www.posav.site Open in urlscan Pro
156.253.51.212 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://posav.site/
Effective URL:
http://www.posav.site/
Submission: On March 02 via api (March 2nd 2020, 7:08:05 pm UTC) from DE

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 5 domains to perform 21 HTTP transactions. The main IP is 156.253.51.212, located in Johannesburg, South Africa and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is www.posav.site.

This is the only time www.posav.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 5	156.253.51.212 156.253.51.212	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
13	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
1	2606:4700:303... 2606:4700:3033::681b:846c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	111.206.37.189 111.206.37.189	4808 (CHINA169-...) (CHINA169-BJ China Unicom Beijing Province Network)
1	2606:4700:303... 2606:4700:3033::681b:8782	13335 (CLOUDFLAR...) (CLOUDFLARENET)
21	6

5 156.253.51.212 (Johannesburg, South Africa) 1 redirects

ASN8100 (ASN-QUADRANET-GLOBAL, US)

posav.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.posav.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:86c0:2091::1 (United Kingdom)

ASN40027 (NETFLIX-ASN, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::681b:846c (United States)

ASN13335 (CLOUDFLARENET, US)

www.456api.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 111.206.37.189 (Beijing, China)

ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN)

push.zhanzhang.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.share.baidu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::681b:8782 (United States)

ASN13335 (CLOUDFLARENET, US)

ganganxxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	nflxext.com codex.nflxext.com assets.nflxext.com	1 MB
5	posav.site 1 redirects posav.site www.posav.site	30 KB
2	baidu.com push.zhanzhang.baidu.com api.share.baidu.com	868 B
1	ganganxxs.com ganganxxs.com
1	456api.com www.456api.com	547 B
21	5

	Domain	Requested by
9	assets.nflxext.com	www.posav.site
4	codex.nflxext.com	www.posav.site
4	www.posav.site	www.posav.site
1	api.share.baidu.com	www.posav.site
1	ganganxxs.com	www.posav.site
1	push.zhanzhang.baidu.com	www.posav.site
1	www.456api.com	www.posav.site
1	posav.site	1 redirects
21	8

This site contains no links.

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert SHA2 Secure Server CA	`2020-02-16` - `2020-03-22`	a month	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-02-26` - `2020-10-09`	7 months	crt.sh

This page contains 2 frames:

Primary Page: http://www.posav.site/
Frame ID: 9639D957A880E77CF05DFFD0C02B7BDE
Requests: 23 HTTP requests in this frame

Frame: https://ganganxxs.com/index.html
Frame ID: DB73A860912480FDBB2B9F1F9F6B06D4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://posav.site/ HTTP 301
http://www.posav.site/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

21
Requests

67 %
HTTPS

60 %
IPv6

5
Domains

8
Subdomains

6
IPs

4
Countries

1210 kB
Transfer

2093 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://posav.site/ HTTP 301
http://www.posav.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.posav.site/
Redirect Chain

http://posav.site/
http://www.posav.site/

83 KB
27 KB

7871ms
519ms

Document
text/html

156.253.51.212
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: http://www.posav.site/
Protocol: HTTP/1.1
Server: 156.253.51.212 Johannesburg, South Africa, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software: nginx /
Resource Hash: a472a244ae0eb2ad82a1d07f917c9c659a9d15724b30a6fe2f51731d7714ac7f

Request headers

Host: www.posav.site
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Mon, 02 Mar 2020 19:07:37 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Mon, 02 Mar 2020 19:07:29 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Location: http://www.posav.site/

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v1b11bfd3/js/js/bootstrap.js,common%7Cbootstrap.js/2/4V034n4m4a4J464D4U060p004W4y4f4p4P4c4E4k4H4w4r0a024R14/bck/true/ 9 KB
4 KB 155ms
115ms Script
application/javascript 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v1b11bfd3/js/js/bootstrap.js,common%7Cbootstrap.js/2/4V034n4m4a4J464D4U060p004W4y4f4p4P4c4E4k4H4w4r0a024R14/bck/true/none

