netstation2-aplus-co-jp.ahjk56.com
Open in
urlscan Pro
2606:4700:3035::6815:4d5a
Malicious Activity!
Public Scan
Effective URL: https://netstation2-aplus-co-jp.ahjk56.com/login/?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.aplus.co.jp%2F%3Fref_%3Dnav...
Submission: On May 09 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 7th 2022. Valid for: a year.
This is the only time netstation2-aplus-co-jp.ahjk56.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aplus (Shinsei Bank) (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 15 | 2606:4700:303... 2606:4700:3035::6815:4d5a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 1 |
ASN13335 (CLOUDFLARENET, US)
netstation2-aplus-co-jp.ahjk56.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
ahjk56.com
1 redirects
netstation2-aplus-co-jp.ahjk56.com |
290 KB |
14 | 1 |
Domain | Requested by | |
---|---|---|
15 | netstation2-aplus-co-jp.ahjk56.com |
1 redirects
netstation2-aplus-co-jp.ahjk56.com
|
14 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.aplus.co.jp |
netstation2.aplus.co.jp |
www.facebook.com |
twitter.com |
www.shinseibank.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-05-07 - 2023-05-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://netstation2-aplus-co-jp.ahjk56.com/login/?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.aplus.co.jp%2F%3Fref_%3Dnav_em_hd_re_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=jpflex&openid.mode=checkid_setup&key=a@b.c&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&&ref_=nav_em_hd_clc_signinhttps://www.aplus.co.jp
Frame ID: C9FC7C59968151ED68FCBCFF43864122
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
ログイン | アプラスPage URL History Show full URLs
-
https://netstation2-aplus-co-jp.ahjk56.com/
HTTP 302
https://netstation2-aplus-co-jp.ahjk56.com/login/?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.aplus.c... Page URL
Detected technologies
Google Tag Manager (Tag Managers) ExpandDetected patterns
- <!-- (?:End )?Google Tag Manager -->
Page Statistics
12 Outgoing links
These are links going to different origins than the main page.
Title: 新規登録(無料)
Search URL Search Domain Scan URL
Title: NETstation*APLUSについて
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: NET station*APLUSのID・パスワードの取扱いに関するご注意とお願い
Search URL Search Domain Scan URL
Title: NET station*APLUSのパスワードの管理は慎重に
Search URL Search Domain Scan URL
Title: 個人情報保護方針
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://netstation2-aplus-co-jp.ahjk56.com/
HTTP 302
https://netstation2-aplus-co-jp.ahjk56.com/login/?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.aplus.co.jp%2F%3Fref_%3Dnav_em_hd_re_signin&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=jpflex&openid.mode=checkid_setup&key=a@b.c&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&&ref_=nav_em_hd_clc_signinhttps://www.aplus.co.jp Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
netstation2-aplus-co-jp.ahjk56.com/login/ Redirect Chain
|
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
netstation2-aplus-co-jp.ahjk56.com/login/ |
145 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app_pc.jpg
netstation2-aplus-co-jp.ahjk56.com/login/ |
16 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
remind-2.jpg
netstation2-aplus-co-jp.ahjk56.com/login/ |
11 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bn_facebook.gif
netstation2-aplus-co-jp.ahjk56.com/login/ |
15 KB 15 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bn_twitter.gif
netstation2-aplus-co-jp.ahjk56.com/login/ |
15 KB 15 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
line.gif
netstation2-aplus-co-jp.ahjk56.com/login/ |
8 KB 8 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
mv_top_shinsei2109.png
netstation2-aplus-co-jp.ahjk56.com/login/ |
187 KB 188 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hd-main-bg.png
netstation2-aplus-co-jp.ahjk56.com/login/ |
79 B 663 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hd-logo.png
netstation2-aplus-co-jp.ahjk56.com/login/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gloval-bg.png
netstation2-aplus-co-jp.ahjk56.com/login/ |
83 B 675 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon.png
netstation2-aplus-co-jp.ahjk56.com/login/ |
997 B 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pagetop.png
netstation2-aplus-co-jp.ahjk56.com/login/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ft-logo.png
netstation2-aplus-co-jp.ahjk56.com/login/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aplus (Shinsei Bank) (Financial)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
netstation2-aplus-co-jp.ahjk56.com/ | Name: PHPSESSID Value: 6dhv3ftj5igv1d87mpqkc3kgq2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
netstation2-aplus-co-jp.ahjk56.com
2606:4700:3035::6815:4d5a
0bf85b852f5aa189bd34c2944b5093d14182cfedb62f5f01cd8e4763384c9aaa
3cb885d126f0c2d91d34f9cf958cb68fe5547986e94fad6fa5acbeb62c6023f1
3d8cc79137767b2c6bb6c8054d093e9788b0f43fe5893c42ef0586b86aa03e20
4aa74984a49acbbd2b76baf9b9ffdd7578ff355e150c6bbbbf42299d08f17d7c
65e17e668c3d58082c325dfba0943414fdce67de6bcbc2f56e2bd56ad74278fa
74b7f0886eeb4c66b8c2f7f4762f6df7ce7a416b3397039b50e7e23478d1adbc
813a1e9758bb99a4744c6b6b84233b6442b8998ad1a83fc36642425232f44b27
8735828b2e32b3ed356ae4bf91b0d95b464d31716702bbcb472a93d0ab560c01
b004c22a0a558c78fde00d5fd42966006ce2df8afa54b2cdb808d4058a8aaeba
b2f5063644a8bf6df9f21bbf528454a2413bce5e01287a940aed548ac5c957e0
b923088ea8deadb010739d6c188b3a5128f538df0b4004e4ab8e520d4934b170
e0a2c557ff82f058d09f93d4ff276190915d21f7ff70155eacb74017e87463a2
f59085841b5eff890edddfb58d9507eaa5d2b12f42c68d5254f805450dd3de69
feffa0caa07987c670cae82d6a1c920bb0a68a2207b8f84e3a18a6ef624a0cbb