mirage-group.ca Open in urlscan Pro
185.83.208.90  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request NedMoney~PROFILE~PIN~PASSWORD.htm Show response mirage-group.ca/n1/n1/	84 KB 84 KB	1007ms 214ms	Document text/html	185.83.208.90 MIZ
General Check archive.org Show headers Download Go to Full URL https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.83.208.90 , Iran, Islamic Republic Of, ASN42468 (MIZ, IR), Reverse DNS ns25.mizban.com Software Apache / Resource Hash 110ac134afb2ec9d7fe29d8e31f2ad5aa682115e140eda6e62ff174270aed1e6 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 accept-language en-CA,en;q=0.9 Response headers Accept-Ranges bytes Access-Control-Allow-Headers Content-Type, Authorization Access-Control-Allow-Methods GET,PUT,POST,DELETE Access-Control-Allow-Origin * Connection Keep-Alive Content-Length 85852 Content-Type text/html Date Wed, 15 Feb 2023 06:14:22 GMT Keep-Alive timeout=5, max=100 Last-Modified Wed, 15 Feb 2023 02:27:32 GMT Server Apache
GET H/1.1	200 OK	styles.css mirage-group.ca/n1/n1/styles/	173 KB 173 KB	218ms 218ms	Stylesheet text/css	185.83.208.90 MIZ
General Check archive.org Show headers Download Go to Full URL https://mirage-group.ca/n1/n1/styles/styles.css Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.83.208.90 , Iran, Islamic Republic Of, ASN42468 (MIZ, IR), Reverse DNS ns25.mizban.com Software Apache / Resource Hash 8887a3e0dea10c649e723d160fcac04d7432910580a8c0f2726c0c27ef8ee9cc Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers Date Wed, 15 Feb 2023 06:14:22 GMT Last-Modified Mon, 18 Mar 2019 05:03:40 GMT Server Apache Access-Control-Allow-Methods GET,PUT,POST,DELETE Content-Type text/css Access-Control-Allow-Origin * Connection Keep-Alive Accept-Ranges bytes Access-Control-Allow-Headers Content-Type, Authorization Content-Length 177164 Keep-Alive timeout=5, max=100
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.12.4/	95 KB 34 KB	71ms 21ms	Script text/javascript	2607:f8b0:4006:81e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81e::200a Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers date Wed, 15 Feb 2023 03:11:34 GMT content-encoding gzip x-content-type-options nosniff age 10970 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33951 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 15 Feb 2024 03:11:34 GMT
GET H/1.1	200 OK	s.js Show response mirage-group.ca/n1/n1/scripts/	3 KB 4 KB	250ms 212ms	Script application/javascript	185.83.208.90 MIZ
General Check archive.org Show headers Download Go to Full URL https://mirage-group.ca/n1/n1/scripts/s.js Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.83.208.90 , Iran, Islamic Republic Of, ASN42468 (MIZ, IR), Reverse DNS ns25.mizban.com Software Apache / Resource Hash acdf1b03d040d641805efed8fc0e4ebf873524c2781dcab0ed307710ae792ff9 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers Date Wed, 15 Feb 2023 06:14:23 GMT Last-Modified Mon, 18 Mar 2019 05:03:36 GMT Server Apache Access-Control-Allow-Methods GET,PUT,POST,DELETE Content-Type application/javascript Access-Control-Allow-Origin * Connection Keep-Alive Accept-Ranges bytes Access-Control-Allow-Headers Content-Type, Authorization Content-Length 3343 Keep-Alive timeout=5, max=99
GET H/1.1	200 OK	NedbankIcon.ef111dcaf7b1952d120f.svg secured.nedbank.co.za/	0 0	1648ms 527ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/NedbankIcon.ef111dcaf7b1952d120f.svg Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers
GET H/1.1	200 OK	location-blank-green.4b8e66bca4aac4a2aad6.svg secured.nedbank.co.za/	0 0	1659ms 532ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/location-blank-green.4b8e66bca4aac4a2aad6.svg Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers
GET H/1.1	200 OK	contact-blank-green.a180fba4b897921edd0b.svg secured.nedbank.co.za/	0 0	1679ms 536ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/contact-blank-green.a180fba4b897921edd0b.svg Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers
GET H/1.1	200 OK	NedbankLogin_v2.png secured.nedbank.co.za/assets/png/	100 KB 101 KB	1687ms 540ms	Image image/png	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/assets/png/NedbankLogin_v2.png Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash 354cb0a75fdc0745134b7809a64030764e4b22c5161d679fdd9ad01b4d8386ca Security Headers Name Value Content-Security-Policy default-src * 'self' data: 'unsafe-inline' 'unsafe-eval' * blob:; frame-src 'self' *.nedbank.co.za https://d21ctq9anmk97c.cloudfront.net https://d3rnm236tp90vs.cloudfront.net https://d140zf541n5jhi.cloudfront.net https://aweuw4.advanced-web-analytics.com blob: Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers Pragma no-cache Content-Security-Policy default-src * 'self' data: 'unsafe-inline' 'unsafe-eval' * blob:; frame-src 'self' *.nedbank.co.za https://d21ctq9anmk97c.cloudfront.net https://d3rnm236tp90vs.cloudfront.net https://d140zf541n5jhi.cloudfront.net https://aweuw4.advanced-web-analytics.com blob: Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff Referrer-Policy no-referrer Last-Modified Fri, 02 Dec 2022 09:31:16 GMT Date Wed, 15 Feb 2023 06:14:27 GMT ETag "0a75d3306d91:0" X-Frame-Options DENY Content-Type image/png Cache-Control no-cache, no-store, must-revalidate Accept-Ranges bytes Content-Length 102656 X-XSS-Protection 1; mode=block Expires Wed, 05 Jul 2017 00:00:00 GMT,0
