fervent-shamir.13-237-241-193.plesk.page Open in urlscan Pro
13.237.241.193 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html
Submission Tags: #phishing @quicksandphish Search All
Submission: On September 22 via api (September 22nd 2022, 7:03:24 pm UTC) from FI — Scanned from AU

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 13.237.241.193, located in Sydney, Australia and belongs to AMAZON-02, US. The main domain is fervent-shamir.13-237-241-193.plesk.page.
TLS certificate: Issued by R3 on September 21st 2022. Valid for: 3 months.

This is the only time fervent-shamir.13-237-241-193.plesk.page was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: JCB (Financial)

Domain & IP information

	IP Address		AS Autonomous System
11	13.237.241.193 13.237.241.193		16509 (AMAZON-02) (AMAZON-02)
11	1

11 13.237.241.193 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com

fervent-shamir.13-237-241-193.plesk.page	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	plesk.page fervent-shamir.13-237-241-193.plesk.page	32 KB
11	1

	Domain	Requested by
11	fervent-shamir.13-237-241-193.plesk.page	fervent-shamir.13-237-241-193.plesk.page
11	1

This site contains no links.

Subject Issuer	Validity	Valid
fervent-shamir.13-237-241-193.plesk.page R3	`2022-09-21` - `2022-12-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html
Frame ID: 0E83BCE3FFB15FBA6500306F19A0C3E1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

