afi.ae Open in urlscan Pro
192.185.109.59  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request continue Show response afi.ae/wp-includes/main/	15 KB 11 KB	2554ms 1187ms	Document text/html	192.185.109.59 NETWORK-SOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://afi.ae/wp-includes/main/continue Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.109.59 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US), Reverse DNS 192-185-109-59.unifiedlayer.com Software Apache / Resource Hash 43c412f54626d9f35bd333575decf7bbef35c6e2079c997c525d8da6c242d45a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 10692 content-type text/html; charset=UTF-8 date Fri, 19 May 2023 07:05:01 GMT expect-ct enforce, max-age=21600 expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache referrer-policy no-referrer server Apache strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding x-content-type-options nosniff x-frame-options sameorigin x-xss-protection 1; mode=block
GET H2	404	recaptcha__id.js www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/	0 0	341ms 293ms	Script text/html	2404:6800:4004:823::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__id.js Requested by Host: afi.ae URL: https://afi.ae/wp-includes/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer Origin https://afi.ae accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Fri, 19 May 2023 07:05:02 GMT x-content-type-options nosniff server sffe content-type text/html; charset=UTF-8 access-control-allow-origin * cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1621 x-xss-protection 0
GET H2	200	api.js Show response www.google.com/recaptcha/	850 B 877 B	83ms 44ms	Script text/javascript	2404:6800:4004:823::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: afi.ae URL: https://afi.ae/wp-includes/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:823::2004 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash f4de494b6cfd42ce31b244cd84410cd4259d82773485f6c7b4ffd2a7ca2d6217 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Fri, 19 May 2023 07:05:02 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 557 x-xss-protection 1; mode=block expires Fri, 19 May 2023 07:05:02 GMT
GET H/1.1	200 OK	index.815c601ede0bda3f6d4b.css accounts.scdn.co/css/	280 KB 49 KB	12ms 2ms	Stylesheet text/css	2a04:4e42:1a::760 FASTLY
General Check archive.org Show headers Download Go to Full URL https://accounts.scdn.co/css/index.815c601ede0bda3f6d4b.css Requested by Host: afi.ae URL: https://afi.ae/wp-includes/main/continue Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1a::760 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 48de22287159c16b74c7cfd12421abfef4a284848129434aa1805a1a9acf0f40 Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Fri, 19 May 2023 07:05:02 GMT Content-Encoding gzip Age 848247 x-amz-meta-goog-reserved-file-mtime 1551867855 X-Cache HIT, HIT x-goog-metageneration 1 x-goog-stored-content-encoding identity Connection keep-alive Content-Length 49311 X-Served-By cache-chi-kigq8000093-CHI, cache-tyo11972-TYO Last-Modified Wed, 06 Mar 2019 10:24:23 GMT ETag "cef7c640274beae0e4bb740e11be8ee3" x-goog-generation 1551867863234713 Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=31536000, no-transform x-goog-stored-content-length 286521 Accept-Ranges bytes X-Cache-Hits 55, 1
GET H2	404	recaptcha__fr.js www.gstatic.com/recaptcha/api2/v1550471573786/	0 0	76ms 39ms	Script text/html	2404:6800:4004:823::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/api2/v1550471573786/recaptcha__fr.js Requested by Host: afi.ae URL: https://afi.ae/wp-includes/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers
GET H2	200	analytics.js Show response www.google-analytics.com/	51 KB 21 KB	112ms 3ms	Script text/javascript	2404:6800:4004:810::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: afi.ae URL: https://afi.ae/wp-includes/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:810::200e , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Fri, 19 May 2023 05:21:32 GMT last-modified Mon, 17 Apr 2023 22:36:01 GMT server Golfe2 age 6210 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20737 expires Fri, 19 May 2023 07:21:32 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.1.1/	85 KB 30 KB	48ms 3ms	Script text/javascript	2404:6800:4004:80c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js Requested by Host: afi.ae URL: https://afi.ae/wp-includes/main/continue Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:80c::200a , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Sat, 13 May 2023 12:08:43 GMT content-encoding gzip x-content-type-options nosniff age 500179 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30244 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sun, 12 May 2024 12:08:43 GMT
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/releases/FFtxPnbuZxq6kkeHkQJR2MNQ/	408 KB 163 KB	4ms 4ms	Script text/javascript	2404:6800:4004:823::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/FFtxPnbuZxq6kkeHkQJR2MNQ/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:823::2003 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ad5008998005064af73229fb144d5f8e789641f8a846e2064ec18788a37e9e2d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer Origin https://afi.ae accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Mon, 15 May 2023 13:32:26 GMT content-encoding gzip x-content-type-options nosniff age 322356 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 166637 x-xss-protection 0 last-modified Mon, 15 May 2023 04:00:52 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Tue, 14 May 2024 13:32:26 GMT
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3ffac94b04d10b7a680d0111c0ea6b11b812ee80d240e30658de4e80bbbf824b Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	circular-book.woff2 sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/	68 KB 69 KB	95ms 2ms	Font font/woff2	151.101.1.194 FASTLY
General Check archive.org Show headers Download Go to Full URL https://sp-bootstrap.global.ssl.fastly.net/8.3.0/fonts/circular-book.woff2 Requested by Host: accounts.scdn.co URL: https://accounts.scdn.co/css/index.815c601ede0bda3f6d4b.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.194 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d Request headers Referer https://accounts.scdn.co/ Origin https://afi.ae accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Fri, 19 May 2023 07:05:02 GMT Age 4999930 x-amz-meta-goog-reserved-file-mtime 1541621104 X-Cache HIT, HIT x-goog-metageneration 1 x-goog-stored-content-encoding identity Connection keep-alive Content-Length 70092 X-Served-By cache-chi-klot8100075-CHI, cache-tyo11921-TYO Last-Modified Mon, 21 Mar 2022 12:56:32 GMT ETag "c4f753e765823b94234e7f5ccd733f44" x-goog-generation 1647867392860779 Content-Type font/woff2 Access-Control-Allow-Origin * Cache-Control max-age=86400 x-goog-stored-content-length 70092 Accept-Ranges bytes X-Cache-Hits 65, 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Emirates NBD (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| $ function| jQuery object| google_tag_data function| ga object| gaplugins object| recaptcha

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			afi.ae/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8ad85c6ba9e8e9d01624a8137a42aae6

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.gstatic.com/recaptcha/api2/v1550471573786/recaptcha__fr.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__id.js Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://afi.ae/wp-includes/main/continue Message: Refused to execute script from 'https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__id.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://afi.ae/wp-includes/main/continue Message: Refused to execute script from 'https://www.gstatic.com/recaptcha/releases/CHIHFAf1bjFPOjwwi5Xa4cWR/recaptcha__id.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.scdn.co
afi.ae
ajax.googleapis.com
sp-bootstrap.global.ssl.fastly.net
www.google-analytics.com
www.google.com
www.gstatic.com
151.101.1.194
192.185.109.59
2404:6800:4004:80c::200a
2404:6800:4004:810::200e
2404:6800:4004:823::2003
2404:6800:4004:823::2004
2a04:4e42:1a::760
3ffac94b04d10b7a680d0111c0ea6b11b812ee80d240e30658de4e80bbbf824b
43c412f54626d9f35bd333575decf7bbef35c6e2079c997c525d8da6c242d45a
48de22287159c16b74c7cfd12421abfef4a284848129434aa1805a1a9acf0f40
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
ad5008998005064af73229fb144d5f8e789641f8a846e2064ec18788a37e9e2d
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
f4de494b6cfd42ce31b244cd84410cd4259d82773485f6c7b4ffd2a7ca2d6217