eki-net-jp18.top Open in urlscan Pro
194.124.216.11  Malicious Activity! Public Scan

Submitted URL: http://jpcom.cc/VWlv
Effective URL: https://eki-net-jp18.top/login.php
Submission Tags: phishing jr east Search All
Submission: On March 18 via api from JP — Scanned from JP

Summary

This website contacted 3 IPs in 4 countries across 4 domains to perform 25 HTTP transactions. The main IP is 194.124.216.11, located in Amsterdam, Netherlands and belongs to XTOM xTom GmbH, DE. The main domain is eki-net-jp18.top.
TLS certificate: Issued by R3 on March 18th 2023. Valid for: 3 months.
This is the only time eki-net-jp18.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: JR East (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 1 45.117.101.242 4785 (XTOM-AS-J...)
1 172.67.148.77 13335 (CLOUDFLAR...)
2 25 194.124.216.11 3214 (XTOM xTom...)
1 218.12.76.165 4837 (CHINA169-...)
25 3
Apex Domain
Subdomains
Transfer
25 eki-net-jp18.top
eki-net-jp18.top
3 MB
1 bootcdn.net
cdn.bootcdn.net — Cisco Umbrella Rank: 104874
4 KB
1 workers.dev
black-wildflower-1903.yppbavj.workers.dev
530 B
1 jpcom.cc
jpcom.cc
228 B
25 4
Domain Requested by
25 eki-net-jp18.top 2 redirects black-wildflower-1903.yppbavj.workers.dev
eki-net-jp18.top
1 cdn.bootcdn.net eki-net-jp18.top
1 black-wildflower-1903.yppbavj.workers.dev
1 jpcom.cc 1 redirects
25 4

This site contains no links.

Subject Issuer Validity Valid
*.yppbavj.workers.dev
GTS CA 1P5
2023-03-11 -
2023-06-09
3 months crt.sh
eki-net-jp18.top
R3
2023-03-18 -
2023-06-16
3 months crt.sh
cdn.bootcdn.net
TrustAsia RSA DV TLS CA G2
2022-06-06 -
2023-06-06
a year crt.sh

This page contains 2 frames:

Primary Page: https://eki-net-jp18.top/login.php
Frame ID: C673A302607E0092ACD0332B33C9F19E
Requests: 24 HTTP requests in this frame

Frame: https://eki-net-jp18.top/index_1.html
Frame ID: 2020555F18B9E478342B0DCCD932F957
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://jpcom.cc/VWlv HTTP 302
    https://black-wildflower-1903.yppbavj.workers.dev/ Page URL
  2. https://eki-net-jp18.top/ Page URL
  3. https://eki-net-jp18.top/index.php?t=784f30863a52e54a306175030503612fe133b3ff5489809cbf3ce64e4ed26e22 HTTP 302
    https://eki-net-jp18.top/tiaozhuan.php HTTP 302
    https://eki-net-jp18.top/login.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

25
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

4
Countries

2623 kB
Transfer

3195 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://jpcom.cc/VWlv HTTP 302
    https://black-wildflower-1903.yppbavj.workers.dev/ Page URL
  2. https://eki-net-jp18.top/ Page URL
  3. https://eki-net-jp18.top/index.php?t=784f30863a52e54a306175030503612fe133b3ff5489809cbf3ce64e4ed26e22 HTTP 302
    https://eki-net-jp18.top/tiaozhuan.php HTTP 302
    https://eki-net-jp18.top/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://jpcom.cc/VWlv HTTP 302
  • https://black-wildflower-1903.yppbavj.workers.dev/

