URL: http://sellerposts.com/auto/DHL/index.php
Submission: On November 30 via manual from DE

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 11 HTTP transactions. The main IP is 103.27.234.90, located in India and belongs to RACKBANK-AS RackBank Datacenters Private Ltd, IN. The main domain is sellerposts.com.
This is the only time sellerposts.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 163.cn (Online)

Domain & IP information

IP Address AS Autonomous System
1 103.27.234.90 132779 (RACKBANK-...)
6 2a00:1450:400... 15169 (GOOGLE)
1 162.144.52.52 46606 (UNIFIEDLA...)
1 52.1.63.150 14618 (AMAZON-AES)
1 43.230.90.2 135391 (OFFEI-HK ...)
1 107.180.2.99 26496 (AS-26496-...)
11 6
Domain Requested by
3 t0.gstatic.com sellerposts.com
1 techtalk.latestone.com sellerposts.com
1 t3.gstatic.com sellerposts.com
1 t2.gstatic.com sellerposts.com
1 mimg.127.net sellerposts.com
1 www.supplychaindigital.com sellerposts.com
1 denkovi.com sellerposts.com
1 t1.gstatic.com sellerposts.com
1 sellerposts.com
11 9

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://sellerposts.com/auto/DHL/index.php
Frame ID: 11282.1
Requests: 11 HTTP requests in this frame

Screenshot


Page Statistics

11
Requests

0 %
HTTPS

17 %
IPv6

6
Domains

9
Subdomains

6
IPs

4
Countries

311 kB
Transfer

308 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.php
sellerposts.com/auto/DHL/
4 KB
4 KB
Document
General
Full URL
http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
103.27.234.90 , India, ASN132779 (RACKBANK-AS RackBank Datacenters Private Ltd, IN),
Reverse DNS
server.wallofindia.com
Software
Apache / PHP/5.5.38
Resource Hash
a14c935723b00f3aba04f040fc5e59bb2fe577edda65558ad3b4c8d1d2e202f3

Request headers

Cache-Control
no-cache
Upgrade-Insecure-Requests
1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language
en-US,en;q=0.8
Connection
keep-alive
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Accept-Encoding
gzip, deflate, sdch
Host
sellerposts.com
Pragma
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

Connection
Keep-Alive
X-Powered-By
PHP/5.5.38
Transfer-Encoding
chunked
Keep-Alive
timeout=15, max=100
Content-Type
text/html
Date
Wed, 30 Nov 2016 20:12:35 GMT
Server
Apache
images
t1.gstatic.com/
10 KB
11 KB
Image
General
Full URL
http://t1.gstatic.com/images?q=tbn:ANd9GcSG3yP24Xd1R7g0dJp9WzG6nTDf1ban0trn-wTqK5KqKVUBVnj-
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
2a00:1450:4001:81c::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
67e7c74758cdee9a8b2202836db22d94dee29068edb7f6fd6f28b944812c5180
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
en-US,en;q=0.8
Connection
keep-alive
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Host
t1.gstatic.com
X-Client-Data
CIi2yQEIpLbJAQ==
Pragma
no-cache
Cache-Control
no-cache
Referer
http://sellerposts.com/auto/DHL/index.php
Accept-Encoding
gzip, deflate, sdch
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-XSS-Protection
1; mode=block
Expires
Thu, 30 Nov 2017 20:04:11 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 30 May 2016 22:01:35 GMT
Age
505
Content-Length
10510
Date
Wed, 30 Nov 2016 20:04:11 GMT
Server
sffe
dhl-express%282%29.png
denkovi.com/userfiles/editor/image/
15 KB
15 KB
Image
General
Full URL
http://denkovi.com/userfiles/editor/image/dhl-express%282%29.png
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
162.144.52.52 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
162-144-52-52.unifiedlayer.com
Software
Apache /
Resource Hash
a595bea134210479f0a9783fcfb664f73ad7bc941c0b8d143e80b6b63260ea95

Request headers

Connection
keep-alive
Accept-Language
en-US,en;q=0.8
Cache-Control
no-cache
Host
denkovi.com
Accept-Encoding
gzip, deflate, sdch
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://sellerposts.com/auto/DHL/index.php
Pragma
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

Keep-Alive
timeout=5, max=100
Server
Apache
Connection
Keep-Alive
Last-Modified
Mon, 14 Nov 2016 13:33:48 GMT
Accept-Ranges
bytes
Expires
Wed, 07 Dec 2016 20:12:25 GMT
Content-Type
image/png
Content-Length
15334
Date
Wed, 30 Nov 2016 20:12:25 GMT
Cache-Control
max-age=604800
Cookie set large_DHL_Aeroplane2.jpg
www.supplychaindigital.com/public/uploads/large/
82 KB
83 KB
Image
General
Full URL
http://www.supplychaindigital.com/public/uploads/large/large_DHL_Aeroplane2.jpg
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
52.1.63.150 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-1-63-150.compute-1.amazonaws.com
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.6.28 /
Resource Hash
a1091c8cb3dd3dde76a272a56f4a857c392b1b5b91f0d691107d1286e8937e98

