www.michelproduction.co.za

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 129.232.212.210, located in South Africa and belongs to HETZNER, ZA. The main domain is www.michelproduction.co.za.

This is the only time www.michelproduction.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) ABSA (Banking)

Domain & IP information

	IP Address		AS Autonomous System
5	129.232.212.210 129.232.212.210		37153 (HETZNER) (HETZNER)
5	2

5 129.232.212.210 (South Africa)

ASN37153 (HETZNER, ZA)
PTR: ssd5.ampledns.com

www.michelproduction.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	michelproduction.co.za www.michelproduction.co.za	308 KB
5	1

	Domain	Requested by
5	www.michelproduction.co.za	www.michelproduction.co.za
5	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html
Frame ID: F2F2DFF1FB0A2D29A8CFACD9565BCFBA
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

308 kB
Transfer

530 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request absa-login.html Show response www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/	299 KB 299 KB	569ms 205ms	Document text/html	129.232.212.210 HETZNER
General Check archive.org Show headers Download Go to Full URL http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html Protocol HTTP/1.1 Server 129.232.212.210 , South Africa, ASN37153 (HETZNER, ZA), Reverse DNS ssd5.ampledns.com Software Apache / Resource Hash `242d923874aa3059ca2585d3af5482c43492ded7e2ce146708f9d10be937d0dc` Request headers Host www.michelproduction.co.za Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id F2F2DFF1FB0A2D29A8CFACD9565BCFBA Response headers Date Fri, 27 Jul 2018 17:53:57 GMT Server Apache Last-Modified Thu, 26 Jul 2018 12:33:32 GMT Accept-Ranges bytes Content-Length 306395 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	style1.css www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/css/	2 KB 3 KB	198ms 197ms	Stylesheet text/css	129.232.212.210 HETZNER
General Check archive.org Show headers Download Go to Full URL http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/css/style1.css Requested by Host: www.michelproduction.co.za URL: http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html Protocol HTTP/1.1 Server 129.232.212.210 , South Africa, ASN37153 (HETZNER, ZA), Reverse DNS ssd5.ampledns.com Software Apache / Resource Hash `f1b8d65ce07c5f4f8b5f1387ee86b14e6212bc49d92b5b163572a3d6b4f16fd2` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.michelproduction.co.za User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html Connection keep-alive Cache-Control no-cache Referer http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 27 Jul 2018 17:53:58 GMT Last-Modified Thu, 26 Jul 2018 12:33:32 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2471
GET H/1.1	200 OK	sign-in.png www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/img/	2 KB 2 KB	202ms 201ms	Image image/png	129.232.212.210 HETZNER
General Check archive.org Show headers Download Go to Show image Full URL http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/img/sign-in.png Requested by Host: www.michelproduction.co.za URL: http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html Protocol HTTP/1.1 Server 129.232.212.210 , South Africa, ASN37153 (HETZNER, ZA), Reverse DNS ssd5.ampledns.com Software Apache / Resource Hash `69846787d70241c44e0a39ae78e4620c5477f9d6f440b270e00ae1d0dcdd48a8` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.michelproduction.co.za User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html Connection keep-alive Cache-Control no-cache Referer http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 27 Jul 2018 17:53:58 GMT Last-Modified Thu, 26 Jul 2018 12:33:32 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1538
GET H/1.1	200 OK	reset.png www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/img/	1 KB 1 KB	200ms 199ms	Image image/png	129.232.212.210 HETZNER
General Check archive.org Show headers Download Go to Show image Full URL http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/img/reset.png Requested by Host: www.michelproduction.co.za URL: http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html Protocol HTTP/1.1 Server 129.232.212.210 , South Africa, ASN37153 (HETZNER, ZA), Reverse DNS ssd5.ampledns.com Software Apache / Resource Hash `a690846d7196c2a103483abdc500656da0cfed80210f09e45d9840ba3802fba4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.michelproduction.co.za User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html Connection keep-alive Cache-Control no-cache Referer http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 27 Jul 2018 17:53:58 GMT Last-Modified Thu, 26 Jul 2018 12:33:32 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1056
GET H/1.1	200 OK	es3.png www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/img/	3 KB 3 KB	376ms 199ms	Image image/png	129.232.212.210 HETZNER
General Check archive.org Show headers Download Go to Show image Full URL http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/img/es3.png Requested by Host: www.michelproduction.co.za URL: http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html Protocol HTTP/1.1 Server 129.232.212.210 , South Africa, ASN37153 (HETZNER, ZA), Reverse DNS ssd5.ampledns.com Software Apache / Resource Hash `acc255443e74441db70f7b0e937814e5a29eff153dfe85d2f3edbf888a60ef41` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host www.michelproduction.co.za User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html Connection keep-alive Cache-Control no-cache Referer http://www.michelproduction.co.za/.a/absa/4553d35af04d70167e3f99bc7a46c6a1/absa-login.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 27 Jul 2018 17:53:59 GMT Last-Modified Thu, 26 Jul 2018 12:33:32 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3189
GET DATA	200 OK	truncated /	223 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `695183d59ededc855458465f3d097477baf1ccb1bf77cc0feb7d5e8fe36b92ff` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) ABSA (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.michelproduction.co.za
129.232.212.210
242d923874aa3059ca2585d3af5482c43492ded7e2ce146708f9d10be937d0dc
695183d59ededc855458465f3d097477baf1ccb1bf77cc0feb7d5e8fe36b92ff
69846787d70241c44e0a39ae78e4620c5477f9d6f440b270e00ae1d0dcdd48a8
a690846d7196c2a103483abdc500656da0cfed80210f09e45d9840ba3802fba4
acc255443e74441db70f7b0e937814e5a29eff153dfe85d2f3edbf888a60ef41
f1b8d65ce07c5f4f8b5f1387ee86b14e6212bc49d92b5b163572a3d6b4f16fd2

www.michelproduction.co.za Open in urlscan Pro 129.232.212.210 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

308 kBTransfer

530 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

www.michelproduction.co.za Open in urlscan Pro
129.232.212.210 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

308 kB
Transfer

530 kB
Size

0
Cookies

5 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!