urlscan.io logo urlscan.io
SecurityTrails logo

wvvw.userlogin.r-e.kr Open in urlscan Pro
210.16.120.212  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://rebrand.ly/w7fuydl
Effective URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Submission: On October 13 via manual from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 4 domains to perform 18 HTTP transactions. The main IP is 210.16.120.212, located in Singapore and belongs to HOSTUS-GLOBAL-AS HostUS, HK. The main domain is wvvw.userlogin.r-e.kr.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on August 1st 2022. Valid for: 3 months.
This is the only time wvvw.userlogin.r-e.kr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Naver (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 3.226.62.59 14618 (AMAZON-AES)
3 210.16.120.212 7489 (HOSTUS-GL...)
8 125.209.226.33 23576 (NHN-AS-KR...)
5 223.130.195.167 23576 (NHN-AS-KR...)
1 23.217.160.172 16625 (AKAMAI-AS)
1 203.104.164.18 23576 (NHN-AS-KR...)
18 6
1    3.226.62.59 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-226-62-59.compute-1.amazonaws.com
rebrand.ly
3    210.16.120.212 (Singapore)

ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK)
wvvw.userlogin.r-e.kr
8    125.209.226.33 (Korea, Republic Of)

ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR)
nid.naver.com
5    223.130.195.167 (Korea, Republic Of)

ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR)
static.nid.naver.com
1    23.217.160.172 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-217-160-172.deploy.static.akamaitechnologies.com
ssl.pstatic.net
1    203.104.164.18 (Singapore)

ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR)
lcs.naver.com
Apex Domain
Subdomains		 Transfer
14 naver.com
nid.naver.com — Cisco Umbrella Rank: 14627
static.nid.naver.com — Cisco Umbrella Rank: 47243
lcs.naver.com — Cisco Umbrella Rank: 29816
104 KB
3 r-e.kr
wvvw.userlogin.r-e.kr
347 KB
1 pstatic.net
ssl.pstatic.net — Cisco Umbrella Rank: 10762
4 KB
1 rebrand.ly
rebrand.ly — Cisco Umbrella Rank: 48618
369 B
18 4
Domain Requested by
8 nid.naver.com wvvw.userlogin.r-e.kr
5 static.nid.naver.com wvvw.userlogin.r-e.kr
static.nid.naver.com
3 wvvw.userlogin.r-e.kr wvvw.userlogin.r-e.kr
1 lcs.naver.com nid.naver.com
1 ssl.pstatic.net wvvw.userlogin.r-e.kr
1 rebrand.ly 1 redirects
18 6
Subject Issuer Validity Valid
wvvw.userlogin.r-e.kr
ZeroSSL RSA Domain Secure Site CA		 2022-08-01 -
2022-10-30		 3 months crt.sh
nid.naver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-08-25 -
2023-09-13		 a year crt.sh
*.nid.naver.com
Sectigo RSA Organization Validation Secure Server CA		 2021-10-15 -
2022-11-15		 a year crt.sh
ssl.pstatic.net
GeoTrust RSA CA 2018		 2021-11-05 -
2022-11-04		 a year crt.sh
cc.naver.com
GeoTrust RSA CA 2018		 2022-05-18 -
2023-06-18		 a year crt.sh

This page contains 1 frames:

Primary Page: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Frame ID: F51ADE8B77A3F257A2877E93A99651F5
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

비밀번호 재확인 : 네이버 내정보

Page URL History Show full URLs

  1. https://rebrand.ly/w7fuydl HTTP 301
    https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

6
Subdomains

6
IPs

3
Countries

455 kB
Transfer

709 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://rebrand.ly/w7fuydl HTTP 301
    https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
wvvw.userlogin.r-e.kr/
Redirect Chain
  • https://rebrand.ly/w7fuydl
  • https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
15 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
210.16.120.212 , Singapore, ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK),
Reverse DNS
Software
Apache/2.4.53 (Unix) OpenSSL/1.1.1n PHP/8.1.5 mod_perl/2.0.12 Perl/v5.34.1 / PHP/8.1.5
Resource Hash
a1a17f9cedf80d04f24a698b2bade5a26f83b8a09231c8f0c733fcf91ad20971

