Submitted URL: http://mmooc.dongseo.ac.kr/lec.html#1
Effective URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Submission Tags: 6629540
Submission: On July 14 via api from NL

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 183.90.241.158, located in Osaka, Japan and belongs to SAKURA-C SAKURA Internet Inc., JP. The main domain is irokasane.net.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 6th 2020. Valid for: 3 months.
This is the only time irokasane.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

IP Address AS Autonomous System
1 203.241.176.78 9774 (DSU-AS Do...)
2 13 183.90.241.158 9371 (SAKURA-C ...)
12 3
Apex Domain
Subdomains
Transfer
13 irokasane.net
irokasane.net
340 KB
1 dongseo.ac.kr
mmooc.dongseo.ac.kr
749 B
12 2
Domain Requested by
13 irokasane.net 2 redirects mmooc.dongseo.ac.kr
irokasane.net
1 mmooc.dongseo.ac.kr
12 2

This site contains no links.

Subject Issuer Validity Valid
www.irokasane.net
Let's Encrypt Authority X3
2020-07-06 -
2020-10-04
3 months crt.sh

This page contains 1 frames:

Primary Page: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Frame ID: 474482674FD15E707266494D11BCBA47
Requests: 14 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://mmooc.dongseo.ac.kr/lec.html Page URL
  2. https://irokasane.net/wp-content/plugins/ubh/ojwa/dv HTTP 301
    https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/ HTTP 302
    https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured Page URL

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

505 kB
Transfer

840 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://mmooc.dongseo.ac.kr/lec.html Page URL
  2. https://irokasane.net/wp-content/plugins/ubh/ojwa/dv HTTP 301
    https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/ HTTP 302
    https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
lec.html
mmooc.dongseo.ac.kr/
470 B
749 B
Document
General
Full URL
http://mmooc.dongseo.ac.kr/lec.html
Protocol
HTTP/1.1
Server
203.241.176.78 Busan, Korea, Republic Of, ASN9774 (DSU-AS Dongseo University, KR),
Reverse DNS
Software
nginx /
Resource Hash
9f96c505646e032d292e14aac920cdaa10288b18d481b7535085ceb6dc2deaa9

Request headers

Host
mmooc.dongseo.ac.kr
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server
nginx
Date
Tue, 14 Jul 2020 05:49:44 GMT
Content-Type
text/html
Content-Length
470
Last-Modified
Thu, 18 Jun 2020 11:11:24 GMT
ETag
"5eeb4bdc-1d6"
Expires
Thu, 13 Aug 2020 05:49:44 GMT
Cache-Control
max-age=2592000
Accept-Ranges
bytes
Primary Request Refund.php
irokasane.net/wp-content/plugins/ubh/ojwa/dv/
Redirect Chain
  • https://irokasane.net/wp-content/plugins/ubh/ojwa/dv
  • https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/
  • https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
14 KB
4 KB
Document
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Requested by
Host: mmooc.dongseo.ac.kr
URL: http://mmooc.dongseo.ac.kr/lec.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
a1b7b524770299f278fcc38bde5e745864a6e2060c8f68f8ba783ec550b72c30

Request headers

:method
GET
:authority
irokasane.net
:scheme
https
:path
/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
http://mmooc.dongseo.ac.kr/lec.html
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
PHPSESSID=f88494ba48974b1561a57a4d4d00956a
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://mmooc.dongseo.ac.kr/lec.html#1

Response headers

status
200
server
nginx
date
Tue, 14 Jul 2020 05:49:54 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
content-encoding
gzip

Redirect headers

status
302
server
nginx
date
Tue, 14 Jul 2020 05:49:54 GMT
content-type
text/html; charset=UTF-8
location
Refund.php?=Secured
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
PHPSESSID=f88494ba48974b1561a57a4d4d00956a; path=/
Main.css
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/css/
67 KB
15 KB
Stylesheet
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/css/Main.css
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
58bb031668da7d75a318c8127b1b2619e65ec6aeb929d47da4c381b100eec335