Request headers

Connection
keep-alive
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Referer
http://sellerposts.com/auto/DHL/index.php
Accept-Encoding
gzip, deflate, sdch
Accept-Language
en-US,en;q=0.8
Accept
image/webp,image/*,*/*;q=0.8
Cache-Control
no-cache
Pragma
no-cache
Host
www.supplychaindigital.com
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

ETag
"14877-540f117043140"
Set-Cookie
AWSELB=01C7B762240FAA8849881E9B0FC96374323DEB3536962D8FEE047C0ADF174137A03733372F5DD09793EA2EA28340B2D5DE06BE8880D468909A220D1BF0EA056387CC5E67;PATH=/;MAX-AGE=60
Last-Modified
Thu, 10 Nov 2016 11:58:21 GMT
Connection
keep-alive
Content-Length
84087
Date
Wed, 30 Nov 2016 20:12:36 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips PHP/5.6.28
Content-Type
image/jpeg
Cache-Control
max-age=604800, public no-cache="set-cookie"
Accept-Ranges
bytes
163logo.gif
mimg.127.net/logo/
7 KB
7 KB
Image
General
Full URL
http://mimg.127.net/logo/163logo.gif
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
43.230.90.2 , Hong Kong, ASN135391 (OFFEI-HK AOFEI DATA INTERNATIONAL COMPANY LIMITED, HK),
Reverse DNS
proxy90-2.mail.163.com
Software
nginx /
Resource Hash
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199

Request headers

Cache-Control
no-cache
Accept-Encoding
gzip, deflate, sdch
Accept
image/webp,image/*,*/*;q=0.8
Connection
keep-alive
Accept-Language
en-US,en;q=0.8
Pragma
no-cache
Host
mimg.127.net
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

Content-Type
image/gif
Content-Length
6671
Accept-Ranges
bytes
Server
nginx
Expires
Wed, 30 Nov 2016 20:48:07 GMT
Date
Wed, 30 Nov 2016 20:08:43 GMT
X-Cache
HIT from HKGM
Last-Modified
Tue, 10 Feb 2009 07:01:48 GMT
Connection
keep-alive
Cache-Control
max-age=3600
images
t0.gstatic.com/
1 KB
1 KB
Image
General
Full URL
http://t0.gstatic.com/images?q=tbn:ANd9GcTDloTtm-fEjXJqjZgKuofPBtzIBYAqUHvVI1pzB9X6-EX_kTZa3g
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
2a00:1450:4001:81c::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
5f00b3b04ae72a52107277c510718e0383f4032da08f884d441c65cbc91a211d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Encoding
gzip, deflate, sdch
Connection
keep-alive
Cache-Control
no-cache
X-Client-Data
CIi2yQEIpLbJAQ==
Accept
image/webp,image/*,*/*;q=0.8
Host
t0.gstatic.com
Pragma
no-cache
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Referer
http://sellerposts.com/auto/DHL/index.php
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
X-XSS-Protection
1; mode=block
Expires
Thu, 30 Nov 2017 20:04:11 GMT
Age
505
Cache-Control
public, max-age=31536000
X-Content-Type-Options
nosniff
Last-Modified
Sun, 07 Jun 2015 22:50:21 GMT
Content-Length
1051
Content-Type
image/jpeg
Date
Wed, 30 Nov 2016 20:04:11 GMT
Server
sffe
images
t0.gstatic.com/
7 KB
8 KB
Image
General
Full URL
http://t0.gstatic.com/images?q=tbn:ANd9GcRaO6bhBI42CKf36t611XhjmxJBcdrHZV4-C03KIR321PA2KNGkfg
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
2a00:1450:4001:81c::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
f15a4944825f5798839f579ce81ca9d3ed9c553968882a9d1a3c0444bf118b27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Cache-Control
no-cache
Accept-Encoding
gzip, deflate, sdch
Referer
http://sellerposts.com/auto/DHL/index.php
X-Client-Data
CIi2yQEIpLbJAQ==
Accept-Language
en-US,en;q=0.8
Accept
image/webp,image/*,*/*;q=0.8
Host
t0.gstatic.com
Connection
keep-alive
Pragma
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

Cache-Control
public, max-age=31536000
Content-Type
image/jpeg
X-Content-Type-Options
nosniff
Server
sffe
Age
347809
X-XSS-Protection
1; mode=block
Date
Sat, 26 Nov 2016 19:35:47 GMT
Expires
Sun, 26 Nov 2017 19:35:47 GMT
Access-Control-Allow-Origin
*
Content-Length
7570
Last-Modified
Mon, 29 Feb 2016 02:36:30 GMT
images
t2.gstatic.com/
5 KB
6 KB
Image
General
Full URL
http://t2.gstatic.com/images?q=tbn:ANd9GcT85BKdtLVGjFCGyQN8s44RAV1eTQmUGRVUOqXyITeHWBTu6TtNxg
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
2a00:1450:4001:81c::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
97cb97f002e1a03fdb9c5741d75f88de6eb2179f46b54d8c203eb72c6305480a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://sellerposts.com/auto/DHL/index.php
Connection
keep-alive
Accept-Language
en-US,en;q=0.8
Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Accept
image/webp,image/*,*/*;q=0.8
X-Client-Data
CIi2yQEIpLbJAQ==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Cache-Control
no-cache
Host
t2.gstatic.com
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

