bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2602:fea2:2::3, located in United States and belongs to PROTOCOL, US. The main domain is bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link.
TLS certificate: Issued by E5 on October 10th 2024. Valid for: 3 months.

This is the only time bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Naver (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	2602:fea2:2::3 2602:fea2:2::3	40680 (PROTOCOL) (PROTOCOL)
1	223.130.195.168 223.130.195.168	23576 (NHN-AS-KR...) (NHN-AS-KR NAVER Cloud Corp.)
4	184.25.36.65 184.25.36.65	16625 (AKAMAI-AS) (AKAMAI-AS)
6	3

1 2602:fea2:2::3 (United States)

ASN40680 (PROTOCOL, US)

bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 223.130.195.168 (Korea, Republic Of)

ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR)

nid.naver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 184.25.36.65 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-25-36-65.deploy.static.akamaitechnologies.com

ssl.pstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	pstatic.net ssl.pstatic.net — Cisco Umbrella Rank: 11532	160 KB
1	naver.com nid.naver.com — Cisco Umbrella Rank: 18076	6 KB
1	dweb.link bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link	3 KB
6	3

	Domain	Requested by
4	ssl.pstatic.net	bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link nid.naver.com
1	nid.naver.com	bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link
1	bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link
6	3

This site contains no links.

Subject Issuer	Validity	Valid
dweb.link E5	`2024-10-10` - `2025-01-08`	3 months	crt.sh
nid.naver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2024-08-28` - `2025-09-16`	a year	crt.sh
ssl.pstatic.net GeoTrust RSA CA 2018	`2024-10-30` - `2025-07-18`	9 months	crt.sh

This page contains 1 frames:

Primary Page: https://bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link/
Frame ID: 01F7FCD518A1B7F1E0EB0AF117189478
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

