urlscan.io logo urlscan.io
SecurityTrails logo

zbebhelw.com Open in urlscan Pro
87.120.254.169  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://zbebhelw.com/pass/indesx.html
Submission: On May 02 via api from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 87.120.254.169, located in Bulgaria and belongs to NETERRA-AS, BG. The main domain is zbebhelw.com.
This is the only time zbebhelw.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Naver (Online)

Domain & IP information

IP Address AS Autonomous System
1 87.120.254.169 34224 (NETERRA-AS)
9 203.104.163.42 23576 (NHN-AS-KR...)
1 203.104.163.21 23576 (NHN-AS-KR...)
11 3
Apex Domain
Subdomains		 Transfer
10 naver.com
nid.naver.com
lcs.naver.com
56 KB
1 zbebhelw.com
zbebhelw.com
11 KB
11 2
Domain Requested by
9 nid.naver.com zbebhelw.com
1 lcs.naver.com zbebhelw.com
1 zbebhelw.com
11 3

This site contains links to these domains. Also see Links.

Domain
www.naver.com
help.naver.com
nid.naver.com
www.navercorp.com
Subject Issuer Validity Valid
nid.naver.com
COMODO RSA Extended Validation Secure Server CA		 2017-08-25 -
2019-08-31		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://zbebhelw.com/pass/indesx.html
Frame ID: 95D18BBA4F10B4A077014BA39238A678
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

11
Requests

82 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

67 kB
Transfer

138 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request indesx.html
zbebhelw.com/pass/ 		11 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://zbebhelw.com/pass/indesx.html
Protocol
HTTP/1.1
Server
87.120.254.169 , Bulgaria, ASN34224 (NETERRA-AS, BG),
Reverse DNS
srv1022.atlastravel-cy.net
Software
Apache /
Resource Hash
d5e6df4b12d7ec436d9bd2fa598159681dbc5f8f10852ba9d68f9ba2849539c8

Request headers

Host
zbebhelw.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 02 May 2019 16:57:50 GMT
Server
Apache
Last-Modified
Fri, 26 Apr 2019 04:51:22 GMT
Accept-Ranges
bytes
Content-Length
10961
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html
we.css
nid.naver.com/login/css/ 		29 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/login/css/we.css?14116
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
nginx /
Resource Hash
c83c7b601b71f29712f3198d6d21a723deea5d5f5aa2537e5b05b48ecff03881

Request headers

Referer
http://zbebhelw.com/pass/indesx.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 16:57:50 GMT
content-encoding
gzip
last-modified
Tue, 04 Dec 2018 11:12:11 GMT
server
nginx
etag
W/"5c06610b-751c"
vary
Accept-Encoding
content-type
text/css
status
200
bu.gif
nid.naver.com/login/image/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nid.naver.com/login/image/bu.gif
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://zbebhelw.com/pass/indesx.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers
common.all.js
nid.naver.com/login/js/ 		51 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/login/js/common.all.js?141216
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
nginx /
Resource Hash
97185b24b80e7c9219be55147d6aaa861ca74841b74b0685987e000fe0fbc67e

Request headers

Referer
http://zbebhelw.com/pass/indesx.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 16:57:50 GMT
content-encoding
gzip
last-modified
Tue, 04 Dec 2018 11:12:11 GMT
server
nginx
etag
W/"5c06610b-ca55"
vary
Accept-Encoding
content-type
application/javascript
status
200
logintheme.js
nid.naver.com/login/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/login/js/logintheme.js?150109
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://zbebhelw.com/pass/indesx.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers
common.util.js
nid.naver.com/login/js/ 		20 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/login/js/common.util.js
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
nginx /
Resource Hash
3e2b95b114efc872c2d773e292620e20f26e61c2c9edd1a929d463a31501f10b

Request headers

Referer
http://zbebhelw.com/pass/indesx.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 16:57:50 GMT
content-encoding
gzip
last-modified
Tue, 04 Dec 2018 11:12:11 GMT
server
nginx
etag
W/"5c06610b-4eef"
vary
Accept-Encoding
content-type
application/javascript
status
200
logintheme.js
nid.naver.com/login/js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://nid.naver.com/login/js/logintheme.js?150109
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
http://zbebhelw.com/pass/indesx.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers
sp_login_20141002.png
nid.naver.com/login/image/tablet/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nid.naver.com/login/image/tablet/sp_login_20141002.png
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
nginx /
Resource Hash
8db63f09b3d92204d0b6286dae14f22411fa9d72eff6d7d71e128e23cde912b9

Request headers

Referer
https://nid.naver.com/login/css/we.css?14116
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 16:57:50 GMT
last-modified
Tue, 04 Dec 2018 11:12:11 GMT
server
nginx
etag
"5c06610b-43aa"
content-type
image/png
status
200
accept-ranges
bytes
content-length
17322
sel_arr.gif
nid.naver.com/login/image/tablet/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nid.naver.com/login/image/tablet/sel_arr.gif
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
nginx /
Resource Hash
1708a58918cd4c3921e571726c848bad200fbcb8dc03adc374a1e35adf6c2b05

