www.jasminsafaris.co.ke Open in urlscan Pro
167.86.71.214  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set login.php Show response www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/	3 KB 3 KB	611ms 69ms	Document text/html	167.86.71.214 CONTABO
General Check archive.org Show headers Download Go to Full URL https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 167.86.71.214 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS mail.ccehosting.com Software nginx/1.21.1 / Resource Hash 1361f8ab93ccfce82c18a89e1115c56f20a5d84cd17c736db9696a2ffd469e2c Request headers Host www.jasminsafaris.co.ke Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Server nginx/1.21.1 Date Thu, 26 Aug 2021 01:37:34 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=b3eea0339c65d5efaa76c8db7fc243eb; path=/ Vary Accept-Encoding
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.1.3/css/	138 KB 22 KB	15ms 13ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/css/bootstrap.min.css Requested by Host: www.jasminsafaris.co.ke URL: https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.jasminsafaris.co.ke/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Thu, 26 Aug 2021 01:37:35 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617, 617 age 11463474 cdn-cachedat 2021-04-07 13:42:41 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid c4e2a50517521fb2f2f884fd4994ffa4 cf-ray 684955f1e9145cb6-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H/1.1	200 OK	login.css www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/css/	2 KB 2 KB	56ms 55ms	Stylesheet text/css	167.86.71.214 CONTABO
General Check archive.org Show headers Download Go to Full URL https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/css/login.css Requested by Host: www.jasminsafaris.co.ke URL: https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 167.86.71.214 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS mail.ccehosting.com Software nginx/1.21.1 / Resource Hash 35c946cbc580e838b6b3255ee94576ad8c31a741af87ee42a9fc27ccdb852f54 Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host www.jasminsafaris.co.ke Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,*/*;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Cookie PHPSESSID=b3eea0339c65d5efaa76c8db7fc243eb Connection keep-alive Referer https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 26 Aug 2021 01:37:35 GMT Last-Modified Sat, 12 Jan 2019 06:28:36 GMT Server nginx/1.21.1 Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 1965
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:830::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: www.jasminsafaris.co.ke URL: https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.jasminsafaris.co.ke/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Wed, 25 Aug 2021 10:06:01 GMT content-encoding gzip x-content-type-options nosniff age 55894 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 25 Aug 2022 10:06:01 GMT
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/	20 KB 7 KB	13ms 12ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js Requested by Host: www.jasminsafaris.co.ke URL: https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://www.jasminsafaris.co.ke/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Thu, 26 Aug 2021 01:37:35 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 23432 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 6451 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4f71" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Ci9Hc2HpJQPhuoAWXnKZMQqz2bycnbL9G2I7eVbRDocT3NSaQVJwOp7rcjtYG%2FaEMqS5M3Pj6KruLsK1GCLB30tddxy8HBNrbwcAEDM%2FFd%2BrN7Vc8wzyC%2FmKki3x4GLeS6MTdIHjkodwOz3uadnwqoM"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 684955f1ed36dfbb-FRA expires Tue, 16 Aug 2022 01:37:35 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 14 KB	15ms 14ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: www.jasminsafaris.co.ke URL: https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.jasminsafaris.co.ke/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Thu, 26 Aug 2021 01:37:35 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 723, 718, 718 age 11973192 cdn-cachedat 2021-04-07 13:43:28 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 7b4b7b2c6b98c0d88edd457ab5e87569 cf-ray 684955f1e91a5cb6-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H/1.1	200 OK	logo.svg www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/images/	4 KB 4 KB	87ms 54ms	Image image/svg+xml	167.86.71.214 CONTABO
General Check archive.org Show headers Download Go to Show image Full URL https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/images/logo.svg Requested by Host: www.jasminsafaris.co.ke URL: https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 167.86.71.214 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS mail.ccehosting.com Software nginx/1.21.1 / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host www.jasminsafaris.co.ke Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Cache-Control no-cache Sec-Fetch-Dest image Referer https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Cookie PHPSESSID=b3eea0339c65d5efaa76c8db7fc243eb Connection keep-alive Referer https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 26 Aug 2021 01:37:35 GMT Last-Modified Sat, 12 Jan 2019 06:26:02 GMT Server nginx/1.21.1 Vary Accept-Encoding Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 3651
GET H/1.1	200 OK	ellipsis_white.svg www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/images/	915 B 1 KB	86ms 51ms	Image image/svg+xml	167.86.71.214 CONTABO
General Check archive.org Show headers Download Go to Show image Full URL https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/images/ellipsis_white.svg Requested by Host: www.jasminsafaris.co.ke URL: https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 167.86.71.214 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS mail.ccehosting.com Software nginx/1.21.1 / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host www.jasminsafaris.co.ke Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Cache-Control no-cache Sec-Fetch-Dest image Referer https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php Cookie PHPSESSID=b3eea0339c65d5efaa76c8db7fc243eb Connection keep-alive Referer https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 26 Aug 2021 01:37:35 GMT Last-Modified Sat, 12 Jan 2019 06:24:42 GMT Server nginx/1.21.1 Vary Accept-Encoding Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 915
GET H/1.1	200 OK	background.jpg www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/images/	277 KB 277 KB	113ms 73ms	Image image/jpeg	167.86.71.214 CONTABO
General Check archive.org Show headers Download Go to Show image Full URL https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/images/background.jpg Requested by Host: www.jasminsafaris.co.ke URL: https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/css/login.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 167.86.71.214 Nuremberg, Germany, ASN51167 (CONTABO, DE), Reverse DNS mail.ccehosting.com Software nginx/1.21.1 / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host www.jasminsafaris.co.ke Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Cache-Control no-cache Sec-Fetch-Dest image Referer https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/css/login.css Cookie PHPSESSID=b3eea0339c65d5efaa76c8db7fc243eb Connection keep-alive Referer https://www.jasminsafaris.co.ke/International%20Auto%20Logistics,%20LLC/office/assets/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Thu, 26 Aug 2021 01:37:35 GMT Last-Modified Sat, 12 Jan 2019 06:24:42 GMT Server nginx/1.21.1 Connection keep-alive Accept-Ranges bytes Content-Length 283351 Content-Type image/jpeg

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.jasminsafaris.co.ke/	1969-12-31 23:59:59	Name: PHPSESSID Value: b3eea0339c65d5efaa76c8db7fc243eb

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
www.jasminsafaris.co.ke
167.86.71.214
2606:4700::6810:135e
2606:4700::6812:acf
2a00:1450:4001:830::200a
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1361f8ab93ccfce82c18a89e1115c56f20a5d84cd17c736db9696a2ffd469e2c
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
35c946cbc580e838b6b3255ee94576ad8c31a741af87ee42a9fc27ccdb852f54
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e