Requested by

Host: www.posav.site
URL: http://www.posav.site/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

ff50610c95fccb97956b2bccca0c7730379418d749325fa29857a27f31ca4577

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 02 Mar 2020 19:07:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 74da9595-1483-4888-a597-04b0841b9ad6
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Fri, 04 Sep 2020 19:07:41 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v1b11bfd3/js/js/signup%7Chome%7CourStory%7Cfuji%7CfujiFrameworkClient.js/2/4V034n4m4a4J464D4U060p004W4y4f4p4P4c4E4k4H4w4r0a024R14/l/true/ 1018 KB
306 KB 169ms
129ms Script
application/javascript 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v1b11bfd3/js/js/signup%7Chome%7CourStory%7Cfuji%7CfujiFrameworkClient.js/2/4V034n4m4a4J464D4U060p004W4y4f4p4P4c4E4k4H4w4r0a024R14/l/true/none

Requested by

Host: www.posav.site
URL: http://www.posav.site/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

bc8e64e845a71642353552be8ec201228baa4f12368ad031e2674c73e5629896

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Mon, 02 Mar 2020 19:07:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 60da9766-57b7-429a-ba42-1fa3cb5ad133
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Fri, 04 Sep 2020 19:07:41 GMT

GET
H/1.1 404
Not Found WebsiteDetect
www.posav.site/personalization/cl2/freeform/ 0
0 458ms
437ms Stylesheet
text/html 156.253.51.212
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: http://www.posav.site/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=nmLanding
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Server: 156.253.51.212 Johannesburg, South Africa, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 02 Mar 2020 19:07:38 GMT
Server: nginx
Connection: keep-alive
Content-Length: 466
Content-Type: text/html

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v1b11bfd3/css/css/less%7Ccore%7Cerror-page.less/1/nvwGyOxLp9FMN/none/true/ 19 KB
5 KB 146ms
112ms Stylesheet
text/css 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v1b11bfd3/css/css/less%7Ccore%7Cerror-page.less/1/nvwGyOxLp9FMN/none/true/none

Requested by

Host: www.posav.site
URL: http://www.posav.site/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

8e0d535dad44182d2d9c92ccd747f283d653610c755be90b79ed9c5f13ab3175

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 02 Mar 2020 19:07:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: a5c4787d-9c1e-4ac4-a377-5bcc3a238ee4
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Expires: Fri, 04 Sep 2020 19:07:41 GMT

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v1b11bfd3/css/css/less%7Cpages%7Chome%7CourStory%7Cfuji%7Cfuji.less/1/nvwGyOxLp9FMN/none/true/ 114 KB
18 KB 42ms
7ms Stylesheet
text/css 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v1b11bfd3/css/css/less%7Cpages%7Chome%7CourStory%7Cfuji%7Cfuji.less/1/nvwGyOxLp9FMN/none/true/none

Requested by

Host: www.posav.site
URL: http://www.posav.site/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

1a39b83b5932bc8330ecb3fb51ad4abd98f7ff1b6868f0cd4ecf0a17cbf4ff8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Mon, 02 Mar 2020 19:07:41 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 54df795d-6313-42ac-96ff-db0aa4bdd749
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 18059
Expires: Fri, 04 Sep 2020 07:26:35 GMT

GET
H/1.1 200
OK tj.js Show response
www.posav.site/ 0
154 B 333ms
312ms Script
application/x-javascript 156.253.51.212
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: http://www.posav.site/tj.js
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Server: 156.253.51.212 Johannesburg, South Africa, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 02 Mar 2020 19:07:37 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
Content-Type: application/x-javascript

GET
H/1.1 200
OK common.js Show response
www.posav.site/ 4 KB
2 KB 317ms
297ms Script
application/x-javascript 156.253.51.212
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: http://www.posav.site/common.js
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Server: 156.253.51.212 Johannesburg, South Africa, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software: nginx /
Resource Hash: 93cb50adfcb4eeecf03f996d9810c4cdd866f1bb49de6455f94f35055ec1c209

