sky.posmaster.co.kr Open in urlscan Pro
121.78.182.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://sky.posmaster.co.kr/test/uploads/TRID/index.php
Effective URL:
http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&...
Submission: On January 23 via manual (January 23rd 2019, 7:20:29 pm UTC) from US

Summary HTTP 7 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 121.78.182.106, located in Korea, Republic Of and belongs to GABIA-AS-KR GABIA Inc., KR. The main domain is sky.posmaster.co.kr.

This is the only time sky.posmaster.co.kr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online) Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1 6	121.78.182.106 121.78.182.106		17589 (GABIA-AS-...) (GABIA-AS-KR GABIA Inc.)
2	2a00:1450:400... 2a00:1450:4001:819::200a		15169 (GOOGLE) (GOOGLE - Google LLC)
7	3

6 121.78.182.106 (Korea, Republic Of) 1 redirects

ASN17589 (GABIA-AS-KR GABIA Inc., KR)

sky.posmaster.co.kr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	posmaster.co.kr 1 redirects sky.posmaster.co.kr	39 KB
2	googleapis.com fonts.googleapis.com	1 KB
7	2

	Domain	Requested by
6	sky.posmaster.co.kr	1 redirects sky.posmaster.co.kr
2	fonts.googleapis.com	sky.posmaster.co.kr
7	2

This site contains no links.

Subject Issuer	Validity	Valid
*.googleapis.com Google Internet Authority G3	`2018-12-19` - `2019-03-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Frame ID: 2AA8ABA5CD486A9B85F8308265204C99
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://sky.posmaster.co.kr/test/uploads/TRID/index.php HTTP 302
http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.177425... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_jk(?:\/([\d\.]+))?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_jk (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_jk(?:\/([\d\.]+))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_jk(?:\/([\d\.]+))?/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Apache Tomcat (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_jk(?:\/([\d\.]+))?/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

7
Requests

29 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

40 kB
Transfer

42 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sky.posmaster.co.kr/test/uploads/TRID/index.php HTTP 302
http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request r64422o09r1ikihmzylwpgvu.php Show response
sky.posmaster.co.kr/test/uploads/TRID/
Redirect Chain

http://sky.posmaster.co.kr/test/uploads/TRID/index.php
http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=

4 KB
5 KB

317ms
316ms

Document
text/html

121.78.182.106
GABIA-AS-KR GABIA...

General

Check archive.org

Show headers Download Go to

Full URL: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol: HTTP/1.1
Server: 121.78.182.106 , Korea, Republic Of, ASN17589 (GABIA-AS-KR GABIA Inc., KR),
Reverse DNS
Software: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips / PHP/5.2.17
Resource Hash: 7e8eb35ac00668594ecd2bdca62a36a50542d95215a0bff284a02bd45afbb1bc

Request headers

Host: sky.posmaster.co.kr
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=ff91c54987741a9429fe2295b9cee71b
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 23 Jan 2019 19:20:13 GMT
Server: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips
X-Powered-By: PHP/5.2.17
Content-Length: 4430
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

Date: Wed, 23 Jan 2019 19:20:13 GMT
Server: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips
X-Powered-By: PHP/5.2.17
Set-Cookie: PHPSESSID=ff91c54987741a9429fe2295b9cee71b; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H2 200 css
fonts.googleapis.com/ 2 KB
570 B 19ms
17ms Stylesheet
text/css 2a00:1450:4001:819::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:600

Requested by

Host: sky.posmaster.co.kr
URL: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

1e3dbaf62562c1f6b3dc33fc018fe550b786f82a6502a3d2c4a9d1aaa32a6a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 23 Jan 2019 19:20:13 GMT
server: ESF
access-control-allow-origin: *
date: Wed, 23 Jan 2019 19:20:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 1; mode=block
expires: Wed, 23 Jan 2019 19:20:13 GMT

GET
H/1.1 200
OK share-point.css
sky.posmaster.co.kr/test/uploads/TRID/css/ 15 KB
16 KB 316ms
315ms Stylesheet
text/css 121.78.182.106
GABIA-AS-KR GABIA...

General

Check archive.org

Show headers Download Go to

Full URL: http://sky.posmaster.co.kr/test/uploads/TRID/css/share-point.css
Requested by: Host: sky.posmaster.co.kr
URL: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol: HTTP/1.1
Server: 121.78.182.106 , Korea, Republic Of, ASN17589 (GABIA-AS-KR GABIA Inc., KR),
Reverse DNS
Software: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips /
Resource Hash: 2ee69aef3afb10b368bde9fea7e97cc75c030c890e3d2b8dc4ad19d498234dbf

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sky.posmaster.co.kr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Cookie: PHPSESSID=ff91c54987741a9429fe2295b9cee71b
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 23 Jan 2019 19:20:14 GMT
Last-Modified: Sun, 31 Dec 2017 04:22:34 GMT
Server: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips
ETag: "9815e7-3ca6-5619b36fe1680"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 15526

