www.hankyu.k-bus.co.jp Open in urlscan Pro
203.133.238.251  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://orders.co.jp/su.html?email= Page URL
2. http://www.hankyu.k-bus.co.jp/wordfence/img/index.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	su.html orders.co.jp/	571 B 857 B	21ms 5ms	Document text/html	153.122.152.52 GMOCL GMO GlobalS...
General Check archive.org Show headers Download Go to Full URL http://orders.co.jp/su.html?email= Protocol HTTP/1.1 Server 153.122.152.52 , Japan, ASN131921 (GMOCL GMO GlobalSign Holdings K.K., JP), Reverse DNS Software Apache/2.0.64 (Unix) / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 571 Content-Type text/html Date Tue, 24 May 2022 07:57:53 GMT ETag "760004-23b-83b54940" Keep-Alive timeout=15, max=100 Last-Modified Sat, 26 Feb 2022 19:06:37 GMT Server Apache/2.0.64 (Unix)
GET H/1.1	200 OK	Primary Request index.html Show response www.hankyu.k-bus.co.jp/wordfence/img/	11 KB 11 KB	41ms 16ms	Document text/html	203.133.238.251 HANSHIN ITEC HANK...
General Check archive.org Show headers Download Go to Full URL http://www.hankyu.k-bus.co.jp/wordfence/img/index.html Requested by Host: orders.co.jp URL: http://orders.co.jp/su.html?email= Protocol HTTP/1.1 Server 203.133.238.251 Itami, Japan, ASN7524 (HANSHIN ITEC HANKYU HANSHIN CO.,LTD., JP), Reverse DNS cb85eefb.itechh.ne.jp Software Apache / Resource Hash d97939235396151fbb8d80952da26d511f4d177959580ebe2d5616b712af731c Request headers Referer http://orders.co.jp/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 11242 Content-Type text/html Date Tue, 24 May 2022 07:57:53 GMT Keep-Alive timeout=3, max=100 Last-Modified Mon, 31 Jan 2022 02:42:34 GMT Server Apache
GET H/1.1	200 OK	email-2-icon.png icons.iconarchive.com/icons/graphicloads/100-flat/256/	6 KB 7 KB	299ms 291ms	Image image/png	2606:4700:3038::6815:e9b6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://icons.iconarchive.com/icons/graphicloads/100-flat/256/email-2-icon.png Requested by Host: www.hankyu.k-bus.co.jp URL: http://www.hankyu.k-bus.co.jp/wordfence/img/index.html Protocol HTTP/1.1 Server 2606:4700:3038::6815:e9b6 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c Request headers accept-language jp-JP,jp;q=0.9 Referer http://www.hankyu.k-bus.co.jp/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Tue, 24 May 2022 07:57:53 GMT CF-Cache-Status REVALIDATED Last-Modified Wed, 08 Jul 2020 23:41:28 GMT Server cloudflare ETag "5f0659a8-19be" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gksa0DrkKByWE8aONlKLcFoBu0l6gIxXSiP2YDq6ry2o%2F4ZV8QZ050ToosePeLRcDBh8a2P95uPxw4YOe6sMKNaYnFDLVPsMgqP3DIn5xmwnBah9hiydSNP8aD1tNa57GtzVem1EP5dzZkWlxtqUemfnWMM%3D"}],"group":"cf-nel","max_age":604800} Content-Type image/png Cache-Control max-age=14400 NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Connection keep-alive Accept-Ranges bytes CF-RAY 71047ba87dd4b015-NRT alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 Content-Length 6590
GET H2	200	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	339ms 113ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: www.hankyu.k-bus.co.jp URL: http://www.hankyu.k-bus.co.jp/wordfence/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Request headers Referer http://www.hankyu.k-bus.co.jp/ Origin http://www.hankyu.k-bus.co.jp accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 07:57:53 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-10fdd" vary Accept-Encoding x-hw 1653379073.dop032.sj3.t,1653379073.cds203.sj3.hn,1653379073.cds207.sj3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 23856
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	26ms 8ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: www.hankyu.k-bus.co.jp URL: http://www.hankyu.k-bus.co.jp/wordfence/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer http://www.hankyu.k-bus.co.jp/ Origin http://www.hankyu.k-bus.co.jp accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 07:57:53 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1031500 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6157 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ONDydcEffUmZqDpCbMP16IANDfiPsG3zSNDcl0Hr6u%2BdchJ1sXa9ukKKwIPhY8fzneCxmyXpzwLf%2B7WcVNwUPfRdhp3%2FiQQwNoiWaN6tiFRZqLdwiZvsByyZO95q%2F8bkqDuTHHpifYYmzUPz%2BxfOJ0TZ"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 