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 02 Mar 2020 19:07:37 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: nginx
Connection: keep-alive
Vary: Accept-Encoding
Content-Type: application/x-javascript

GET
H/1.1 200
OK hero-background.jpg
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 12 KB
13 KB 40ms
6ms Image
image/jpeg 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/hero-background.jpg
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 59235484f36c6344af123d1988484e876da612755e8ff20e806f53200b24e8d9

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 02 Mar 2020 19:07:41 GMT
Last-Modified: Wed, 14 Nov 2018 18:20:41 GMT
Server: nginx
Content-MD5: 24JLjkyKGXouoymieJUwGg==
Content-Type: image/jpeg
Cache-Control: public, max-age=4898503
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 12789
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK tv.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 11 KB
11 KB 40ms
6ms Image
image/png 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/tv.png
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: b68ea2c7bea397aa11fadb189ce7d83862baebaf03ece643eb5aa9fb5f755056

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 02 Mar 2020 19:07:41 GMT
Last-Modified: Wed, 14 Nov 2018 18:20:41 GMT
Server: nginx
Content-MD5: d5lKZzJ7qVff2IDjOpHwQQ==
Content-Type: image/png
Cache-Control: public, max-age=6621660
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11418
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK mobile-0819.jpg
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 48 KB
49 KB 10ms
9ms Image
image/jpeg 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/mobile-0819.jpg
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 492fdebd363e40cbba153a244bcfe2a7f5f7cf20aff0805fe45d5c7e2180b875

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 02 Mar 2020 19:07:41 GMT
Last-Modified: Wed, 14 Aug 2019 17:59:05 GMT
Server: nginx
Content-MD5: pIMz1DwZYS7WGYf6Xb/zxQ==
Content-Type: image/jpeg
Cache-Control: public, max-age=6621497
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 49614
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK boxshot.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 20 KB
20 KB 5ms
5ms Image
image/png 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/boxshot.png
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: e1fa26cc34fda574edc01d09e374d6f10735a3fa621bdde87c104ee15453d4b6

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 02 Mar 2020 19:07:41 GMT
Last-Modified: Wed, 14 Nov 2018 18:48:14 GMT
Server: nginx
Content-MD5: WH4EDyAll5IJSQHKlzlmng==
Content-Type: image/png
Cache-Control: public, max-age=4826884
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20506
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK device-pile.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 134 KB
134 KB 7ms
6ms Image
image/png 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/device-pile.png
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 81cf64888a7b3f6848b09695b034026d9ad685665b91d54597ecbb6197c6acbb

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 02 Mar 2020 19:07:41 GMT
Last-Modified: Wed, 23 Jan 2019 00:35:07 GMT
Server: nginx
Content-MD5: Cz2CFJPVdI2CnIUrvW0pLQ==
Content-Type: image/png
Cache-Control: public, max-age=4826882
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 137040
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK eddata Show response
www.456api.com/index.php/Article/ 69 B
547 B 164ms
164ms XHR
application/json 2606:4700:3033::681b:846c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.456api.com/index.php/Article/eddata?zq=zq_kf&val=smplink&t=0.3606769468464206?v=009896912377851597
Requested by: Host: www.posav.site
URL: http://www.posav.site/common.js
Protocol: HTTP/1.1
Server: 2606:4700:3033::681b:846c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0f69a6ba7fc0f1e01a7dc1d88d084e9c1a053cec325dd9e688f3ae473e29eed

Request headers

Origin: http://www.posav.site
Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 02 Mar 2020 19:07:42 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Connection: keep-alive
CF-RAY: 56dd66f3dc259aaa-FRA

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 621 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b2ef3dfa947184425ff82b88ee374b987e9478c0edbce1cbc9feb9a471f6077

