logo.png
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
5270d1e68e98cfb0e1fceb021ff3f134293994a7800c36920186137e4b98e0f2

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1404
ao-logo2.png
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
10 KB
10 KB
Image
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/ao-logo2.png
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
3f596c191ddbe25572cfb3ace361b84724d6dd5ac3a486ed5cbbfde21865163f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
10395
05-Calculators.jpg
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
63 KB
63 KB
Image
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/05-Calculators.jpg
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
9e5cfd255a795d0db11d44b5c21c2c5fd7e1333767d19b30d4d1e621c0da0599

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
64643
APB2.jpg
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
20 KB
20 KB
Image
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/APB2.jpg
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
ee8f5af250e7df71b88df4ed3c0244096f7b16408053555d46a02d5130c3bf01

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
20294
Switch.jpg
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
31 KB
31 KB
Image
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/Switch.jpg
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
470d3d86466c5596997c962ca9846195d997724a66a500e6b007c1cbe9eccd42

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
31736
Secmon_eng.jpg
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
64 KB
64 KB
Image
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/Secmon_eng.jpg
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
ca557e0f61a59f2511a11104bde0080ba24e6de61587b8d6e48356cff4701c08

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
65375
barclays_logo.gif
dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/
3 KB
3 KB
Image
General
Full URL
https://dotsecure.cf/jps/absaa/wp-content/cp/Absa%20Online_files/barclays_logo.gif
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.209.160.67 -, , ASN14576 (HOSTING-SOLUTIONS - Hosting Solution Ltd., US),
Reverse DNS
customer.clientshostname.com
Software
Apache /
Resource Hash
0cb3310e567959fcfdf1c25b93415a638f43ddc9bfffb1bb92d402fddd358aee

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
dotsecure.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Connection
keep-alive
Cache-Control
no-cache
Referer
https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:56:09 GMT
Last-Modified
Thu, 17 Oct 2013 06:50:56 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
2932
main-navigation-rounded-2018.gif
ib.absa.co.za/absa-online/static/style/resources/
100 B
401 B
Image
General
Full URL
https://ib.absa.co.za/absa-online/static/style/resources/main-navigation-rounded-2018.gif
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
9f8e9f22e07c69671b529f27fbd307da8409f499fc844e686a1efe81aa74de45

Request headers

Referer
https://ib.absa.co.za/absa-online/static/style/absa.css?v=0.1.0-2013-10-11-14-37-54
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:45 GMT
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Content-Language
en-US
Cache-Control
max-age=2678400
Connection
Keep-Alive
Content-Type
image/gif
Keep-Alive
timeout=10, max=13
Content-Length
100
Expires
Sun, 24 Feb 2019 10:53:45 GMT
sprite-titlebar-no-gradients-2018.png
ib.absa.co.za/absa-online/static/style/resources/
621 B
922 B
Image
General
Full URL
https://ib.absa.co.za/absa-online/static/style/resources/sprite-titlebar-no-gradients-2018.png
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
a0bfd5bef65c754b35599a259b2aa7373857a385802d705f090ea4fef18470be

Request headers

Referer
https://ib.absa.co.za/absa-online/static/style/absa.css?v=0.1.0-2013-10-11-14-37-54
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:45 GMT
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Content-Language
en-US
Cache-Control
max-age=2678400
Connection
Keep-Alive
Content-Type
image/png
Keep-Alive
timeout=10, max=11
Content-Length
621
Expires
Sun, 24 Feb 2019 10:53:45 GMT
sprite-dividers.gif
ib.absa.co.za/absa-online/static/style/resources/
289 B
590 B
Image
General
Full URL
https://ib.absa.co.za/absa-online/static/style/resources/sprite-dividers.gif
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
c27aee2360a4554999091c3f4acbe28c3e0badb1484d2aee914e1d8b4f7ace1f

