![](/screenshots/536f0343-1330-4767-bef3-bd3d37d14abb.png)
cbmftn.ink
Open in
urlscan Pro
154.212.129.95
Malicious Activity!
Public Scan
Effective URL: https://cbmftn.ink/login
Submission: On June 27 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on June 27th 2023. Valid for: 3 months.
This is the only time cbmftn.ink was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nishi-Nippon City Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 17 | 154.212.129.95 154.212.129.95 | 58879 (ANCHNET S...) (ANCHNET Shanghai Anchang Network Security Technology Co.) | |
16 | 2 |
ASN58879 (ANCHNET Shanghai Anchang Network Security Technology Co.,Ltd., CN)
cbmftn.ink |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
cbmftn.ink
1 redirects
cbmftn.ink |
269 KB |
16 | 1 |
Domain | Requested by | |
---|---|---|
17 | cbmftn.ink |
1 redirects
cbmftn.ink
|
16 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ncbank.co.jp |
Subject Issuer | Validity | Valid | |
---|---|---|---|
jbyeaz.ink R3 |
2023-06-27 - 2023-09-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cbmftn.ink/login
Frame ID: 8563B5DE3544C6DFF057AC779E29194B
Requests: 18 HTTP requests in this frame
Screenshot
![](/screenshots/536f0343-1330-4767-bef3-bd3d37d14abb.png)
Page Title
ログインPage URL History Show full URLs
-
https://cbmftn.ink/
HTTP 302
https://cbmftn.ink/login Page URL
Detected technologies
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- (?:/([\d.]+))?/vue(?:\.min)?\.js
Slick (JavaScript Libraries) Expand
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?slick-theme\.css
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: ※インターネットによる金融犯罪にご注意ください
Search URL Search Domain Scan URL
Title: Q&A
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cbmftn.ink/
HTTP 302
https://cbmftn.ink/login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
cbmftn.ink/ Redirect Chain
|
71 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.theme.css
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/css/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.css
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/css/ |
31 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.structure.css
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/css/ |
15 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.qtip.min.css
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/css/ |
9 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style_sp_new_design.css
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/css/0190/ |
100 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slick.css
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/css/ |
2 KB 823 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slick-theme.css
cbmftn.ink/docs/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_freehone_01.png
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/images/0190/ |
473 B 679 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_freehone_01.png
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/images/ |
473 B 679 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pc-icon02.png
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/images/0190/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.js
cbmftn.ink/js/ |
281 KB 97 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.js
cbmftn.ink/js/ |
334 KB 104 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index_pc.js
cbmftn.ink/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sm_header_bg.png
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/images/0190/ |
307 B 513 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sm_logo_155_19.png
cbmftn.ink/www.ncb-direct.ncbank.co.jp/docs/images/0190/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nishi-Nippon City Bank (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery function| Vue2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cbmftn.ink/ | Name: PHPSESSID Value: afddc049ab5b8d720565ca7314cc298d |
|
cbmftn.ink/ | Name: thinkphp_show_page_trace Value: 0|0 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cbmftn.ink
154.212.129.95
023ca8c9a46d9c6553cb0287fc8b31c6ee4f5c8d2ce02704d01ccf017f373e97
2a00ed2839b506630495a568a9c304005e759e8eaa267a9a37ee0d2171eeb846
352baa818da109925437a8433057ddc6f91ec48efe88bc5741b2f9e34450fdce
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
4a3ccc0b900b107c5cc12546995c5a377bba19cb438cc6ad357abf306a039808
676b4c280fc8d9c0c8ce71fe4cbc207905b8d59fc7ed55647ff2799d742d6454
83171ce6831197c0f77fd1ab8b4795a6064b60f0376341672e2e989a5b2cef19
846f676a751142fccaed31408d0ba2be2769208c71987a41a374b2855c90d71d
ab7ce6379cd0fadab9a5bf642f185cf4098f55acaba254786da8eeebd6dce1a9
ac1c8f94750b39b12327a5d0c56fdf946dabfb6d91e5d2a202879ff9a5d67e29
af16a2b37eda9ca527a4be50cd262d7be26722c9a41a62c6f9984a4a4664c153
de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
e00c4685576550a775a9d4105356096eb87d13a0943715fcd2773261c1332444
ec792742239d55eab516fcf1b26202da290ec4c92916d344aedc937626caabda
f7e0d31b961880e6795a2ca4c4325bdae359bc036b07502bcb6c86835bc1c58d
fdcc3093786f3f4b6668f5ca5844bbc9303a7e3a272256b64c373191a440bfc6