GET H/1.1	404 Not Found	Eye-Show.e1de9570f043be4db21c.svg mirage-group.ca/n1/n1/styles/	315 B 315 B	226ms 225ms	Image text/html	185.83.208.90 MIZ
General Check archive.org Show headers Download Go to Show image Full URL https://mirage-group.ca/n1/n1/styles/Eye-Show.e1de9570f043be4db21c.svg Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/styles/styles.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.83.208.90 , Iran, Islamic Republic Of, ASN42468 (MIZ, IR), Reverse DNS ns25.mizban.com Software Apache / Resource Hash d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/n1/n1/styles/styles.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers Date Wed, 15 Feb 2023 06:14:25 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	FontFont%20-%20MarkPro.12d6724a254d3be629fc.otf mirage-group.ca/n1/n1/fonts/	162 KB 162 KB	209ms 208ms	Font font/otf	185.83.208.90 MIZ
General Check archive.org Show headers Download Go to Full URL https://mirage-group.ca/n1/n1/fonts/FontFont%20-%20MarkPro.12d6724a254d3be629fc.otf Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 185.83.208.90 , Iran, Islamic Republic Of, ASN42468 (MIZ, IR), Reverse DNS ns25.mizban.com Software Apache / Resource Hash eaa561f9f8ef5b69bd39e15e332dc3700decacebf48e08b0640ad3a5d8711f65 Request headers Referer https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Origin https://mirage-group.ca accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers Date Wed, 15 Feb 2023 06:14:25 GMT Last-Modified Mon, 18 Mar 2019 05:03:46 GMT Server Apache Access-Control-Allow-Methods GET,PUT,POST,DELETE Content-Type font/otf Access-Control-Allow-Origin * Connection Keep-Alive Accept-Ranges bytes Access-Control-Allow-Headers Content-Type, Authorization Content-Length 165396 Keep-Alive timeout=5, max=98
GET H/1.1	200 OK	contact-footer.ff0deb4d99b5c501e332.svg secured.nedbank.co.za/	0 0	2411ms 271ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/contact-footer.ff0deb4d99b5c501e332.svg Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers
GET H/1.1	200 OK	location-blank.e36d304f8628a21886d3.svg secured.nedbank.co.za/	0 0	2684ms 540ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/location-blank.e36d304f8628a21886d3.svg Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers
GET H/1.1	200 OK	phoneicon.d20aa97e94487e70b840.svg secured.nedbank.co.za/	0 0	1590ms 520ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/phoneicon.d20aa97e94487e70b840.svg Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers
GET H/1.1	200 OK	tncs.04b64534a4bbcb7c2676.svg secured.nedbank.co.za/	0 0	1598ms 521ms	Image text/html	168.142.204.82 IS
General Check archive.org Show headers Download Go to Show image Full URL https://secured.nedbank.co.za/tncs.04b64534a4bbcb7c2676.svg Requested by Host: mirage-group.ca URL: https://mirage-group.ca/n1/n1/NedMoney~PROFILE~PIN~PASSWORD.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 168.142.204.82 Johannesburg, South Africa, ASN3741 (IS, ZA), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-CA,en;q=0.9 Referer https://mirage-group.ca/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.96 Safari/537.36 Response headers

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nedbank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery function| ajax_jsonp_call function| isNumberKey function| validatePassword function| untouched function| checkPwd string| site_Url

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mirage-group.ca/n1/n1/styles/Eye-Show.e1de9570f043be4db21c.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
mirage-group.ca
secured.nedbank.co.za
168.142.204.82
185.83.208.90
2607:f8b0:4006:81e::200a
110ac134afb2ec9d7fe29d8e31f2ad5aa682115e140eda6e62ff174270aed1e6
354cb0a75fdc0745134b7809a64030764e4b22c5161d679fdd9ad01b4d8386ca
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
8887a3e0dea10c649e723d160fcac04d7432910580a8c0f2726c0c27ef8ee9cc
acdf1b03d040d641805efed8fc0e4ebf873524c2781dcab0ed307710ae792ff9
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaa561f9f8ef5b69bd39e15e332dc3700decacebf48e08b0640ad3a5d8711f65