mass.report
Scan Intelligence Report0/100
high Risk
www.alsafwaco.net
https://www.alsafwaco.net/
IP
194.39.149.124 · WHG Hosting Services Ltd
Location
Dallas, United States
Domain Age
4909 days
HTTP
200 · 23.1s
SSL
Valid· R13, Let's Encrypt, US
Status
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Alsafwa I & E
Vendors
30/31
Status
partial
✓ avg✓ avast✓ microsoft✓ polyswarm✓ sophos✓ yandex✓ drweb✗ norton✓ chainpatrol✓ brightcloud✓ apple✓ emsisoft✓ urlquery✓ spamhaus✓ virustotal✓ phishtank✓ eset✓ bitdefender✓ cisa✓ apwg✓ isitphish✓ openphish✓ urlscan✓ phishreport✓ netcraft✓ urlabuse✓ mcafee✓ threatyeti✓ kaspersky✓ google✓ fortiguard
Registered-domain escalation
Submit alsafwaco.net as the primary IOC, enriched with evidence from hostile subdomains like www.alsafwaco.net.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Alsafwa I & E
Unknownecommerce | technology | finance · 7/19/2026
Summary
The page presents Arabic branding for Alsafwa I & E, but the domain www.alsafwaco.net appears to host the site. Visuals show the real brand styling and content related to Alsafwa Import & Export. However, the page includes a login form and credential collection UI within a site that is not obviously the official Alsafwa corporate domain, raising potential impersonation concerns if the domain is misaligned with the legitimate brand. The evidence does show password fields and POST endpoints, but there is no definitive proof of credential harvesting directed at a third-party brand; the presence of login UI and external POST endpoints warrants further review to determine if impersonation or phishing is occurring.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸Content changed across stages: visible text changed materially.
▸Canonical stage contains password collection UI.
▸POST targets observed during capture: https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT, https://www.youtube.com/youtubei/v1/log_event?alt=json.
▸Distinctive asset clues: caption.js, core.js, template.css, css, twitter50.png, facebook50.png.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: Yes
visible text changed materially
Credential Signals
Forms: 2
Password fields: 1
Late-stage login UI: No
Resource Signals
Resources: 153
Hosts: 10
Domains: 8
Suspicious Endpoints
hxxps://www[.]alsafwaco[.]net/index.php/ar/
Observed Signals (1)
POST form targets and potential credential capture UI
Observed Indicators (1)
▸Post-target URL in network data suggesting credential or data submission flow
Risk AssessmentUsed in abuse reports
The site displays Alsafwa branding with Arabic content and appears to be a legitimate page for the brand. However, the presence of a password field and login form on the same page, coupled with POST requests to external endpoints and an iframe embedding YouTube content, creates ambiguity about credential handling and potential data exfiltration. The mixed signals (brand presence vs. suspicious external POSTs) justify closer monitoring and possible abuse reporting if the domain is not the official corporate domain. The SSL is valid but short-lived, and the site is hosted on a US-based provider; no definitive credential-phishing flow is confirmed from the available data alone.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API