71047ba88d4b34f3-NRT expires Sun, 14 May 2023 07:57:53 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 14 KB	25ms 16ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: www.hankyu.k-bus.co.jp URL: http://www.hankyu.k-bus.co.jp/wordfence/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer http://www.hankyu.k-bus.co.jp/ Origin http://www.hankyu.k-bus.co.jp accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 07:57:53 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 803 age 5421 cdn-cachedat 11/15/2021 00:30:40 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cdn-proxyver 1.0 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:04 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid ed717bebe0aa949cc419d10c4416eaa2 cf-ray 71047ba87d6733f6-NRT cdn-requestcountrycode US cdn-status 200 cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	48ms 3ms	Script text/javascript	2404:6800:4004:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: www.hankyu.k-bus.co.jp URL: http://www.hankyu.k-bus.co.jp/wordfence/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:810::200a , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language jp-JP,jp;q=0.9 Referer http://www.hankyu.k-bus.co.jp/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Sat, 21 May 2022 17:56:52 GMT content-encoding gzip x-content-type-options nosniff age 223261 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sun, 21 May 2023 17:56:52 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	22ms 10ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: www.hankyu.k-bus.co.jp URL: http://www.hankyu.k-bus.co.jp/wordfence/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://www.hankyu.k-bus.co.jp/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 07:57:53 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 753, 617, 617 age 28273551 cdn-cachedat 2021-06-19 03:25:59 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 091569a016b5cc61e090d5815e862673 cf-ray 71047ba88ddaaf9a-NRT cdn-requestcountrycode AU cdn-requestpullsuccess True
GET H2	200	jquery.session.min.js Show response cdn.jsdelivr.net/npm/jquery.session@1.0.0/	2 KB 2 KB	18ms 11ms	Script application/javascript	2606:4700::6810:5814 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js Requested by Host: www.hankyu.k-bus.co.jp URL: http://www.hankyu.k-bus.co.jp/wordfence/img/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language jp-JP,jp;q=0.9 Referer http://www.hankyu.k-bus.co.jp/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Tue, 24 May 2022 07:57:53 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1021608 x-jsd-version 1.0.0 x-cache HIT, HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by cache-fra19137-FRA, cache-tyo11951-TYO timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"91d-mUGbC+S4VCL/hIcOVNvYpS3G2rE" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OKgCqDwcUBtwHXVetizWsfmgP8xdxriy2wqwe0Hl1wbzi%2F1laEBiTJKTr40ZG%2FeP6cFfwJRugfJtQWG5b%2BRCxYjajyH20aIb8Dk6gTKviarD3WVC1LIpFfH44kkAyZQyEiH7WPhhr3r7NLxxMYg%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 71047ba87c053499-NRT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getDateTime string| message function| clickIE function| clickNS function| disableCtrlKeyCombination function| $ function| jQuery function| Popper object| bootstrap string| currentTime

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.hankyu.k-bus.co.jp/	1969-12-31 23:59:59	Name: BIGipServerssl1.itechh.ne.jp-http Value: !Yba4qTUNecOQ5KWzk22lrD9ujepHf24Yhsc1FI7rNQUZm9nnmR6/tWnY6BGz8msIHRY44zwWK7hMhzI=
			www.hankyu.k-bus.co.jp/	1970-01-20 03:16:19	Name: __session:0.9187212783793008: Value: http:

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
icons.iconarchive.com
maxcdn.bootstrapcdn.com
orders.co.jp
stackpath.bootstrapcdn.com
www.hankyu.k-bus.co.jp
153.122.152.52
2001:4de0:ac18::1:a:2b
203.133.238.251
2404:6800:4004:810::200a
2606:4700:3038::6815:e9b6
2606:4700::6810:5814
2606:4700::6811:180e
2606:4700::6812:bcf
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
d97939235396151fbb8d80952da26d511f4d177959580ebe2d5616b712af731c
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b