![](/screenshots/1c5af7bf-0061-4e44-890d-0cd1d00e24c4.png)
continuedwa-ddcheckout.mefound.com
Open in
urlscan Pro
43.129.174.41
Malicious Activity!
Public Scan
Effective URL: https://continuedwa-ddcheckout.mefound.com/auth.php?screen/na/authorize?response_type=code&client_id=ZC001&state=&scope=openid&_gl=1*1li7pm...
Submission: On February 01 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on January 30th 2024. Valid for: 3 months.
This is the only time continuedwa-ddcheckout.mefound.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UC Card (Financial) Saison Card (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 12 | 43.129.174.41 43.129.174.41 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
1 | 4.79.109.103 4.79.109.103 | 3356 (LEVEL3) (LEVEL3) | |
8 | 45.60.44.171 45.60.44.171 | 19551 (INCAPSULA) (INCAPSULA) | |
3 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2600:1901:0:5... 2600:1901:0:587d:: | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
4 | 2607:f8b0:400... 2607:f8b0:4006:809::201b | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:141b:1c0... 2600:141b:1c00:31::1739:5a4f | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2600:141b:1c0... 2600:141b:1c00:31::1739:5a49 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
32 | 8 |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
continuedwa-ddcheckout.mefound.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
jp.api.capy.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
mefound.com
1 redirects
continuedwa-ddcheckout.mefound.com |
130 KB |
8 |
saisoncard.co.jp
api.saisoncard.co.jp |
294 KB |
4 |
googleapis.com
capy.storage.googleapis.com |
6 KB |
3 |
capy.me
jp.api.capy.me |
365 KB |
3 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 |
59 KB |
2 |
typekit.net
use.typekit.net — Cisco Umbrella Rank: 463 p.typekit.net — Cisco Umbrella Rank: 566 |
189 KB |
1 |
bootcdn.net
cdn.bootcdn.net — Cisco Umbrella Rank: 106194 |
4 KB |
32 | 7 |
Domain | Requested by | |
---|---|---|
12 | continuedwa-ddcheckout.mefound.com |
1 redirects
continuedwa-ddcheckout.mefound.com
|
8 | api.saisoncard.co.jp |
continuedwa-ddcheckout.mefound.com
|
4 | capy.storage.googleapis.com |
continuedwa-ddcheckout.mefound.com
|
3 | jp.api.capy.me |
continuedwa-ddcheckout.mefound.com
|
3 | cdnjs.cloudflare.com |
continuedwa-ddcheckout.mefound.com
cdnjs.cloudflare.com |
1 | p.typekit.net |
use.typekit.net
|
1 | use.typekit.net |
continuedwa-ddcheckout.mefound.com
|
1 | cdn.bootcdn.net |
continuedwa-ddcheckout.mefound.com
|
32 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.saisoncard.co.jp |
faq.saisoncard.co.jp |
Subject Issuer | Validity | Valid | |
---|---|---|---|
continuedwa-ddcheckout.wikaba.com R3 |
2024-01-30 - 2024-04-29 |
3 months | crt.sh |
*.bootcss.com Sectigo RSA Domain Validation Secure Server CA |
2024-01-03 - 2025-02-02 |
a year | crt.sh |
api.saisoncard.co.jp Cybertrust Japan SureServer EV CA G3 |
2023-12-05 - 2024-12-31 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
jp.api.capy.me RapidSSL TLS RSA CA G1 |
2023-08-30 - 2024-09-29 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1C3 |
2024-01-09 - 2024-04-02 |
3 months | crt.sh |
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-02-01 - 2025-03-03 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://continuedwa-ddcheckout.mefound.com/auth.php?screen/na/authorize?response_type=code&client_id=ZC001&state=&scope=openid&_gl=1*1li7pmi*_ga*MTc0NjIwMTE2Ni4xNjY5MzY5MDg0*_ga_BKKP87CX6T*MTY3NzE1NDEyNC4xLjAuMTY3NzE1NDEyNi41OC4wLjA
Frame ID: 854C20C30AD3421D0CD72A053B4ABE7A
Requests: 25 HTTP requests in this frame
Frame:
