www.flowmaxgroup.com
Open in
urlscan Pro
31.193.5.6
Malicious Activity!
Public Scan
Effective URL: https://www.flowmaxgroup.com/wp-includes/js/alaskafcu/iiiiiak/index.htm
Submission: On December 30 via manual from US
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 31st 2019. Valid for: a year.
This is the only time www.flowmaxgroup.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Alaska USA Federal Credit Union (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 202.218.49.3 202.218.49.3 | 2554 (IDCF2554 ...) (IDCF2554 IDC Frontier Inc.) | |
1 | 31.193.5.6 31.193.5.6 | 61323 (SECARMA) (SECARMA) | |
11 | 107.162.151.111 107.162.151.111 | 55002 (DEFENSE-NET) (DEFENSE-NET - Defense.Net) | |
1 | 208.69.196.32 208.69.196.32 | 40226 (AKUSA) (AKUSA - Alaska USA Federal Credit Union) | |
14 | 4 |
ASN2554 (IDCF2554 IDC Frontier Inc., JP)
PTR: server49.joeswebhosting.net
k-antiques.jp |
ASN55002 (DEFENSE-NET - Defense.Net, Inc, US)
login.alaskausa.org |
ASN40226 (AKUSA - Alaska USA Federal Credit Union, US)
www.alaskausa.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
alaskausa.org
login.alaskausa.org www.alaskausa.org |
49 KB |
1 |
flowmaxgroup.com
www.flowmaxgroup.com |
4 KB |
1 |
k-antiques.jp
k-antiques.jp |
508 B |
14 | 3 |
Domain | Requested by | |
---|---|---|
11 | login.alaskausa.org |
www.flowmaxgroup.com
|
1 | www.alaskausa.org |
www.flowmaxgroup.com
|
1 | www.flowmaxgroup.com | |
1 | k-antiques.jp | |
14 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.alaskausa.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
flowmaxgroup.com Sectigo RSA Domain Validation Secure Server CA |
2019-10-31 - 2020-10-31 |
a year | crt.sh |
login.alaskausa.org DigiCert SHA2 Secure Server CA |
2018-09-25 - 2020-02-04 |
a year | crt.sh |
www.alaskausa.org DigiCert SHA2 Secure Server CA |
2018-12-11 - 2021-01-28 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.flowmaxgroup.com/wp-includes/js/alaskafcu/iiiiiak/index.htm
Frame ID: F853D7DB354CDC0B87E4C453085D4225
Requests: 14 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://k-antiques.jp/alaskafcu/dr.php Page URL
- https://www.flowmaxgroup.com/wp-includes/js/alaskafcu/iiiiiak/index.htm Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Forgot User ID?
Search URL Search Domain Scan URL
Title: Other issues?
Search URL Search Domain Scan URL
Title: More contact information
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://k-antiques.jp/alaskafcu/dr.php Page URL
- https://www.flowmaxgroup.com/wp-includes/js/alaskafcu/iiiiiak/index.htm Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
dr.php
k-antiques.jp/alaskafcu/ |
289 B 508 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.htm
www.flowmaxgroup.com/wp-includes/js/alaskafcu/iiiiiak/ |
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ub-main.css
login.alaskausa.org/efs/efs/jsp/inc/css/ |
21 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ub-login-new.css
login.alaskausa.org/efs/efs/jsp/inc/css/ |
3 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common_functions.js
login.alaskausa.org/efs/efs/jslibrary/ |
8 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
open_window.js
login.alaskausa.org/efs/efs/jslibrary/ |
5 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
akusafcu_logo.png
login.alaskausa.org/efs/efs/grafx/akusa/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ehl-tri.gif
login.alaskausa.org/efs/efs/grafx/akusa/ |
2 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-ncua.gif
login.alaskausa.org/efs/efs/grafx/akusa/ |
4 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ub-print.css
login.alaskausa.org/efs/efs/jsp/inc/css/ |
3 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ub-popup.css
login.alaskausa.org/efs/efs/jsp/inc/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header_bg.png
login.alaskausa.org/efs/efs/grafx/akusa/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pgMainEdge.png
www.alaskausa.org/css/nav/ |
960 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bullet-right.png
login.alaskausa.org/efs/images/ |
154 B 491 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Alaska USA Federal Credit Union (Banking)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| isBlank function| isValidMask function| trimSpaces function| isNum function| hasInvalidChar function| isInvalidChar function| hasInvalidCharBeneficiary function| isInvalidCharBeneficiary function| isChar function| isNumOrChar function| stripChars function| isLength function| parseString function| isAllNums function| stripSpaces function| containsInvalidChar function| isItInvalidChar function| showNote function| toggleTree function| toggleNote function| PopupWindow function| PopupHelp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
k-antiques.jp
login.alaskausa.org
www.alaskausa.org
www.flowmaxgroup.com
107.162.151.111
202.218.49.3
208.69.196.32
31.193.5.6
0949ef9fa6244f4b2f107f79c6ef0a23e45741046a316306ea0f6b3f8cca0f57
1fb28d9c14ec42912599df0f34b14c6e6f996084ca13e06bb11dcb4c9459ed34
29fbae99db27d372bc1c80e818b1d715dd45db38b3e443ecf76612fa6d6fb6ca
2d9fa36e51725a611606fa03dd21a3bf7335bcc6d9a576adcbec24b5b90c9855
32144e8c46a477afce0c571d57b94fc6c6e8926b446df525692ae6b4932b4c02
5cd6b433131a0f7972117a1de73410cd07059f385b4dceb1e99b1c9dd6351fb6
70a46f91c5948576ac320802ed148ed967757b8391f9b3e958c2dcbe1f333d14
a3941d5f3a221368776c19f01fef5fdcff8825460e416580fc809dbdd83972cc
ae0a9f620731be24cc8c6fc0f2cc46e789f276f497e96ad92734bd7facd2f9e8
d2309e7671c293a03f7a8999460b2ad780f4325de30ee729870db4b755a5e25c
da209614d1df8cf3089c96fcbc74df2a989d53d7e26df1c53f1c35a858bedd73
dcfdce79105743aeda2d194642ba6c291664dd193002cf0e761762896af7ac08
e9d50b964802b2bb60004481eb67394bd994ba4c6f8a67e3ded7574ef58fcfc2
f657d267e6ae9ad4ea7098837dbb17e74eda13d95eaddff6afa5b51b6ceede4c