netstation.aplunet0server2history0netstation2login.com Open in urlscan Pro
92.38.178.224 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
Submission Tags: #phishing @romonlyht Search All
Submission: On October 14 via api (October 14th 2022, 5:11:16 am UTC) from FI — Scanned from JP

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 15 HTTP transactions. The main IP is 92.38.178.224, located in Tokyo, Japan and belongs to GHOST, LU. The main domain is netstation.aplunet0server2history0netstation2login.com.
TLS certificate: Issued by R3 on October 13th 2022. Valid for: 3 months.

This is the only time netstation.aplunet0server2history0netstation2login.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aplus (Shinsei Bank) (Financial)

Domain & IP information

	IP Address		AS Autonomous System
15	92.38.178.224 92.38.178.224		202422 (GHOST) (GHOST)
15	2

15 92.38.178.224 (Tokyo, Japan)

ASN202422 (GHOST, LU)
PTR: montasworegnerqmo.example.com

netstation.aplunet0server2history0netstation2login.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	aplunet0server2history0netstation2login.com netstation.aplunet0server2history0netstation2login.com	635 KB
15	1

	Domain	Requested by
15	netstation.aplunet0server2history0netstation2login.com	netstation.aplunet0server2history0netstation2login.com
15	1

This site contains no links.

Subject Issuer	Validity	Valid
netstation.aplunet0server2history0netstation2login.com R3	`2022-10-13` - `2023-01-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
Frame ID: EFDBE8105457CC119BA0FB405AB6A270
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ログイン | アプラス

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

635 kB
Transfer

1286 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
netstation.aplunet0server2history0netstation2login.com/oa/ 615 B
769 B 190ms
3ms Document
text/html 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

a299d19bdb63e3edfb781ef58540150377fd34bb11e68301e303bed40891cd8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

accept-ranges: bytes
content-length: 615
content-type: text/html
date: Fri, 14 Oct 2022 05:11:12 GMT
etag: "6348ab4c-267"
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
strict-transport-security: max-age=31536000

GET
H2 200 chunk-vendors.7ee4b046.js Show response
netstation.aplunet0server2history0netstation2login.com/oa/js/ 145 KB
56 KB 11ms
6ms Script
application/javascript 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/js/chunk-vendors.7ee4b046.js

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

08ae97b26d9343a96f9873cab47ac0359bc4a377d446e3f3f14341287332a62b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: W/"6348ab4c-242d1"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Fri, 14 Oct 2022 17:11:12 GMT

GET
H2 200 app.e027963a.js Show response
netstation.aplunet0server2history0netstation2login.com/oa/js/ 31 KB
20 KB 24ms
20ms Script
application/javascript 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/js/app.e027963a.js

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

19cfbb234a55805c2309ce759cbd29d8ec38afd4ef9a88ad5d69ae4a71212cff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: W/"6348ab4c-7d43"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Fri, 14 Oct 2022 17:11:12 GMT

GET
H2 200 app.3e303c92.css
netstation.aplunet0server2history0netstation2login.com/oa/css/ 275 KB
71 KB 22ms
19ms Stylesheet
text/css 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/css/app.3e303c92.css

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

968e5811d698d504cd85060a73e7f591fdb7bc70a69fd4251f41b4577f655aa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: W/"6348ab4c-44d88"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Fri, 14 Oct 2022 17:11:12 GMT

GET
H2 200 jquery.js Show response
netstation.aplunet0server2history0netstation2login.com/oa/js/ 412 KB
108 KB 22ms
19ms Script
application/javascript 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/js/jquery.js

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

88a777922b72afde362874b9b8af5b684b521e992906f98b9d2131f041d9d540

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: W/"6348ab4c-66e40"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Fri, 14 Oct 2022 17:11:12 GMT

GET
H2 200 jquery.payment.js Show response
netstation.aplunet0server2history0netstation2login.com/oa/js/ 21 KB
5 KB 22ms
20ms Script
application/javascript 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/js/jquery.payment.js

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

7d9ee131601814aa3a1fbe0cd4f989b6d4a73c94db106e22b00dfb167326591b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: W/"6348ab4c-526e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Fri, 14 Oct 2022 17:11:12 GMT

GET
H2 200 660.f6ecbf33.css
netstation.aplunet0server2history0netstation2login.com/oa/css/ 4 KB
1 KB 3ms
2ms Stylesheet
text/css 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/css/660.f6ecbf33.css

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/js/app.e027963a.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

ec1831aa9c1743b6aa304509c7ac9f6e1b6d60371da4afc5b906ee4dac192d87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: W/"6348ab4c-100c"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=43200
expires: Fri, 14 Oct 2022 17:11:12 GMT

GET
H2 200 660.844f9e48.js Show response
netstation.aplunet0server2history0netstation2login.com/oa/js/ 8 KB
6 KB 3ms
3ms Script
application/javascript 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/js/660.844f9e48.js

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/js/app.e027963a.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

4d1711398a37473a26bee477e4923e3cf3a2c28cc8bc1bd603e0ce46054c169a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: W/"6348ab4c-1e54"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
expires: Fri, 14 Oct 2022 17:11:12 GMT

GET
H2 200 3ds_sp.2368b6d.962efa1b.jpg
netstation.aplunet0server2history0netstation2login.com/oa/img/ 37 KB
37 KB 3ms
2ms Image
image/jpeg 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/img/3ds_sp.2368b6d.962efa1b.jpg

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

8449a9ce08dc78e931f5df588628a6c5698ed3d667f08cf9db70346a067e13f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: "6348ab4c-9238"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 37432
expires: Sun, 13 Nov 2022 05:11:12 GMT

GET
H2 200 app_pc.869e95c.f811cbce.jpg
netstation.aplunet0server2history0netstation2login.com/oa/img/ 16 KB
17 KB 5ms
4ms Image
image/jpeg 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/img/app_pc.869e95c.f811cbce.jpg

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

3cb885d126f0c2d91d34f9cf958cb68fe5547986e94fad6fa5acbeb62c6023f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: "6348ab4c-41b0"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 16816
expires: Sun, 13 Nov 2022 05:11:12 GMT

GET
H2 200 app_sp.450709a.962efa1b.jpg
netstation.aplunet0server2history0netstation2login.com/oa/img/ 37 KB
37 KB 6ms
5ms Image
image/jpeg 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/img/app_sp.450709a.962efa1b.jpg

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

8449a9ce08dc78e931f5df588628a6c5698ed3d667f08cf9db70346a067e13f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: "6348ab4c-9238"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 37432
expires: Sun, 13 Nov 2022 05:11:12 GMT

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0fab965781d41e18e2bc92075163cf48a53622ae8a680d4efd4471f46a08e14a

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bn_facebook.3e92102.51552af2.gif
netstation.aplunet0server2history0netstation2login.com/oa/img/ 15 KB
15 KB 8ms
8ms Image
image/gif 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/img/bn_facebook.3e92102.51552af2.gif

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

b923088ea8deadb010739d6c188b3a5128f538df0b4004e4ab8e520d4934b170

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: "6348ab4c-3b5f"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 15199
expires: Sun, 13 Nov 2022 05:11:12 GMT

GET
H2 200 bn_twitter.1cfbbf3.5016f91b.gif
netstation.aplunet0server2history0netstation2login.com/oa/img/ 15 KB
15 KB 9ms
8ms Image
image/gif 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/img/bn_twitter.1cfbbf3.5016f91b.gif

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

8735828b2e32b3ed356ae4bf91b0d95b464d31716702bbcb472a93d0ab560c01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: "6348ab4c-3b13"
content-type: image/gif
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 15123
expires: Sun, 13 Nov 2022 05:11:12 GMT

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f59085841b5eff890edddfb58d9507eaa5d2b12f42c68d5254f805450dd3de69

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 3ds.6810491.a11754d0.jpg
netstation.aplunet0server2history0netstation2login.com/oa/img/ 152 KB
152 KB 8ms
8ms Image
image/jpeg 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/img/3ds.6810491.a11754d0.jpg

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

ef63a6aa77e61dc91953b7deb3b3b76c9d758c4b3358f5d3037a13fa0e81bc12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/?s=5375cb497d7eb2435cb39f35fb2bfc00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: "6348ab4c-25ecf"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 155343
expires: Sun, 13 Nov 2022 05:11:12 GMT

GET
DATA 200
OK truncated
/ 79 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e0a2c557ff82f058d09f93d4ff276190915d21f7ff70155eacb74017e87463a2

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2f5063644a8bf6df9f21bbf528454a2413bce5e01287a940aed548ac5c957e0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 83 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65e17e668c3d58082c325dfba0943414fdce67de6bcbc2f56e2bd56ad74278fa

