kljhf.gmsdlbi.cn
Open in
urlscan Pro
204.44.93.151
Malicious Activity!
Public Scan
Effective URL: https://kljhf.gmsdlbi.cn/
Submission: On May 25 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on May 20th 2022. Valid for: 3 months.
This is the only time kljhf.gmsdlbi.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Saison Card (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 3 | 204.44.93.151 204.44.93.151 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
14 | 210.151.8.173 210.151.8.173 | 4725 (ODN SoftB...) (ODN SoftBank Corp.) | |
2 | 54.64.4.35 54.64.4.35 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2600:1901:0:5... 2600:1901:0:587d:: | 15169 (GOOGLE) (GOOGLE) | |
4 | 2404:6800:400... 2404:6800:4004:824::2010 | 15169 (GOOGLE) (GOOGLE) | |
6 | 45.60.48.171 45.60.48.171 | 19551 (INCAPSULA) (INCAPSULA) | |
1 | 2404:6800:400... 2404:6800:4004:801::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2404:6800:400... 2404:6800:4004:80b::200e | 15169 (GOOGLE) (GOOGLE) | |
33 | 8 |
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 204.44.93.151.static.quadranet.com
kljhf.gmsdlbi.cn |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-64-4-35.ap-northeast-1.compute.amazonaws.com
spd-csna.securebrain.co.jp |
ASN19551 (INCAPSULA, US)
www.a-q-f.com | |
netanswerplus.saisoncard.co.jp |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
saisoncard.co.jp
api.saisoncard.co.jp netanswerplus.saisoncard.co.jp |
110 KB |
4 |
googleapis.com
capy.storage.googleapis.com |
7 KB |
3 |
capy.me
jp.api.capy.me — Cisco Umbrella Rank: 801163 |
174 KB |
3 |
gmsdlbi.cn
1 redirects
kljhf.gmsdlbi.cn |
4 KB |
2 |
a-q-f.com
www.a-q-f.com |
2 KB |
2 |
securebrain.co.jp
spd-csna.securebrain.co.jp |
158 KB |
1 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 37 |
20 KB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 71 |
40 KB |
33 | 8 |
Domain | Requested by | |
---|---|---|
14 | api.saisoncard.co.jp |
kljhf.gmsdlbi.cn
api.saisoncard.co.jp |
4 | netanswerplus.saisoncard.co.jp |
api.saisoncard.co.jp
netanswerplus.saisoncard.co.jp |
4 | capy.storage.googleapis.com |
kljhf.gmsdlbi.cn
|
3 | jp.api.capy.me |
kljhf.gmsdlbi.cn
|
3 | kljhf.gmsdlbi.cn |
1 redirects
kljhf.gmsdlbi.cn
|
2 | www.a-q-f.com |
kljhf.gmsdlbi.cn
|
2 | spd-csna.securebrain.co.jp |
kljhf.gmsdlbi.cn
spd-csna.securebrain.co.jp |
1 | www.google-analytics.com |
www.googletagmanager.com
|
1 | www.googletagmanager.com |
api.saisoncard.co.jp
|
33 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
netanswerplus.saisoncard.co.jp |
www.saisoncard.co.jp |
api.saisoncard.co.jp |
Subject Issuer | Validity | Valid | |
---|---|---|---|
kljhf.gmsdlbi.cn R3 |
2022-05-20 - 2022-08-18 |
3 months | crt.sh |
api.saisoncard.co.jp Cybertrust Japan SureServer EV CA G3 |
2021-12-02 - 2022-12-31 |
a year | crt.sh |
*.securebrain.co.jp Amazon |
2022-03-16 - 2023-04-14 |
a year | crt.sh |
jp.api.capy.me GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-08-17 - 2022-09-17 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1C3 |
2022-05-04 - 2022-07-27 |
3 months | crt.sh |
www.a-q-f.com Cybertrust Japan SureServer EV CA G3 |
2022-05-09 - 2023-05-31 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-05-04 - 2022-07-27 |
3 months | crt.sh |
netanswerplus.saisoncard.co.jp Cybertrust Japan SureServer EV CA G3 |
2021-12-02 - 2022-12-31 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://kljhf.gmsdlbi.cn/
Frame ID: E6721E527BDBF1BC48DF12E107595C8C
Requests: 21 HTTP requests in this frame
Frame:
https://api.saisoncard.co.jp/html/NA/PC/iframe/index.html
Frame ID: 8A0FFFAFB2EABD7AED673F5FCA8C17C2
Requests: 8 HTTP requests in this frame
Frame:
