![](/screenshots/0e14d1ef-1087-4e78-b665-a78ea5be8b9f.png)
r68zhfdh.serveuser.com
Open in
urlscan Pro
43.133.178.218
Malicious Activity!
Public Scan
Submission Tags: gc
Submission: On September 14 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on August 29th 2023. Valid for: 3 months.
This is the only time r68zhfdh.serveuser.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rakuten (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 43.133.178.218 43.133.178.218 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
6 | 23.39.217.169 23.39.217.169 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 139.200.106.73 139.200.106.73 | 4134 (CHINANET-...) (CHINANET-BACKBONE No.31) | |
1 | 23.33.39.124 23.33.39.124 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 133.237.61.118 133.237.61.118 | 23820 (RAKUTEN R...) (RAKUTEN Rakuten Group) | |
1 | 23.39.217.163 23.39.217.163 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
17 | 6 |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
r68zhfdh.serveuser.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-39-217-169.deploy.static.akamaitechnologies.com
www.rakuten.co.jp |
ASN16625 (AKAMAI-AS, US)
PTR: a23-33-39-124.deploy.static.akamaitechnologies.com
static.id.rakuten.co.jp |
ASN23820 (RAKUTEN Rakuten Group, Inc., JP)
PTR: challenger02.api.rakuten.co.jp
challenger.api.rakuten.co.jp |
ASN16625 (AKAMAI-AS, US)
PTR: a23-39-217-163.deploy.static.akamaitechnologies.com
jp.rakuten-static.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
rakuten.co.jp
www.rakuten.co.jp — Cisco Umbrella Rank: 199020 static.id.rakuten.co.jp challenger.api.rakuten.co.jp |
11 KB |
7 |
serveuser.com
r68zhfdh.serveuser.com |
127 KB |
1 |
rakuten-static.com
jp.rakuten-static.com — Cisco Umbrella Rank: 251304 |
350 B |
1 |
bootcdn.net
cdn.bootcdn.net — Cisco Umbrella Rank: 112996 |
4 KB |
17 | 4 |
Domain | Requested by | |
---|---|---|
7 | r68zhfdh.serveuser.com |
r68zhfdh.serveuser.com
|
6 | www.rakuten.co.jp |
r68zhfdh.serveuser.com
www.rakuten.co.jp |
1 | jp.rakuten-static.com |
r68zhfdh.serveuser.com
|
1 | challenger.api.rakuten.co.jp |
r68zhfdh.serveuser.com
|
1 | static.id.rakuten.co.jp |
r68zhfdh.serveuser.com
|
1 | cdn.bootcdn.net |
r68zhfdh.serveuser.com
|
17 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.rakuten.co.jp |
Subject Issuer | Validity | Valid | |
---|---|---|---|
ghj67ojh.vizvaz.com R3 |
2023-08-29 - 2023-11-27 |
3 months | crt.sh |
www.rakuten.co.jp DigiCert SHA2 Extended Validation Server CA |
2023-02-16 - 2024-02-16 |
a year | crt.sh |
*.bootcdn.net Sectigo RSA Domain Validation Secure Server CA |
2023-08-17 - 2024-08-17 |
a year | crt.sh |
*.id.rakuten.co.jp DigiCert TLS RSA SHA256 2020 CA1 |
2023-04-10 - 2024-04-09 |
a year | crt.sh |
*.api.rakuten.co.jp DigiCert TLS RSA SHA256 2020 CA1 |
2023-07-24 - 2024-08-23 |
a year | crt.sh |
intl.rakuten-static.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-09-08 - 2024-04-17 |
7 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://r68zhfdh.serveuser.com/mobile/index.php
Frame ID: 1823467B3A6ACE11ABC3D0B900C1DAFD
Requests: 17 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
r68zhfdh.serveuser.com/mobile/ |
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
import.css
www.rakuten.co.jp/com/css/id/sf/ |
104 B 276 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
site-jquery.min.js
r68zhfdh.serveuser.com/admin/im/ |
91 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layui.js
r68zhfdh.serveuser.com/admin/im/ |
284 KB 92 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layer.min.css
cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rakuten_sp_28px@2x.png
static.id.rakuten.co.jp/static/com/img/id/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
challenger.css
challenger.api.rakuten.co.jp/static/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pop.gif
jp.rakuten-static.com/1/im/ic/ui/ |
75 B 350 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
www.rakuten.co.jp/com/css/id/sf/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id.css
www.rakuten.co.jp/com/css/id/sf/ |
18 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
psm_style.css
www.rakuten.co.jp/com/css/id/sf/ |
3 KB 801 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
laydate.css
r68zhfdh.serveuser.com/admin/im/css/modules/laydate/default/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layer.css
r68zhfdh.serveuser.com/admin/im/css/modules/layer/default/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
code.css
r68zhfdh.serveuser.com/admin/im/css/modules/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.php
r68zhfdh.serveuser.com/ |
13 B 187 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_circle.gif
www.rakuten.co.jp/com/img/id/sf/ |
342 B 505 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chevron.png
www.rakuten.co.jp/com/img/id/sf/ |
259 B 422 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rakuten (E-commerce)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery object| layui function| lay number| errors object| layer object| jQuery110106296321162497152 object| mask object| timer object| hb_timer function| heart_beat function| ip_save function| verify1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
r68zhfdh.serveuser.com/ | Name: PHPSESSID Value: qn0rr07j8nr2j14i8gpuclfqo7 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.bootcdn.net
challenger.api.rakuten.co.jp
jp.rakuten-static.com
r68zhfdh.serveuser.com
static.id.rakuten.co.jp
www.rakuten.co.jp
133.237.61.118
139.200.106.73
23.33.39.124
23.39.217.163
23.39.217.169
43.133.178.218
0f058bb17832ff87f6a0ed178a9bfc03d077ec65f234fe7c2ce0a7cb60c7e307
1c693152fcad1f68f89fca7b0fdc640195bd8d7ada9a10bf661f90884f0e7a64
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
7ab9a4d7f597471f82e8ebc6019525cd45f81decff7853062056a3c3417eba59
7ca3b60cecf9d09a7a015794e15a6cb66e8aa55c6dee27e1d3456ab3b7efb23f
7f5e68e8b1e7fae38a3ee4872c95e183c97f3e18b39cfd02b1074216a9f91e82
88eed35d75907988c5edf2688df02fd8f4a04eac7a5467d847da35ddd32c7270
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e
d5bd47efbf5b0cf47fec9e7400993f8f97362000b13f6be453ce8efc4e1ef0d7
e3c6fe7bec882eac29ed8b44fa4ea691c746025037bd31db0421673450f6f25e
f0665d11143ffaff81d3720294bf52e56a0cafa1248c4d99a42680c4d0d77d88
f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e
fd1a8abe402a8953a7184bb9c3bb230b6e75e34efbdaf20a691c2ca9181e7465