25 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
black-wildflower-1903.yppbavj.workers.dev/
Redirect Chain
  • http://jpcom.cc/VWlv
  • https://black-wildflower-1903.yppbavj.workers.dev/
65 B
530 B
Document
General
Full URL
https://black-wildflower-1903.yppbavj.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.148.77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-ray
7a9e66fadee81a15-KIX
content-encoding
br
content-type
text/html;charset=UTF-8
date
Sat, 18 Mar 2023 15:10:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Cqgrd7%2BhxhqZbybHVnC3pdhzRe%2Bbvp0Uyfxj9YHRWfHfv9ShC0f%2FtegM8HVudzvJItq0RD7MEF9gqogefw3AqKbadDu5jScuzE7PF1PymJc674IXmYYcEko2XTIHDoE%2FvsO1qJg3c%2FdaOGtBpZJ23eb77Wv5Ir4%2Br8mzA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Sat, 18 Mar 2023 15:10:20 GMT
Location
https://black-wildflower-1903.yppbavj.workers.dev/
Server
nginx
Transfer-Encoding
chunked
/
eki-net-jp18.top/
1 KB
1 KB
Document
General
Full URL
https://eki-net-jp18.top/
Requested by
Host: black-wildflower-1903.yppbavj.workers.dev
URL: https://black-wildflower-1903.yppbavj.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
0f904b618e9fec2a84ee32e19358fe212f97588c22b46ed690c1152e6f62fc4e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://black-wildflower-1903.yppbavj.workers.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 18 Mar 2023 15:10:28 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
vendor.23238u92u82.js
eki-net-jp18.top/vendor/
5 KB
2 KB
Script
General
Full URL
https://eki-net-jp18.top/vendor/vendor.23238u92u82.js
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
ae9da3c9a568a7b3602dc54e10c324166db3abe1d3a6892770d6ce6a7cc8c1c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:28 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Tue, 06 Apr 2021 18:24:54 GMT
server
nginx
etag
W/"606ca776-1375"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Sun, 19 Mar 2023 03:10:28 GMT
Primary Request login.php
eki-net-jp18.top/
Redirect Chain
  • https://eki-net-jp18.top/index.php?t=784f30863a52e54a306175030503612fe133b3ff5489809cbf3ce64e4ed26e22
  • https://eki-net-jp18.top/tiaozhuan.php
  • https://eki-net-jp18.top/login.php
23 KB
5 KB
Document
General
Full URL
https://eki-net-jp18.top/login.php
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
47d269cff1a714c38a487f1b2fe11c7140974b0b73d52b91c8535c526400a297
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://eki-net-jp18.top/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 18 Mar 2023 15:10:30 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-type
text/html; charset=UTF-8
date
Sat, 18 Mar 2023 15:10:29 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
login.php
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000
common.css
eki-net-jp18.top/Personal/member/Login/
120 KB
18 KB
Stylesheet
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/common.css
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
fbcbb0912635e55cd83d661b59db34e48fdbd0b2961d1d24e2f727ce90d5f0d8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:30 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
W/"61c48542-1e053"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sun, 19 Mar 2023 03:10:30 GMT
module.css
eki-net-jp18.top/Personal/member/Login/
74 KB
13 KB
Stylesheet
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/module.css
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
ca27acde5e0af70829e3284e78e58104e5ef2a85e2aab0fc970c45dac342ff9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:31 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
W/"61c48542-1275f"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sun, 19 Mar 2023 03:10:31 GMT
member.css
eki-net-jp18.top/Personal/member/Login/
20 KB
4 KB
Stylesheet
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/member.css
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
8e4d01ee0450f9f5e21ea7178dd0aad676fcebf6808a1a550fddc686fba02542
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:31 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
W/"61c48542-4fe7"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sun, 19 Mar 2023 03:10:31 GMT
style.css
eki-net-jp18.top/Personal/member/Login/
39 KB
8 KB
Stylesheet
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/style.css
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
e8c6c7fcb27ecf30f805db2440815cb88ba295463da429641f99efbd0131f04c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:31 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
W/"61c48542-9a3e"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sun, 19 Mar 2023 03:10:31 GMT
top_searchparts.css
eki-net-jp18.top/Personal/member/Login/
119 KB
16 KB
Stylesheet
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/top_searchparts.css
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
b069f9e249e6adc408d2359f237ce6a1e4d24422d1834c1ec9b7dce4461cae1b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:31 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
W/"61c48542-1db6d"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Sun, 19 Mar 2023 03:10:31 GMT
site-jquery.min.js
eki-net-jp18.top/admin/im/
91 KB
36 KB
Script
General
Full URL
https://eki-net-jp18.top/admin/im/site-jquery.min.js
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:31 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sun, 03 Apr 2022 17:44:22 GMT
server
nginx
etag
W/"6249dcf6-16b60"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Sun, 19 Mar 2023 03:10:31 GMT
layui.js
eki-net-jp18.top/admin/im/
284 KB
105 KB
Script
General
Full URL
https://eki-net-jp18.top/admin/im/layui.js
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:31 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sun, 03 Apr 2022 17:44:22 GMT
server
nginx
etag
W/"6249dcf6-471da"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Sun, 19 Mar 2023 03:10:31 GMT
layer.min.css
cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/
13 KB
4 KB
Stylesheet
General
Full URL
https://cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/layer.min.css
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
218.12.76.165 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software
openresty /
Resource Hash
f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