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 13 Oct 2022 00:21:39 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.53 (Unix) OpenSSL/1.1.1n PHP/8.1.5 mod_perl/2.0.12 Perl/v5.34.1
Transfer-Encoding
chunked
X-Powered-By
PHP/8.1.5

Redirect headers

Cache-Control
no-cache, no-store
Connection
keep-alive
Content-Length
0
Date
Thu, 13 Oct 2022 00:21:37 GMT
Engine
Rebrandly.redirect, version 2.1
Expires
-1
Location
https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Strict-Transport-Security
max-age=15552000
jquery.min.js
nid.naver.com/inc/common/js/ 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/inc/common/js/jquery.min.js
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
125.209.226.33 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
161ddce728615bd31a9c34fbb1cd047a4fe165e30cb86f826d1c856a956016ca

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:42 GMT
content-encoding
gzip
last-modified
Mon, 23 Mar 2020 04:08:31 GMT
server
nginx
accept-ch
dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile
etag
W/"5e78363f-17651"
vary
Accept-Encoding
accept-ch-lifetime
86400
content-type
application/javascript
x-ua-compatible
IE=edge
help_member.css
wvvw.userlogin.r-e.kr//assets/css/ 		301 KB
302 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wvvw.userlogin.r-e.kr//assets/css/help_member.css
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
210.16.120.212 , Singapore, ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK),
Reverse DNS
Software
Apache/2.4.53 (Unix) OpenSSL/1.1.1n PHP/8.1.5 mod_perl/2.0.12 Perl/v5.34.1 /
Resource Hash
e35f17e8bffac0b461a0eb39bffe5c926527e1ccc145c2c6dd74b4a547cb0541

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date
Thu, 13 Oct 2022 00:21:42 GMT
Last-Modified
Wed, 11 May 2022 00:06:55 GMT
Server
Apache/2.4.53 (Unix) OpenSSL/1.1.1n PHP/8.1.5 mod_perl/2.0.12 Perl/v5.34.1
ETag
"4b4b8-5deb138196227"
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
308408
w_202105.css
wvvw.userlogin.r-e.kr//assets/css/ 		30 KB
30 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wvvw.userlogin.r-e.kr//assets/css/w_202105.css
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
210.16.120.212 , Singapore, ASN7489 (HOSTUS-GLOBAL-AS HostUS, HK),
Reverse DNS
Software
Apache/2.4.53 (Unix) OpenSSL/1.1.1n PHP/8.1.5 mod_perl/2.0.12 Perl/v5.34.1 /
Resource Hash
1f46c0f870bbb78a0f39e1a9602f52f24ed52a6acbe04de62446702bbb58bb07

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date
Thu, 13 Oct 2022 00:21:42 GMT
Last-Modified
Wed, 11 May 2022 00:06:56 GMT
Server
Apache/2.4.53 (Unix) OpenSSL/1.1.1n PHP/8.1.5 mod_perl/2.0.12 Perl/v5.34.1
ETag
"77af-5deb1382ee9e6"
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
30639
clickcr.js
nid.naver.com/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/js/clickcr.js
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
125.209.226.33 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
383b038cf3099d6eec1303bbb4dbe77dfda1a426e5d41d92802a0be3356cd332

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:42 GMT
content-encoding
gzip
last-modified
Tue, 24 Mar 2020 03:00:00 GMT
server
nginx
accept-ch
dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile
etag
W/"5e7977b0-2601"
vary
Accept-Encoding
accept-ch-lifetime
86400
content-type
application/javascript
x-ua-compatible
IE=edge
lcs_nclicks.js
nid.naver.com/inc/common/js/ 		46 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/inc/common/js/lcs_nclicks.js
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
125.209.226.33 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
0e3ab8bec90558af14bbf3c89e718d19d3def83fba1e2d8ec3c69e58d1497346

