urlscan.io logo urlscan.io
SecurityTrails logo

dmega.co.kr Open in urlscan Pro
114.108.131.226  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Submission: On March 27 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 5 countries across 9 domains to perform 12 HTTP transactions. The main IP is 114.108.131.226, located in Seoul, Korea, Republic Of and belongs to LGDACOM LG DACOM Corporation, KR. The main domain is dmega.co.kr.
This is the only time dmega.co.kr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online) Yahoo (Online) 163.cn (Online)

Domain & IP information

IP Address AS Autonomous System
2 114.108.131.226 3786 (LGDACOM L...)
2 79.170.40.67 20738 (AS20738)
1 198.1.122.127 46606 (UNIFIEDLA...)
2 43.230.90.2 135391 (AOFEI-HK ...)
1 2a00:1288:84:... 203219 (YAHOO-AMA)
1 212.27.63.101 12322 (PROXAD)
1 50.87.152.243 46606 (UNIFIEDLA...)
1 2620:0:862:ed... 14907 (WIKIMEDIA)
12 9
2    114.108.131.226 (Seoul, Korea, Republic Of)

ASN3786 (LGDACOM LG DACOM Corporation, KR)
dmega.co.kr
2    79.170.40.67 (United Kingdom)

ASN20738 (AS20738, GB)
PTR: www.outitgoes.com
www.outitgoes.com
1    198.1.122.127 (Provo, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: the.theemailcompany.com
www.theemailguide.com
2    43.230.90.2 (Hong Kong)

ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK)
PTR: proxy90-2.mail.163.com
mimg.127.net
1    2a00:1288:84:800::1001 (United Kingdom)

ASN203219 (YAHOO-AMA, NL)
s1.yimg.com
1    212.27.63.101 (Paris, France)

ASN12322 (PROXAD, FR)
PTR: perso101-g5.free.fr
pacaventure.free.fr
1    50.87.152.243 (Provo, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: 50-87-152-243.unifiedlayer.com
www.ticandcloud.com
1    2620:0:862:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US)
upload.wikimedia.org
Domain Requested by
2 mimg.127.net dmega.co.kr
2 www.outitgoes.com dmega.co.kr
2 dmega.co.kr
1 upload.wikimedia.org dmega.co.kr
1 www.ticandcloud.com dmega.co.kr
1 pacaventure.free.fr dmega.co.kr
1 s1.yimg.com dmega.co.kr
1 www.theemailguide.com dmega.co.kr
0 sc.imp.live.com Failed dmega.co.kr
12 9

This site contains no links.

Subject Issuer Validity Valid
www.outitgoes.com
GlobalSign Domain Validation CA - SHA256 - G2		 2014-04-10 -
2018-09-03		 4 years crt.sh
*.yimg.com
Symantec Class 3 Secure Server CA - G4		 2015-08-28 -
2017-08-27		 2 years crt.sh
*.wikipedia.org
DigiCert SHA2 High Assurance Server CA		 2016-12-19 -
2018-01-03		 a year crt.sh

This page contains 1 frames:

Primary Page: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Frame ID: 8312.1
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

12
Requests

33 %
HTTPS

25 %
IPv6

9
Domains

9
Subdomains

9
IPs

5
Countries

125 kB
Transfer

125 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request 0
  • http://www.outitgoes.com/default.css
  • https://www.outitgoes.com/default.css
Request 1
  • http://www.outitgoes.com/login_panel_gradient.jpg
  • https://www.outitgoes.com/login_panel_gradient.jpg
Request 8
  • http://upload.wikimedia.org/wikipedia/commons/9/93/Squirrelmail_logo.png
  • https://upload.wikimedia.org/wikipedia/commons/9/93/Squirrelmail_logo.png

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request page.php
dmega.co.kr/dmega/data/qna/sec/ 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
HTTP/1.1
Server
114.108.131.226 Seoul, Korea, Republic Of, ASN3786 (LGDACOM LG DACOM Corporation, KR),
Reverse DNS
Software
Apache / PHP/4.4.9
Resource Hash
307b492645faa92412e2d68a4a93eae0ad0889a0f25d042a56f0bc7a24b5fcdb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dmega.co.kr
Accept-Language
en-US,en;q=0.8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date
Mon, 27 Mar 2017 11:57:36 GMT
Server
Apache
Connection
Keep-Alive
X-Powered-By
PHP/4.4.9
Content-Length
4438
Keep-Alive
timeout=5, max=100
Content-Type
text/html
default.css
www.outitgoes.com/
Redirect Chain
  • http://www.outitgoes.com/default.css
  • https://www.outitgoes.com/default.css
 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.outitgoes.com/default.css
Requested by
Host: dmega.co.kr
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.170.40.67 , United Kingdom, ASN20738 (AS20738, GB),
Reverse DNS
www.outitgoes.com
Software
Apache/2.2.24 (Red Hat) /
Resource Hash
9995407957e06b460ebdef847f2966698845231a2887aadc3ac1706193464002

