urlscan.io logo urlscan.io
SecurityTrails logo

ai.safetywallet.co.za Open in urlscan Pro
41.72.156.162  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ai.safetywallet.co.za/
Effective URL: https://ai.safetywallet.co.za/wlai.php
Submission: On June 04 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 41.72.156.162, located in South Africa and belongs to xneelo, ZA. The main domain is ai.safetywallet.co.za.
TLS certificate: Issued by R3 on June 4th 2024. Valid for: 3 months.
This is the only time ai.safetywallet.co.za was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 41.72.156.162 37153 (xneelo)
2 2606:4700::68... 13335 (CLOUDFLAR...)
5 94.130.111.77 24940 (HETZNER-AS)
9 3
Apex Domain
Subdomains		 Transfer
5 ohsonline.co.za
fhushik.ohsonline.co.za
44 KB
3 safetywallet.co.za
ai.safetywallet.co.za
15 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 426
53 KB
9 3
Domain Requested by
5 fhushik.ohsonline.co.za ai.safetywallet.co.za
fhushik.ohsonline.co.za
3 ai.safetywallet.co.za 1 redirects
2 cdn.jsdelivr.net ai.safetywallet.co.za
9 3

This site contains links to these domains. Also see Links.

Domain
www.mysafetyshop.co.za
Subject Issuer Validity Valid
ai.safetywallet.co.za
R3		 2024-06-04 -
2024-09-02		 3 months crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA		 2024-05-04 -
2025-05-04		 a year crt.sh
fhushik.ohsonline.co.za
R3		 2024-04-06 -
2024-07-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ai.safetywallet.co.za/wlai.php
Frame ID: F504665326C1B482F54D658645614698
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login

Page URL History Show full URLs

  1. https://ai.safetywallet.co.za/ HTTP 302
    https://ai.safetywallet.co.za/wlai.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

9
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

111 kB
Transfer

369 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ai.safetywallet.co.za/ HTTP 302
    https://ai.safetywallet.co.za/wlai.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request wlai.php
ai.safetywallet.co.za/
Redirect Chain
  • https://ai.safetywallet.co.za/
  • https://ai.safetywallet.co.za/wlai.php
878 B
856 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ai.safetywallet.co.za/wlai.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
41.72.156.162 , South Africa, ASN37153 (xneelo, ZA),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
592261e666c8d593f2cafc4e6fe6507a3946284a824a22d21dbd0d1273874545

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
468
Content-Type
text/html; charset=UTF-8
Date
Tue, 04 Jun 2024 09:01:37 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
Pragma
no-cache
Server
Apache/2.4.29 (Ubuntu)
Vary
Accept-Encoding

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Tue, 04 Jun 2024 09:01:37 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Location
/wlai.php
Pragma
no-cache
Server
Apache/2.4.29 (Ubuntu)
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap/dist/css/ 		227 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap/dist/css/bootstrap.min.css
Requested by
Host: ai.safetywallet.co.za
URL: https://ai.safetywallet.co.za/wlai.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c8f27e6009ccfd710a905e6dcf12d0ee3c6f2ac7da05b0572d3e0d12e736fc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ai.safetywallet.co.za/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 04 Jun 2024 09:01:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
19994
x-jsd-version
5.3.3
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
34908
x-served-by
cache-fra-etou8220110-FRA, cache-lga21940-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"38d63-xawd7pYctZoEUlbsID9p4xeHL3w"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8YdrdedHOwy2fP1xcA88xv%2FIic%2BJUWp2Nd24m95ImvlUDeBep1A4HmNEeUR9NRmWPjPF31idtVaYQhEKRe8UPzsmxuSKQjE%2FdkH7ZnMXFDTfxAsZoqfyfghGVledxPpEaiuITx0lwW6gnIV3e%2BA%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88e6bd540e7239eb-FRA
loginplugin.css
fhushik.ohsonline.co.za/php/api/gw/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fhushik.ohsonline.co.za/php/api/gw/loginplugin.css
Requested by
Host: ai.safetywallet.co.za
URL: https://ai.safetywallet.co.za/wlai.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.130.111.77 Marburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
germox.teacup.co.za
Software
Apache /
Resource Hash
bd5084664a9961749d0e37bd7ffde3eed760d38ddf776d45a301a037d3dc35d7

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ai.safetywallet.co.za/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 04 Jun 2024 09:01:40 GMT
Content-Encoding
gzip
Last-Modified
Tue, 24 Jan 2023 08:46:54 GMT
Server
Apache
ETag
"9a1-5f2fe8eccf12d-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
776
loginplugin.js
fhushik.ohsonline.co.za/php/api/gw/ 		27 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fhushik.ohsonline.co.za/php/api/gw/loginplugin.js
Requested by
Host: ai.safetywallet.co.za
URL: https://ai.safetywallet.co.za/wlai.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.130.111.77 Marburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
germox.teacup.co.za
Software
Apache /
Resource Hash
2d9da5191bc7632d4fa90412dd9cc0d130c16f5fb63b075725b6f54d49f9dae9

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ai.safetywallet.co.za/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 04 Jun 2024 09:01:40 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 May 2024 10:12:07 GMT
Server
Apache
ETag
"6d1d-618a3958790cc-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
4426
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap/dist/js/ 		59 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap/dist/js/bootstrap.min.js
Requested by
Host: ai.safetywallet.co.za
URL: https://ai.safetywallet.co.za/wlai.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de040986d9a3ed89d5d5f9ad6d5727015e9e238c2cd13af8f1b55909386d0864
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ai.safetywallet.co.za/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 04 Jun 2024 09:01:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
10641
x-jsd-version
5.3.3
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
17737
x-served-by
cache-fra-etou8220069-FRA, cache-lga21946-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"ecdb-LGwKWDRaCdN2EjCvgjpOSFKxJkM"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OQgCMIr5PonnsirUWi5%2B8zSpqRNeHcx8%2BsTGihxCMkFsEiLn7dgQFzmrl7RVXez4l5b%2FlQAvk3%2BG1115YriRrS3W4jGWZoVre9oLCXJ9AFL2NeUL7DBkC5olxIWhbpV966foxXFz9i4qhd%2Fs4Rw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88e6bd540e7639eb-FRA
gwclientlogin.php
fhushik.ohsonline.co.za/php/api/gw/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fhushik.ohsonline.co.za/php/api/gw/gwclientlogin.php?referrer=&ul=https://ai.safetywallet.co.za/wlai.php&logintype=6&authmethod=uspasstd&ak=
Requested by
Host: fhushik.ohsonline.co.za
URL: https://fhushik.ohsonline.co.za/php/api/gw/loginplugin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.130.111.77 Marburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
germox.teacup.co.za
Software
Apache /
Resource Hash
d971ed8b94ea2664169b951cc24a7b7f76484df18d7ebbeb5d9d496991c50cc0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ai.safetywallet.co.za/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 04 Jun 2024 09:01:41 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
783
gwauth.php
fhushik.ohsonline.co.za/php/api/gw/ 		191 B
617 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fhushik.ohsonline.co.za/php/api/gw/gwauth.php
Requested by
Host: fhushik.ohsonline.co.za
URL: https://fhushik.ohsonline.co.za/php/api/gw/loginplugin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.130.111.77 Marburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
germox.teacup.co.za
Software
Apache /
Resource Hash
b85906004d2abda9275d490c163101b012a1c6bc9545301a8e1fe82b46abd8de

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform
"Win32"
Referer
https://ai.safetywallet.co.za/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 04 Jun 2024 09:01:41 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Keep-Alive
timeout=5
Content-Length
163
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Walli-Icon-orange-thick.png
ai.safetywallet.co.za/images/ 		14 KB
14 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://ai.safetywallet.co.za/images/Walli-Icon-orange-thick.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
41.72.156.162 , South Africa, ASN37153 (xneelo, ZA),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
58c4c9933cebef0eb1dfb808fa47088122698189cdde6fb795bcb4eb0fc73d65

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ai.safetywallet.co.za/wlai.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 04 Jun 2024 09:01:39 GMT
Last-Modified
Tue, 23 Apr 2024 10:59:19 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"367b-616c17226fbf7"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
13947
WalliLeanForward.png
fhushik.ohsonline.co.za/uploads/fgdfgdfdfgfdg344/html_blobs_media/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fhushik.ohsonline.co.za/uploads/fgdfgdfdfgfdg344/html_blobs_media/WalliLeanForward.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.130.111.77 Marburg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
germox.teacup.co.za
Software
Apache /
Resource Hash
2440607a4714d80b47289a3c2b6de65e52b032c025d665d3557e66f6888a892c

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ai.safetywallet.co.za/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 04 Jun 2024 09:01:41 GMT
Last-Modified
Thu, 30 May 2024 19:09:10 GMT
Server
Apache
ETag
"907d-619b09a188376"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
36989

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| logintype string| authmethod object| xmlhttp string| referrer string| loc number| logintypesend string| authmethodsend function| showtabcontent function| loadprofilepage function| mswsaveglobaldetails function| mswsaveaccountdetails function| buildcouponselector function| mswpopulateaccountdetails function| runpasswordreset function| requestpasswordresetn function| resetpassword function| setmemberscontent function| setloggedinloggedoutitems function| gwlogout function| checkloginstate function| swaccessgranted function| ohsaccessgranted function| walliaccessdenied function| swaccessdenied function| ohsaccessdenied function| runohslogin function| runmswlogin number| uidEvent object| bootstrap

1 Cookies

Domain/Path Name / Value
ai.safetywallet.co.za/ Name: PHPSESSID
Value: fu5mh980vvnh7vgdk1n5m07405

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://ai.safetywallet.co.za/wlai.php
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o