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:42 GMT
content-encoding
gzip
last-modified
Mon, 19 Sep 2022 07:28:24 GMT
server
nginx
accept-ch
dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile
etag
W/"63281a18-b7f1"
vary
Accept-Encoding
accept-ch-lifetime
86400
content-type
application/javascript
x-ua-compatible
IE=edge
commonUtil.js
nid.naver.com/inc/common/js/ko/ 		27 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/inc/common/js/ko/commonUtil.js?20170214
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
125.209.226.33 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
d41e6c4084db79e357e51804753915e5da8e42f29790bf5f5e4825a2b94dd401

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:42 GMT
content-encoding
gzip
last-modified
Mon, 19 Sep 2022 07:28:24 GMT
server
nginx
accept-ch
dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile
etag
W/"63281a18-6d74"
vary
Accept-Encoding
accept-ch-lifetime
86400
content-type
application/javascript
x-ua-compatible
IE=edge
lua.js
nid.naver.com/inc/common/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/inc/common/js/lua.js
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
125.209.226.33 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
8e9735941f9f6ee895032ba2e4e223bffa694729e865a6d1b44082e851ea5fdd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:42 GMT
content-encoding
gzip
last-modified
Mon, 19 Sep 2022 07:28:24 GMT
server
nginx
accept-ch
dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile
etag
W/"63281a18-1768"
vary
Accept-Encoding
accept-ch-lifetime
86400
content-type
application/javascript
x-ua-compatible
IE=edge
rsaAll.js
nid.naver.com/inc/common/js/ 		23 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/inc/common/js/rsaAll.js
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
125.209.226.33 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
aae3f77d882701cf238d7eeab0b674241eacb3268bbb520f633c648093134b79

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:42 GMT
content-encoding
gzip
last-modified
Mon, 23 Mar 2020 04:08:31 GMT
server
nginx
accept-ch
dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile
etag
W/"5e78363f-5a69"
vary
Accept-Encoding
accept-ch-lifetime
86400
content-type
application/javascript
x-ua-compatible
IE=edge
passwdAjax.js
nid.naver.com/inc/common/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/inc/common/js/passwdAjax.js?20180530
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
125.209.226.33 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
a4ce065bd4de565480b20a8cb948ec9723ff2bc859ab313566914533d09c8a51

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:42 GMT
content-encoding
gzip
last-modified
Fri, 09 Apr 2021 09:47:09 GMT
server
nginx
accept-ch
dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile
etag
W/"6070229d-1492"
vary
Accept-Encoding
accept-ch-lifetime
86400
content-type
application/javascript
x-ua-compatible
IE=edge
gnb_utf8.nhn
static.nid.naver.com/template/ 		136 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.nid.naver.com/template/gnb_utf8.nhn?2021.%208.%2026
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
223.130.195.167 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
df59d1b3064250bfa4001470763d104408909e915735110b5604ec15b7fd3245

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:42 GMT
content-encoding
gzip
last-modified
Thu, 21 Jul 2022 07:41:57 GMT
server
nginx
content-type
application/x-javascript; charset=utf-8
cache-control
max-age=86400
content-length
26860
expires
Fri, 14 Oct 2022 00:21:42 GMT
jquery.resize.js
nid.naver.com/inc/common/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/inc/common/js/jquery.resize.js
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
125.209.226.33 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
6003564f429abedfebb834b923045bc9de62861e232abd089cae66f6fe177359

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:42 GMT
content-encoding
gzip
last-modified
Mon, 23 Mar 2020 04:08:31 GMT
server
nginx
accept-ch
dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile
etag
W/"5e78363f-16cc"
vary
Accept-Encoding
accept-ch-lifetime
86400
content-type
application/javascript
x-ua-compatible
IE=edge
sp_u_skip.png
static.nid.naver.com/images/web/user/ 		967 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.nid.naver.com/images/web/user/sp_u_skip.png
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr//assets/css/help_member.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
223.130.195.167 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
67bef5d26af42c5a7842ecd98bf3df205cf8de0270802b34a2380de4eb517d46

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:44 GMT
last-modified
Tue, 02 Nov 2021 11:50:30 GMT
server
nginx
etag
"61812606-3c7"
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
content-length
967
expires
Thu, 31 Dec 2037 23:55:55 GMT
pc_sp_txt_shape.png
static.nid.naver.com/images/ui/myinfo/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.nid.naver.com/images/ui/myinfo/pc_sp_txt_shape.png
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr//assets/css/help_member.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
223.130.195.167 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
58730f842267e35a5526afd726a1268e98accd4cce470ddb8865768cd15bb42b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:44 GMT
last-modified
Tue, 02 Nov 2021 11:50:27 GMT
server
nginx
etag
"61812603-1a7c"
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
content-length
6780
expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ 		26 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/gif
promo_npay_200108.png
ssl.pstatic.net/static/common/gnb/banner/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.pstatic.net/static/common/gnb/banner/promo_npay_200108.png
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr/?session=3F8206CD1C2612924A35F76EDCC20F20&m=verify&token=a3RzMDMwMw==&last=info
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.217.160.172 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-217-160-172.deploy.static.akamaitechnologies.com
Software
Testa/6.1.1 /
Resource Hash
65704a1944135aac4d1ed30b794f30e981f9946a09bcb6e1274e24a8a62c1a06

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:44 GMT
referrer-policy
unsafe-url
last-modified
Tue, 26 Apr 2022 08:57:20 GMT
server
Testa/6.1.1
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=256691
accept-ranges
bytes
content-length
3874
expires
Sat, 15 Oct 2022 23:39:55 GMT
ci_naver.png
static.nid.naver.com/images/web/user/ 		560 B
735 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.nid.naver.com/images/web/user/ci_naver.png
Requested by
Host: wvvw.userlogin.r-e.kr
URL: https://wvvw.userlogin.r-e.kr//assets/css/help_member.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
223.130.195.167 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
326563f7904e43af49eaaf79934acf49b692fb66d10db05e18df823a8703aa82

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 13 Oct 2022 00:21:44 GMT
last-modified
Tue, 02 Nov 2021 11:50:29 GMT
server
nginx
etag
"61812605-230"
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
content-length
560
expires
Thu, 31 Dec 2037 23:55:55 GMT
getLoginStatus
static.nid.naver.com/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://static.nid.naver.com/getLoginStatus?callback=showGNB&charset=utf-8&svc=nid&template=gnb_utf8&one_naver=1
Requested by
Host: static.nid.naver.com
URL: https://static.nid.naver.com/template/gnb_utf8.nhn?2021.%208.%2026
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
223.130.195.167 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://wvvw.userlogin.r-e.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers
m
lcs.naver.com/ 		0
335 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://lcs.naver.com/m
Requested by
Host: nid.naver.com
URL: https://nid.naver.com/inc/common/js/lcs_nclicks.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
203.104.164.18 , Singapore, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://wvvw.userlogin.r-e.kr/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Thu, 13 Oct 2022 00:21:44 GMT
server
nginx
p3p
CP="ALL CURa ADMa DEVa TAIa OUR BUS IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC OTC"
content-type
application/octet-stream
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-length
0
expires
Tue, 01 Jan 1980 09:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Naver (Online)