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 997 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0bf85b852f5aa189bd34c2944b5093d14182cfedb62f5f01cd8e4763384c9aaa

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4aa74984a49acbbd2b76baf9b9ffdd7578ff355e150c6bbbbf42299d08f17d7c

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 813a1e9758bb99a4744c6b6b84233b6442b8998ad1a83fc36642425232f44b27

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 404.458c248a.png
netstation.aplunet0server2history0netstation2login.com/oa/img/ 96 KB
96 KB 3ms
2ms Image
image/png 92.38.178.224
GHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://netstation.aplunet0server2history0netstation2login.com/oa/img/404.458c248a.png

Requested by

Host: netstation.aplunet0server2history0netstation2login.com
URL: https://netstation.aplunet0server2history0netstation2login.com/oa/404

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

92.38.178.224 Tokyo, Japan, ASN202422 (GHOST, LU),

Reverse DNS

montasworegnerqmo.example.com

Software

nginx /

Resource Hash

538aa4d7334df582e45c6f998b2a98dad44062fa8586a6c602af103a61f1d63e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://netstation.aplunet0server2history0netstation2login.com/oa/404
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Fri, 14 Oct 2022 05:11:12 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 14 Oct 2022 00:20:28 GMT
server: nginx
etag: "6348ab4c-17f17"
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 98071
expires: Sun, 13 Nov 2022 05:11:12 GMT

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98e7ac66d86036e26a821eb4882d8d040e48991f9ae200119cdefaf450a405e8

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aplus (Shinsei Bank) (Financial)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

netstation.aplunet0server2history0netstation2login.com
92.38.178.224
08ae97b26d9343a96f9873cab47ac0359bc4a377d446e3f3f14341287332a62b
0bf85b852f5aa189bd34c2944b5093d14182cfedb62f5f01cd8e4763384c9aaa
0fab965781d41e18e2bc92075163cf48a53622ae8a680d4efd4471f46a08e14a
19cfbb234a55805c2309ce759cbd29d8ec38afd4ef9a88ad5d69ae4a71212cff
3cb885d126f0c2d91d34f9cf958cb68fe5547986e94fad6fa5acbeb62c6023f1
4aa74984a49acbbd2b76baf9b9ffdd7578ff355e150c6bbbbf42299d08f17d7c
4d1711398a37473a26bee477e4923e3cf3a2c28cc8bc1bd603e0ce46054c169a
538aa4d7334df582e45c6f998b2a98dad44062fa8586a6c602af103a61f1d63e
65e17e668c3d58082c325dfba0943414fdce67de6bcbc2f56e2bd56ad74278fa
7d9ee131601814aa3a1fbe0cd4f989b6d4a73c94db106e22b00dfb167326591b
813a1e9758bb99a4744c6b6b84233b6442b8998ad1a83fc36642425232f44b27
8449a9ce08dc78e931f5df588628a6c5698ed3d667f08cf9db70346a067e13f4
8735828b2e32b3ed356ae4bf91b0d95b464d31716702bbcb472a93d0ab560c01
88a777922b72afde362874b9b8af5b684b521e992906f98b9d2131f041d9d540
968e5811d698d504cd85060a73e7f591fdb7bc70a69fd4251f41b4577f655aa7
98e7ac66d86036e26a821eb4882d8d040e48991f9ae200119cdefaf450a405e8
a299d19bdb63e3edfb781ef58540150377fd34bb11e68301e303bed40891cd8b
b2f5063644a8bf6df9f21bbf528454a2413bce5e01287a940aed548ac5c957e0
b923088ea8deadb010739d6c188b3a5128f538df0b4004e4ab8e520d4934b170
e0a2c557ff82f058d09f93d4ff276190915d21f7ff70155eacb74017e87463a2
ec1831aa9c1743b6aa304509c7ac9f6e1b6d60371da4afc5b906ee4dac192d87
ef63a6aa77e61dc91953b7deb3b3b76c9d758c4b3358f5d3037a13fa0e81bc12
f59085841b5eff890edddfb58d9507eaa5d2b12f42c68d5254f805450dd3de69

netstation.aplunet0server2history0netstation2login.com Open in urlscan Pro 92.38.178.224 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

635 kBTransfer

1286 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

netstation.aplunet0server2history0netstation2login.com Open in urlscan Pro
92.38.178.224 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

635 kB
Transfer

1286 kB
Size

0
Cookies

15 HTTP transactions
9 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!