google.0wn.kr
Open in
urlscan Pro
3.34.123.68
Malicious Activity!
Public Scan
Effective URL: https://google.0wn.kr/v3/signin/identifier?dsh=S1375788286%3A1681116506564739&authuser=0&continue=https%3A%2F%2Fwww.go...
Submission: On April 17 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by R3 on April 17th 2023. Valid for: 3 months.
This is the only time google.0wn.kr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Google (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 6 | 3.34.123.68 3.34.123.68 | 16509 (AMAZON-02) (AMAZON-02) | |
9 | 2a00:1450:400... 2a00:1450:4001:830::2003 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:831::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::200e | 15169 (GOOGLE) (GOOGLE) | |
19 | 5 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-34-123-68.ap-northeast-2.compute.amazonaws.com
google.0wn.kr |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
367 KB |
6 |
0wn.kr
1 redirects
google.0wn.kr |
179 KB |
1 |
youtube.com
accounts.youtube.com — Cisco Umbrella Rank: 891 |
|
19 | 3 |
Domain | Requested by | |
---|---|---|
9 | www.gstatic.com |
google.0wn.kr
www.gstatic.com |
6 | google.0wn.kr |
1 redirects
google.0wn.kr
www.gstatic.com |
4 | fonts.gstatic.com |
google.0wn.kr
|
1 | accounts.youtube.com |
www.gstatic.com
|
19 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
support.google.com |
accounts.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
google.0wn.kr R3 |
2023-04-17 - 2023-07-16 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-03-28 - 2023-06-20 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://google.0wn.kr/v3/signin/identifier?dsh=S1375788286%3A1681116506564739&authuser=0&continue=https%3A%2F%2Fwww.google.com%2F&ec=GAlAmgQ&hl=en&flowName=GlifWebSignIn&flowEntry=AddSession
Frame ID: C4C697DB8EC7DA37168ED15E628E07EA
Requests: 17 HTTP requests in this frame
Frame:
https://google.0wn.kr/identifier_files/CheckConnection.html
Frame ID: E597A9A079126182F224B11546D66948
Requests: 1 HTTP requests in this frame
Frame:
https://google.0wn.kr/identifier_files/bscframe.html
Frame ID: 5308AB45E4FF7DE17F79456B387CF4C4
Requests: 1 HTTP requests in this frame
Frame:
https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1108652608×tamp=1681714352164
Frame ID: 80BA120D3529801A142EF22B40730ADB
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Sign in - Google AccountsPage URL History Show full URLs
-
https://google.0wn.kr/
HTTP 302
https://google.0wn.kr/v3/signin/identifier?dsh=S1375788286%3A1681116506564739&authuser=0&continue=... Page URL
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Learn more
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://google.0wn.kr/
HTTP 302
https://google.0wn.kr/v3/signin/identifier?dsh=S1375788286%3A1681116506564739&authuser=0&continue=https%3A%2F%2Fwww.google.com%2F&ec=GAlAmgQ&hl=en&flowName=GlifWebSignIn&flowEntry=AddSession Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
identifier
google.0wn.kr/v3/signin/ Redirect Chain
|
1013 KB 177 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=_b,_tp,_r
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ygnw8zNZYxc.es5.O/am=As45HBgEEOdgMgQAAAAAAAAAAFgYmoA/d=1/excm=_b,_r,_tp,identifierview/ed=1/dg=0/wt=2/rs=AOaEmlELRcdeplivD... |
205 KB 72 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
CheckConnection.html
google.0wn.kr/identifier_files/ Frame E597 |
207 B 394 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bscframe.html
google.0wn.kr/identifier_files/ Frame 5308 |
207 B 394 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
267 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v18/ |
10 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UaGrENHsxJlGDuGo1OIlL3Owp5eKQtG.woff2
fonts.gstatic.com/s/googlesans/v14/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v18/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4UabrENHsxJlGDuGo1OIlLU94YtzCwZsPF4o.woff2
fonts.gstatic.com/s/googlesans/v14/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=byfTOb,lsjVmc,LEikZe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ygnw8zNZYxc.es5.O/ck=boq-identity.AccountsSignInUi.v5UC2wbMsyA.L.B1.O/am=As45HBgEEOdgMgQAAAAAAAAAAFgYmoA/d=1/exm=_b,_r,_tp... |
37 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=n73qwf,UUJqVe,MpJwZc,pxq3x
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ygnw8zNZYxc.es5.O/ck=boq-identity.AccountsSignInUi.v5UC2wbMsyA.L.B1.O/am=As45HBgEEOdgMgQAAAAAAAAAAFgYmoA/d=1/exm=LEikZe,_b... |
53 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=SCuOPb,IZT63,vfuNJf,ws9Tlc,siKnQd,STuCOe,njlZCf,XVq9Qb,xUdipf,OTA3Ae,COQbmf,fKUV3e,aurFic,U0aPgd,kibjWe,nnwwYc,ANCJdb,V3dDOb,G0cNrd,zsCYJ,mWLH9d,NOeYWe,O6y8ed,t2srLd,fqEYIb,PrPYRd,NwH0H,OmgaI,hc6...
