www2.jreast.co.jplogin.erfwr.cn
Open in
urlscan Pro
155.94.163.99
Malicious Activity!
Public Scan
URL:
https://www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login.html
Submission: On August 23 via api from JP — Scanned from JP
Submission: On August 23 via api from JP — Scanned from JP
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 21 HTTP transactions.
The main IP is 155.94.163.99, located in
Los Angeles, United States and
belongs to ASN-QUADRANET-GLOBAL, US.
The main domain is www2.jreast.co.jplogin.erfwr.cn.
TLS certificate: Issued by R3 on August 22nd 2022. Valid for: 3 months.
This is the only time www2.jreast.co.jplogin.erfwr.cn was scanned on urlscan.io!
TLS certificate: Issued by R3 on August 22nd 2022. Valid for: 3 months.
This is the only time www2.jreast.co.jplogin.erfwr.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: VIEW Card (JR East) (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 21 | 155.94.163.99 155.94.163.99 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
| 21 | 1 |
21
155.94.163.99
(Los Angeles, United States)
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 155.94.163.99.static.quadranet.com
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 155.94.163.99.static.quadranet.com
| www2.jreast.co.jplogin.erfwr.cn |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 21 |
erfwr.cn
www2.jreast.co.jplogin.erfwr.cn |
56 KB |
| 21 | 1 |
| Domain | Requested by | |
|---|---|---|
| 21 | www2.jreast.co.jplogin.erfwr.cn |
www2.jreast.co.jplogin.erfwr.cn
|
| 21 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.jreast.co.jp |
| viewsnet.jp |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www2.jreast.co.jplogin.erfwr.cn R3 |
2022-08-22 - 2022-11-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login.html
Frame ID: 2E27A02D7822AF7F5DBA4DA352ACA226
Requests: 21 HTTP requests in this frame
5 Outgoing links
These are links going to different origins than the main page.
URL: https://www.jreast.co.jp/card/index.html
Search URL Search Domain Scan URL
URL: https://viewsnet.jp/V0200/V0200_001.aspx
Title: サービスID・パスワードをお忘れの方へ
Title: サービスID・パスワードをお忘れの方へ
Search URL Search Domain Scan URL
URL: https://viewsnet.jp/V0100/V0100_024.aspx
Title: 「My JR-EAST ID」でログインされる場合はこちら
Title: 「My JR-EAST ID」でログインされる場合はこちら
Search URL Search Domain Scan URL
URL: https://www.jreast.co.jp/card/sp/servicelist/viewsnet/login.html
Title: スマートフォンサイトにログインされる場合はこちら
Title: スマートフォンサイトにログインされる場合はこちら
Search URL Search Domain Scan URL
URL: https://viewsnet.jp/default.htm#wrap
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
view_net_login.html
www2.jreast.co.jplogin.erfwr.cn/pc/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common.css
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
16 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
default.css
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
viewsnet.tooltip.css
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
554 B 346 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.4.1.min.js.%E4%B8%8B%E8%BD%BD
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
change_imgs.js.%E4%B8%8B%E8%BD%BD
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
356 B 281 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
viewsnet.tooltip.js.%E4%B8%8B%E8%BD%BD
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
1 KB 585 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
viewsnetCommon.js.%E4%B8%8B%E8%BD%BD
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
22 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
viewcard_logo.gif
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
indispensable.gif
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
344 B 414 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
btn_login_off.gif
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
5 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
pagetop.gif
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
myjreast_logo.gif
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
foot_copy.gif
www2.jreast.co.jplogin.erfwr.cn/pc/view_net_login_files/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
body_bg.gif
www2.jreast.co.jplogin.erfwr.cn/pc/IMG/ |
278 B 278 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wrap_bg.gif
www2.jreast.co.jplogin.erfwr.cn/pc/IMG/ |
278 B 278 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
top_bg.gif
www2.jreast.co.jplogin.erfwr.cn/pc/IMG/ |
278 B 278 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
line.gif
www2.jreast.co.jplogin.erfwr.cn/pc/IMG/ |
278 B 278 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
details_back.gif
www2.jreast.co.jplogin.erfwr.cn/pc/IMG/ |
278 B 278 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon_arrow.gif
www2.jreast.co.jplogin.erfwr.cn/pc/IMG/ |
278 B 278 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon_error.gif
www2.jreast.co.jplogin.erfwr.cn/pc/IMG/ |
278 B 278 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: VIEW Card (JR East) (Financial)37 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| tooltip function| IsHiraganaCode string| oldvalue function| toKatakanaCase function| convertUpperCase function| isValidRequired function| isValidHalfWidth function| isAtmark function| isValidAlphanumericCharacter function| isValidNumber function| imeModeCheck function| imeModeOnCheck function| isValidDoubleByteCharacter function| isValidDoubleByteKatakana function| isValidDoubleByteKatakanaName function| isValidUppercase function| isValidUppercaseName function| isValidAlphanumericMarkCharacter function| isValidMailAddress function| setClassName function| isSurrogate function| isValidKatakanaNumCharHyphen function| isValidMultipleNumber function| checkNumber function| checkRequired function| isValidMultipleNumberV1800PostDedicated function| isValidHolidayCardNum0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www2.jreast.co.jplogin.erfwr.cn
155.94.163.99
006e2973afc98584c5a38d54eca3e36f35e2a4ef9c7522052bee047e6f9938e7
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
17fd799ff851a85eb4b515e05dd8be07833eec895095edb9894e3b34dcd2d585
2794d6bf4593980761063e8d2d8d95953eaee1254e0fb51205fa5cc10ad084b4
32e7a34eee6d2026b2824cb5e996bba0cc0fcd4fb5beb1799acc8aa0bb77f028
49c357852bdb7445482cbb4050c48487c4724de2f353636e8b302fa583be4b41
4caf1f98078c267c548858771715cb37aacaf7d402b13e28a5dbeb976f0f6c72
59e4af91d1c855bd06cd517956557184d81e17acb547dc9f31a5fee128cb4d68
64400db216a298ff65e896421a6e445b84cc3eb011e79c37bab72e313d4feabb
80c53960359b23c231d87c59fdba6a7f4ab82fa31fb17293fa15e6af36f6b453
84ab9c42fb885efe55b0ae0ba3ab53812afcc189cf662257313b3c298e78c6a6
a06ef43eb026b1e3bed9a48f361451626ee4f4354c069b16ac0fbd8f968ed213
a4153a105cbda8d19dd1aa6b8bd66d474e26c0ebbbcc372b928464bd0bfac791
f73bee2418229209f496298751bfe891c7a5afdac68862d7e46fc327bbe00ff8
f91b5a78894e730f243be291b173ccc9f88b079bb5aff73abec4093acb9b893f