ago2.co.kr Open in urlscan Pro
49.212.180.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Submission: On July 11 via manual (July 11th 2018, 3:59:29 pm UTC) from US

Summary HTTP 17 Redirects Links 43 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 3 domains to perform 17 HTTP transactions. The main IP is 49.212.180.106, located in Osaka, Japan and belongs to SAKURA-C SAKURA Internet Inc., JP. The main domain is ago2.co.kr.

This is the only time ago2.co.kr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Naver (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	49.212.180.106 49.212.180.106	9371 (SAKURA-C ...) (SAKURA-C SAKURA Internet Inc.)
4	203.104.163.42 203.104.163.42	23576 (NHN-AS-KR...) (NHN-AS-KR NBP)
6	125.209.226.239 125.209.226.239	23576 (NHN-AS-KR...) (NHN-AS-KR NBP)
6	2.18.233.157 2.18.233.157	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
17	5

1 49.212.180.106 (Osaka, Japan)

ASN9371 (SAKURA-C SAKURA Internet Inc., JP)
PTR: www2696.sakura.ne.jp

ago2.co.kr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 203.104.163.42 (Korea, Republic Of)

ASN23576 (NHN-AS-KR NBP, KR)

nid.naver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 125.209.226.239 (Korea, Republic Of)

ASN23576 (NHN-AS-KR NBP, KR)

static.nid.naver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.18.233.157 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-157.deploy.static.akamaitechnologies.com

ssl.pstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	naver.com nid.naver.com static.nid.naver.com	107 KB
6	pstatic.net ssl.pstatic.net	62 KB
1	ago2.co.kr ago2.co.kr	14 KB
17	3

	Domain	Requested by
6	ssl.pstatic.net	ago2.co.kr static.nid.naver.com
6	static.nid.naver.com	ago2.co.kr static.nid.naver.com
4	nid.naver.com	ago2.co.kr
1	ago2.co.kr
17	4

This site contains links to these domains. Also see Links.

Domain
nid.naver.com
www.naver.com
mail.naver.com
pay.naver.com
blog.naver.com
section.cafe.naver.com
me.naver.com
cafe.naver.com
news.naver.com
map.naver.com
sports.news.naver.com
game.naver.com
section.blog.naver.com
post.naver.com
dic.naver.com
kin.naver.com
weather.naver.com
stock.naver.com
land.naver.com
music.naver.com
book.naver.com
shopping.naver.com
comic.naver.com
movie.naver.com
cloud.naver.com
auto.naver.com
campaign.naver.com
help.naver.com
www.navercorp.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Frame ID: B4211A177546FAE81AB3104EA38107F4
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

비밀번호 재확인 : 네이버 내정보

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

17
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

182 kB
Transfer

520 kB
Size

0
Cookies

43 Outgoing links

These are links going to different origins than the main page.

URL: https://nid.naver.com/#lnb
Title: 주메뉴로 바로가기

Search URL Search Domain Scan URL

URL: https://nid.naver.com/#content
Title: 본문으로 바로가기

Search URL Search Domain Scan URL

URL: http://www.naver.com/
Title: NAVER

Search URL Search Domain Scan URL

URL: https://nid.naver.com/user2/help/myInfo.nhn?menu=home&lang=ko_KR
Title: 내정보

Search URL Search Domain Scan URL

URL: https://nid.naver.com/nidlogin.login
Title: 로그인

Search URL Search Domain Scan URL

URL: https://nid.naver.com/
Title: (임직원혜택)

Search URL Search Domain Scan URL

URL: https://nid.naver.com/user2/api/naverProfile.nhn?m=checkIdType
Title: 프로필 사진 변경

Search URL Search Domain Scan URL

URL: https://nid.naver.com/nidlogin.logout?returl=https%3A%2F%2Fnid.naver.com%2Fuser2%2Fhelp%2FmyInfo.nhn%3Fmenu%3Dhome
Title: 로그아웃

Search URL Search Domain Scan URL

URL: http://mail.naver.com/
Title: :@naver.com

Search URL Search Domain Scan URL

URL: https://nid.naver.com/user2/help/myInfo.nhn?menu=home
Title: 내정보

Search URL Search Domain Scan URL

URL: https://nid.naver.com/user2/help/myInfo.nhn?m=viewSecurity&menu=security
Title: 보안설정

