urlscan.io logo urlscan.io
SecurityTrails logo

workers-playground-shrill-mud-928d.mslee.workers.dev Open in urlscan Pro
2606:4700:3035::ac43:b28a  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://workers-playground-shrill-mud-928d.mslee.workers.dev/
Submission: On July 26 via api from US — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3035::ac43:b28a, located in United States and belongs to CLOUDFLARENET, US. The main domain is workers-playground-shrill-mud-928d.mslee.workers.dev.
TLS certificate: Issued by WE1 on June 26th 2024. Valid for: 3 months.
This is the only time workers-playground-shrill-mud-928d.mslee.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Naver (Online)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 223.130.195.168 23576 (NHN-AS-KR...)
4 184.25.36.65 16625 (AKAMAI-AS)
1 2a04:4e42:400... 54113 (FASTLY)
7 4
Apex Domain
Subdomains		 Transfer
4 pstatic.net
ssl.pstatic.net — Cisco Umbrella Rank: 22169
160 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211
78 KB
1 naver.com
nid.naver.com — Cisco Umbrella Rank: 18898
6 KB
1 workers.dev
workers-playground-shrill-mud-928d.mslee.workers.dev
4 KB
7 4
Domain Requested by
4 ssl.pstatic.net workers-playground-shrill-mud-928d.mslee.workers.dev
nid.naver.com
1 code.jquery.com workers-playground-shrill-mud-928d.mslee.workers.dev
1 nid.naver.com workers-playground-shrill-mud-928d.mslee.workers.dev
1 workers-playground-shrill-mud-928d.mslee.workers.dev
7 4

This site contains no links.

Subject Issuer Validity Valid
mslee.workers.dev
WE1		 2024-06-26 -
2024-09-24		 3 months crt.sh
nid.naver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-08-28 -
2024-09-14		 a year crt.sh
ssl.pstatic.net
GeoTrust RSA CA 2018		 2024-07-18 -
2025-07-17		 a year crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://workers-playground-shrill-mud-928d.mslee.workers.dev/
Frame ID: 08FE8344BD66E315D3EC3354FDC9B2E8
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

네이버 : 로그인

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

247 kB
Transfer

460 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
workers-playground-shrill-mud-928d.mslee.workers.dev/ 		12 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://workers-playground-shrill-mud-928d.mslee.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:b28a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a3617ecfb643a7b038b612c2d276e205ef13c3e4edf61304e5416d1ea593c4d9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
8a9283d89c94a1da-YYZ
content-encoding
br
content-type
text/html
date
Fri, 26 Jul 2024 07:00:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hx9KG7MtHZaQGOOrb4GvKm93il4tWva0YNFmoJzThbky4lfB%2B64GYKSDNhJkVNLjT8IhhmVsokmlbWxY646o6LZ83HbmUjToHFqtXAtXJSFId0i8sc4V5kCzDEXn2DKL0bwKIBExcziAOQ5PB%2FvJqiEKXR%2BLvh6uWX%2Fcka7Qq6ZZTmdBPH%2FiTZmfLD%2FWrbv9RQSe"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
w_20220216.css
nid.naver.com/login/css/global/desktop/ 		27 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/login/css/global/desktop/w_20220216.css?20210812
Requested by
Host: workers-playground-shrill-mud-928d.mslee.workers.dev
URL: https://workers-playground-shrill-mud-928d.mslee.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
223.130.195.168 , Korea, Republic Of, ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR),
Reverse DNS
Software
nginx /
Resource Hash
de1f6ef9f776adff8398700d0253745557df93c37972e8be399b11f31f408256

Request headers

Referer
https://workers-playground-shrill-mud-928d.mslee.workers.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 26 Jul 2024 07:00:52 GMT
content-encoding
gzip
last-modified
Thu, 25 Jul 2024 06:04:51 GMT
server
nginx
accept-ch
dpr,device-memory,viewport-width,rtt,downlink,ect,lang, ua-arch,ua-platform,ua-platform-version,ua-model,ua-full-version,ua,ua-mobile, sec-ch-ua-arch,sec-ch-ua-platform,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-mobile
etag
W/"66a1eb03-6a84"
vary
Accept-Encoding
accept-ch-lifetime
86400
content-type
text/css
x-ua-compatible
IE=edge
m_banner_2step_924x294.png
ssl.pstatic.net/static/nid/login/banner/ 		54 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.pstatic.net/static/nid/login/banner/m_banner_2step_924x294.png
Requested by
Host: workers-playground-shrill-mud-928d.mslee.workers.dev
URL: https://workers-playground-shrill-mud-928d.mslee.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
184.25.36.65 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-25-36-65.deploy.static.akamaitechnologies.com
Software
Testa/6.2.4 /
Resource Hash
dbec0a6f4f63ad346cc2e20fd1c52dd79a019978ee031ba0f76dbcb9d3fac6df