nginx-hit
1
date
Sat, 18 Mar 2023 15:10:31 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-ccdn-cachettl
31536000
via
CHN-HEshijiazhuang-AREACUCC1-CACHE40[4],CHN-HEshijiazhuang-AREACUCC1-CACHE48[0,TCP_HIT,2],CHN-SH-GLOBAL1-CACHE100[104],CHN-SH-GLOBAL1-CACHE117[93,TCP_MISS,101],EA-SGP-GLOBAL1-CACHE5[21],EA-SGP-GLOBAL1-CACHE9[0,TCP_HIT,20]
age
12229050
content-encoding
gzip
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 11 Jun 2021 14:31:54 GMT
server
openresty
cf-cdnjs-via
cfworker/kv
etag
W/"60c373da-a5f"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aQ54cAKo4lkxdAUi19bNMdPq5Jj9AWg1w%2FKB%2BCBPa3iW6EHeGlAhSrk4xSvPUjfH4CVFWnuTfc3K78n9hNSbRvGW9blbWyOQ56aALR30v2RJ4Lo6r0RSG7F00QiASF6oW0Y0%2B88i"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
x-ccdn-expires
19306950
timing-allow-origin
*
cf-ray
74b793be1d8d897a-SIN
x-hcs-proxy-type
1
expires
Wed, 06 Sep 2023 06:34:35 GMT
load_font.css
eki-net-jp18.top/Personal/member/Login/
768 B
971 B
Stylesheet
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/load_font.css
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
09f83e61ec727d85b276d4d1c70eb3c40a05c40c796fdd3683709477b7b0d3c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:31 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
"61c48542-300"
content-type
text/css
cache-control
max-age=43200
accept-ranges
bytes
content-length
768
expires
Sun, 19 Mar 2023 03:10:31 GMT
logo_ekinet.png
eki-net-jp18.top/Personal/member/Login/
7 KB
8 KB
Image
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/logo_ekinet.png
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
3f7c549cfacde11c4129c09b1908d106126d823682cc758f70fc046638d7746b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:31 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
"61c48542-1d38"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
7480
expires
Mon, 17 Apr 2023 15:10:31 GMT
logo_jreast.png
eki-net-jp18.top/Personal/member/Login/
3 KB
3 KB
Image
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/logo_jreast.png
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
ba4924716ed0580ae30f974eebb97421a2c10c1e2cf61e8ad60fcd39d8fbca30
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:32 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
"61c48542-b5d"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
2909
expires
Mon, 17 Apr 2023 15:10:32 GMT
icon_input_ok.png
eki-net-jp18.top/Personal/member/Login/
3 KB
3 KB
Image
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/icon_input_ok.png
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
d4d96a513c50320d375f5cb8c1c4f52d6ba868b6ffafec5f451deb8dc9ef05f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:32 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
"61c48542-c9d"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
3229
expires
Mon, 17 Apr 2023 15:10:32 GMT
icon_linkblank.png
eki-net-jp18.top/Personal/member/Login/
166 B
371 B
Image
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/icon_linkblank.png
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
e918e110b6e7e8c5ada678baab1d10bcf4f24d149943804b0b31363ccd976b7a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:32 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
"61c48542-a6"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
166
expires
Mon, 17 Apr 2023 15:10:32 GMT
icon_linkblank-1.png
eki-net-jp18.top/Personal/member/Login/
166 B
371 B
Image
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/icon_linkblank-1.png
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
e918e110b6e7e8c5ada678baab1d10bcf4f24d149943804b0b31363ccd976b7a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:32 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
"61c48542-a6"
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
166
expires
Mon, 17 Apr 2023 15:10:32 GMT
laydate.css
eki-net-jp18.top/admin/im/css/modules/laydate/default/
0
0
Stylesheet
General
Full URL
https://eki-net-jp18.top/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/admin/im/layui.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:32 GMT
server
nginx
content-length
548
content-type
text/html
layer.css
eki-net-jp18.top/admin/im/css/modules/layer/default/
0
0
Stylesheet
General
Full URL
https://eki-net-jp18.top/admin/im/css/modules/layer/default/layer.css?v=3.5.1
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/admin/im/layui.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:32 GMT
server
nginx
content-length
548
content-type
text/html
code.css
eki-net-jp18.top/admin/im/css/modules/
0
0
Stylesheet
General
Full URL
https://eki-net-jp18.top/admin/im/css/modules/code.css?v=2
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/admin/im/layui.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://eki-net-jp18.top/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:32 GMT
server
nginx
content-length
548
content-type
text/html
api.php
eki-net-jp18.top/
13 B
245 B
XHR
General
Full URL
https://eki-net-jp18.top/api.php?act=ip_save&_r=0.521512989325817
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/admin/im/site-jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Referer
https://eki-net-jp18.top/login.php
X-Requested-With
XMLHttpRequest
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 18 Mar 2023 15:10:32 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
expires
Thu, 19 Nov 1981 08:52:00 GMT
index_1.html
eki-net-jp18.top/ Frame 2020
548 B
611 B
Document
General
Full URL
https://eki-net-jp18.top/index_1.html
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

