urlscan.io logo urlscan.io
SecurityTrails logo

heidimanzini.co.za Open in urlscan Pro
160.119.102.110  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://heidimanzini.co.za/zip/ko/acc0unt/komail.php
Submission: On May 06 via manual from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 160.119.102.110, located in South Africa and belongs to MacroLAN, ZA. The main domain is heidimanzini.co.za.
This is the only time heidimanzini.co.za was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 160.119.102.110 37353 (MacroLAN)
1 192.0.72.22 2635 (AUTOMATTIC)
3 2
Domain Requested by
2 heidimanzini.co.za heidimanzini.co.za
1 yahnwagner.files.wordpress.com heidimanzini.co.za
3 2

This site contains no links.

Subject Issuer Validity Valid
*.files.wordpress.com
Sectigo RSA Domain Validation Secure Server CA		 2019-01-15 -
2021-01-14		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://heidimanzini.co.za/zip/ko/acc0unt/komail.php
Frame ID: 4E99C662A6E8885A92929CDE124F96F7
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

3
Requests

33 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

96 kB
Transfer

96 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request komail.php
heidimanzini.co.za/zip/ko/acc0unt/ 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://heidimanzini.co.za/zip/ko/acc0unt/komail.php
Protocol
HTTP/1.1
Server
160.119.102.110 , South Africa, ASN37353 (MacroLAN, ZA),
Reverse DNS
ns1.powerfuldns.net.za
Software
Apache /
Resource Hash
a463f622517f58b491c9a03655e065d7bdfa01e71e4b0ea558ba9e0639ed8b53

Request headers

Host
heidimanzini.co.za
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 10:06:26 GMT
Server
Apache
Content-Encoding
gzip
Vary
Accept-Encoding
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
google_analytics_auto.js
heidimanzini.co.za/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://heidimanzini.co.za/google_analytics_auto.js
Requested by
Host: heidimanzini.co.za
URL: http://heidimanzini.co.za/zip/ko/acc0unt/komail.php
Protocol
HTTP/1.1
Server
160.119.102.110 , South Africa, ASN37353 (MacroLAN, ZA),
Reverse DNS
ns1.powerfuldns.net.za
Software
Apache /
Resource Hash

Request headers

Referer
http://heidimanzini.co.za/zip/ko/acc0unt/komail.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 06 May 2019 10:06:26 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Location
http://ffrirvie.tk/index/?6011555126850
Cache-Control
no-cache, must-revalidate, max-age=0
Transfer-Encoding
chunked
Connection
Keep-Alive
Link
<http://heidimanzini.co.za/wp-json/>; rel="https://api.w.org/"
Keep-Alive
timeout=5, max=100
Expires
Wed, 11 Jan 1984 05:00:00 GMT
logoemail.png
yahnwagner.files.wordpress.com/2015/05/ 		94 KB
95 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yahnwagner.files.wordpress.com/2015/05/logoemail.png
Requested by
Host: heidimanzini.co.za
URL: http://heidimanzini.co.za/zip/ko/acc0unt/komail.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.72.22 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software
nginx /
Resource Hash
4b89616e2a678635916096d9c0995d01703c202e96b6a5efdaf793d05fcb7238

Request headers

Referer
http://heidimanzini.co.za/zip/ko/acc0unt/komail.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nc
HIT fra 22 np
date
Mon, 06 May 2019 10:06:26 GMT
last-modified
Mon, 08 Jun 2015 01:57:39 GMT
server
nginx
x-orig-src
01_mogdir
content-type
image/png
status
200
accept-ranges
bytes
content-length
96547
expires
Fri, 17 May 2019 07:17:54 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

heidimanzini.co.za
yahnwagner.files.wordpress.com
160.119.102.110
192.0.72.22
4b89616e2a678635916096d9c0995d01703c202e96b6a5efdaf793d05fcb7238
a463f622517f58b491c9a03655e065d7bdfa01e71e4b0ea558ba9e0639ed8b53