Age
505
Content-Length
5348
X-XSS-Protection
1; mode=block
Content-Type
image/jpeg
Expires
Thu, 30 Nov 2017 20:04:11 GMT
Access-Control-Allow-Origin
*
Server
sffe
Cache-Control
public, max-age=31536000
Last-Modified
Tue, 12 Jan 2016 15:01:36 GMT
X-Content-Type-Options
nosniff
Date
Wed, 30 Nov 2016 20:04:11 GMT
images
t0.gstatic.com/
2 KB
2 KB
Image
General
Full URL
http://t0.gstatic.com/images?q=tbn:ANd9GcQVdKwjofHMs4cOdDpxVZdMqyH3WaP3Xf1_dPBdc9u2jP2MP3jfEg
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
2a00:1450:4001:81c::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
071665f029d1045f6f38b6378677d395ae0ceae22b758c0169c3f51fd60ee2b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Connection
keep-alive
Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
t0.gstatic.com
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Cache-Control
no-cache
Accept-Language
en-US,en;q=0.8
X-Client-Data
CIi2yQEIpLbJAQ==
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

Cache-Control
public, max-age=31536000
Content-Length
2076
Date
Wed, 30 Nov 2016 20:04:11 GMT
Age
505
X-Content-Type-Options
nosniff
Access-Control-Allow-Origin
*
Last-Modified
Sat, 29 Nov 2014 18:00:37 GMT
Server
sffe
Content-Type
image/png
X-XSS-Protection
1; mode=block
Expires
Thu, 30 Nov 2017 20:04:11 GMT
images
t3.gstatic.com/
2 KB
2 KB
Image
General
Full URL
http://t3.gstatic.com/images?q=tbn:ANd9GcTHy4txXcn9D32MCGrfRf2s4cmbnkyOmZmQJVmKULwy9gimP1WW
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
2a00:1450:4001:81c::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
f86c7bf0ffe0273cfbaf43f2847e66d41c84e0bb528028f6fb6adc85a70c26ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://sellerposts.com/auto/DHL/index.php
Host
t3.gstatic.com
Connection
keep-alive
Accept-Encoding
gzip, deflate, sdch
Accept
image/webp,image/*,*/*;q=0.8
Cache-Control
no-cache
Pragma
no-cache
Accept-Language
en-US,en;q=0.8
X-Client-Data
CIi2yQEIpLbJAQ==
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Referer
http://sellerposts.com/auto/DHL/index.php

Response headers

Expires
Thu, 30 Nov 2017 20:04:11 GMT
Date
Wed, 30 Nov 2016 20:04:11 GMT
Cache-Control
public, max-age=31536000
X-XSS-Protection
1; mode=block
Age
505
X-Content-Type-Options
nosniff
Last-Modified
Tue, 27 Jan 2015 15:02:22 GMT
Server
sffe
Content-Type
image/png
Content-Length
1944
Access-Control-Allow-Origin
*
401db19e-02c2-4dcd-9b22-8007a402baa9.jpg
techtalk.latestone.com/wp-content/uploads/2015/01/
172 KB
172 KB
Image
General
Full URL
http://techtalk.latestone.com/wp-content/uploads/2015/01/401db19e-02c2-4dcd-9b22-8007a402baa9.jpg
Requested by
Host: sellerposts.com
URL: http://sellerposts.com/auto/DHL/index.php
Protocol
HTTP/1.1
Server
107.180.2.99 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS
ip-107-180-2-99.ip.secureserver.net
Software
Apache/2.4.23 /
Resource Hash
b5aa71dec6f7bbca47325a17a34ada6df34883639031dc247ba224211913d33a

Request headers

Referer
http://sellerposts.com/auto/DHL/index.php
Pragma
no-cache
Cache-Control
no-cache
Accept
image/webp,image/*,*/*;q=0.8
Host
techtalk.latestone.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36
Connection
keep-alive
Accept-Language
en-US,en;q=0.8
Accept-Encoding
gzip, deflate, sdch
Referer
http://sellerposts.com/auto/DHL/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.100 Safari/537.36

Response headers

Date
Wed, 30 Nov 2016 20:12:36 GMT
Accept-Ranges
bytes
ETag
"73032cd-2b06b-50cfbffd49600"
Keep-Alive
timeout=5
Content-Type
image/jpeg
Connection
Keep-Alive
Server
Apache/2.4.23
Last-Modified
Mon, 19 Jan 2015 07:09:12 GMT
Content-Length
176235

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 163.cn (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies