www.sotech.co.kr Open in urlscan Pro
183.110.253.146 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://j.mp/38VZdvb
Effective URL:
http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?idea=9n9kzu...
Submission: On November 23 via manual (November 23rd 2020, 10:03:41 am UTC) from FR

Summary HTTP 3 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 183.110.253.146, located in Korea, Republic Of and belongs to KIXS-AS-KR Korea Telecom, KR. The main domain is www.sotech.co.kr.

This is the only time www.sotech.co.kr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lion's Den Scam (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 1	67.199.248.16 67.199.248.16		396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
2	183.110.253.146 183.110.253.146		4766 (KIXS-AS-K...) (KIXS-AS-KR Korea Telecom)
1	2606:4700::68... 2606:4700::6810:135e		13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	3

1 67.199.248.16 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: j.mp

j.mp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 183.110.253.146 (Korea, Republic Of)

ASN4766 (KIXS-AS-KR Korea Telecom, KR)

www.sotech.co.kr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	sotech.co.kr www.sotech.co.kr	3 KB
1	cloudflare.com cdnjs.cloudflare.com	27 KB
1	j.mp 1 redirects j.mp	344 B
3	3

	Domain	Requested by
2	www.sotech.co.kr	www.sotech.co.kr
1	cdnjs.cloudflare.com	www.sotech.co.kr
1	j.mp	1 redirects
3	3

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?idea=9n9kzuxp99y0tr&method=cover&size=fill
Frame ID: F90D18CC5269FAB3C07089682FF67FBD
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://j.mp/38VZdvb HTTP 301
http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/grou... Page URL
http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/grou... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_dav (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /\b(?:mod_)?DAV\b(?:\/([\d.]+))?/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

3
Requests

33 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

30 kB
Transfer

273 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://j.mp/38VZdvb HTTP 301
http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?during=1ey1bpy10fny0ww&death=choose&minute=please Page URL
http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?idea=9n9kzuxp99y0tr&method=cover&size=fill Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://j.mp/38VZdvb HTTP 301
http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?during=1ey1bpy10fny0ww&death=choose&minute=please

Request Chain 1

http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js HTTP 307
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

3 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

groupmgr.php Show response
www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/
Redirect Chain

https://j.mp/38VZdvb
http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?during=1ey1bpy10fny0ww&death=choose&minute=please

3 KB
3 KB

4147ms
2883ms

Document
text/html

183.110.253.146
KIXS-AS-KR Korea ...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?during=1ey1bpy10fny0ww&death=choose&minute=please
Protocol: HTTP/1.1
Server: 183.110.253.146 , Korea, Republic Of, ASN4766 (KIXS-AS-KR Korea Telecom, KR),
Reverse DNS
Software: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.6 / PHP/5.2.6
Resource Hash: 3d4515e852630fddca542fd35c22b19e732f5bcd2244ad6e55c2b82ca2260779

Request headers

Host: www.sotech.co.kr
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 23 Nov 2020 10:03:08 GMT
Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 2700
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

server: nginx
date: Mon, 23 Nov 2020 10:03:09 GMT
content-type: text/html; charset=utf-8
content-length: 253
cache-control: private, max-age=90
content-security-policy: referrer always;
location: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?during=1ey1bpy10fny0ww&death=choose&minute=please
referrer-policy: unsafe-url
set-cookie: _bit=kana39-77526a8bf1b284ce00-00q; Domain=j.mp; Expires=Sat, 22 May 2021 10:03:09 GMT
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK Primary Request groupmgr.php
www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/ 176 KB
0 7574ms
7573ms Document
text/html 183.110.253.146
KIXS-AS-KR Korea ...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?idea=9n9kzuxp99y0tr&method=cover&size=fill
Requested by: Host: www.sotech.co.kr
URL: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?during=1ey1bpy10fny0ww&death=choose&minute=please
Protocol: HTTP/1.1
Server: 183.110.253.146 , Korea, Republic Of, ASN4766 (KIXS-AS-KR Korea Telecom, KR),
Reverse DNS
Software: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.6 / PHP/5.2.6
Resource Hash

Request headers

Host: www.sotech.co.kr
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?during=1ey1bpy10fny0ww&death=choose&minute=please
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?during=1ey1bpy10fny0ww&death=choose&minute=please

Response headers

Date: Mon, 23 Nov 2020 10:03:11 GMT
Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.6
X-Powered-By: PHP/5.2.6
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H2

200

jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/
Redirect Chain

http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

86 KB
27 KB

14ms
14ms

Script
application/javascript

2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: www.sotech.co.kr
URL: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?idea=9n9kzuxp99y0tr&method=cover&size=fill

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000

Request headers

Referer: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?idea=9n9kzuxp99y0tr&method=cover&size=fill
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 23 Nov 2020 10:03:35 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 255931
x-via: cfworker/kv
cross-origin-resource-policy: cross-origin
content-length: 27748
cf-request-id: 0696281ec00000dfdbb00c9000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
etag: "5eb03ec4-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dKtGOu%2FVXEi3l6H0N%2Fwo8aHioPt0rulQCzHMMJCpeRljQMNkdTqSy59dp%2BN5KBb59KUErhZMjumvQz37YXsO5CDL118Ld2SiMn3Dxhu6BqE4EzfBchINQ%2F5Wvc1%2FlFvahA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5f6a0faace2bdfdb-FRA
expires: Sat, 13 Nov 2021 10:03:35 GMT

Redirect headers

Location: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e

Request headers

Referer: http://www.sotech.co.kr/gnuboard4/data/file/product2/thumb/processpaypal/remain.func/highscores/groupmgr.php?idea=9n9kzuxp99y0tr&method=cover&size=fill
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lion's Den Scam (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
j.mp
www.sotech.co.kr
183.110.253.146
2606:4700::6810:135e
67.199.248.16
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
3d4515e852630fddca542fd35c22b19e732f5bcd2244ad6e55c2b82ca2260779
739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e