Search URL Search Domain Scan URL

URL: http://pay.naver.com/
Title: 내 페이포인트

Search URL Search Domain Scan URL

URL: http://blog.naver.com/MyBlog.nhn
Title: 내 블로그

Search URL Search Domain Scan URL

URL: http://section.cafe.naver.com/
Title: 가입한 카페

Search URL Search Domain Scan URL

URL: http://me.naver.com/box/noti.nhn
Title: 내 알림 전체보기

Search URL Search Domain Scan URL

URL: http://cafe.naver.com/
Title: 카페

Search URL Search Domain Scan URL

URL: http://news.naver.com/
Title: 뉴스

Search URL Search Domain Scan URL

URL: http://map.naver.com/
Title: 지도

Search URL Search Domain Scan URL

URL: http://sports.news.naver.com/
Title: 스포츠

Search URL Search Domain Scan URL

URL: http://game.naver.com/
Title: 게임

Search URL Search Domain Scan URL

URL: http://section.blog.naver.com/
Title: 블로그

Search URL Search Domain Scan URL

URL: http://post.naver.com/main.nhn
Title: 포스트

Search URL Search Domain Scan URL

URL: http://dic.naver.com/
Title: 사전

Search URL Search Domain Scan URL

URL: http://kin.naver.com/
Title: 지식iN

Search URL Search Domain Scan URL

URL: http://weather.naver.com/
Title: 날씨

Search URL Search Domain Scan URL

URL: http://stock.naver.com/
Title: 증권

Search URL Search Domain Scan URL

URL: http://land.naver.com/
Title: 부동산

Search URL Search Domain Scan URL

URL: http://music.naver.com/
Title: 뮤직

Search URL Search Domain Scan URL

URL: http://book.naver.com/
Title: 책

Search URL Search Domain Scan URL

URL: http://shopping.naver.com/
Title: 쇼핑

Search URL Search Domain Scan URL

URL: http://comic.naver.com/
Title: 웹툰

Search URL Search Domain Scan URL

URL: http://movie.naver.com/
Title: 영화

Search URL Search Domain Scan URL

URL: http://cloud.naver.com/
Title: 클라우드

Search URL Search Domain Scan URL

URL: http://auto.naver.com/
Title: 자동차

Search URL Search Domain Scan URL

URL: https://campaign.naver.com/npay/rediret/index.nhn

Search URL Search Domain Scan URL

URL: http://www.naver.com/more.html
Title: 전체 서비스 보기

Search URL Search Domain Scan URL

URL: https://nid.naver.com/user2/help/myInfo.nhn?m=viewSecurity&menu=security&lang=ko_KR
Title: 보안설정

Search URL Search Domain Scan URL

URL: http://www.naver.com/rules/privacy.html
Title: 개인정보취급방침

Search URL Search Domain Scan URL

URL: http://www.naver.com/rules/disclaimer.html
Title: 책임의 한계와 법적 고지

Search URL Search Domain Scan URL

URL: https://help.naver.com/support/service/main.nhn?serviceNo=532
Title: 회원정보 고객센터

Search URL Search Domain Scan URL

URL: https://nid.naver.com/notice/myInfoNotice.nhn
Title: 공지사항

Search URL Search Domain Scan URL

URL: http://www.navercorp.com/
Title: NAVER

Search URL Search Domain Scan URL

URL: http://www.navercorp.com/ko/index.nhn
Title: NAVER Corp.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ago2.co.kr/data/1501/rental/ 13 KB
14 KB 1214ms
662ms Document
text/html 49.212.180.106
SAKURA-C SAKURA I...

General

Check archive.org

Show headers Download Go to

Full URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: HTTP/1.1
Server: 49.212.180.106 Osaka, Japan, ASN9371 (SAKURA-C SAKURA Internet Inc., JP),
Reverse DNS: www2696.sakura.ne.jp
Software: nginx /
Resource Hash: f0b03886f67a95a9cde0c00e89db8b9188deb27bc815d87565fd0f18241ac24c

Request headers

Host: ago2.co.kr
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: B4211A177546FAE81AB3104EA38107F4

Response headers

Server: nginx
Date: Wed, 11 Jul 2018 15:59:12 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive

GET
S 200 m.jquery.js Show response
nid.naver.com/inc/mobile/js/ 84 KB
29 KB 45ms
6ms Script
application/javascript 203.104.163.42
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to

Full URL: https://nid.naver.com/inc/mobile/js/m.jquery.js?20140912
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: SPDY
Server: 203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software: nginx /
Resource Hash: 63eee4fa8b21de372a537d286cbf11a2f47d958c297ca4a3b498005873285ea7