Referer
https://eki-net-jp18.top/login.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

content-length
548
content-type
text/html
date
Sat, 18 Mar 2023 15:10:32 GMT
server
nginx
NotoSansCJKjp-Regular_subset.woff
eki-net-jp18.top/Personal/member/Login/
1 MB
1 MB
Font
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/NotoSansCJKjp-Regular_subset.woff
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/Personal/member/Login/load_font.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
434379a92cc3af5ca03ccb2bfaadc7f2b8224b1b49f310ec5f4d27ca36777520
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://eki-net-jp18.top/Personal/member/Login/load_font.css
Origin
https://eki-net-jp18.top
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:32 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
"61c48542-128eb4"
content-type
font/woff
accept-ranges
bytes
content-length
1216180
NotoSansCJKjp-Bold_subset.woff
eki-net-jp18.top/Personal/member/Login/
1 MB
1 MB
Font
General
Full URL
https://eki-net-jp18.top/Personal/member/Login/NotoSansCJKjp-Bold_subset.woff
Requested by
Host: eki-net-jp18.top
URL: https://eki-net-jp18.top/Personal/member/Login/load_font.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.124.216.11 Amsterdam, Netherlands, ASN3214 (XTOM xTom GmbH, DE),
Reverse DNS
194.124.216.11.static.xtom.com
Software
nginx /
Resource Hash
a1dc96381991e019ff7dfcfbe7dc3502bee81f16fac13231e8c2921d8431e621
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://eki-net-jp18.top/Personal/member/Login/load_font.css
Origin
https://eki-net-jp18.top
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 15:10:32 GMT
strict-transport-security
max-age=31536000
last-modified
Thu, 23 Dec 2021 14:18:42 GMT
server
nginx
etag
"61c48542-12cce4"
content-type
font/woff
accept-ranges
bytes
content-length
1232100

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: JR East (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery

4 Cookies

Domain/Path Name / Value
eki-net-jp18.top/ Name: PHPSESSID
Value: n82rll0vb439cl6ii9u612svin
.eki-net-jp18.top/ Name: 62345ba76168db0033ce8ae6a90ce5a762956614
Value: nwcMGFHjQc7nDOZDxhWlbg%3D%3D
.eki-net-jp18.top/ Name: _amkc
Value: 1643ae38-f498-4ecc-99d1-c63da64c2643
.eki-net-jp18.top/ Name: ak_bmsc
Value: JgGVxRJWxiWUgoZiejEjpsCIDNsulJOxl8RneWIVwN6N%2F80JsIJFL21ZfNCWelXD9fZF2pTrAVRpAJxPBeJhsf8syW4dMVDCaT3WAjcTwl2l7ZQjlajnlJkh7yb%2FFKX3ykgnEkl3S0aGg%2FYgN1RWI%2B0rpfGKYXEVn4tcYodMjMFQE8fYImnTQUwPH9l5Qi1Qtq6PYP8aF3D6v4%2FGbSpeKdDCO%2F6Ss6yptFt6LvL0ZSmwkG4mwt48zb5sZMZT0DZCKiqSQRwiC837VVOOPXz3n2NmEkmXoIXPu633LHuxyImb3ejojfrmdg7T8W%2Bi8hv1HlXn9SJq0Dg13WoKtM%2F%2F4lqAZ%2BAluRD2JF7onDjJlyYSef4YjzLfL565GsoPRq62cucoOplVJh2%2BKsGftx%2FCUCHYL0UtlpTkJsA3o9uR7zYHDxgb7gl5%2BUZ4j0Ym0fWz8tJ6sAi2%2FcqCc9Q9mchYvqv1OYxTjgN1rIvc4WFhF469JR2nfsOmVbRi7BZtlF1tMzwN82vNjcJcR%2FcBGHochQYz598Vbk4ytqMBBAOV0H519zXb0vEF82ANy70V1zD8UxQLAlTT8814T0giVKojWBwJY4XvKmyjyylzaz%2Bu1pKYjbMJTBevT9roSXMZtmPqGGh28QmGPrybCKib8ET1N9zLFNWm8epQUCvOrylB%2Bqp67gaKCVqiIY4TIxzjQCr2HpBKPSuagXYF6maVwaB0n48D4s7voqNOGTq1t%2BWG6gnOpwQWsKxL1hEDddtYQZA5

4 Console Messages

Source Level URL
Text
network error URL: https://eki-net-jp18.top/admin/im/css/modules/laydate/default/laydate.css?v=5.3.1
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://eki-net-jp18.top/admin/im/css/modules/layer/default/layer.css?v=3.5.1
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://eki-net-jp18.top/admin/im/css/modules/code.css?v=2
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://eki-net-jp18.top/index_1.html
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

black-wildflower-1903.yppbavj.workers.dev
cdn.bootcdn.net
eki-net-jp18.top
jpcom.cc
172.67.148.77
194.124.216.11
218.12.76.165
45.117.101.242
09f83e61ec727d85b276d4d1c70eb3c40a05c40c796fdd3683709477b7b0d3c0
0f904b618e9fec2a84ee32e19358fe212f97588c22b46ed690c1152e6f62fc4e
3f7c549cfacde11c4129c09b1908d106126d823682cc758f70fc046638d7746b
434379a92cc3af5ca03ccb2bfaadc7f2b8224b1b49f310ec5f4d27ca36777520
47d269cff1a714c38a487f1b2fe11c7140974b0b73d52b91c8535c526400a297
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
8e4d01ee0450f9f5e21ea7178dd0aad676fcebf6808a1a550fddc686fba02542
a1dc96381991e019ff7dfcfbe7dc3502bee81f16fac13231e8c2921d8431e621
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
ae9da3c9a568a7b3602dc54e10c324166db3abe1d3a6892770d6ce6a7cc8c1c6
b069f9e249e6adc408d2359f237ce6a1e4d24422d1834c1ec9b7dce4461cae1b
ba4924716ed0580ae30f974eebb97421a2c10c1e2cf61e8ad60fcd39d8fbca30
bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e
ca27acde5e0af70829e3284e78e58104e5ef2a85e2aab0fc970c45dac342ff9d
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d4d96a513c50320d375f5cb8c1c4f52d6ba868b6ffafec5f451deb8dc9ef05f4
e8c6c7fcb27ecf30f805db2440815cb88ba295463da429641f99efbd0131f04c
e918e110b6e7e8c5ada678baab1d10bcf4f24d149943804b0b31363ccd976b7a
f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e
fbcbb0912635e55cd83d661b59db34e48fdbd0b2961d1d24e2f727ce90d5f0d8