https://continuedwa-ddcheckout.mefound.com/if.html
Frame ID: DBF34077D4503DB3C28F92E9161B9CEF
Requests: 7 HTTP requests in this frame
Screenshot
![](/screenshots/1c5af7bf-0061-4e44-890d-0cd1d00e24c4.png)
Page Title
SAISON CARD NetアンサーPage URL History Show full URLs
-
https://continuedwa-ddcheckout.mefound.com/
HTTP 302
https://continuedwa-ddcheckout.mefound.com/auth.php?screen/na/authorize?response_type=code&client_id=ZC001&state=&scope... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- <!-- (?:End )?Google Tag Manager -->
Detected patterns
- [^a-z]mtc.*\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: 登録・ログインでお困りの方
Search URL Search Domain Scan URL
Title: よくあるお問い合わせ
Search URL Search Domain Scan URL
Title: メンテナンス情報
Search URL Search Domain Scan URL
Title: 推奨環境
Search URL Search Domain Scan URL
Title: Netアンサー規約
Search URL Search Domain Scan URL
Title: Cookieについて
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://continuedwa-ddcheckout.mefound.com/
HTTP 302
https://continuedwa-ddcheckout.mefound.com/auth.php?screen/na/authorize?response_type=code&client_id=ZC001&state=&scope=openid&_gl=1*1li7pmi*_ga*MTc0NjIwMTE2Ni4xNjY5MzY5MDg0*_ga_BKKP87CX6T*MTY3NzE1NDEyNC4xLjAuMTY3NzE1NDEyNi41OC4wLjA Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
auth.php
continuedwa-ddcheckout.mefound.com/ Redirect Chain
|
20 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
site-jquery.min.js
continuedwa-ddcheckout.mefound.com/admin/im/ |
91 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layui.js
continuedwa-ddcheckout.mefound.com/admin/im/ |
284 KB 92 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layer.min.css
cdn.bootcdn.net/ajax/libs/layer/3.5.1/theme/default/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
api.saisoncard.co.jp/auth/resources/css/client/ |
13 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
na.css
api.saisoncard.co.jp/auth/resources/css/client/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.2/css/ |
99 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_saison_03.svg
api.saisoncard.co.jp/auth/resources/img/logo/ |
4 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
key_ani.gif
api.saisoncard.co.jp/auth/resources/img/ |
177 KB 178 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
jp.api.capy.me/puzzle/get_image/ |
128 KB 128 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
update.png
capy.storage.googleapis.com/static/img/ |
705 B 938 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new_make_captcha_easy.png
capy.storage.googleapis.com/static/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
guide.png
capy.storage.googleapis.com/static/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
capy.storage.googleapis.com/static/img/ |
404 B 674 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
jp.api.capy.me/puzzle/get_js/ |
102 KB 102 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sportal.svg
api.saisoncard.co.jp/auth/resources/img/client/ |
37 KB 37 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
apple.svg
api.saisoncard.co.jp/auth/resources/img/client/ |
10 KB 10 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google.png
api.saisoncard.co.jp/auth/resources/img/client/ |
40 KB 40 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_f.svg
api.saisoncard.co.jp/auth/resources/img/footer/ |
4 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
laydate.css
continuedwa-ddcheckout.mefound.com/admin/im/css/modules/laydate/default/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layer.css
continuedwa-ddcheckout.mefound.com/admin/im/css/modules/layer/default/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
code.css
continuedwa-ddcheckout.mefound.com/admin/im/css/modules/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
if.html
continuedwa-ddcheckout.mefound.com/ Frame DBF3 |
1 KB 774 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iframe.css
continuedwa-ddcheckout.mefound.com/css/ Frame DBF3 |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.2/css/ Frame DBF3 |
99 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dkv4rfm.js
use.typekit.net/ Frame DBF3 |
286 KB 189 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
continuedwa-ddcheckout.mefound.com/js/ Frame DBF3 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iframe.js
continuedwa-ddcheckout.mefound.com/js/ Frame DBF3 |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-regular-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.2/webfonts/ |
23 KB 24 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.php
continuedwa-ddcheckout.mefound.com/ |
13 B 84 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
jp.api.capy.me/puzzle/get_image/ |
134 KB 134 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p.gif
p.typekit.net/ Frame DBF3 |
35 B 205 B |
XHR
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UC Card (Financial) Saison Card (Financial)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery object| layui function| lay number| errors object| layer object| jQuery110101666221418250029 object| mask object| timer object| hb_timer function| heart_beat function| ip_save function| verify object| puzzleApp1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
continuedwa-ddcheckout.mefound.com/ | Name: PHPSESSID Value: lnms3bqpudfvus3c7msp815rpq |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.saisoncard.co.jp
capy.storage.googleapis.com
cdn.bootcdn.net
cdnjs.cloudflare.com
continuedwa-ddcheckout.mefound.com
jp.api.capy.me
p.typekit.net
use.typekit.net
2600:141b:1c00:31::1739:5a49
2600:141b:1c00:31::1739:5a4f
2600:1901:0:587d::
2606:4700::6811:180e
2607:f8b0:4006:809::201b
4.79.109.103
43.129.174.41
45.60.44.171
005e12935537cad000e4b91f4f7f0099af2d0a76166ae9ff7577b4e7a6ccebb8
01c58e9fde4e043d29deb9b9f5a09930f7c8300de8fa91f1f08dbcdc56eb8682
0bc49396cc03f5619f2eea2e441b629353f1e9c39df8c56b3fb20010600baf93
217d1b91669dd4a21ce0cff140d526b43a3ac1ea5caa5578d5372fde00dadf1d
2a9a2a00a40c8a424a136215aeab6dda1af941afe3b68da802b3dda239a85af7
2b1b4ff5b79346bcfc5a78e760e781a5161202adb9884c58f142b457b4bc0a9c
4205e944eeb068ce55b3cf194cb4b1a4dcc0deae431f2a84445dad173ac1db35
4293a505ac0dbf6351dd21d54f092862832f760f740f0b70b5f1ef4ecdf63c1b
4594e2f4cb1b0bb20e49e0e44446cb0717f38aa5e202d0b26acdbdee8e03d495
52ec4d833cfa502f109fcc197b417736165f53d3d0b4e73a2801c8d50b641805
5994332aadd364a7350ad226ef61c1c75dc97372f739e01682e190be3abaf672
6527ce1d64e5deae0babf6d43438ea74a8f39d1eda142c92c4a6ada34f4a32f6
78194da74b169b466c79454b7e6ad7751b5392f9989872b709126abd549978f3
8fca1ac0be84adf4e4c152bd6db10305f9af5f7761a41a90cd1d55a18b892221
988fe0a48015c5a56dac88172487a1f5cda96340b34d80fd94312d02e9f67865
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
a41d45143e94023697405baabba914184fee4de441c3880da7628e08e7fe2632
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
bbfe1536a99000acceb61f549aa59354cc596efc9f10d3843aab6b273f5adb1e
c5e8e8eb22e2eaf1ad02370c22c63c04774ab0b83b4329d5945333750814bb2f
cbdfa3c10646e35dad9baa7d51729fec894e8cadcf0539aaa214f43a8a0ce5d7
d2a5d18324a1fab80dab285d2fe0f860254b5ee10536229c70c82026cf07ce6e
ddd6300d42d57985e6b3449494bff182a7fa3f4b29a5d0e69c7ed3829bf98bd6
ec184ee7445dc1ba62851e08873aba452918ced583e837070af3ecb26e67a6e6
f99199228144a11b7adda7dad83f11c366ecb6f530ba8a352fb155bc0e58fc0e