abelusi.co.za Open in urlscan Pro
105.19.57.72  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request .index.html Show response abelusi.co.za/.send/	4 KB 2 KB	796ms 204ms	Document text/html	105.19.57.72 SEACOM-AS
General Check archive.org Show headers Download Go to Full URL https://abelusi.co.za/.send/.index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 105.19.57.72 Johannesburg, South Africa, ASN37100 (SEACOM-AS, MU), Reverse DNS peter.happychappy.com Software Apache / Resource Hash 2b38b492c1223664921d0aa5c01283a128fede14cbfe3d279970a28090bbf7ba Request headers Host abelusi.co.za Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 16 Mar 2021 19:35:09 GMT Server Apache Last-Modified Tue, 16 Mar 2021 18:00:14 GMT Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 1910 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H2	200	bootstrap.min.css stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/	157 KB 21 KB	16ms 15ms	Stylesheet text/css	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css Requested by Host: abelusi.co.za URL: https://abelusi.co.za/.send/.index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://abelusi.co.za Referer https://abelusi.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 16 Mar 2021 19:35:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617 age 4293 cdn-cachedat 2021-03-11 11:57:51 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 08de220a8000004ec7842d5000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 78ab03c8deb9749d33870b1bc84420ce cf-ray 63106c5738dd4ec7-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H/1.1	200 OK	sg-twilio-lockup.svg uiux.s3.amazonaws.com/logo/	4 KB 4 KB	498ms 138ms	Image image/svg+xml	52.216.77.108 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://uiux.s3.amazonaws.com/logo/sg-twilio-lockup.svg Requested by Host: abelusi.co.za URL: https://abelusi.co.za/.send/.index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.77.108 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-1-w.amazonaws.com Software AmazonS3 / Resource Hash 929e88471afd8a6882e29779d1f4175111d92b6180baa86265db6bb90c9f18cd Request headers Referer https://abelusi.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 16 Mar 2021 19:35:12 GMT Last-Modified Fri, 18 Jan 2019 20:14:00 GMT Server AmazonS3 x-amz-request-id 44T365WFCNX79GQ2 ETag "1a6735bc2e300fa20b88a325395e5590" Content-Type image/svg+xml x-amz-version-id 99rRhjNxC9Rz8fzHhVjTuuxhKZ_Y7bho Accept-Ranges bytes Content-Length 3787 x-amz-id-2 u2uGicMgghZP3FEN46PgyQGjIXV+0s66RFn+NfqooYuewK5GMN0SfWPNeNZCsw1KOnBGyYAAvbk=
GET H2	200	jquery-3.5.1.slim.min.js Show response code.jquery.com/	71 KB 24 KB	11ms 10ms	Script application/javascript	2001:4de0:ac18::1:a:3a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.slim.min.js Requested by Host: abelusi.co.za URL: https://abelusi.co.za/.send/.index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db Request headers Origin https://abelusi.co.za Referer https://abelusi.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 16 Mar 2021 19:35:11 GMT content-encoding gzip last-modified Mon, 04 May 2020 23:02:39 GMT server nginx etag W/"5eb09f0f-11abc" vary Accept-Encoding x-hw 1615923311.dop215.fr8.t,1615923311.cds267.fr8.hn,1615923311.cds240.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 24606
GET H2	200	popper.min.js Show response cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/	21 KB 8 KB	91ms 31ms	Script application/javascript	2a04:4e42:4a::621 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js Requested by Host: abelusi.co.za URL: https://abelusi.co.za/.send/.index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:4a::621 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://abelusi.co.za Referer https://abelusi.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff age 3011757 x-cache HIT, HIT cross-origin-resource-policy cross-origin content-length 7503 etag W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q" x-served-by cache-fra19153-FRA, cache-man4133-MAN date Tue, 16 Mar 2021 19:35:11 GMT vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin *
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/	59 KB 14 KB	14ms 14ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js Requested by Host: abelusi.co.za URL: https://abelusi.co.za/.send/.index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://abelusi.co.za Referer https://abelusi.co.za/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 16 Mar 2021 19:35:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617 age 4293 cdn-cachedat 2021-03-11 11:57:52 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 08de220a8000004ec79c3e0000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 917687850c4dee962dd6253b22567466 cf-ray 63106c5738de4ec7-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sendgrid (Online)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap string| email string| my_email number| ind string| my_slice string| c string| final

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abelusi.co.za
cdn.jsdelivr.net
code.jquery.com
stackpath.bootstrapcdn.com
uiux.s3.amazonaws.com
105.19.57.72
2001:4de0:ac18::1:a:3a
2606:4700::6812:acf
2a04:4e42:4a::621
52.216.77.108
2b38b492c1223664921d0aa5c01283a128fede14cbfe3d279970a28090bbf7ba
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
929e88471afd8a6882e29779d1f4175111d92b6180baa86265db6bb90c9f18cd
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f