https://netanswerplus.saisoncard.co.jp/WebPc/pages/images/person/login/banner/banner.html?page=login_NAPC
Frame ID: 16E46ED5C4BE2ED58AB6F3A5CD6DBAF3
Requests: 4 HTTP requests in this frame
Screenshot
Page Title
SAISON CARD NetアンサーPage URL History Show full URLs
-
http://kljhf.gmsdlbi.cn/
HTTP 301
https://kljhf.gmsdlbi.cn/ Page URL
Detected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtm\.js
Imperva (Security) Expand
Detected patterns
- /_Incapsula_Resource
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: こちら
Search URL Search Domain Scan URL
Title: Netアンサー新規登録(無料)
Search URL Search Domain Scan URL
Title: ID・パスワードをお忘れの方
Search URL Search Domain Scan URL
Title: よくあるお問い合わせ
Search URL Search Domain Scan URL
Title: メンテナンス情報
Search URL Search Domain Scan URL
Title: クラブ・オン/ミレニアムカードでログイン
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://kljhf.gmsdlbi.cn/
HTTP 301
https://kljhf.gmsdlbi.cn/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
kljhf.gmsdlbi.cn/ Redirect Chain
|
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.css
api.saisoncard.co.jp/auth/resources/css/ |
18 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
layout.css
api.saisoncard.co.jp/auth/resources/css/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
t.js
spd-csna.securebrain.co.jp/js/ |
157 KB 157 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon_saison_01.png
api.saisoncard.co.jp/auth/resources/img/logo/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
key_ani.gif
kljhf.gmsdlbi.cn/auth/resources/img/ |
263 B 263 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
jp.api.capy.me/puzzle/get_image/ |
0 166 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
update.png
capy.storage.googleapis.com/static/img/ |
705 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new_make_captcha_easy.png
capy.storage.googleapis.com/static/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
guide.png
capy.storage.googleapis.com/static/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
capy.storage.googleapis.com/static/img/ |
404 B 693 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
jp.api.capy.me/puzzle/get_js/ |
100 KB 100 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
footer_img.png
api.saisoncard.co.jp/auth/resources/img/netanswer/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s_code.js
www.a-q-f.com/saison/sc/na/ |
721 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s_code_prd.js
www.a-q-f.com/saison/sc/na/ |
0 731 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eye.png
api.saisoncard.co.jp/auth/resources/img/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.html
api.saisoncard.co.jp/html/NA/PC/iframe/ Frame 8A0F |
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
jp.api.capy.me/puzzle/get_image/ |
73 KB 74 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon01.gif
api.saisoncard.co.jp/auth/resources/img/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ie8_btnBG2.png
api.saisoncard.co.jp/auth/resources/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ie8_btnBG.png
api.saisoncard.co.jp/auth/resources/img/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
agreement.js
api.saisoncard.co.jp/html/ Frame 8A0F |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jackIframe.css
api.saisoncard.co.jp/html/NA/PC/iframe/pages/css/ Frame 8A0F |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
window_icon.gif
api.saisoncard.co.jp/html/images/ Frame 8A0F |
86 B 302 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
t
spd-csna.securebrain.co.jp/ |
0 253 B |
Ping
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ Frame 8A0F |