GET
H/1.1 200
OK logo.png
sky.posmaster.co.kr/test/uploads/TRID/img/ 3 KB
4 KB 279ms
278ms Image
image/png 121.78.182.106
GABIA-AS-KR GABIA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sky.posmaster.co.kr/test/uploads/TRID/img/logo.png
Requested by: Host: sky.posmaster.co.kr
URL: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol: HTTP/1.1
Server: 121.78.182.106 , Korea, Republic Of, ASN17589 (GABIA-AS-KR GABIA Inc., KR),
Reverse DNS
Software: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips /
Resource Hash: 825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sky.posmaster.co.kr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Cookie: PHPSESSID=ff91c54987741a9429fe2295b9cee71b
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 23 Jan 2019 19:20:14 GMT
Last-Modified: Sat, 30 Dec 2017 21:39:06 GMT
Server: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips
ETag: "9815ef-d03-5619594155280"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3331

GET
H/1.1 200
OK pdf.png
sky.posmaster.co.kr/test/uploads/TRID/img/ 7 KB
7 KB 557ms
277ms Image
image/png 121.78.182.106
GABIA-AS-KR GABIA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sky.posmaster.co.kr/test/uploads/TRID/img/pdf.png
Requested by: Host: sky.posmaster.co.kr
URL: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol: HTTP/1.1
Server: 121.78.182.106 , Korea, Republic Of, ASN17589 (GABIA-AS-KR GABIA Inc., KR),
Reverse DNS
Software: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips /
Resource Hash: db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sky.posmaster.co.kr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Cookie: PHPSESSID=ff91c54987741a9429fe2295b9cee71b
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 23 Jan 2019 19:20:14 GMT
Last-Modified: Sat, 30 Dec 2017 22:33:24 GMT
Server: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips
ETag: "9815f2-1aae-5619656467500"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 6830

GET
H/1.1 200
OK logo_strip.png
sky.posmaster.co.kr/test/uploads/TRID/img/ 7 KB
8 KB 838ms
281ms Image
image/png 121.78.182.106
GABIA-AS-KR GABIA...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://sky.posmaster.co.kr/test/uploads/TRID/img/logo_strip.png
Requested by: Host: sky.posmaster.co.kr
URL: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Protocol: HTTP/1.1
Server: 121.78.182.106 , Korea, Republic Of, ASN17589 (GABIA-AS-KR GABIA Inc., KR),
Reverse DNS
Software: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips /
Resource Hash: d1f126b54d456b3d15be32e56fa230cb8a9d4b5b3cfa8e0e2b0386431c869fba

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: sky.posmaster.co.kr
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
Cookie: PHPSESSID=ff91c54987741a9429fe2295b9cee71b
Connection: keep-alive
Cache-Control: no-cache
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 23 Jan 2019 19:20:14 GMT
Last-Modified: Sat, 05 May 2018 17:13:04 GMT
Server: Apache/2.2.19 (Unix) DAV/2 PHP/5.2.17 mod_jk/1.2.41 mod_ssl/2.2.19 OpenSSL/1.0.1e-fips
ETag: "9815f0-1d75-56b788cadc800"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 7541

GET
H2 200 css
fonts.googleapis.com/ 0
616 B 17ms
16ms Other
text/css 2a00:1450:4001:819::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:600

Requested by

Host: sky.posmaster.co.kr
URL: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:819::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Purpose: prefetch
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/r64422o09r1ikihmzylwpgvu.php?rand=13InboxLightaspxn.1774256418&fid&1252899642&fid.1&fav.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Wed, 23 Jan 2019 19:20:13 GMT
server: ESF
access-control-allow-origin: *
date: Wed, 23 Jan 2019 19:20:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39,35"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 1; mode=block
expires: Wed, 23 Jan 2019 19:20:13 GMT

GET
DATA 200
OK truncated
/ 2 KB
0 Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://sky.posmaster.co.kr/test/uploads/TRID/css/share-point.css
Origin: http://sky.posmaster.co.kr

Response headers

Content-Type: application/octet-stream

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online) Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sky.posmaster.co.kr/	1969-12-31 23:59:59	Name: PHPSESSID Value: ff91c54987741a9429fe2295b9cee71b

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
sky.posmaster.co.kr
121.78.182.106
2a00:1450:4001:819::200a
1e3dbaf62562c1f6b3dc33fc018fe550b786f82a6502a3d2c4a9d1aaa32a6a68
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
2ee69aef3afb10b368bde9fea7e97cc75c030c890e3d2b8dc4ad19d498234dbf
7e8eb35ac00668594ecd2bdca62a36a50542d95215a0bff284a02bd45afbb1bc
825de044d5ac6442a094ff95099f9f67e9249a8110a2fbd57128285776632adb
d1f126b54d456b3d15be32e56fa230cb8a9d4b5b3cfa8e0e2b0386431c869fba
db307fcef7f95139689007d7a623b340ec21282bd421c4e4b2ba09078f230545
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855