Request headers

Referer
https://workers-playground-shrill-mud-928d.mslee.workers.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 26 Jul 2024 07:00:51 GMT
referrer-policy
unsafe-url
last-modified
Mon, 12 Apr 2021 07:18:08 GMT
server
Testa/6.2.4
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=349015
accept-ranges
bytes
content-length
55608
expires
Tue, 30 Jul 2024 07:57:46 GMT
jquery-1.9.1.js
code.jquery.com/ 		262 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-1.9.1.js
Requested by
Host: workers-playground-shrill-mud-928d.mslee.workers.dev
URL: https://workers-playground-shrill-mud-928d.mslee.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

Referer
https://workers-playground-shrill-mud-928d.mslee.workers.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 26 Jul 2024 07:00:51 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
9602717
x-cache
HIT, HIT
content-length
79506
x-served-by
cache-lga21952-LGA, cache-yul1970045-YUL
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1721977251.165522,VS0,VE0
etag
W/"28feccc0-4185d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
4447, 13454
m_sp_00_common_978240a6.png
ssl.pstatic.net/static/nid/login/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.pstatic.net/static/nid/login/m_sp_00_common_978240a6.png
Requested by
Host: nid.naver.com
URL: https://nid.naver.com/login/css/global/desktop/w_20220216.css?20210812
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
184.25.36.65 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-25-36-65.deploy.static.akamaitechnologies.com
Software
Testa/6.1.1 /
Resource Hash
3be89f766c6a9ac418ec1c6f33dc7a24607a6e067c0731e77b8cc01fb3355bc7

Request headers

Referer
https://nid.naver.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

unused62
8096267
date
Fri, 26 Jul 2024 07:00:52 GMT
referrer-policy
unsafe-url
last-modified
Thu, 28 Oct 2021 05:48:39 GMT
server
Testa/6.1.1
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=82745
accept-ranges
bytes
content-length
21505
expires
Sat, 27 Jul 2024 05:59:57 GMT
m_sp_01_login_008d5216.png
ssl.pstatic.net/static/nid/login/ 		83 KB
83 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.pstatic.net/static/nid/login/m_sp_01_login_008d5216.png
Requested by
Host: nid.naver.com
URL: https://nid.naver.com/login/css/global/desktop/w_20220216.css?20210812
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
184.25.36.65 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-25-36-65.deploy.static.akamaitechnologies.com
Software
Testa/6.2.4 /
Resource Hash
1bf14b8b72b6a63f58405cf21a1954a75b85b00c85fec19bc784d33f6c8e4a64

Request headers

Referer
https://nid.naver.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 26 Jul 2024 07:00:52 GMT
referrer-policy
unsafe-url
last-modified
Wed, 16 Feb 2022 12:15:27 GMT
server
Testa/6.2.4
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=84315
accept-ranges
bytes
content-length
85176
expires
Sat, 27 Jul 2024 06:26:07 GMT
og_v3.png
ssl.pstatic.net/sstatic/search/common/ 		724 B
888 B 		Other
General
Check archive.org
Download Go to
Full URL
https://ssl.pstatic.net/sstatic/search/common/og_v3.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
184.25.36.65 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-25-36-65.deploy.static.akamaitechnologies.com
Software
Testa/6.1.1 /
Resource Hash
624901f7513fa4aae712d94f8e47cbc3be38a4d3ac0d433c5eac74c23007c777

Request headers

Referer
https://workers-playground-shrill-mud-928d.mslee.workers.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 26 Jul 2024 07:00:52 GMT
last-modified
Fri, 15 Jul 2016 09:40:49 GMT
server
Testa/6.1.1
etag
"2d4-537a969e26a40"
content-type
image/png
cache-control
max-age=16572041
accept-ranges
bytes
content-length
724
expires
Mon, 03 Feb 2025 02:21:33 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Naver (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| feedUpdateResponse object| feedUpdateSplit number| x function| $ function| jQuery

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://workers-playground-shrill-mud-928d.mslee.workers.dev/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o