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
www.outitgoes.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date
Mon, 27 Mar 2017 12:49:28 GMT
Last-Modified
Wed, 29 Oct 2008 11:04:00 GMT
Server
Apache/2.2.24 (Red Hat)
Accept-Ranges
bytes
ETag
"1c0db9-122a-45a62523f0800"
Content-Length
4650
Content-Type
text/css

Redirect headers

Location
https://www.outitgoes.com/default.css
Connection
close
Content-length
0
login_panel_gradient.jpg
www.outitgoes.com/
Redirect Chain
  • http://www.outitgoes.com/login_panel_gradient.jpg
  • https://www.outitgoes.com/login_panel_gradient.jpg
 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.outitgoes.com/login_panel_gradient.jpg
Requested by
Host: dmega.co.kr
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.170.40.67 , United Kingdom, ASN20738 (AS20738, GB),
Reverse DNS
www.outitgoes.com
Software
Apache/2.2.24 (Red Hat) /
Resource Hash
f3297b1306f3704663aff9483c7e6e983a27eaf9f0567d58995128a11b75f2c3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch, br
Host
www.outitgoes.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date
Mon, 27 Mar 2017 12:49:28 GMT
Last-Modified
Wed, 29 Oct 2008 11:04:00 GMT
Server
Apache/2.2.24 (Red Hat)
Accept-Ranges
bytes
ETag
"1c0dc3-31ba-45a62523f0800"
Content-Length
12730
Content-Type
image/jpeg

Redirect headers

Location
https://www.outitgoes.com/login_panel_gradient.jpg
Connection
close
Content-length
0
ninja-hp-logo.jpg
www.theemailguide.com/images/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.theemailguide.com/images/ninja-hp-logo.jpg
Requested by
Host: dmega.co.kr
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
HTTP/1.1
Server
198.1.122.127 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
the.theemailcompany.com
Software
Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash
2e5f1dbb453433cfec00df81d0afb2e99ced0b8ebdae347c47dd1ef7ab85ec86

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.theemailguide.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date
Mon, 27 Mar 2017 12:49:29 GMT
Last-Modified
Thu, 24 May 2012 18:56:45 GMT
Server
Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag
"787e-4c0ccd0283540"
Content-Type
image/jpeg
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
30846
Expires
Wed, 26 Apr 2017 12:49:29 GMT
logo_mail.png
sc.imp.live.com/content/dam/imp/surfaces/mail_signin/header/ 		0
0
126logo.gif
mimg.127.net/logo/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/logo/126logo.gif
Requested by
Host: dmega.co.kr
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
HTTP/1.1
Server
43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK),
Reverse DNS
proxy90-2.mail.163.com
Software
nginx /
Resource Hash
4b65646e580b883fa13c46a43b399b98e7627a866f44de26bc08284628c15f38

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
mimg.127.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date
Mon, 27 Mar 2017 12:49:29 GMT
Last-Modified
Tue, 10 Feb 2009 07:01:48 GMT
Server
nginx
X-Cache
HIT from HKGM
Content-Type
image/gif
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6593
Expires
Mon, 27 Mar 2017 13:35:12 GMT
yahoo_en-US_f_p_bestfit_2x.png
s1.yimg.com/rz/d/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.yimg.com/rz/d/yahoo_en-US_f_p_bestfit_2x.png
Requested by
Host: dmega.co.kr
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:84:800::1001 , United Kingdom, ASN203219 (YAHOO-AMA, NL),
Reverse DNS
Software
ATS /
Resource Hash
19b644434cfa9f5d12e1e90a3c2d062aacf27da9ecbe8393df77383ab3c00208

Request headers

:path
/rz/d/yahoo_en-US_f_p_bestfit_2x.png
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
s1.yimg.com
referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
:scheme
https
:method
GET
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

date
Sun, 26 Mar 2017 23:08:38 GMT
via
HTTP/1.1 web11.use26.mobstor.bf1.yahoo.com UserFiberFramework/1.0, https/1.1 e15.ycpi.amb.yahoo.com (ApacheTrafficServer [cRs f ])
x-ysws-request-id
2a6392c6-a6b8-45f3-8f60-aa3565cf474e
server
ATS
age
49252
etag
"YM:1:e01eee34-5b9f-448f-87fe-288932b7a23400054ba95cee38ce"
content-type
image/png
status
200
cache-control
private
last-modified
Sun, 26 Mar 2017 22:01:04 GMT
accept-ranges
bytes
content-length
3066
x-ysws-visited-replicas
gops.use26.mobstor.vip.bf1.yahoo.com
expires
Mon, 27 Mar 2017 23:08:33 GMT
logo_2x.png
pacaventure.free.fr/images/cache/2016/general/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://pacaventure.free.fr/images/cache/2016/general/logo_2x.png
Requested by
Host: dmega.co.kr
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
HTTP/1.1
Server
212.27.63.101 Paris, France, ASN12322 (PROXAD, FR),
Reverse DNS
perso101-g5.free.fr
Software
Apache/ProXad [Sep 23 2014 15:26:28] /
Resource Hash
6a98c57c930e333d44bb67b31a10080e1d1a868befbc545fb262c07bf6818bac