Request headers

Referer
https://ib.absa.co.za/absa-online/static/style/absa.css?v=0.1.0-2013-10-11-14-37-54
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:45 GMT
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Content-Language
en-US
Cache-Control
max-age=2678400
Connection
Keep-Alive
Content-Type
image/gif
Keep-Alive
timeout=10, max=11
Content-Length
289
Expires
Sun, 24 Feb 2019 10:53:45 GMT
sprite-corners-rounded.png
ib.absa.co.za/absa-online/static/style/resources/
246 B
547 B
Image
General
Full URL
https://ib.absa.co.za/absa-online/static/style/resources/sprite-corners-rounded.png
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
6a1423dcdc9a531df9d5dfc5a1ea720eec868eda0a56e1580a0c71c69e79b8fe

Request headers

Referer
https://ib.absa.co.za/absa-online/static/style/absa.css?v=0.1.0-2013-10-11-14-37-54
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:45 GMT
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Content-Language
en-US
Cache-Control
max-age=2678400
Connection
Keep-Alive
Content-Type
image/png
Keep-Alive
timeout=10, max=16
Content-Length
246
Expires
Sun, 24 Feb 2019 10:53:45 GMT
gadget-bg.png
ib.absa.co.za/absa-online/static/style/resources/
23 KB
24 KB
Image
General
Full URL
https://ib.absa.co.za/absa-online/static/style/resources/gadget-bg.png
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
1a26395eab756d476a44492edba11fbb4dfe44d42ed1599f04fdef5ea18ac954

Request headers

Referer
https://ib.absa.co.za/absa-online/static/style/absa.css?v=0.1.0-2013-10-11-14-37-54
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:45 GMT
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Content-Language
en-US
Cache-Control
max-age=2678400
Connection
Keep-Alive
Content-Type
image/png
Keep-Alive
timeout=10, max=14
Content-Length
23889
Expires
Sun, 24 Feb 2019 10:53:45 GMT
gadget-login-bg.png
ib.absa.co.za/absa-online/static/style/resources/
13 KB
13 KB
Image
General
Full URL
https://ib.absa.co.za/absa-online/static/style/resources/gadget-login-bg.png
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
3d9062add3a3419de36dac8b09af9960e412c570e256cbe5ca6c0910b30d9aef

Request headers

Referer
https://ib.absa.co.za/absa-online/static/style/login.css?v=0.1.0-2013-10-11-14-37-54
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:45 GMT
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Content-Language
en-US
Cache-Control
max-age=2678400
Connection
Keep-Alive
Content-Type
image/png
Keep-Alive
timeout=10, max=17
Content-Length
13337
Expires
Sun, 24 Feb 2019 10:53:45 GMT
button.png
ib.absa.co.za/absa-online/static/style/resources/
491 B
792 B
Image
General
Full URL
https://ib.absa.co.za/absa-online/static/style/resources/button.png
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
ada2e972abcb9493c9b709ce52c1b2122b0320a9ec37d4c5ca13a132dfda11e1

Request headers

Referer
https://ib.absa.co.za/absa-online/static/style/absa.css?v=0.1.0-2013-10-11-14-37-54
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:45 GMT
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Content-Language
en-US
Cache-Control
max-age=2678400
Connection
Keep-Alive
Content-Type
image/png
Keep-Alive
timeout=10, max=10
Content-Length
491
Expires
Sun, 24 Feb 2019 10:53:45 GMT
buttonArrowWhite.png
ib.absa.co.za/absa-online/static/style/resources/
1 KB
1 KB
Image
General
Full URL
https://ib.absa.co.za/absa-online/static/style/resources/buttonArrowWhite.png
Requested by
Host: dotsecure.cf
URL: https://dotsecure.cf/jps/absaa/wp-content/cp/index2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
169.202.9.74 Johannesburg, South Africa, ASN14115 (AMALGAMATED-BSA, ZA),
Reverse DNS
ib.absa.co.za
Software
/
Resource Hash
dbdc69769919eb9de6942ac447a2b029681b71b36c0154e7bee12977063b1f42

