urlscan.io logo urlscan.io
SecurityTrails logo

netstation.aplus1server9netstation2mail5login.com Open in urlscan Pro
92.38.178.224  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://netstation.aplus1server9netstation2mail5login.com/serv/
Effective URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Submission Tags: 7829790
Submission: On October 14 via api from FR — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 92.38.178.224, located in Tokyo, Japan and belongs to GHOST, LU. The main domain is netstation.aplus1server9netstation2mail5login.com.
TLS certificate: Issued by R3 on October 13th 2022. Valid for: 3 months.
This is the only time netstation.aplus1server9netstation2mail5login.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aplus (Shinsei Bank) (Financial)

Domain & IP information

IP Address AS Autonomous System
1 15 92.38.178.224 202422 (GHOST)
14 2
Apex Domain
Subdomains		 Transfer
15 aplus1server9netstation2mail5login.com
netstation.aplus1server9netstation2mail5login.com
533 KB
14 1
Domain Requested by
15 netstation.aplus1server9netstation2mail5login.com 1 redirects netstation.aplus1server9netstation2mail5login.com
14 1

This site contains links to these domains. Also see Links.

Domain
www.aplus.co.jp
Subject Issuer Validity Valid
netstation.aplus1server9netstation2mail5login.com
R3		 2022-10-13 -
2023-01-11		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Frame ID: BBC0F07E69F7B029F7704D38B3612722
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

ログイン | アプラス

Page URL History Show full URLs

  1. https://netstation.aplus1server9netstation2mail5login.com/serv/ HTTP 302
    https://netstation.aplus1server9netstation2mail5login.com/index1.php?s=51c07ea48d19c1f00d3b7a7422071eef Page URL
  2. https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

533 kB
Transfer

1174 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://netstation.aplus1server9netstation2mail5login.com/serv/ HTTP 302
    https://netstation.aplus1server9netstation2mail5login.com/index1.php?s=51c07ea48d19c1f00d3b7a7422071eef Page URL
  2. https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://netstation.aplus1server9netstation2mail5login.com/serv/ HTTP 302
  • https://netstation.aplus1server9netstation2mail5login.com/index1.php?s=51c07ea48d19c1f00d3b7a7422071eef

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
index1.php
netstation.aplus1server9netstation2mail5login.com/
Redirect Chain
  • https://netstation.aplus1server9netstation2mail5login.com/serv/
  • https://netstation.aplus1server9netstation2mail5login.com/index1.php?s=51c07ea48d19c1f00d3b7a7422071eef
181 B
391 B 		Document
General
Check archive.org
Download Go to
Full URL
https://netstation.aplus1server9netstation2mail5login.com/index1.php?s=51c07ea48d19c1f00d3b7a7422071eef
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
*
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
*
content-type
*
date
Fri, 14 Oct 2022 01:41:05 GMT
server
nginx
strict-transport-security
max-age=31536000

Redirect headers

content-type
text/html; charset=UTF-8
date
Fri, 14 Oct 2022 01:41:05 GMT
location
https://netstation.aplus1server9netstation2mail5login.com/index1.php?s=51c07ea48d19c1f00d3b7a7422071eef
server
nginx
strict-transport-security
max-age=31536000
Primary Request /
netstation.aplus1server9netstation2mail5login.com/oa/ 		615 B
767 B 		Document
General
Check archive.org
Download Go to
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/index1.php?s=51c07ea48d19c1f00d3b7a7422071eef
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
98d8614d55c9ee58c4ea9599ef3eabb04aa4c591b2b14aa72914ce4581c68070
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://netstation.aplus1server9netstation2mail5login.com/index1.php?s=51c07ea48d19c1f00d3b7a7422071eef
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

accept-ranges
bytes
content-length
615
content-type
text/html
date
Fri, 14 Oct 2022 01:41:05 GMT
etag
"6348aab0-267"
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
strict-transport-security
max-age=31536000
chunk-vendors.7ee4b046.js
netstation.aplus1server9netstation2mail5login.com/oa/js/ 		145 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/js/chunk-vendors.7ee4b046.js
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
08ae97b26d9343a96f9873cab47ac0359bc4a377d446e3f3f14341287332a62b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
W/"6348aab0-242d1"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Fri, 14 Oct 2022 13:41:05 GMT
app.08e64618.js
netstation.aplus1server9netstation2mail5login.com/oa/js/ 		31 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/js/app.08e64618.js
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
90b80489adcba6a567f4ca99664603ecbfadbcb6f76b1e72e4378f9090b098aa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
W/"6348aab0-7d3e"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Fri, 14 Oct 2022 13:41:05 GMT
app.3e303c92.css
netstation.aplus1server9netstation2mail5login.com/oa/css/ 		275 KB
71 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/css/app.3e303c92.css
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
968e5811d698d504cd85060a73e7f591fdb7bc70a69fd4251f41b4577f655aa7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
W/"6348aab0-44d88"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Fri, 14 Oct 2022 13:41:05 GMT
jquery.js
netstation.aplus1server9netstation2mail5login.com/oa/js/ 		412 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/js/jquery.js
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
88a777922b72afde362874b9b8af5b684b521e992906f98b9d2131f041d9d540
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
W/"6348aab0-66e40"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Fri, 14 Oct 2022 13:41:05 GMT
jquery.payment.js
netstation.aplus1server9netstation2mail5login.com/oa/js/ 		21 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/js/jquery.payment.js
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
7d9ee131601814aa3a1fbe0cd4f989b6d4a73c94db106e22b00dfb167326591b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
W/"6348aab0-526e"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Fri, 14 Oct 2022 13:41:05 GMT
censorTimes.php
netstation.aplus1server9netstation2mail5login.com/ 		24 B
234 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://netstation.aplus1server9netstation2mail5login.com/censorTimes.php
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/js/chunk-vendors.7ee4b046.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
31b03d021a816056da49decfeedd758254abccff4a320556c603343f59b2c743
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
application/json, text/plain, */*
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
*
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
*
3ds_sp.2368b6d.962efa1b.jpg
netstation.aplus1server9netstation2mail5login.com/oa/img/ 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/img/3ds_sp.2368b6d.962efa1b.jpg
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
8449a9ce08dc78e931f5df588628a6c5698ed3d667f08cf9db70346a067e13f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
"6348aab0-9238"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
37432
expires
Sun, 13 Nov 2022 01:41:05 GMT
app_pc.869e95c.f811cbce.jpg
netstation.aplus1server9netstation2mail5login.com/oa/img/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/img/app_pc.869e95c.f811cbce.jpg
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
3cb885d126f0c2d91d34f9cf958cb68fe5547986e94fad6fa5acbeb62c6023f1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
"6348aab0-41b0"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
16816
expires
Sun, 13 Nov 2022 01:41:05 GMT
app_sp.450709a.962efa1b.jpg
netstation.aplus1server9netstation2mail5login.com/oa/img/ 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/img/app_sp.450709a.962efa1b.jpg
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
8449a9ce08dc78e931f5df588628a6c5698ed3d667f08cf9db70346a067e13f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
"6348aab0-9238"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
37432
expires
Sun, 13 Nov 2022 01:41:05 GMT
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0fab965781d41e18e2bc92075163cf48a53622ae8a680d4efd4471f46a08e14a

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
bn_facebook.3e92102.51552af2.gif
netstation.aplus1server9netstation2mail5login.com/oa/img/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/img/bn_facebook.3e92102.51552af2.gif
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
b923088ea8deadb010739d6c188b3a5128f538df0b4004e4ab8e520d4934b170
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
"6348aab0-3b5f"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
15199
expires
Sun, 13 Nov 2022 01:41:05 GMT
bn_twitter.1cfbbf3.5016f91b.gif
netstation.aplus1server9netstation2mail5login.com/oa/img/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/img/bn_twitter.1cfbbf3.5016f91b.gif
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
8735828b2e32b3ed356ae4bf91b0d95b464d31716702bbcb472a93d0ab560c01
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
"6348aab0-3b13"
content-type
image/gif
cache-control
max-age=2592000
accept-ranges
bytes
content-length
15123
expires
Sun, 13 Nov 2022 01:41:05 GMT
truncated
/ 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f59085841b5eff890edddfb58d9507eaa5d2b12f42c68d5254f805450dd3de69

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/gif
3ds.6810491.a11754d0.jpg
netstation.aplus1server9netstation2mail5login.com/oa/img/ 		152 KB
152 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netstation.aplus1server9netstation2mail5login.com/oa/img/3ds.6810491.a11754d0.jpg
Requested by
Host: netstation.aplus1server9netstation2mail5login.com
URL: https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),
Reverse DNS
montasworegnerqmo.example.com
Software
nginx /
Resource Hash
ef63a6aa77e61dc91953b7deb3b3b76c9d758c4b3358f5d3037a13fa0e81bc12
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://netstation.aplus1server9netstation2mail5login.com/oa/?s=3aad75dbf29ef1b3280b25184c24cee3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Fri, 14 Oct 2022 01:41:05 GMT
strict-transport-security
max-age=31536000
last-modified
Fri, 14 Oct 2022 00:17:52 GMT
server
nginx
etag
"6348aab0-25ecf"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
155343
expires
Sun, 13 Nov 2022 01:41:05 GMT
truncated
/ 		79 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e0a2c557ff82f058d09f93d4ff276190915d21f7ff70155eacb74017e87463a2

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2f5063644a8bf6df9f21bbf528454a2413bce5e01287a940aed548ac5c957e0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		83 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
65e17e668c3d58082c325dfba0943414fdce67de6bcbc2f56e2bd56ad74278fa

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		997 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0bf85b852f5aa189bd34c2944b5093d14182cfedb62f5f01cd8e4763384c9aaa

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4aa74984a49acbbd2b76baf9b9ffdd7578ff355e150c6bbbbf42299d08f17d7c

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
813a1e9758bb99a4744c6b6b84233b6442b8998ad1a83fc36642425232f44b27

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aplus (Shinsei Bank) (Financial)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| webpackChunkvue_view function| clearImmediate function| setImmediate

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

netstation.aplus1server9netstation2mail5login.com
92.38.178.224
08ae97b26d9343a96f9873cab47ac0359bc4a377d446e3f3f14341287332a62b
0bf85b852f5aa189bd34c2944b5093d14182cfedb62f5f01cd8e4763384c9aaa
0fab965781d41e18e2bc92075163cf48a53622ae8a680d4efd4471f46a08e14a
31b03d021a816056da49decfeedd758254abccff4a320556c603343f59b2c743
3cb885d126f0c2d91d34f9cf958cb68fe5547986e94fad6fa5acbeb62c6023f1
4aa74984a49acbbd2b76baf9b9ffdd7578ff355e150c6bbbbf42299d08f17d7c
65e17e668c3d58082c325dfba0943414fdce67de6bcbc2f56e2bd56ad74278fa
7d9ee131601814aa3a1fbe0cd4f989b6d4a73c94db106e22b00dfb167326591b
813a1e9758bb99a4744c6b6b84233b6442b8998ad1a83fc36642425232f44b27
8449a9ce08dc78e931f5df588628a6c5698ed3d667f08cf9db70346a067e13f4
8735828b2e32b3ed356ae4bf91b0d95b464d31716702bbcb472a93d0ab560c01
88a777922b72afde362874b9b8af5b684b521e992906f98b9d2131f041d9d540
90b80489adcba6a567f4ca99664603ecbfadbcb6f76b1e72e4378f9090b098aa
968e5811d698d504cd85060a73e7f591fdb7bc70a69fd4251f41b4577f655aa7
98d8614d55c9ee58c4ea9599ef3eabb04aa4c591b2b14aa72914ce4581c68070
b2f5063644a8bf6df9f21bbf528454a2413bce5e01287a940aed548ac5c957e0
b923088ea8deadb010739d6c188b3a5128f538df0b4004e4ab8e520d4934b170
e0a2c557ff82f058d09f93d4ff276190915d21f7ff70155eacb74017e87463a2
ef63a6aa77e61dc91953b7deb3b3b76c9d758c4b3358f5d3037a13fa0e81bc12
f59085841b5eff890edddfb58d9507eaa5d2b12f42c68d5254f805450dd3de69