www.magicpeople.co.za Open in urlscan Pro
154.0.168.117  Malicious Activity! Public Scan

URL: http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Submission: On June 07 via automatic, source openphish

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 154.0.168.117, located in South Africa and belongs to Afrihost, ZA. The main domain is www.magicpeople.co.za.
This is the only time www.magicpeople.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 154.0.168.117 37611 (Afrihost)
1 104.111.251.20 20940 (AKAMAI-ASN1)
1 162.125.32.10 19679 (DROPBOX)
1 66.235.148.129 15224 (OMNITURE)
6 5
Domain Requested by
3 www.magicpeople.co.za www.magicpeople.co.za
1 stats.adobe.com www.magicpeople.co.za
1 dropboxstatic.com www.magicpeople.co.za
1 use.typekit.net www.magicpeople.co.za
6 4

This site contains no links.

Subject Issuer Validity Valid
typekit.net
Symantec Class 3 Secure Server CA - G4
2017-03-20 -
2018-06-19
a year crt.sh
*.dropboxstatic.com
DigiCert SHA2 High Assurance Server CA
2015-04-09 -
2018-04-13
3 years crt.sh

This page contains 1 frames:

Primary Page: http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Frame ID: 7931.1
Requests: 7 HTTP requests in this frame

Screenshot


Page Statistics

6
Requests

33 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

286 kB
Transfer

307 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request 1
  • http://dropboxstatic.com/static/images/brand/spacing-vflgKqAuk.png
  • https://dropboxstatic.com/static/images/brand/spacing-vflgKqAuk.png
Request 2
  • http://stats.adobe.com/b/ss/adbims,adbadobenonacdcprod/1/JS-1.2.3/s94034580999898?AQB=1&ndh=1&t=7%2F5%2F2017%2021%3A21%3A21%203%200&ce=UTF-8&ns=adobecorp&pageName=Account%3AIMS%3AonLoad_SignInForm&...
  • http://stats.adobe.com/b/ss/adbims,adbadobenonacdcprod/1/JS-1.2.3/s94034580999898?AQB=1&pccr=true&vidn=2C9C372885314168-4000012BA0033C8F&&ndh=1&t=7%2F5%2F2017%2021%3A21%3A21%203%200&ce=UTF-8&ns=ado...

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
264 KB
264 KB
Document
General
Full URL
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Protocol
HTTP/1.1
Server
154.0.168.117 , South Africa, ASN37611 (Afrihost, ZA),
Reverse DNS
host2.axxesslocal.co.za
Software
Protected by COMODO WAF /
Resource Hash
63df86a7c826bf03df14ad684db33da42ab350b18b39da5d649f0bd6b57d5b18

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.magicpeople.co.za
Accept-Language
en-US,en;q=0.8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 07 Jun 2017 21:21:18 GMT
Last-Modified
Tue, 06 Jun 2017 06:32:33 GMT
Server
Protected by COMODO WAF
ETag
"da925a-41e1c-55144c8e4d050"
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=100
Content-Length
269852
ath5djs.js
use.typekit.net/
17 KB
7 KB
Script
General
Full URL
https://use.typekit.net/ath5djs.js
Requested by
Host: www.magicpeople.co.za
URL: http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.251.20 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-111-251-20.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
84a682a55476639067d77f642e13093dfbfe57267aa60172c6fac52b538063d7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

:path
/ath5djs.js
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
use.typekit.net
referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
:scheme
https
:method
GET
Referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
server
nginx
status
200 200 OK
date
Wed, 07 Jun 2017 21:21:21 GMT
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=600, stale-while-revalidate=604800
timing-allow-origin
*
content-length
7489
spacing-vflgKqAuk.png
dropboxstatic.com/static/images/brand/
Redirect Chain
  • http://dropboxstatic.com/static/images/brand/spacing-vflgKqAuk.png
  • https://dropboxstatic.com/static/images/brand/spacing-vflgKqAuk.png
15 KB
15 KB
Image
General
Full URL
https://dropboxstatic.com/static/images/brand/spacing-vflgKqAuk.png
Requested by
Host: www.magicpeople.co.za
URL: http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.125.32.10 San Francisco, United States, ASN19679 (DROPBOX - Dropbox, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ab8af4e5a31d7e2bd29be69e7281310d5c3ff0e14d00c3f1cb66457430e3f83e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

:path
/static/images/brand/spacing-vflgKqAuk.png
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
dropboxstatic.com
referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
:scheme
https
:method
GET
Referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

date
Wed, 07 Jun 2017 21:21:22 GMT
x-content-type-options
nosniff
last-modified
Fri, 17 Feb 2017 00:01:17 GMT
server
nginx
etag
"58a63d4d-3c29"
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000 public, immutable
x-dropbox-request-id
cd8467b6d41d2bc73d7e435f9ba98cfb
accept-ranges
bytes
timing-allow-origin
https://www.dropbox.com
content-length
15401
expires
Thu, 31 Dec 2037 23:55:55 GMT

Redirect headers

Location
https://dropboxstatic.com/static/images/brand/spacing-vflgKqAuk.png
Date
Wed, 07 Jun 2017 21:21:21 GMT
Server
nginx
Connection
keep-alive
Content-Length
178
X-Dropbox-Request-Id
99c951400562d4336db2137db1490b92
Content-Type
text/html
Cookie set s94034580999898
stats.adobe.com/b/ss/adbims,adbadobenonacdcprod/1/JS-1.2.3/
Redirect Chain
  • http://stats.adobe.com/b/ss/adbims,adbadobenonacdcprod/1/JS-1.2.3/s94034580999898?AQB=1&ndh=1&t=7%2F5%2F2017%2021%3A21%3A21%203%200&ce=UTF-8&ns=adobecorp&pageName=Account%3AIMS%3AonLoad_SignInForm&...
  • http://stats.adobe.com/b/ss/adbims,adbadobenonacdcprod/1/JS-1.2.3/s94034580999898?AQB=1&pccr=true&vidn=2C9C372885314168-4000012BA0033C8F&&ndh=1&t=7%2F5%2F2017%2021%3A21%3A21%203%200&ce=UTF-8&ns=ado...
43 B
43 B
Image
General
Full URL
http://stats.adobe.com/b/ss/adbims,adbadobenonacdcprod/1/JS-1.2.3/s94034580999898?AQB=1&pccr=true&vidn=2C9C372885314168-4000012BA0033C8F&&ndh=1&t=7%2F5%2F2017%2021%3A21%3A21%203%200&ce=UTF-8&ns=adobecorp&pageName=Account%3AIMS%3AonLoad_SignInForm&g=http%3A%2F%2Fwww.magicpeople.co.za%2Fadd%2Fsap%2Fdpbox%2Fa66e6150c85052577b0bbe38af934fe4%2F&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AIMS%3AonLoad_SignInForm&v13=SignIn&c22=adobe.com&v30=adobedotcom2&s=1600x1200&c=24&j=1.6&v=N&k=N&bw=1598&bh=1132&p=Chrome%20PDF%20Viewer%3BShockwave%20Flash%3BWidevine%20Content%20Decryption%20Module%3BNative%20Client%3B&AQE=1
Requested by
Host: www.magicpeople.co.za
URL: http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Protocol
HTTP/1.1
Server
66.235.148.129 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
*.d1.sc.omtrdc.net
Software
Omniture DC /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
stats.adobe.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Cookie
s_vi=[CS]v1|2C9C372885314168-4000012BA0033C8F[CE]
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 07 Jun 2017 21:21:21 GMT
X-C
ms-5.2.1
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
Pragma
no-cache
Last-Modified
Thu, 08 Jun 2017 21:21:21 GMT
Server
Omniture DC
xserver
www188
ETag
"59386E51-B006-4227F6AD"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Set-Cookie
s_vi=[CS]v1|2C9C372885314168-4000012BA0033C8F[CE]; Expires=Fri, 7 Jun 2019 21:21:21 GMT; Domain=adobe.com; Path=/
Keep-Alive
timeout=15
Expires
Tue, 06 Jun 2017 21:21:21 GMT

Redirect headers

Date
Wed, 07 Jun 2017 21:21:21 GMT
X-C
ms-5.2.1
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
0
Pragma
no-cache
Last-Modified
Thu, 08 Jun 2017 21:21:21 GMT
Server
Omniture DC
xserver
www293
Location
http://stats.adobe.com/b/ss/adbims,adbadobenonacdcprod/1/JS-1.2.3/s94034580999898?AQB=1&pccr=true&vidn=2C9C372885314168-4000012BA0033C8F&&ndh=1&t=7%2F5%2F2017%2021%3A21%3A21%203%200&ce=UTF-8&ns=adobecorp&pageName=Account%3AIMS%3AonLoad_SignInForm&g=http%3A%2F%2Fwww.magicpeople.co.za%2Fadd%2Fsap%2Fdpbox%2Fa66e6150c85052577b0bbe38af934fe4%2F&ch=IMS&c3=services.adobe.com&c4=en_US&c5=en_US%3AAccount%3AIMS%3AonLoad_SignInForm&v13=SignIn&c22=adobe.com&v30=adobedotcom2&s=1600x1200&c=24&j=1.6&v=N&k=N&bw=1598&bh=1132&p=Chrome%20PDF%20Viewer%3BShockwave%20Flash%3BWidevine%20Content%20Decryption%20Module%3BNative%20Client%3B&AQE=1
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Set-Cookie
s_vi=[CS]v1|2C9C372885314168-4000012BA0033C8F[CE]; Expires=Fri, 7 Jun 2019 21:21:21 GMT; Domain=adobe.com; Path=/
Keep-Alive
timeout=15
Expires
Tue, 06 Jun 2017 21:21:21 GMT
truncated
/
11 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ae75f31c2922a0c4ecfe6e5f74904a46d26e7695cdeb93383a029bfa841c7f29

Request headers

Response headers

squarespinner_2x.gif
www.magicpeople.co.za/renga-idprovider/resources/web_v2/img/
375 B
0
Image
General
Full URL
http://www.magicpeople.co.za/renga-idprovider/resources/web_v2/img/squarespinner_2x.gif
Requested by
Host: www.magicpeople.co.za
URL: http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Protocol
HTTP/1.1
Server
154.0.168.117 , South Africa, ASN37611 (Afrihost, ZA),
Reverse DNS
host2.axxesslocal.co.za
Software
Protected by COMODO WAF /
Resource Hash
4403546cef517cb464c7cfa43e4c6170e0e16e35a5879e3aff4bd1b3bd41a6ea

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.magicpeople.co.za
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 07 Jun 2017 21:21:19 GMT
Server
Protected by COMODO WAF
Connection
Keep-Alive
Keep-Alive
timeout=2, max=99
Content-Length
375
Content-Type
text/html; charset=iso-8859-1
favicon.ico
www.magicpeople.co.za/
328 B
328 B
Other
General
Full URL
http://www.magicpeople.co.za/favicon.ico
Protocol
HTTP/1.1
Server
154.0.168.117 , South Africa, ASN37611 (Afrihost, ZA),
Reverse DNS
host2.axxesslocal.co.za
Software
Protected by COMODO WAF /
Resource Hash
6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.magicpeople.co.za
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.magicpeople.co.za/add/sap/dpbox/a66e6150c85052577b0bbe38af934fe4/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Wed, 07 Jun 2017 21:21:20 GMT
Server
Protected by COMODO WAF
Connection
Keep-Alive
Keep-Alive
timeout=2, max=98
Content-Length
328
Content-Type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

1 Console Messages

Source Level URL
Text
console-api error URL: https://use.typekit.net/ath5djs.js(Line 33)
Message:
Typekit: the domain "www.magicpeople.co.za" isn't in the list of published domains for kit "ath5djs".