네이버 : 로그인

Page Statistics

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

169 kB
Transfer

196 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link/	11 KB 3 KB	85ms 26ms	Document text/html	2602:fea2:2::3 PROTOCOL
General Check archive.org Show headers Download Go to Full URL https://bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link/ Protocol H3 Security QUIC, , AES_128_GCM Server 2602:fea2:2::3 , United States, ASN40680 (PROTOCOL, US), Reverse DNS Software cloudflare / Resource Hash `d1624e00d8229e3df4c6ad5050642c2093e0df29e7e14809055fa35ad56cf476` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type Range User-Agent X-Requested-With access-control-allow-methods GET HEAD OPTIONS access-control-allow-origin * access-control-expose-headers Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output age 5136386 alt-svc h3=":443"; ma=86400 cache-control public, max-age=29030400, immutable cf-cache-status HIT cf-ray 8e4fb5aa3a685e6c-EWR content-encoding br content-type text/html date Tue, 19 Nov 2024 11:02:43 GMT server cloudflare vary Accept-Encoding x-ipfs-path /ipfs/bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga/ x-ipfs-pop rainbow-ny5-04 x-ipfs-roots bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga
GET H2	200	w_20220216.css nid.naver.com/login/css/global/desktop/	27 KB 6 KB	1167ms 226ms	Stylesheet text/css	223.130.195.168 NHN-AS-KR NAVER C...
General Check archive.org Show headers Download Go to Full URL https://nid.naver.com/login/css/global/desktop/w_20220216.css?20210812 Requested by Host: bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link URL: https://bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 223.130.195.168 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR), Reverse DNS Software nginx / Resource Hash `de1f6ef9f776adff8398700d0253745557df93c37972e8be399b11f31f408256` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link/ Response headers content-encoding gzip accept-ch dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile etag W/"673c3037-6a84" accept-ch-lifetime 86400 x-ua-compatible IE=edge date Tue, 19 Nov 2024 11:02:44 GMT content-type text/css last-modified Tue, 19 Nov 2024 06:29:11 GMT server nginx vary Accept-Encoding
GET H2	200	m_banner_2step_924x294.png ssl.pstatic.net/static/nid/login/banner/	54 KB 54 KB	116ms 16ms	Image image/png	184.25.36.65 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.pstatic.net/static/nid/login/banner/m_banner_2step_924x294.png Requested by Host: bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link URL: https://bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.25.36.65 Ashburn, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-25-36-65.deploy.static.akamaitechnologies.com Software Testa/6.2.4 / Resource Hash `dbec0a6f4f63ad346cc2e20fd1c52dd79a019978ee031ba0f76dbcb9d3fac6df` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link/ Response headers cache-control max-age=147437 referrer-policy unsafe-url expires Thu, 21 Nov 2024 04:00:00 GMT accept-ranges bytes access-control-allow-origin * content-length 55608 date Tue, 19 Nov 2024 11:02:43 GMT last-modified Mon, 12 Apr 2021 07:18:08 GMT content-type image/png server Testa/6.2.4
GET H2	200	m_sp_00_common_978240a6.png ssl.pstatic.net/static/nid/login/	21 KB 21 KB	15ms 15ms	Image image/png	184.25.36.65 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.pstatic.net/static/nid/login/m_sp_00_common_978240a6.png Requested by Host: nid.naver.com URL: https://nid.naver.com/login/css/global/desktop/w_20220216.css?20210812 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.25.36.65 Ashburn, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-25-36-65.deploy.static.akamaitechnologies.com Software Testa/6.2.4 / Resource Hash `3be89f766c6a9ac418ec1c6f33dc7a24607a6e067c0731e77b8cc01fb3355bc7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://nid.naver.com/ Response headers cache-control max-age=95030 referrer-policy unsafe-url expires Wed, 20 Nov 2024 13:26:34 GMT accept-ranges bytes access-control-allow-origin * akamai-loopback-request 8096267 content-length 21505 date Tue, 19 Nov 2024 11:02:44 GMT last-modified Thu, 28 Oct 2021 05:48:39 GMT content-type image/png server Testa/6.2.4
GET H2	200	m_sp_01_login_008d5216.png ssl.pstatic.net/static/nid/login/	83 KB 83 KB	22ms 22ms	Image image/png	184.25.36.65 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.pstatic.net/static/nid/login/m_sp_01_login_008d5216.png Requested by Host: nid.naver.com URL: https://nid.naver.com/login/css/global/desktop/w_20220216.css?20210812 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.25.36.65 Ashburn, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-25-36-65.deploy.static.akamaitechnologies.com Software Testa/6.2.4 / Resource Hash `1bf14b8b72b6a63f58405cf21a1954a75b85b00c85fec19bc784d33f6c8e4a64` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://nid.naver.com/ Response headers cache-control max-age=427328 referrer-policy unsafe-url expires Sun, 24 Nov 2024 09:44:52 GMT accept-ranges bytes access-control-allow-origin * content-length 85176 date Tue, 19 Nov 2024 11:02:44 GMT last-modified Wed, 16 Feb 2022 12:15:27 GMT content-type image/png server Testa/6.2.4
GET H2	200	og_v3.png ssl.pstatic.net/sstatic/search/common/	724 B 888 B	53ms 52ms	Other image/png	184.25.36.65 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://ssl.pstatic.net/sstatic/search/common/og_v3.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.25.36.65 Ashburn, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-25-36-65.deploy.static.akamaitechnologies.com Software Testa/6.1.1 / Resource Hash `624901f7513fa4aae712d94f8e47cbc3be38a4d3ac0d433c5eac74c23007c777` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link/ Response headers cache-control max-age=27367021 etag "2d4-537a969e26a40" expires Thu, 02 Oct 2025 04:59:45 GMT accept-ranges bytes content-length 724 date Tue, 19 Nov 2024 11:02:44 GMT last-modified Fri, 15 Jul 2016 09:40:49 GMT content-type image/png server Testa/6.1.1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Naver (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link
nid.naver.com
ssl.pstatic.net
184.25.36.65
223.130.195.168
2602:fea2:2::3
1bf14b8b72b6a63f58405cf21a1954a75b85b00c85fec19bc784d33f6c8e4a64
3be89f766c6a9ac418ec1c6f33dc7a24607a6e067c0731e77b8cc01fb3355bc7
624901f7513fa4aae712d94f8e47cbc3be38a4d3ac0d433c5eac74c23007c777
d1624e00d8229e3df4c6ad5050642c2093e0df29e7e14809055fa35ad56cf476
dbec0a6f4f63ad346cc2e20fd1c52dd79a019978ee031ba0f76dbcb9d3fac6df
de1f6ef9f776adff8398700d0253745557df93c37972e8be399b11f31f408256

bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link Open in urlscan Pro 2602:fea2:2::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

169 kBTransfer

196 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

bafybeie5f5zmnofaardfauktuutu6zxh6pju6itev6tgck7kdwezlbmvga.ipfs.dweb.link Open in urlscan Pro
2602:fea2:2::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

169 kB
Transfer

196 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!