navercce.duckdns.org
Open in
urlscan Pro
69.197.188.43
Malicious Activity!
Public Scan
URL:
http://navercce.duckdns.org/
Submission: On October 29 via manual from JP
Submission: On October 29 via manual from JP
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 69.197.188.43, located in
Kansas City, United States and
belongs to WII, US.
The main domain is navercce.duckdns.org.
This is the only time navercce.duckdns.org was scanned on urlscan.io!
This is the only time navercce.duckdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Naver (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 69.197.188.43 69.197.188.43 | 32097 (WII) (WII) | |
| 7 | 1 |
7
69.197.188.43
(Kansas City, United States)
ASN32097 (WII, US)
PTR: pdp.buckup24.win
ASN32097 (WII, US)
PTR: pdp.buckup24.win
| navercce.duckdns.org |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
duckdns.org
navercce.duckdns.org |
303 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | navercce.duckdns.org |
navercce.duckdns.org
|
| 7 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://navercce.duckdns.org/
Frame ID: 8D30C7C433F496EA71154C53C109B00F
Requests: 7 HTTP requests in this frame
Screenshot
Detected technologies
Windows Server
(Operating Systems)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- headers server /^Kestrel/i
Microsoft ASP.NET
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^Kestrel/i
Kestrel
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^Kestrel/i
IIS
(Web Servers)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- headers server /^Kestrel/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
navercce.duckdns.org/ |
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
w_20200707.css
navercce.duckdns.org/css/ |
90 KB 90 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bvsd.1.3.4.min.js
navercce.duckdns.org/js/ |
94 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
default200417.js
navercce.duckdns.org/js/ |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sp_u_skip.png
navercce.duckdns.org/images/ |
967 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pc_sp_login_190522.png
navercce.duckdns.org/images/ |
88 KB 89 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pc_qr_once.png
navercce.duckdns.org/images/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Naver (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes object| __core-js_shared__ object| __sofabfp_registry object| sofa undefined| pwElement function| nolink0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
navercce.duckdns.org
69.197.188.43
18646bcf187a14e4e07d42074365ba07dc98278ffa0dfc06389a379145d7aede
63d35e03b6583709f1326f90939025deb7ac744a55f7dd90069744ecb9efaf0f
67bef5d26af42c5a7842ecd98bf3df205cf8de0270802b34a2380de4eb517d46
8a071a70196749dfd8f829c4a46441fb3bfe376e014d7e17db8f6afd01845aa2
9b90a891455ececd09f30c1943bc587b1fb168588ac0a6ce4e39c5da71083ba8
b273657638e8b7e43fd5d9b06ac27a4ef8a8ad9150ef6a3d1fb26afaa67167ca
b283bd73dfa96ff9bbae95734e91f369d1f825b83c37860a993eabb75ea99ebc