www.jk-bic.jp
Open in
urlscan Pro
124.108.39.82
Malicious Activity!
Public Scan
URL:
https://www.jk-bic.jp/up_pdf/wp-config/Service/PayPal/..com/.ma.home/webapps/verf.php?websrc=77dab160d987730dc452ffcdb...
Submission: On June 23 via automatic, source openphish
Submission: On June 23 via automatic, source openphish
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 4 HTTP transactions.
The main IP is 124.108.39.82, located in
Tokyo, Japan and
belongs to CLARAONLINE CLARA ONLINE, Inc., JP.
The main domain is www.jk-bic.jp.
TLS certificate: Issued by GlobalSign Domain Validation CA - SHA... on June 30th 2016. Valid for: a year.
This is the only time www.jk-bic.jp was scanned on urlscan.io!
TLS certificate: Issued by GlobalSign Domain Validation CA - SHA... on June 30th 2016. Valid for: a year.
This is the only time www.jk-bic.jp was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 3 | 124.108.39.82 124.108.39.82 | 23661 (CLARAONLI...) (CLARAONLINE CLARA ONLINE) | |
| 1 | 213.174.135.1 213.174.135.1 | 39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS) | |
| 4 | 2 |
3
124.108.39.82
(Tokyo, Japan)
ASN23661 (CLARAONLINE CLARA ONLINE, Inc., JP)
PTR: www.jk-bic.jp
ASN23661 (CLARAONLINE CLARA ONLINE, Inc., JP)
PTR: www.jk-bic.jp
| www.jk-bic.jp |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
jk-bic.jp
www.jk-bic.jp |
4 KB |
| 1 |
postimg.org
s10.postimg.org |
153 KB |
| 4 | 2 |
| Domain | Requested by | |
|---|---|---|
| 3 | www.jk-bic.jp |
www.jk-bic.jp
|
| 1 | s10.postimg.org |
www.jk-bic.jp
|
| 4 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.jk-bic.jp GlobalSign Domain Validation CA - SHA256 - G2 |
2016-06-30 - 2017-07-24 |
a year | crt.sh |
| *.postimg.org AlphaSSL CA - SHA256 - G2 |
2016-11-02 - 2017-11-03 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.jk-bic.jp/up_pdf/wp-config/Service/PayPal/..com/.ma.home/webapps/verf.php?websrc=77dab160d987730dc452ffcdb621579a&dispatched=62&id=8244544933
Frame ID: 27455.1
Requests: 4 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
verf.php
www.jk-bic.jp/up_pdf/wp-config/Service/PayPal/..com/.ma.home/webapps/ |
827 B 827 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
verf.css
www.jk-bic.jp/up_pdf/wp-config/Service/PayPal/..com/.ma.home/webapps/css/ |
936 B 936 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
exc.png
www.jk-bic.jp/up_pdf/wp-config/Service/PayPal/..com/.ma.home/webapps/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
image.jpg
s10.postimg.org/g5ujyvukp/ |
152 KB 153 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
s10.postimg.org
www.jk-bic.jp
124.108.39.82
213.174.135.1
5cec30ffd3ec48d710a31dd595face594d24df98afbda809c3f326bb5cf3e002
8e222d38e5738386913ecd6b80de6f1fe1f817aae33a2778f106872e0204c44e
a94dcaa2913e24e6d67308e3a554fc67a40fbcc34e89c62fb77bf5e9bcd26245
e1dcc26fdbf63715908eae53a854858d7352499959ae1b906c751b351a9be96e