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 11 Jul 2018 15:59:13 GMT
content-encoding: gzip
last-modified: Tue, 03 Jul 2018 07:06:29 GMT
server: nginx
etag: W/"5b3b2075-14e36"
vary: Accept-Encoding
content-type: application/javascript
status: 200

GET
S 200 help_member.css
nid.naver.com/inc/user/css/ko/ 214 KB
36 KB 44ms
6ms Stylesheet
text/css 203.104.163.42
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to

Full URL: https://nid.naver.com/inc/user/css/ko/help_member.css?20160314
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: SPDY
Server: 203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software: nginx /
Resource Hash: fe6c0dc5722a9b10ea59fa875791372e4bba5a0b2e9a943916330797c8439a6d

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 11 Jul 2018 15:59:13 GMT
content-encoding: gzip
last-modified: Tue, 03 Jul 2018 07:06:29 GMT
server: nginx
etag: W/"5b3b2075-35725"
vary: Accept-Encoding
content-type: text/css
status: 200

GET
S 404 passwdAjax.js
nid.naver.com/js/ 0
0 44ms
6ms Script
text/html 203.104.163.42
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to

Full URL: https://nid.naver.com/js/passwdAjax.js?20140717
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: SPDY
Server: 203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-type: text/html

GET
H/1.1 200
OK gnb_utf8.nhn Show response
static.nid.naver.com/template/ 131 KB
31 KB 1846ms
743ms Script
application/x-javascript 125.209.226.239
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to

Full URL: https://static.nid.naver.com/template/gnb_utf8.nhn?2016.%208.%2017
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: HTTP/1.1
Server: 125.209.226.239 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software: nginx /
Resource Hash: bb3038e0a92600d9300ae8de532b7c554dbb3f78dc645bf8230d32ad4d07ea24

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 11 Jul 2018 15:59:14 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Jul 2018 05:34:22 GMT
Server: nginx
ETag: W/"5b3b0ade-20aca"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=86400
Connection: keep-alive
Expires: Thu, 12 Jul 2018 15:59:14 GMT

GET
S 404 passwdAjax.js
nid.naver.com/js/ 0
0 6ms
6ms Script
text/html 203.104.163.42
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to

Full URL: https://nid.naver.com/js/passwdAjax.js?20140717
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: SPDY
Server: 203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-type: text/html

GET
H/1.1 200
OK pc_sp_txt_shape.png
static.nid.naver.com/images/ui/myinfo/ 7 KB
7 KB 1467ms
372ms Image
image/png 125.209.226.239
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.nid.naver.com/images/ui/myinfo/pc_sp_txt_shape.png
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: HTTP/1.1
Server: 125.209.226.239 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software: nginx /
Resource Hash: 58730f842267e35a5526afd726a1268e98accd4cce470ddb8865768cd15bb42b

Request headers

Referer: https://nid.naver.com/inc/user/css/ko/help_member.css?20160314
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 11 Jul 2018 15:59:15 GMT
Last-Modified: Wed, 02 Nov 2016 02:36:08 GMT
Server: nginx
ETag: "58195118-1a7c"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6780
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK sp_u_skip.png
static.nid.naver.com/images/web/user/ 967 B
1 KB 371ms
370ms Image
image/png 125.209.226.239
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.nid.naver.com/images/web/user/sp_u_skip.png
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: HTTP/1.1
Server: 125.209.226.239 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software: nginx /
Resource Hash: 67bef5d26af42c5a7842ecd98bf3df205cf8de0270802b34a2380de4eb517d46

Request headers

Referer: https://nid.naver.com/inc/user/css/ko/help_member.css?20160314
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 11 Jul 2018 15:59:15 GMT
Last-Modified: Mon, 11 Apr 2016 11:25:27 GMT
Server: nginx
ETag: "570b89a7-3c7"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 967
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 26 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/gif

GET
S 200 promo_npay.png
ssl.pstatic.net/static/common/gnb/2014/ 19 KB
19 KB 33ms
6ms Image
image/png 2.18.233.157
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.pstatic.net/static/common/gnb/2014/promo_npay.png
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: SPDY
Server: 2.18.233.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-157.deploy.static.akamaitechnologies.com
Software: Testa/4.8.6 /
Resource Hash: f84fd6ce91cb1586bd658d0bcc5b98046030e18faabbc96a5b0520b129ecf132

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 11 Jul 2018 15:59:15 GMT
last-modified: Mon, 02 Nov 2015 01:46:59 GMT
server: Testa/4.8.6
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=274925
accept-ranges: bytes
content-length: 19450
expires: Sat, 14 Jul 2018 20:21:20 GMT