Request headers

Referer
https://nid.naver.com/login/css/we.css?14116
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 16:57:51 GMT
last-modified
Tue, 23 Apr 2019 08:32:12 GMT
server
nginx
etag
"5cbecd8c-527"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
1319
sp_btn_20140615.png
nid.naver.com/login/image/tablet/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nid.naver.com/login/image/tablet/sp_btn_20140615.png
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
203.104.163.42 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
nginx /
Resource Hash
895f1b0c2eac140334010595105f81974dd492c3821406f02f4a60ed60e22606

Request headers

Referer
https://nid.naver.com/login/css/we.css?14116
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 02 May 2019 16:57:50 GMT
last-modified
Tue, 04 Dec 2018 11:12:11 GMT
server
nginx
etag
"5c06610b-2654"
content-type
image/png
status
200
accept-ranges
bytes
content-length
9812
m
lcs.naver.com/ 		43 B
512 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://lcs.naver.com/m?u=http%3A%2F%2Fzbebhelw.com%2Fpass%2Findesx.html&e=&i=&os=Linux%20x86_64&ln=en-US&sr=1600x1200&bw=1600&bh=1200&c=24&j=N&jv=1.8&k=Y&fv=&sl=&ct=&p=&EOU
Requested by
Host: zbebhelw.com
URL: http://zbebhelw.com/pass/indesx.html
Protocol
HTTP/1.1
Server
203.104.163.21 , Korea, Republic Of, ASN23576 (NHN-AS-KR NBP, KR),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
http://zbebhelw.com/pass/indesx.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 02 May 2019 16:57:50 GMT
Server
nginx
P3P
CP="ALL CURa ADMa DEVa TAIa OUR BUS IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC OTC"
Cache-Control
no-cache, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 01 Jan 1980 09:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Naver (Online)

193 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| resizePopup function| viewKeyboard function| switchkeyboard function| switchlocale2 function| switchlocale function| normal function| onetime function| show function| hide function| _addEvent function| _addInputEvent function| addInputEvent function| addDeleteButtonEvent function| msieblur function| borderOn function| borderOff function| confirmSubmit function| encryptIdPw function| getKeyByRuntimeInclude function| clearErrorLayers function| keySplit function| getLenChar function| respSelect function| nclk function| nclk_clsnm function| nclk_chk function| nclk_if string| getkeyurl number| curtimecheck function| getKeysv2 function| getAjaxResult function| getXmlHttp function| getCookie function| savedLong function| ipCheckOff function| ipCheckOn function| setSmartLevel function| initSmartLevel function| ipCheck boolean| isshift boolean| userStrokes function| checkShiftUp function| checkShiftDown boolean| is_capslockon function| checkEnt function| capslockevt function| BigInteger function| nbi function| am1 function| am2 function| am3 function| int2char function| intAt function| bnpCopyTo function| bnpFromInt function| nbv function| bnpFromString function| bnpClamp function| bnToString function| bnNegate function| bnAbs function| bnCompareTo function| nbits function| bnBitLength function| bnpDLShiftTo function| bnpDRShiftTo function| bnpLShiftTo function| bnpRShiftTo function| bnpSubTo function| bnpMultiplyTo function| bnpSquareTo function| bnpDivRemTo function| bnMod function| Classic function| cConvert function| cRevert function| cReduce function| cMulTo function| cSqrTo function| bnpInvDigit function| Montgomery function| montConvert function| montRevert function| montReduce function| montSqrTo function| montMulTo function| bnpIsEven function| bnpExp function| bnModPowInt function| Arcfour function| ARC4init function| ARC4next function| prng_newstate function| rng_seed_int function| rng_seed_time function| rng_get_byte function| rng_get_bytes function| SecureRandom function| parseBigInt function| linebrk function| byte2Hex function| pkcs1pad2 function| RSAKey function| RSASetPublic function| RSADoPublic function| RSAEncrypt function| hex2b64 function| b64tohex function| b64toBA boolean| isIE boolean| isWin boolean| isOpera number| dbits number| canary boolean| j_lm number| BI_FP string| BI_RM object| BI_RC number| rr number| vv number| rng_psize undefined| rng_state object| rng_pool number| rng_pptr number| t undefined| z string| b64map string| b64pad boolean| lcs_isie boolean| lcs_isns boolean| lcs_isopera boolean| lcs_ismac object| lcs_add object| lcs_bc string| lcs_ver number| lcs_cnt object| keys object| keystr string| keyname string| evalue string| nvalue number| initEnc string| is_ipcheck undefined| enctp boolean| is_sid boolean| is_spw boolean| is_mid boolean| is_mpw undefined| browser number| nclkMaxDepth string| ccsrv string| nclkModule string| nsc string| g_pid string| g_sid object| nclkImg function| clickcr function| nclks function| nclks_clsnm function| nclks_chk function| nclks_if function| lcs_do function| lcs_do_gdid function| lcs_getBrowserCapa function| lcs_getOS function| lcs_getlanguage function| lcs_getScreen function| lcs_getWindowSize function| lcs_getColorDepth function| lcs_getJavaEnabled function| lcs_getCookieEnabled function| lcs_getConnectType function| lcs_getJavascriptVer function| lcs_getSwfVer function| lcs_getSLVersion function| lcs_getPlugIn string| disp_stat string| session_keys string| pc_keyboard_close string| pc_keyboard_open string| view_char string| view_symbol object| login_chk function| persist_usage boolean| view_onetimeusage function| viewOnetime undefined| nid_buk number| smart_level function| nclks_select

0 Cookies