316 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery number| nclkMaxDepth string| ccsrv string| nclkModule string| nsc string| g_pid string| g_sid object| nclkImg function| clickcr function| nclks function| nclks_clsnm function| nclks_chk function| nclks_if function| nclks_select function| nclk function| nclk_proxy function| nclk_v2 function| nclk_v2_with_obj function| lcs_do function| lcs_do_gdid function| lcs_get_lpid function| lcs_update_lpid string| lcs_version function| isValid_corp_no function| isValid_bizr_no function| isValid_uniq_no function| isValid_socno function| isValid_fgnno function| isValid_id function| isValid_passwd function| isValid_passwd_ajax function| isValid_email function| isValid_email_myinfo function| isValid_pswdEmail function| isValid_email_local function| isValid_email2 function| isValid_name function| isValid_ForeignName function| isValid_Passport function| isXP function| isXPSP2 function| isIE7 function| isIE8 function| isIE function| isHangul function| checkSpace function| winOpenAtCenter function| winOpenAtCenter2 function| window_resize function| resizePopup function| resizeToBodySize function| setCookie function| getCookie boolean| next_go object| cur_val function| moveNext boolean| nextGo object| curVal function| moveNextNoCheckNum function| num_only function| trim function| containsCharsOnly function| isNumeric object| db string| agent boolean| busy function| check_num function| check_num_ajax function| check_num_ajax2 function| check_num_ajax3 function| toggleObject function| toggleSingleObj function| toggleObjectForPopUp function| displayObj function| hiddenObj function| checkUninterruptNumber function| checkSameNumber number| lua_cnt object| lua_bi object| lua_sDate string| ERROR_NO_VALUE string| ERROR_NOT_ENOUGH_LENGTH string| ERROR_AUTH_REQUIRED string| ERROR_AGREE_REQUIRED string| ERROR_ID_REQUIRED string| ERROR_PSWD1_REQUIRED string| ERROR_PSWD2_REQUIRED string| ERROR_NAME_REQUIRED string| ERROR_NAME_FORMAT string| ERROR_DATE_FORMAT string| INFO_CHECK_POINT_10 string| INFO_CHECK_POINT_20 string| INFO_CHECK_POINT_30 string| INFO_CHECK_POINT_40 string| INFO_CHECK_POINT_50 string| INFO_CHECK_POINT_60 string| INFO_CHECK_POINT_70 string| INFO_CHECK_POINT_80 string| INFO_CHECK_POINT_90 string| INFO_CHECK_POINT_SU string| INFO_CHECK_POINT_SUBMIT string| INFO_CHECK_POINT_RETRY string| ERROR_NO_VALUE_SEX string| ERROR_NO_VALUE_NAME string| ERROR_NO_VALUE_YEAR string| ERROR_NO_VALUE_MONTH string| ERROR_NO_VALUE_DAY string| ERROR_NO_VALUE_DATE string| ERROR_NO_VALUE_PHONENO string| ERROR_NO_VALUE_EMAIL string| ERROR_NO_VALUE_AUTHNO string| ERROR_NO_VALUE_AGREE1 string| ERROR_NO_VALUE_CAPTCHA string| ERROR_FORMAT_ID string| ERROR_FORMAT_PSWD1 string| ERROR_FORMAT_PSWD2 string| ERROR_FORMAT_NAME string| ERROR_FORMAT_YEAR string| ERROR_FORMAT_MONTH string| ERROR_FORMAT_DAY string| ERROR_FORMAT_DATE string| ERROR_FORMAT_PHONENO string| ERROR_FORMAT_EMAIL string| ERROR_FORMAT_AUTHNO string| ERROR_JOIN_SUBMIT string| SUCCESS_JOIN_SUBMIT function| lua_do function| lua_do2 function| lua_setValues function| lua_getBrowser function| lua_getOS function| lua_getlanguage function| lua_getCookieEnabled function| lua_getTime function| lua_getAgent object| gnb_option function| gnbClose function| setContainerHeight function| clearDocs number| dbits number| canary boolean| j_lm function| BigInteger function| nbi function| am1 function| am2 function| am3 number| BI_FP string| BI_RM object| BI_RC number| rr number| vv function| int2char function| intAt function| bnpCopyTo function| bnpFromInt function| nbv function| bnpFromString function| bnpClamp function| bnToString function| bnNegate function| bnAbs function| bnCompareTo function| nbits function| bnBitLength function| bnpDLShiftTo function| bnpDRShiftTo function| bnpLShiftTo function| bnpRShiftTo function| bnpSubTo function| bnpMultiplyTo function| bnpSquareTo function| bnpDivRemTo function| bnMod function| Classic function| cConvert function| cRevert function| cReduce function| cMulTo function| cSqrTo function| bnpInvDigit function| Montgomery function| montConvert function| montRevert function| montReduce function| montSqrTo function| montMulTo function| bnpIsEven function| bnpExp function| bnModPowInt function| Arcfour function| ARC4init function| ARC4next function| prng_newstate number| rng_psize undefined| rng_state object| rng_pool number| rng_pptr function| rng_seed_int function| rng_seed_time number| t string| ua undefined| z function| rng_get_byte function| rng_get_bytes function| SecureRandom function| parseBigInt function| linebrk function| byte2Hex function| pkcs1pad2 function| RSAKey function| RSASetPublic function| RSADoPublic function| RSAEncrypt string| b64map string| b64pad function| hex2b64 function| b64tohex function| b64toBA string| url_login string| url_nologin boolean| isshift boolean| isCapslock number| pswdlevel number| focuswhere boolean| pwdstat function| getXmlHttp function| getAjaxResult function| checkpwd_login function| checkpwd_nologin function| sendLevel function| showhelpmsg function| capslock function| showCapslock function| checkShiftUp function| checkShiftDown function| checkShiftDownNoMsg function| show function| hide function| mainSubmit function| createRsaKey function| getLenChar function| reset function| convertDiv function| hideCapsLock object| gnb_date object| gnbSvcs object| gnbWholeSvc object| gnbSvcsArr function| gnbSvcFromId function| makeGnbSvcList object| gnb_html_buffer string| gnb_html object| gnb_css_buffer string| gnb_style function| gnb$ function| gnbGetElementsByClassName function| gnbJsonStringify function| insertGnbContents object| gnbNaverMeLayer object| gnbUserLayer object| gnbMoreLayer object| gnbFavorite object| gnb_search object| gnbJSONP function| showMeCount function| showMailCount function| showNotiCount function| setLoginUrl function| showGNB function| showGNBReload function| gnbAllLayerClose function| gnbAddClassName function| gnbRemoveClassName function| gnbShortNick function| gnbResponseSetting object| gnb_options function| initGNBOptions function| getGNB object| gnbHangul object| gnbNClicks function| gnb_svc function| reloadGnbVariables function| loadGnbComponents function| reloadGNB string| tagList string| menu function| showMenu function| addResizeListener function| removeResizeListener number| cur_container_height number| min_container_height number| header_height number| footer_height function| changeContentSize function| lockInput function| unlockInput function| showError function| showCaptcha function| onKeyDownPassword function| onClickSubmit string| lcs_SerName

