URL: http://www.mabas.co.za/CONFIRMATION/off365auths.php
Submission: On July 18 via manual from IN — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 102.221.100.86, located in Gauteng, South Africa and belongs to Gigawave-Solutions, ZA. The main domain is www.mabas.co.za.
This is the only time www.mabas.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

IP Address AS Autonomous System
4 102.221.100.86 328785 (Gigawave-...)
4 1
Apex Domain
Subdomains
Transfer
4 mabas.co.za
www.mabas.co.za
211 KB
4 1
Domain Requested by
4 www.mabas.co.za www.mabas.co.za
4 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://www.mabas.co.za/CONFIRMATION/off365auths.php
Frame ID: CDA679AF5A1BE6B69EAA3359639AE8C9
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Sign In

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

211 kB
Transfer

225 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request off365auths.php
www.mabas.co.za/CONFIRMATION/
15 KB
4 KB
Document
General
Full URL
http://www.mabas.co.za/CONFIRMATION/off365auths.php
Protocol
HTTP/1.1
Server
102.221.100.86 Gauteng, South Africa, ASN328785 (Gigawave-Solutions, ZA),
Reverse DNS
Software
Apache/2 /
Resource Hash
3175032de9b31bab9f10b952b1d9e7d66fd1319652041603eaa3bc740ec1d91c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Upgrade, Keep-Alive
Content-Encoding
gzip
Content-Length
4195
Content-Type
text/html; charset=UTF-8
Date
Tue, 18 Jul 2023 01:01:47 GMT
Keep-Alive
timeout=2, max=100
Server
Apache/2
Upgrade
h2,h2c
Vary
Accept-Encoding,User-Agent
s2.css
www.mabas.co.za/CONFIRMATION/sssc/
8 KB
3 KB
Stylesheet
General
Full URL
http://www.mabas.co.za/CONFIRMATION/sssc/s2.css
Requested by
Host: www.mabas.co.za
URL: http://www.mabas.co.za/CONFIRMATION/off365auths.php
Protocol
HTTP/1.1
Server
102.221.100.86 Gauteng, South Africa, ASN328785 (Gigawave-Solutions, ZA),
Reverse DNS
Software
Apache/2 /
Resource Hash
c3b6bd9acf94e5a9956a51cc34b487bea53c6b224496681ed4c105347a77cbf0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.mabas.co.za/CONFIRMATION/off365auths.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 18 Jul 2023 01:01:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 11 Jul 2019 11:49:28 GMT
Server
Apache/2
ETag
"1e87-58d6662d72200-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=99
Content-Length
2376
jjjjj.png
www.mabas.co.za/CONFIRMATION/sssc/
4 KB
5 KB
Image
General
Full URL
http://www.mabas.co.za/CONFIRMATION/sssc/jjjjj.png
Requested by
Host: www.mabas.co.za
URL: http://www.mabas.co.za/CONFIRMATION/off365auths.php
Protocol
HTTP/1.1
Server
102.221.100.86 Gauteng, South Africa, ASN328785 (Gigawave-Solutions, ZA),
Reverse DNS
Software
Apache/2 /
Resource Hash
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.mabas.co.za/CONFIRMATION/off365auths.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 18 Jul 2023 01:01:47 GMT
Last-Modified
Thu, 11 Jul 2019 11:49:28 GMT
Server
Apache/2
ETag
"11e9-58d6662d72200"
Upgrade
h2,h2c
Content-Type
image/png
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=100
Content-Length
4585
ghjhhhh.png
www.mabas.co.za/CONFIRMATION/sssc/
199 KB
199 KB
Image
General
Full URL
http://www.mabas.co.za/CONFIRMATION/sssc/ghjhhhh.png
Protocol
HTTP/1.1
Server
102.221.100.86 Gauteng, South Africa, ASN328785 (Gigawave-Solutions, ZA),
Reverse DNS
Software
Apache/2 /
Resource Hash
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.mabas.co.za/CONFIRMATION/off365auths.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 18 Jul 2023 01:01:47 GMT
Last-Modified
Thu, 11 Jul 2019 11:49:28 GMT
Server
Apache/2
ETag
"31a1e-58d6662d72200"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=99
Content-Length
203294

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration

0 Cookies