GET
H/1.1 200
OK ci_naver.png
static.nid.naver.com/images/web/user/ 560 B
865 B 372ms
371ms Image
image/png 125.209.226.239
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.nid.naver.com/images/web/user/ci_naver.png
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: HTTP/1.1
Server: 125.209.226.239 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software: nginx /
Resource Hash: 326563f7904e43af49eaaf79934acf49b692fb66d10db05e18df823a8703aa82

Request headers

Referer: https://nid.naver.com/inc/user/css/ko/help_member.css?20160314
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 11 Jul 2018 15:59:15 GMT
Last-Modified: Mon, 11 Apr 2016 11:25:27 GMT
Server: nginx
ETag: "570b89a7-230"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 560
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK getLoginStatus.nhn Show response
static.nid.naver.com/ 136 B
537 B 533ms
372ms Script
application/x-javascript 125.209.226.239
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to

Full URL

https://static.nid.naver.com/getLoginStatus.nhn?callback=showGNB&charset=utf-8&svc=nid&template=gnb_utf8&one_naver=1

Requested by

Host: static.nid.naver.com
URL: https://static.nid.naver.com/template/gnb_utf8.nhn?2016.%208.%2017

Protocol

HTTP/1.1

Server

125.209.226.239 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),

Reverse DNS

Software

nginx /

Resource Hash

d14c65ad2dc2a19e86c82d9e64935da29c42d312ab6c326028aace59a85a2c80

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 11 Jul 2018 15:59:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Transfer-Encoding: chunked
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-store, no-cache, must-revalidate
Connection: keep-alive
Expires: -1

GET
S 200 clickcrD.js Show response
ssl.pstatic.net/static.gn/js/ 13 KB
4 KB 8ms
5ms Script
application/javascript 2.18.233.157
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.pstatic.net/static.gn/js/clickcrD.js
Requested by: Host: static.nid.naver.com
URL: https://static.nid.naver.com/template/gnb_utf8.nhn?2016.%208.%2017
Protocol: SPDY
Server: 2.18.233.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-157.deploy.static.akamaitechnologies.com
Software: Testa/4.8.6 /
Resource Hash: fd38ea5606027922a3202e65a2656f9f9b237062cd3d36a154f557b9462dea7a

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 11 Jul 2018 15:59:16 GMT
content-encoding: gzip
last-modified: Tue, 03 Jul 2018 05:34:22 GMT
server: Testa/4.8.6
etag: "5b3b0ade-3502-df"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=28170
accept-ranges: bytes
content-length: 4060
expires: Wed, 11 Jul 2018 23:48:46 GMT

GET
S 200 promo_npay_1807.png
ssl.pstatic.net/static/common/gnb/banner/ 4 KB
4 KB 9ms
6ms Image
image/png 2.18.233.157
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.pstatic.net/static/common/gnb/banner/promo_npay_1807.png
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: SPDY
Server: 2.18.233.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-157.deploy.static.akamaitechnologies.com
Software: Testa/4.8.6 /
Resource Hash: f9c6c91045ab3fa79438efa4b83c799d9e911f7d152930e5a3db2c2f2d8a78d6

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 11 Jul 2018 15:59:16 GMT
last-modified: Mon, 25 Jun 2018 09:05:53 GMT
server: Testa/4.8.6
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=195200
accept-ranges: bytes
content-length: 3799
expires: Fri, 13 Jul 2018 22:12:36 GMT

GET
S 200 bg_one_line.png
ssl.pstatic.net/static/common/gnb/ 923 B
1 KB 8ms
5ms Image
image/png 2.18.233.157
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.pstatic.net/static/common/gnb/bg_one_line.png
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: SPDY
Server: 2.18.233.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-157.deploy.static.akamaitechnologies.com
Software: Testa/4.8.6 /
Resource Hash: 0039debc4c5dc14f3f6e3d97c49e93531547d0e9e47791eeade306d68a3ba1df

Request headers

Referer: https://nid.naver.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 11 Jul 2018 15:59:16 GMT
last-modified: Wed, 26 Oct 2016 08:22:55 GMT
server: Testa/4.8.6
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=544129
accept-ranges: bytes
content-length: 923
expires: Tue, 17 Jul 2018 23:08:05 GMT

GET
S 200 sp_gnb_v14.png
ssl.pstatic.net/static/common/gnb/one/ 32 KB
32 KB 9ms
6ms Image
image/png 2.18.233.157
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.pstatic.net/static/common/gnb/one/sp_gnb_v14.png
Requested by: Host: ago2.co.kr
URL: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
Protocol: SPDY
Server: 2.18.233.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-157.deploy.static.akamaitechnologies.com
Software: Testa/4.8.6 /
Resource Hash: ca65206e2b21878267729e3c416204c3a48a78dace602a49a07c54ef46e88c8a