JCBの会員専用WEBサービス「MyJCB（マイジェーシービー）」

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

32 kB
Transfer

109 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.html Show response fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/	9 KB 3 KB	302ms 103ms	Document text/html	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `95fec276f27acc641323b1fb54ce584ec697fc0be64403c7365954ac34a15c1c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers content-encoding br content-type text/html date Thu, 22 Sep 2022 19:03:19 GMT etag W/"631cec4e-2505" last-modified Sat, 10 Sep 2022 19:58:06 GMT server nginx x-powered-by PleskLin
GET H2	200	login.css fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/	11 KB 2 KB	108ms 107ms	Stylesheet text/css	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/login.css Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `c9201d468dddf3a23a57bb912500032ee22b6bdc69c5d59eb8cee9ff46083c6b` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT content-encoding br etag W/"631bee1a-2d24" last-modified Sat, 10 Sep 2022 01:53:30 GMT server nginx x-powered-by PleskLin content-type text/css
GET H2	200	frame.css fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/	33 KB 4 KB	105ms 104ms	Stylesheet text/css	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/frame.css Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `c83cd93e3355eb5ed9889c41585612ddf25a1eb8d98aaddb177298dfa9d81365` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT content-encoding br etag W/"631bee1a-8233" last-modified Sat, 10 Sep 2022 01:53:30 GMT server nginx x-powered-by PleskLin content-type text/css
GET H2	200	logo.png fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/	3 KB 3 KB	186ms 185ms	Image image/png	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/logo.png Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `dd8e7c6375bd6ccc23582eec91b4f1417b6f582dfc48e40b7ae3a63d7b0ae949` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT last-modified Sat, 10 Sep 2022 01:53:30 GMT server nginx x-powered-by PleskLin etag "631bee1a-c6c" content-type image/png accept-ranges bytes content-length 3180
GET H2	200	icon_blank.png fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/	1 KB 1 KB	109ms 108ms	Image image/png	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/icon_blank.png Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `6034aa1a5202485c861be5b8b5664b920a6ba8e02f65bea1ba7419ad736145c1` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT last-modified Sat, 10 Sep 2022 01:53:30 GMT server nginx x-powered-by PleskLin etag "631bee1a-429" content-type image/png accept-ranges bytes content-length 1065
GET H2	200	faq-btn.png fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/	6 KB 6 KB	187ms 186ms	Image image/png	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/faq-btn.png Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `ded913d8bb8cd42a34881a7fc5169f3faf295cfb7b582c9293c5b223d3568be1` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT last-modified Sat, 10 Sep 2022 01:53:30 GMT server nginx x-powered-by PleskLin etag "631bee1a-1811" content-type image/png accept-ranges bytes content-length 6161
GET H2	200	error-icon.png fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/	350 B 519 B	186ms 185ms	Image image/png	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/error-icon.png Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `80adebc84b57ccb10f21a41231e22b5b051bbe66a81385536650b42e1fd2b50a` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT etag "15e-5e848ede43a80" last-modified Sat, 10 Sep 2022 01:53:30 GMT server nginx x-powered-by PleskLin content-type image/png x-accel-version 0.01 accept-ranges bytes content-length 350
GET H2	200	logo_footer.png fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/	2 KB 2 KB	112ms 111ms	Image image/png	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/logo_footer.png Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `93b334e1a1d3b1f7ad60a247c93d72e8d3c03db8b81bc4c4184ad3a3d7ce5b62` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT last-modified Sat, 10 Sep 2022 01:53:30 GMT server nginx x-powered-by PleskLin etag "631bee1a-6e5" content-type image/png accept-ranges bytes content-length 1765
GET H2	200	jquery.cookie.js Show response fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/	3 KB 1 KB	186ms 184ms	Script application/javascript	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/jquery.cookie.js Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `8c0301b3dba5061632d7321cd8bb7bd527f48288d5cb15ff614ea0c1dcc1ad69` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT content-encoding br etag W/"631bee1a-c44" last-modified Sat, 10 Sep 2022 01:53:30 GMT server nginx x-powered-by PleskLin content-type application/javascript
GET H2	200	frame.js Show response fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/	31 KB 6 KB	185ms 183ms	Script application/javascript	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/MyJCB/frame.js Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `eb8fa3b5341548ac9394dd9382be48403455b59ba2f23ef347bb3a004fbceea2` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT content-encoding br etag W/"631bee1a-7d15" last-modified Sat, 10 Sep 2022 01:53:30 GMT server nginx x-powered-by PleskLin content-type application/javascript
GET H2	200	login.html Show response fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/	9 KB 3 KB	115ms 114ms	Script text/html	13.237.241.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Requested by Host: fervent-shamir.13-237-241-193.plesk.page URL: https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 13.237.241.193 Sydney, Australia, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-237-241-193.ap-southeast-2.compute.amazonaws.com Software nginx / PleskLin Resource Hash `95fec276f27acc641323b1fb54ce584ec697fc0be64403c7365954ac34a15c1c` Request headers accept-language en-AU,en;q=0.9 Referer https://fervent-shamir.13-237-241-193.plesk.page/jvb/jvxxxxxxx-manager/login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 22 Sep 2022 19:03:19 GMT content-encoding br etag W/"631cec4e-2505" last-modified Sat, 10 Sep 2022 19:58:06 GMT server nginx x-powered-by PleskLin content-type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: JCB (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fervent-shamir.13-237-241-193.plesk.page
13.237.241.193
6034aa1a5202485c861be5b8b5664b920a6ba8e02f65bea1ba7419ad736145c1
80adebc84b57ccb10f21a41231e22b5b051bbe66a81385536650b42e1fd2b50a
8c0301b3dba5061632d7321cd8bb7bd527f48288d5cb15ff614ea0c1dcc1ad69
93b334e1a1d3b1f7ad60a247c93d72e8d3c03db8b81bc4c4184ad3a3d7ce5b62
95fec276f27acc641323b1fb54ce584ec697fc0be64403c7365954ac34a15c1c
c83cd93e3355eb5ed9889c41585612ddf25a1eb8d98aaddb177298dfa9d81365
c9201d468dddf3a23a57bb912500032ee22b6bdc69c5d59eb8cee9ff46083c6b
dd8e7c6375bd6ccc23582eec91b4f1417b6f582dfc48e40b7ae3a63d7b0ae949
ded913d8bb8cd42a34881a7fc5169f3faf295cfb7b582c9293c5b223d3568be1
eb8fa3b5341548ac9394dd9382be48403455b59ba2f23ef347bb3a004fbceea2

fervent-shamir.13-237-241-193.plesk.page Open in urlscan Pro 13.237.241.193 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

32 kBTransfer

109 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

fervent-shamir.13-237-241-193.plesk.page Open in urlscan Pro
13.237.241.193 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

32 kB
Transfer

109 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!