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:49:55 GMT
content-encoding
gzip
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
W/"10b8a-5a83228687430"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=604800
expires
Tue, 21 Jul 2020 05:49:55 GMT
Font.css
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/css/
267 KB
201 KB
Stylesheet
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/css/Font.css
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
76fe31eb8274a4258f00e62a53da76ba3578e4fbfd9dc6fd9c5d499f07c0e4f7

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:49:55 GMT
content-encoding
gzip
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
W/"42a58-5a83228686490"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=604800
expires
Tue, 21 Jul 2020 05:49:55 GMT
jquery-1.9.1.js
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/
262 KB
95 KB
Script
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/jquery-1.9.1.js
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:50:02 GMT
content-encoding
gzip
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
W/"4185d-5a83228689370"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
expires
Tue, 21 Jul 2020 05:50:02 GMT
jquery.payment.js
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/
17 KB
4 KB
Script
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/jquery.payment.js
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
190b90b1f62ad6798fca4c93adce6d0205c13b960b609af306f2d87b54885f85

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:49:55 GMT
content-encoding
gzip
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
W/"4242-5a83228689370"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
expires
Tue, 21 Jul 2020 05:49:55 GMT
jquery.validate.min.js
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/
21 KB
7 KB
Script
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/jquery.validate.min.js
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
7705fee13417229d718f14947e9860d5bb2b25bd15c9f5cd834f2545c7bad0a6

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:49:55 GMT
content-encoding
gzip
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
W/"524c-5a83228689370"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
expires
Tue, 21 Jul 2020 05:49:55 GMT
additional-methods.min.js
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/
17 KB
6 KB
Script
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/additional-methods.min.js
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
2b9a658314baccfef5f3b1d279571f0c1dbe62e6f71735828dd7606e426ba798

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:50:04 GMT
content-encoding
gzip
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
W/"433a-5a832286883d0"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
expires
Tue, 21 Jul 2020 05:50:04 GMT
jquery.maskedinput.js
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/
6 KB
2 KB
Script
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/jquery.maskedinput.js
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
c459460a568697ea2988106b3a9d38d9dee5de28636734cbf1fd0bae75b0006c

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:49:55 GMT
content-encoding
gzip
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
W/"176d-5a83228689370"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
expires
Tue, 21 Jul 2020 05:49:55 GMT
logo.png
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/img/
780 B
966 B
Image
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/img/logo.png
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/Refund.php?=Secured
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:50:04 GMT
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
"30c-5a83228687430"
content-type
image/png
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
780
expires
Tue, 21 Jul 2020 05:50:04 GMT
truncated
/
94 KB
94 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin
https://irokasane.net

Response headers

Content-Type
application/font-woff
o.png
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/img/
761 B
947 B
Image
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/img/o.png
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/jquery-1.9.1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/css/Main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:50:05 GMT
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
"2f9-5a83228687430"
content-type
image/png
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
761
expires
Tue, 21 Jul 2020 05:50:05 GMT
logo2.png
irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/img/
4 KB
4 KB
Image
General
Full URL
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/img/logo2.png
Requested by
Host: irokasane.net
URL: https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/js/jquery-1.9.1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
183.90.241.158 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS
sv7637.xserver.jp
Software
nginx /
Resource Hash
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b

Request headers

Referer
https://irokasane.net/wp-content/plugins/ubh/ojwa/dv/assets/css/Main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 14 Jul 2020 05:50:05 GMT
last-modified
Tue, 16 Jun 2020 11:51:03 GMT
server
nginx
etag
"e00-5a83228687430"
content-type
image/png
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
3584
expires
Tue, 21 Jul 2020 05:50:05 GMT
truncated
/
71 KB
71 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin
https://irokasane.net

Response headers

Content-Type
application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies