alpus.hzkbwq.com
Open in
urlscan Pro
194.41.59.97
Malicious Activity!
Public Scan
URL:
https://alpus.hzkbwq.com/login.html
Submission: On December 27 via automatic, source phishtank — Scanned from DE
Submission: On December 27 via automatic, source phishtank — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 194.41.59.97, located in
Hong Kong and
belongs to SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK.
The main domain is alpus.hzkbwq.com.
TLS certificate: Issued by R3 on December 26th 2021. Valid for: 3 months.
This is the only time alpus.hzkbwq.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on December 26th 2021. Valid for: 3 months.
This is the only time alpus.hzkbwq.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aplus (Shinsei Bank) (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 194.41.59.97 194.41.59.97 | 133199 (SONDERCLO...) (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited) | |
| 1 | 13.230.226.62 13.230.226.62 | 16509 (AMAZON-02) (AMAZON-02) | |
| 14 | 2 |
13
194.41.59.97
(Hong Kong)
ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK)
ASN133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK)
| alpus.hzkbwq.com |
1
13.230.226.62
(Tokyo, Japan)
ASN16509 (AMAZON-02, US)
PTR: ec2-13-230-226-62.ap-northeast-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-13-230-226-62.ap-northeast-1.compute.amazonaws.com
| www.aplus.co.jp |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
hzkbwq.com
alpus.hzkbwq.com |
213 KB |
| 1 |
aplus.co.jp
www.aplus.co.jp |
174 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 13 | alpus.hzkbwq.com |
alpus.hzkbwq.com
|
| 1 | www.aplus.co.jp |
alpus.hzkbwq.com
|
| 14 | 2 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.aplus.co.jp |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| alpus.moxiox.com R3 |
2021-12-26 - 2022-03-26 |
3 months | crt.sh |
| www.aplus.co.jp Entrust Certification Authority - L1M |
2021-01-18 - 2022-01-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://alpus.hzkbwq.com/login.html
Frame ID: 118874A1DF9DCF829C5D6B440575FBF2
Requests: 14 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
URL: http://www.aplus.co.jp/notes/2014/net_station_aplus.html
Title: NET station*APLUSのＩＤ・パスワードの取扱いに関するご注意とお願い
Title: NET station*APLUSのＩＤ・パスワードの取扱いに関するご注意とお願い
Search URL Search Domain Scan URL
URL: http://www.aplus.co.jp/creditcard/use/security/info03.html#anc05
Title: NET station*APLUSのパスワードの管理は慎重に
Title: NET station*APLUSのパスワードの管理は慎重に
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
login.html
alpus.hzkbwq.com/ |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style1.css
alpus.hzkbwq.com/css/ |
162 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
remind-2.jpg
alpus.hzkbwq.com/images/ |
11 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bn_facebook.gif
alpus.hzkbwq.com/images/ |
15 KB 15 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bn_twitter.gif
alpus.hzkbwq.com/images/ |
15 KB 15 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
line.gif
alpus.hzkbwq.com/images/ |
8 KB 8 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
anshin.png
www.aplus.co.jp/rt/img/ |
173 KB 174 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mv_top_shinsei.jpg
alpus.hzkbwq.com/images/ |
127 KB 128 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
hd-main-bg.png
alpus.hzkbwq.com/images/ |
79 B 283 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
hd-logo.png
alpus.hzkbwq.com/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gloval-bg.png
alpus.hzkbwq.com/images/netstation/bg/ |
548 B 548 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon.png
alpus.hzkbwq.com/images/netstation/sprite/ |
548 B 548 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pagetop.png
alpus.hzkbwq.com/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ft-logo.png
alpus.hzkbwq.com/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aplus (Shinsei Bank) (Financial)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.aplus.co.jp/ | Name: AWSALBCORS Value: BeTvp5GSwhx3AWj8khEvGDVahOf65j7ztNAMRb/41c3fzfm1vMWVtUAocVj6D6K97bIJEY58yj9WVGWBbOSBxnRWgjFt7pITu2ddNibkXv3tzGTm0eDttf8sqcuM |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
alpus.hzkbwq.com
www.aplus.co.jp
13.230.226.62
194.41.59.97
3d279dc3189529f3fa70612f9c9fa8347c25e8d850e4d6734eec3e4983674cbc
52e27e501ad4551775e5c21144112f599992fc1d1e091c2c4c44d5f861ed6d61
813a1e9758bb99a4744c6b6b84233b6442b8998ad1a83fc36642425232f44b27
8450f47b265f986fe2133e2d23100bc91a630c77855b8cbfee76d9c191a7691e
8735828b2e32b3ed356ae4bf91b0d95b464d31716702bbcb472a93d0ab560c01
b923088ea8deadb010739d6c188b3a5128f538df0b4004e4ab8e520d4934b170
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d5b4820b56305486339a22a55e5a133b49e2019d114b9c94403390e487cec04f
e0a2c557ff82f058d09f93d4ff276190915d21f7ff70155eacb74017e87463a2
e0aae5f751775a504d1119f1fb92a46cf65774780e0c1d3c33647dd7a59815e1
f59085841b5eff890edddfb58d9507eaa5d2b12f42c68d5254f805450dd3de69
f8c559350b794ab19e192fbf63f3ebe48b2ce6937ffc897ef43a18ebe05bf501
feffa0caa07987c670cae82d6a1c920bb0a68a2207b8f84e3a18a6ef624a0cbb