xrnp.frisuba.online
Open in
urlscan Pro
188.114.97.3
Malicious Activity!
Public Scan
Submission: On May 09 via manual from JP — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on April 21st 2024. Valid for: 3 months.
This is the only time xrnp.frisuba.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Japan Post (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 2.17.147.123 2.17.147.123 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
3 | 54.168.155.230 54.168.155.230 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 52.199.47.224 52.199.47.224 | 16509 (AMAZON-02) (AMAZON-02) | |
6 | 18.182.196.200 18.182.196.200 | 16509 (AMAZON-02) (AMAZON-02) | |
33 | 5 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-147-123.deploy.static.akamaitechnologies.com
cache.jp-bank.japanpost.jp |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-168-155-230.ap-northeast-1.compute.amazonaws.com
directcss.jp-bank.japanpost.jp |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-199-47-224.ap-northeast-1.compute.amazonaws.com
directacct.jp-bank.japanpost.jp |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-182-196-200.ap-northeast-1.compute.amazonaws.com
directss.jp-bank.japanpost.jp |
Apex Domain Subdomains |
Transfer | |
---|---|---|
31 |
japanpost.jp
cache.jp-bank.japanpost.jp directcss.jp-bank.japanpost.jp directacct.jp-bank.japanpost.jp directss.jp-bank.japanpost.jp |
323 KB |
2 |
frisuba.online
xrnp.frisuba.online |
7 KB |
33 | 2 |
Domain | Requested by | |
---|---|---|
19 | cache.jp-bank.japanpost.jp |
xrnp.frisuba.online
cache.jp-bank.japanpost.jp |
6 | directss.jp-bank.japanpost.jp |
xrnp.frisuba.online
|
3 | directacct.jp-bank.japanpost.jp |
xrnp.frisuba.online
|
3 | directcss.jp-bank.japanpost.jp |
xrnp.frisuba.online
|
2 | xrnp.frisuba.online | |
33 | 5 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
frisuba.online GTS CA 1P5 |
2024-04-21 - 2024-07-20 |
3 months | crt.sh |
direct.jp-bank.japanpost.jp DigiCert SHA2 Extended Validation Server CA |
2023-08-10 - 2024-08-08 |
a year | crt.sh |
directacct.jp-bank.japanpost.jp DigiCert EV RSA CA G2 |
2024-03-29 - 2025-04-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://xrnp.frisuba.online/tp1web/U010101WAK.do
Frame ID: 881E81CA9D17C18EC50DFA04F8B196C7
Requests: 31 HTTP requests in this frame
15 Outgoing links
These are links going to different origins than the main page.
Title: https://ifkt.rubberducky.site
Search URL Search Domain Scan URL
Title: https://gpbq.rubberducky.site
Search URL Search Domain Scan URL
Title: https://kpye.qipai.online
Search URL Search Domain Scan URL
Title: https://enyy.ophimhd.site
Search URL Search Domain Scan URL
Title: https://irgk.waihui.online
Search URL Search Domain Scan URL
Title: https://iitj.workpolska.online
Search URL Search Domain Scan URL
Title: https://fsvs.qipai.online
Search URL Search Domain Scan URL
Title: https://bkkg.rubberducky.site
Search URL Search Domain Scan URL
Title: https://antw.haychill.site
Search URL Search Domain Scan URL
Title: https://ynni.haychill.site
Search URL Search Domain Scan URL
Title: https://wyme.waihui.online
Search URL Search Domain Scan URL
Title: https://ewmt.waihui.online
Search URL Search Domain Scan URL
Title: https://mbiv.workpolska.online
Search URL Search Domain Scan URL
Title: https://bmxd.rubberducky.site
Search URL Search Domain Scan URL
Title: https://ywkq.waihui.online
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
U010101WAK.do
xrnp.frisuba.online/tp1web/ |
20 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dgCAbase.css
cache.jp-bank.japanpost.jp/pages/pc/etc/css/ |
123 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cache.jp-bank.japanpost.jp/pages/pc/etc/js/ |
90 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mjl.js
cache.jp-bank.japanpost.jp/pages/pc/etc/js/ |
37 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
run.js
cache.jp-bank.japanpost.jp/pages/pc/etc/js/ |
71 KB 71 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dgbaRequestControllerP02.js
cache.jp-bank.japanpost.jp/pages/pc/etc/js/ |
38 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
HcFwEhqexk.js
directcss.jp-bank.japanpost.jp/js/ |
18 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAheaderLogo01.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/structure/ |
3 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAheaderLogo02.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/structure/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
phishingmail.png
cache.jp-bank.japanpost.jp/pages/cmsimage/4/files/Image/ |
49 KB 49 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
btn_menu_direct.gif
cache.jp-bank.japanpost.jp/pages/cmsimage/4/files/Image/ |
12 KB 12 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FAQlink.png
cache.jp-bank.japanpost.jp/pages/cmsimage/4/files/Image/ |
15 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAimgTel01.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/modules/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aes.js
directacct.jp-bank.japanpost.jp/js/ |
13 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
load.js
directacct.jp-bank.japanpost.jp/js/ |
18 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dl.js
directacct.jp-bank.japanpost.jp/js/ |
603 B 876 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAfooterLogo01.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/structure/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dgCApwc.js
directcss.jp-bank.japanpost.jp/js/ |
559 B 832 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ig.json
directss.jp-bank.japanpost.jp/ |
79 B 188 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAiconArrow07.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/modules/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAiconArrow02.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/modules/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAiconArrow04.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/modules/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAiconArrow04L.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/modules/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAiconBullet01.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/modules/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAiconArrow03T.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/modules/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
r.js
directss.jp-bank.japanpost.jp/js/ |
32 KB 32 KB |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chrome.png
directcss.jp-bank.japanpost.jp/js/ |
3 B 274 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DFCAiconBlank01.gif
cache.jp-bank.japanpost.jp/pages/pc/etc/img/modules/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
xrnp.frisuba.online/ |
4 KB 2 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
d
directss.jp-bank.japanpost.jp/ |
0 0 |
Preflight
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
d
directss.jp-bank.japanpost.jp/ |
512 B 785 B |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
u
directss.jp-bank.japanpost.jp/ |
0 253 B |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
u
directss.jp-bank.japanpost.jp/ |
0 0 |
Preflight
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Japan Post (Transportation)96 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| MJL function| jsLaunchFidoApp function| jsLaunchFidoAppLogin function| jsLaunchFidoAppInactive function| jsLaunchFidoAppInactiveOverdraft function| launchFidoApp number| Cmc0gV41_sh function| nd_shtml function| Ah3_sh object| z_sh object| wo_sh boolean| ije_sh boolean| ije9_sh boolean| ije10_sh string| zM_sh function| uw_sh function| ep_sh string| yM_sh function| ct44_shtml object| scpt_sh function| dec_shtml function| Ct44_shtml string| m_shtml function| rr_sh function| nd_sh object| nk_sh string| ua_sh number| pa_sh boolean| mac_sh function| at1_sh function| as_sh boolean| lge_sh undefined| lxE_sh boolean| kon_sh function| fJ_sh boolean| fas_sh boolean| goog_sh boolean| alreadyClicked boolean| isCanceled function| dcRequest string| wid string| hei string| men string| too string| loc string| sta string| res string| scr string| opt function| dcPrintRequest function| dcPrintRequestClose function| dcAbort function| cgfLoadHomepage function| pwc_loadpljs function| pwc_create_loadpljs string| pwc_plugin_jsurl string| gPwcHost function| pwcCall object| spf object| target_paths function| PWCOBJ string| key string| iv object| contents_info function| DC function| LDS function| EXS function| includePageIds object| gPwc_spf_ object| uri object| plugin string| code object| CryptoJS function| sb_loader function| load_accesslog_image object| jQuery19104552383394109567 object| $tableDiv object| $SelectSelect number| $SelectChecked number| gPRSeed function| dnre function| lgin object| _ieCie1aeti_ string| gPWDone number| gPRSeed2 function| uuid string| func_str undefined| desc number| bB string| out string| url object| x object| buttons object| button2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.frisuba.online/tp1web/ | Name: JP_GID Value: e46ec6de-f68e-4cb0-8904-9ea8f3eac40c |
|
xrnp.frisuba.online/ | Name: PHPSESSID Value: lvvdsud8125c030bqfg8p5j147 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cache.jp-bank.japanpost.jp
directacct.jp-bank.japanpost.jp
directcss.jp-bank.japanpost.jp
directss.jp-bank.japanpost.jp
xrnp.frisuba.online
18.182.196.200
188.114.97.3
2.17.147.123
52.199.47.224
54.168.155.230
15069aeeb72de6b4d2eca4261b597748d714dd4d78d3e61726c77e29dd51d69b
21be32e3ebd437693ade8147db49917d4b94b3584f00f85a829a477cc81325cb
3ff7d4cc230bbdd9c3937309a74716d1fcbd6e932e6b8c25ac767e7944686828
473fdd6dc5410d86bb29d2d5b778544d743019f8566ac2d0aede41af2c0e41c6
49a955deefb073a61a2256ba50ee27aa60ecc531bf7dd94bffce6d077b264175
4d889649c218bde85ab1af95f9779b5cad73578d0033b85027018f4b41c4d647
4f14fe1d7b13e8e050f89bbb18338c2dd575943cd0f254e52c6fe09401c7ae6f
5c37f096ea376ffca3d260cd000845153b67a773a9527fc56cbb3285132c7410
5ff47765449c3719b1523f2e2a4c289b14fbb50a3a26fd161ba2e2190991abb6
6060e7b5a404985db41646a116c8a28af727efc49ca93a9044bd710de5eb9e90
6633a0dfe38f8b851462327a3a5084be43ef3aa7d091e8fa365b1a6ac0083d12
732c4e9711639ed1436dd90d3951ca347d737084fc0cea250eed823bef07d0f1
783507319974a6376b481f4593a1bbcc01358196b357c8200a5aed1b4adb9495
7938585ecb0c1eec275a12f428708171b79e974b64aaceabae5fb6cabc48a2aa
85fa3146e5b7d274791cdb45992abb155b92ec78e2449360ef665c02acfdd029
86230921babf02b502d4fb5fdff886c330ec9ee9f2ea5ef257efd17ee6e3f3c9
8aaee76b24b99d4b8ba81846b8533f773dd43f357bb18aeeb50aac43eb58aa0f
8c79231392942d162c1775ea71a394530897d95607770c6f80c5c2544b7d66d1
a2ef74aa8f30b83294857131aaa7be38c76902cb6a553315ffeb11b26399f0b1
a477076461d61c5b2c561d6affbea42b4e7554a255b847c9e44d4ff34b4f62fd
bdd8000d37fa4698590e721db10f65f8a2d435cded92f56323fd9e354bf17619
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c1968701cdc45bfd81fafee99e9123fa2a5a00ef2e2427fc8b0a034aaf14c198
c3ac49f01362869c0c876d39be716a7e7c95b56b60a171b070d6ba44ef882a14
c5c6e9f818e29d735c4baac7f34fc0721985638da58981f89a0763871a2bab75
d15f46a0d7e9532ce64f54d9eb7688e7c0ae6be961d57d4cbe3394c90fc5ed94
d8710c6feedd499a1e3967ee66dcde515486c538856e7a00d26481a918769e70
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f248e7819c22cf0222b2841b1e783ecd14068ea1ba2e911515d32ba763564991
f2685585dd8c05dea3cf28ebaeb6e66eab278e8bb1456079c2a929aa270ff471
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a