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK download-icon.gif
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 22 KB
22 KB 6ms
5ms Image
image/gif 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/download-icon.gif
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f99e4c2ed1c2b7de72f47102c64d601567f8efaad5944a08c86786cad4050e6

Request headers

Referer: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v1b11bfd3/css/css/less%7Cpages%7Chome%7CourStory%7Cfuji%7Cfuji.less/1/nvwGyOxLp9FMN/none/true/none
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 02 Mar 2020 19:07:42 GMT
Last-Modified: Mon, 12 Nov 2018 22:40:57 GMT
Server: nginx
Content-MD5: 3Ty3jbeMPgoTybd+4Z3u5g==
Content-Type: image/gif
Cache-Control: public, max-age=4826892
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22171
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 28ms
6ms Font
font/woff 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v1b11bfd3/css/css/less%7Cpages%7Chome%7CourStory%7Cfuji%7Cfuji.less/1/nvwGyOxLp9FMN/none/true/none
Origin: http://www.posav.site
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 02 Mar 2020 19:07:42 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=6621670
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 206
Partial Content video-tv-0819.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 264 KB
264 KB 9ms
8ms Media
video/x-m4v 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/video-tv-0819.m4v
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 4c7a552d219146985961bf78d9083b7e2c1a82c4ada5d959f48b3e53754c9049

Request headers

Referer: http://www.posav.site/
Sec-Fetch-Dest: video
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Mon, 02 Mar 2020 19:07:42 GMT
Last-Modified: Mon, 12 Aug 2019 20:49:12 GMT
Server: nginx
Content-MD5: PLEtt8Zyszc1AGSApFXscg==
Content-Type: video/x-m4v
Content-Range: bytes 0-270045/270046
Cache-Control: public, max-age=4826871
Connection: keep-alive
Content-Length: 270046
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 206
Partial Content video-devices.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 260 KB
260 KB 8ms
7ms Media
video/x-m4v 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/video-devices.m4v
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 3eec290a7f7da9abb00b49ca84f5f16e6d45ca33d40fd8ede4380835d6161d71

Request headers

Referer: http://www.posav.site/
Sec-Fetch-Dest: video
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Mon, 02 Mar 2020 19:07:42 GMT
Last-Modified: Wed, 09 Jan 2019 20:47:49 GMT
Server: nginx
Content-MD5: PlXFYgWonIWf7QBa4XKfqg==
Content-Type: video/x-m4v
Content-Range: bytes 0-266159/266160
Cache-Control: public, max-age=13767378
Connection: keep-alive
Content-Length: 266160
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK push.js Show response
push.zhanzhang.baidu.com/ 281 B
752 B 584ms
541ms Script
text/javascript 111.206.37.189
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to

Full URL: http://push.zhanzhang.baidu.com/push.js
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Server: 111.206.37.189 Beijing, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software: apache /
Resource Hash: 674bc0c70f98d627b8a7e1d278a1f21ffe33815565f7d5371bf0275da57571b2

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 02 Mar 2020 19:07:42 GMT
Content-Encoding: gzip
Last-Modified: Wed, 25 Nov 2015 07:47:55 GMT
Server: apache
Etag: "4078521116"
Vary: Accept-Encoding
P3p: CP=" OTI DSP COR IVA OUR IND COM "
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 227
Expires: Tue, 02 Mar 2021 19:07:42 GMT

GET
H2 200 index.html
ganganxxs.com/ Frame DB73 0
0 185ms
185ms Document
text/html 2606:4700:3033::681b:8782
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ganganxxs.com/index.html
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::681b:8782 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: ganganxxs.com
:scheme: https
:path: /index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: http://www.posav.site/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: http://www.posav.site/