Request headers

Referer
https://ib.absa.co.za/absa-online/static/style/absa.css?v=0.1.0-2013-10-11-14-37-54
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 24 Jan 2019 10:53:45 GMT
Last-Modified
Fri, 18 Jan 2019 14:30:48 GMT
Content-Language
en-US
Cache-Control
max-age=2678400
Connection
Keep-Alive
Content-Type
image/png
Keep-Alive
timeout=10, max=12
Content-Length
1150
Expires
Sun, 24 Feb 2019 10:53:45 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ABSA (Banking)

41 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| SOAPEnvelope object| JSONRequest function| JSONRequestError object| bb object| portal object| gadgets object| absa function| triggerModal4Body function| absaGadgetTemplate function| onForm1Submit function| doSubmitForm1 function| resetForm1 function| checkEntries2 function| onForm2Submit function| doSubmitForm2 function| resetForm2 function| onForm3Submit function| doSubmitForm3 function| resetForm3 function| onForm4Submit function| doSubmitForm4 function| onForm5Submit function| doSubmitForm5 function| showErrorMessage function| hideErrorMessages function| doMoveForm2Focus function| showHideHelp function| showPasswordTips function| changeLang function| getLanguage object| xhtml object| btl function| oldConvert function| oldGetStyle object| phe function| Raphael undefined| mask undefined| borderFrame

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dotsecure.cf
ib.absa.co.za
169.202.9.74
185.209.160.67
0cb3310e567959fcfdf1c25b93415a638f43ddc9bfffb1bb92d402fddd358aee
1617f9443945fdd7e3ff09558dbc3e5ecfaf2e24bb6daf56d170913a3ee136d7
1a26395eab756d476a44492edba11fbb4dfe44d42ed1599f04fdef5ea18ac954
3d9062add3a3419de36dac8b09af9960e412c570e256cbe5ca6c0910b30d9aef
3f596c191ddbe25572cfb3ace361b84724d6dd5ac3a486ed5cbbfde21865163f
470d3d86466c5596997c962ca9846195d997724a66a500e6b007c1cbe9eccd42
50a67bf5b7e45c9779dd68140dff2c87c9877e8984bc64d845e99d4e6b58786d
5270d1e68e98cfb0e1fceb021ff3f134293994a7800c36920186137e4b98e0f2
65d43dece9520e9928f64cfcfdd1144bedcf04c3c07931167d6509b3d4110b2d
6a1423dcdc9a531df9d5dfc5a1ea720eec868eda0a56e1580a0c71c69e79b8fe
76762251d490ac519fe0bdb95202ee7fdf12a12061deea76187aa8f880d88ed6
7c3001abae8540d4d87da6796f56812d702ec61a8b7c3bb2fd967729a80ea6c1
9438da458b05b442162ce297d583972a12ca23b076b2265a88ffcd6934469e95
9e5cfd255a795d0db11d44b5c21c2c5fd7e1333767d19b30d4d1e621c0da0599
9f8e9f22e07c69671b529f27fbd307da8409f499fc844e686a1efe81aa74de45
a0bfd5bef65c754b35599a259b2aa7373857a385802d705f090ea4fef18470be
ada2e972abcb9493c9b709ce52c1b2122b0320a9ec37d4c5ca13a132dfda11e1
c27aee2360a4554999091c3f4acbe28c3e0badb1484d2aee914e1d8b4f7ace1f
ca557e0f61a59f2511a11104bde0080ba24e6de61587b8d6e48356cff4701c08
dbdc69769919eb9de6942ac447a2b029681b71b36c0154e7bee12977063b1f42
ee8f5af250e7df71b88df4ed3c0244096f7b16408053555d46a02d5130c3bf01
f0975b5b48e4b063d3af61d4ed68c913e0962c70341eab089333bf4dedf56b89