103 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner.html
netanswerplus.saisoncard.co.jp/WebPc/pages/images/person/login/banner/ Frame 16E4 |
2 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
h3.gif
api.saisoncard.co.jp/html/NA/PC/iframe/pages/images/ Frame 8A0F |
120 B 337 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ico_arrow.gif
api.saisoncard.co.jp/html/NA/PC/iframe/pages/images/ Frame 8A0F |
197 B 414 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_Incapsula_Resource
netanswerplus.saisoncard.co.jp/ Frame 16E4 |
135 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2202_login_520_230.jpg
netanswerplus.saisoncard.co.jp/WebPc/pages/images/person/login/images/ Frame 16E4 |
27 KB 27 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_Incapsula_Resource
netanswerplus.saisoncard.co.jp/ Frame 16E4 |
1 B 257 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ Frame 8A0F |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Saison Card (Financial)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| jsSHA function| uuid object| puzzleApp string| dev_domainList object| dev_domainList_split number| dev_flg string| k2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
kljhf.gmsdlbi.cn/ | Name: PHPSESSID Value: tr3a7darhqc57hfo5jut05q6ej |
|
.gmsdlbi.cn/ | Name: ___kah3oM1i Value: 90936788-7633-413b-9855-1fcae1feaed0 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.saisoncard.co.jp
capy.storage.googleapis.com
jp.api.capy.me
kljhf.gmsdlbi.cn
netanswerplus.saisoncard.co.jp
spd-csna.securebrain.co.jp
www.a-q-f.com
www.google-analytics.com
www.googletagmanager.com
204.44.93.151
210.151.8.173
2404:6800:4004:801::2008
2404:6800:4004:80b::200e
2404:6800:4004:824::2010
2600:1901:0:587d::
45.60.48.171
54.64.4.35
01c58e9fde4e043d29deb9b9f5a09930f7c8300de8fa91f1f08dbcdc56eb8682
046dae1710bdf2c2a11b49acadad79bafc11b086ed2d79e3c1647f129a8b8ddd
0534de8aa76330dd00be2ca15c817fb1c593ca6afca8a115cc6069dcd0cc475c
0d4c56c6c7ea3588f7679451e0df8640907d41bfbb16689cd194da9298b61b41
16eeb4aa7dc0abadb5ded8ee6097cdefa459fdeed5865e37ba137efffbcf7ff5
1e0d2b1c95bc3d26756f53c142fa32c44dfa291eac780596e8dcb57ce9d04103
1ed19ea7ee0a908c19890a25bf56f01efe45d145f87e8f7f6964a79b8bbcec0b
217d1b91669dd4a21ce0cff140d526b43a3ac1ea5caa5578d5372fde00dadf1d
24a058c8e90224058dad7e8482544d87701c56df6f238a5df875cf071fdc98c9
3a99cc1bdae5170e1076e4f5d760939a2b6011b73207c8ff2245e51f87577282
46b1e9712828ae8ad0dd0b7a6eb8b93aaaf6e014c97a5bf5b194749229f460c0
505a0244bdbef631f62d2f6d3e8c2f77dde8f0b72a8cc19b9d0b529117a93fa7
6527ce1d64e5deae0babf6d43438ea74a8f39d1eda142c92c4a6ada34f4a32f6
6dbfe2e8a966ff6518e842a34478a784dec9c08f2062692ae2e68ad9683c8631
70cb0f56464f2b9816cbe66ac6886ca874a032b1599c7ff08e2c43e294fd19ee
766b9361bba45e02ec03d15b3e2ab80e70525570decb1473dfd6ab8ec49506fe
7829cd82e5b348bd82b5917ab6b4df98a0ca39a30a21d70735cf791e5e8b7bcf
8acc1c37aefb20f2fc4c5812d8f94f47c85287452e4b37dc5fd6c4c75998157b
8c9be12bee7203cfa76a9d42b4a34466602894877334a369864ad1b1f97a24a9
8ff8aec485f0e2f249e6831f47c8be7560c8d6077c57b857c84f47e6d1f583e8
90647453b750f19d6dbe4e6b5dc373b7f5d446b76cc0425d9b8856447453e329
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a348c7a8a94430562064f02f77308e3e8bbaf912420b8cd77ad3956bdfbf7df5
a41d45143e94023697405baabba914184fee4de441c3880da7628e08e7fe2632
a485d61bbecaf28799bc489e555e816b61205600d282ac15f2eeb65ff6ee12f9
a9ad849120f8fbb3105a603ca07d70242c2aea73f79bbbc2ad5ca65ee332d6a2
b0f628c4204263d06e5a028c3f2df7a264df11d2766f7dfc50fe786bebda6df8
b5396b96d122928321773117aad160b5c7e0806334fc1477479123cd4a66683e
da0e225d66db0a3ebf1aa9d3ba389955f3f220836f577830c6d9f12e0f9f2a4c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855