Response headers

status: 200
date: Mon, 02 Mar 2020 19:07:42 GMT
content-type: text/html
set-cookie: __cfduid=dcd93fa1d53630663137b9aab4c6f0c221583176062; expires=Wed, 01-Apr-20 19:07:42 GMT; path=/; domain=.ganganxxs.com; HttpOnly; SameSite=Lax; Secure
last-modified: Fri, 07 Feb 2020 15:26:43 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 56dd66f51ac697ae-FRA
content-encoding: br

GET
H/1.1 200
OK s.gif
api.share.baidu.com/ 0
116 B 540ms
518ms Image
text/plain 111.206.37.189
CHINA169-BJ China...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://api.share.baidu.com/s.gif?l=http://www.posav.site/
Requested by: Host: www.posav.site
URL: http://www.posav.site/
Protocol: HTTP/1.1
Server: 111.206.37.189 Beijing, China, ASN4808 (CHINA169-BJ China Unicom Beijing Province Network, CN),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.posav.site/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 02 Mar 2020 19:07:43 GMT
Content-Length: 0
Content-Type: text/plain; charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://www.posav.site/common.js(Line 12) Message: 1
console-api	log	URL: http://www.posav.site/common.js(Line 42) Message: 2
console-api	log	URL: http://www.posav.site/common.js(Line 47) Message: 0*DIVshowcloneshengxiaon
console-api	log	URL: http://www.posav.site/common.js(Line 47) Message: 1*STYLE

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.share.baidu.com
assets.nflxext.com
codex.nflxext.com
ganganxxs.com
posav.site
push.zhanzhang.baidu.com
www.456api.com
www.posav.site
111.206.37.189
156.253.51.212
2606:4700:3033::681b:846c
2606:4700:3033::681b:8782
2a00:86c0:2091::1
1a39b83b5932bc8330ecb3fb51ad4abd98f7ff1b6868f0cd4ecf0a17cbf4ff8e
3eec290a7f7da9abb00b49ca84f5f16e6d45ca33d40fd8ede4380835d6161d71
492fdebd363e40cbba153a244bcfe2a7f5f7cf20aff0805fe45d5c7e2180b875
4c7a552d219146985961bf78d9083b7e2c1a82c4ada5d959f48b3e53754c9049
4f99e4c2ed1c2b7de72f47102c64d601567f8efaad5944a08c86786cad4050e6
59235484f36c6344af123d1988484e876da612755e8ff20e806f53200b24e8d9
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
674bc0c70f98d627b8a7e1d278a1f21ffe33815565f7d5371bf0275da57571b2
81cf64888a7b3f6848b09695b034026d9ad685665b91d54597ecbb6197c6acbb
8e0d535dad44182d2d9c92ccd747f283d653610c755be90b79ed9c5f13ab3175
93cb50adfcb4eeecf03f996d9810c4cdd866f1bb49de6455f94f35055ec1c209
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9b2ef3dfa947184425ff82b88ee374b987e9478c0edbce1cbc9feb9a471f6077
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
a0f69a6ba7fc0f1e01a7dc1d88d084e9c1a053cec325dd9e688f3ae473e29eed
a472a244ae0eb2ad82a1d07f917c9c659a9d15724b30a6fe2f51731d7714ac7f
b68ea2c7bea397aa11fadb189ce7d83862baebaf03ece643eb5aa9fb5f755056
bc8e64e845a71642353552be8ec201228baa4f12368ad031e2674c73e5629896
e1fa26cc34fda574edc01d09e374d6f10735a3fa621bdde87c104ee15453d4b6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff50610c95fccb97956b2bccca0c7730379418d749325fa29857a27f31ca4577

www.posav.site Open in urlscan Pro 156.253.51.212 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

67 %HTTPS

60 %IPv6

5 Domains

8 Subdomains

6 IPs

4 Countries

1210 kBTransfer

2093 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

www.posav.site Open in urlscan Pro
156.253.51.212 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

67 %
HTTPS

60 %
IPv6

5
Domains

8
Subdomains

6
IPs

4
Countries

1210 kB
Transfer

2093 kB
Size

0
Cookies

21 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!