1 Cookies

Domain/Path Name / Value
.naver.com/ Name: NNB
Value: GZWU7FQYLJDWG

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lcs.naver.com
nid.naver.com
rebrand.ly
ssl.pstatic.net
static.nid.naver.com
wvvw.userlogin.r-e.kr
125.209.226.33
203.104.164.18
210.16.120.212
223.130.195.167
23.217.160.172
3.226.62.59
0e3ab8bec90558af14bbf3c89e718d19d3def83fba1e2d8ec3c69e58d1497346
161ddce728615bd31a9c34fbb1cd047a4fe165e30cb86f826d1c856a956016ca
1f46c0f870bbb78a0f39e1a9602f52f24ed52a6acbe04de62446702bbb58bb07
326563f7904e43af49eaaf79934acf49b692fb66d10db05e18df823a8703aa82
383b038cf3099d6eec1303bbb4dbe77dfda1a426e5d41d92802a0be3356cd332
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
58730f842267e35a5526afd726a1268e98accd4cce470ddb8865768cd15bb42b
6003564f429abedfebb834b923045bc9de62861e232abd089cae66f6fe177359
65704a1944135aac4d1ed30b794f30e981f9946a09bcb6e1274e24a8a62c1a06
67bef5d26af42c5a7842ecd98bf3df205cf8de0270802b34a2380de4eb517d46
8e9735941f9f6ee895032ba2e4e223bffa694729e865a6d1b44082e851ea5fdd
a1a17f9cedf80d04f24a698b2bade5a26f83b8a09231c8f0c733fcf91ad20971
a4ce065bd4de565480b20a8cb948ec9723ff2bc859ab313566914533d09c8a51
aae3f77d882701cf238d7eeab0b674241eacb3268bbb520f633c648093134b79
d41e6c4084db79e357e51804753915e5da8e42f29790bf5f5e4825a2b94dd401
df59d1b3064250bfa4001470763d104408909e915735110b5604ec15b7fd3245
e35f17e8bffac0b461a0eb39bffe5c926527e1ccc145c2c6dd74b4a547cb0541
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855