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ygnw8zNZYxc.es5.O/ck=boq-identity.AccountsSignInUi.v5UC2wbMsyA.L.B1.O/am=As45HBgEEOdgMgQAAAAAAAAAAFgYmoA/d=1/exm=LEikZe,Mp... |
517 KB 166 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m=ltDFwf,Rusgnf,Ctsu,UPKV3d,wGM7Jc,IZ1fbc,i5dxUd,m9oV,kSPLL,i5H9N,NTMZac,bTi8wc,SzsEAf,RAnnUd,qPfo0c,PHUIyb,bPkrc,uu7UOe,yRXbo,wg1P6b,soHxf,qNG0Fc,ywOR5c,W2YXuc
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ygnw8zNZYxc.es5.O/ck=boq-identity.AccountsSignInUi.v5UC2wbMsyA.L.B1.O/am=As45HBgEEOdgMgQAAAAAAAAAAFgYmoA/d=1/exm=A2sInc,AD... |
126 KB 36 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=RqjULd
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ygnw8zNZYxc.es5.O/ck=boq-identity.AccountsSignInUi.v5UC2wbMsyA.L.B1.O/am=As45HBgEEOdgMgQAAAAAAAAAAFgYmoA/d=1/exm=A2sInc,AD... |
14 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=ZwDk9d,RMhBfe
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ygnw8zNZYxc.es5.O/ck=boq-identity.AccountsSignInUi.v5UC2wbMsyA.L.B1.O/am=As45HBgEEOdgMgQAAAAAAAAAAFgYmoA/d=1/exm=A2sInc,AD... |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=bm51tf
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ygnw8zNZYxc.es5.O/ck=boq-identity.AccountsSignInUi.v5UC2wbMsyA.L.B1.O/am=As45HBgEEOdgMgQAAAAAAAAAAFgYmoA/d=1/exm=A2sInc,AD... |
1 KB 732 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
jserror
google.0wn.kr/v3/signin/_/AccountsSignInUi/ |
207 B 394 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
jserror
google.0wn.kr/v3/signin/_/AccountsSignInUi/ |
207 B 394 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CheckConnection
accounts.youtube.com/accounts/ Frame 80BA |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
m=Wt6vjf,hhhU8,FCpbqb,WhJNk
www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.ygnw8zNZYxc.es5.O/ck=boq-identity.AccountsSignInUi.v5UC2wbMsyA.L.B1.O/am=As45HBgEEOdgMgQAAAAAAAAAAFgYmoA/d=1/exm=A2sInc,AD... |
6 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Google (Online)45 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 boolean| credentialless function| email_onkeydown function| password_onkeydown function| loginprocess object| WIZ_global_data number| cc_latency_start_time function| onaft function| _isLazyImage string| cc_aid number| iml_start number| css_size object| cc_latency function| ccTick function| onJsLoad function| onCssLoad function| _isVisible function| _recordImlEl number| prt function| wiz_tick string| _F_cssRowKey string| _F_combinedSignature function| _DumpException object| BOQ_wizbind object| AF_initDataKeys object| AF_dataServiceRequests object| AF_initDataChunkQueue function| AF_initDataCallback undefined| AF_initDataInitializeCallback object| aft_counter function| initAft object| IJ_values object| _wjdd object| default_AccountsSignInUi boolean| BOQ_loadedInitialJS function| _F_installCss function| _B_err object| closure_lm_25258 function| wiz_progress function| _F_getIjData object| _mxNDff function| nativePrimaryActionHit function| nativeSecondaryActionHit1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
google.0wn.kr/ | Name: OTZ Value: 6990173_56_56__56_ |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.youtube.com
fonts.gstatic.com
google.0wn.kr
www.gstatic.com
2a00:1450:4001:806::200e
2a00:1450:4001:830::2003
2a00:1450:4001:831::2003
3.34.123.68
06a286841b02e0257d10853b79afe099641dc12a758d7c7285a84d6be4b34b59
1e1c37812116c45a81199ac9302cf3bb1fa9ef9199d9d8e7a0887dd526dc039a
34220228d511c7771ef00ed3705ba46290e01bfbb2fe52cbeaf239a264f9a7ea
41d27d7132de78c927e476f9e3ecc70f1a0be908702f5a6f65ca5799b9768e87
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
4abc701cf9f19bdd7d403cf72a473b8488100a62b1f61a1cc1008312781801e4
64f65e6e4bd5b69d331112b7151bb34781b54b46b800b3cb9583dd242e252a42
7c7d4868e15e5d5a1c663e4a438bd0dba392be2de16535b0acdcc7bb694bf032
8c3dcd64a3c1de3f00ec177fdedf75263dae83b63a740f950d06498911eb37e3
abfe5b27310a016303a0ede1f41a67d4adb8886b7c0ade3474cd44f60be50548
b79781efede37903be212fcdf63955e41c8649e678b6b83adf824459d240a188
c714fca69ec3e1f46f2e59d9fb5041b5a1f8f91ab4ff95778b050adfd4536d43
ca8a090651c62cbe8c24c6e99ce3c75a2aeac745159675da0f35a3249b2d4733
dfc155fd4601164fadab479c630ffb11a62677a0979e4293119f8333174bf2b4
e9639e3c4681ce85f852fbac48e2eeee5ba51296dbfec57c200d59b76237ab80
fbbe41fe12666ab62e2d65cc329e7e628f3388d5052bcf98eca9ebd816d11311