Request headers

Referer: https://nid.naver.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 11 Jul 2018 15:59:16 GMT
last-modified: Mon, 13 Nov 2017 06:24:28 GMT
server: Testa/4.8.6
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=275323
accept-ranges: bytes
content-length: 32647
expires: Sat, 14 Jul 2018 20:27:59 GMT

GET
H/1.1 200
OK img_aside_photo_default.png
static.nid.naver.com/images/web/user/ 416 B
721 B 373ms
371ms Image
image/png 125.209.226.239
NHN-AS-KR NBP

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.nid.naver.com/images/web/user/img_aside_photo_default.png
Protocol: HTTP/1.1
Server: 125.209.226.239 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software: nginx /
Resource Hash: f09f617bce1db1becd59e76bfea75c67de224d170bff5cf5b2db0523aad3302b

Request headers

Referer: http://ago2.co.kr/data/1501/rental/?m=viewInputPasswdForMyInfo&menu=security&token_help=Og==
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 11 Jul 2018 15:59:16 GMT
Last-Modified: Mon, 11 Apr 2016 11:25:27 GMT
Server: nginx
ETag: "570b89a7-1a0"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 416
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
S 200 ico_arrow_wh.gif
ssl.pstatic.net/static/common/gnb/2014/ 1 KB
1 KB 8ms
5ms Image
image/gif 2.18.233.157
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssl.pstatic.net/static/common/gnb/2014/ico_arrow_wh.gif
Protocol: SPDY
Server: 2.18.233.157 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-157.deploy.static.akamaitechnologies.com
Software: Testa/4.8.6 /
Resource Hash: d1e5459bb721f16889458a78d54e987baee3710244a51e96bd59659729bfd209

Request headers

Referer: https://nid.naver.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 11 Jul 2018 15:59:16 GMT
last-modified: Mon, 20 Apr 2015 03:25:07 GMT
server: Testa/4.8.6
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=542604
accept-ranges: bytes
content-length: 1100
expires: Tue, 17 Jul 2018 22:42:40 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Naver (Online)

65 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ago2.co.kr
nid.naver.com
ssl.pstatic.net
static.nid.naver.com
125.209.226.239
2.18.233.157
203.104.163.42
49.212.180.106
0039debc4c5dc14f3f6e3d97c49e93531547d0e9e47791eeade306d68a3ba1df
326563f7904e43af49eaaf79934acf49b692fb66d10db05e18df823a8703aa82
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
58730f842267e35a5526afd726a1268e98accd4cce470ddb8865768cd15bb42b
63eee4fa8b21de372a537d286cbf11a2f47d958c297ca4a3b498005873285ea7
67bef5d26af42c5a7842ecd98bf3df205cf8de0270802b34a2380de4eb517d46
bb3038e0a92600d9300ae8de532b7c554dbb3f78dc645bf8230d32ad4d07ea24
ca65206e2b21878267729e3c416204c3a48a78dace602a49a07c54ef46e88c8a
d14c65ad2dc2a19e86c82d9e64935da29c42d312ab6c326028aace59a85a2c80
d1e5459bb721f16889458a78d54e987baee3710244a51e96bd59659729bfd209
f09f617bce1db1becd59e76bfea75c67de224d170bff5cf5b2db0523aad3302b
f0b03886f67a95a9cde0c00e89db8b9188deb27bc815d87565fd0f18241ac24c
f84fd6ce91cb1586bd658d0bcc5b98046030e18faabbc96a5b0520b129ecf132
f9c6c91045ab3fa79438efa4b83c799d9e911f7d152930e5a3db2c2f2d8a78d6
fd38ea5606027922a3202e65a2656f9f9b237062cd3d36a154f557b9462dea7a
fe6c0dc5722a9b10ea59fa875791372e4bba5a0b2e9a943916330797c8439a6d

ago2.co.kr Open in urlscan Pro 49.212.180.106 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

17 Requests

0 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

5 IPs

3 Countries

182 kBTransfer

520 kBSize

0 Cookies

43 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

65 JavaScript Global Variables

0 Cookies

Indicators

ago2.co.kr Open in urlscan Pro
49.212.180.106 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

5
IPs

3
Countries

182 kB
Transfer

520 kB
Size

0
Cookies

17 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!