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
pacaventure.free.fr
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date
Mon, 27 Mar 2017 12:49:29 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
Apache/ProXad [Sep 23 2014 15:26:28]
Connection
close
Content-Type
text/html; charset=iso-8859-1
logo_horde.png
www.ticandcloud.com/img/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.ticandcloud.com/img/logo_horde.png
Requested by
Host: dmega.co.kr
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
HTTP/1.1
Server
50.87.152.243 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
50-87-152-243.unifiedlayer.com
Software
nginx/1.10.3 /
Resource Hash
e624b9d739c2e1ff03bb2087a035687ee7db92068351937cb05e0a198810b6ad

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
www.ticandcloud.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date
Mon, 27 Mar 2017 12:49:29 GMT
Last-Modified
Tue, 08 Apr 2014 23:53:06 GMT
Server
nginx/1.10.3
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
13349
Content-Type
image/png
Squirrelmail_logo.png
upload.wikimedia.org/wikipedia/commons/9/93/
Redirect Chain
  • http://upload.wikimedia.org/wikipedia/commons/9/93/Squirrelmail_logo.png
  • https://upload.wikimedia.org/wikipedia/commons/9/93/Squirrelmail_logo.png
 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://upload.wikimedia.org/wikipedia/commons/9/93/Squirrelmail_logo.png
Requested by
Host: dmega.co.kr
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US),
Reverse DNS
Software
/
Resource Hash
c5c10376ded4b11ef6d5e4ccf79f0347c882d9cbb946d0e19f411b2b373f919e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

:path
/wikipedia/commons/9/93/Squirrelmail_logo.png
pragma
no-cache
accept-encoding
gzip, deflate, sdch, br
accept-language
en-US,en;q=0.8
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept
image/webp,image/*,*/*;q=0.8
cache-control
no-cache
:authority
upload.wikimedia.org
referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
:scheme
https
:method
GET
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

x-analytics
https=1;nocookies=1
date
Mon, 27 Mar 2017 12:49:29 GMT
via
1.1 varnish-v4, 1.1 varnish-v4, 1.1 varnish-v4
age
99890
x-cache-status
hit
x-cache
cp1049 miss, cp3038 hit/31, cp3044 miss
status
200
content-length
41510
x-trans-id
txc9cc83b7e59f40d9af6e4-0058d78426
x-client-ip
2a01:4f8:202:a9::2
x-object-meta-sha1base36
7grp1ynm9js1i9iyya91pjim63mhdz3
timing-allow-origin
*
last-modified
Sun, 06 Oct 2013 16:22:20 GMT
etag
8a5946eca6e1640efdc2c761ecd6b89b
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-varnish
10718343, 190290387 125005513, 669857040
access-control-allow-origin
*
x-timestamp
1381076539.75532
accept-ranges
bytes
content-type
image/png
access-control-expose-headers
Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache, X-Varnish

Redirect headers

Location
https://upload.wikimedia.org/wikipedia/commons/9/93/Squirrelmail_logo.png
Non-Authoritative-Reason
HSTS
163logo.gif
mimg.127.net/logo/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://mimg.127.net/logo/163logo.gif
Requested by
Host: dmega.co.kr
URL: http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Protocol
HTTP/1.1
Server
43.230.90.2 , Hong Kong, ASN135391 (AOFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK),
Reverse DNS
proxy90-2.mail.163.com
Software
nginx /
Resource Hash
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
mimg.127.net
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date
Mon, 27 Mar 2017 12:49:29 GMT
Last-Modified
Tue, 10 Feb 2009 07:01:48 GMT
Server
nginx
X-Cache
HIT from HKGM
Content-Type
image/gif
Cache-Control
max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6671
Expires
Mon, 27 Mar 2017 12:54:54 GMT
favicon.ico
dmega.co.kr/ 		209 B
209 B 		Other
General
Check archive.org
Download Go to
Full URL
http://dmega.co.kr/favicon.ico
Protocol
HTTP/1.1
Server
114.108.131.226 Seoul, Korea, Republic Of, ASN3786 (LGDACOM LG DACOM Corporation, KR),
Reverse DNS
Software
Apache /
Resource Hash
b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
dmega.co.kr
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
Connection
keep-alive
Cache-Control
no-cache
Referer
http://dmega.co.kr/dmega/data/qna/sec/page.php?email=ZmFpdGhAc2VtYW50aWMuaW5mbw==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date
Mon, 27 Mar 2017 11:57:38 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
209
Content-Type
text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
sc.imp.live.com
URL
https://sc.imp.live.com/content/dam/imp/surfaces/mail_signin/header/logo_mail.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online) Yahoo (Online) 163.cn (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies