robertoi.com Open in urlscan Pro
94.156.253.199 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php
Submission: On August 22 via api (August 22nd 2023, 3:31:15 pm UTC) from US — Scanned from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 94.156.253.199, located in Bulgaria and belongs to WINTERSTORM, US. The main domain is robertoi.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 18th 2023. Valid for: 3 months.

This is the only time robertoi.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BIGLOBE (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
4	94.156.253.199 94.156.253.199	7411 (WINTERSTORM) (WINTERSTORM)
3	2406:da14:5ff... 2406:da14:5ff:9a00:9841:6d31:70e9:1646	16509 (AMAZON-02) (AMAZON-02)
1	2406:da14:5e4... 2406:da14:5e4:7d00:eff0:3ecf:6075:9319	16509 (AMAZON-02) (AMAZON-02)
9	4

4 94.156.253.199 (Bulgaria)

ASN7411 (WINTERSTORM, US)

robertoi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2406:da14:5ff:9a00:9841:6d31:70e9:1646 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)

webmail.biglobe.ne.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2406:da14:5e4:7d00:eff0:3ecf:6075:9319 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)

member4.sso.biglobe.ne.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	biglobe.ne.jp webmail.biglobe.ne.jp member4.sso.biglobe.ne.jp	7 KB
4	robertoi.com robertoi.com	49 KB
0	Failed function sub() { [native code] }. Failed
9	3

	Domain	Requested by
4	robertoi.com	robertoi.com
3	webmail.biglobe.ne.jp	robertoi.com
1	member4.sso.biglobe.ne.jp	robertoi.com
0	ckejmhbmlajgoklhgbapkiccekfoccmk Failed	robertoi.com
9	4

This site contains no links.

Subject Issuer	Validity	Valid
robertoi.com cPanel, Inc. Certification Authority	`2023-08-18` - `2023-11-16`	3 months	crt.sh
webmail.biglobe.ne.jp Amazon RSA 2048 M01	`2023-02-10` - `2023-12-21`	10 months	crt.sh
member4.sso.biglobe.ne.jp GlobalSign Extended Validation CA - SHA256 - G3	`2022-08-29` - `2023-09-30`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php
Frame ID: 1610D7E686D6A8D3AA339A902CFA2431
Requests: 8 HTTP requests in this frame

Frame: https://member4.sso.biglobe.ne.jp/heute
Frame ID: B14B08B059DBF3BD653EBAE90A6D252E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

9
Requests

89 %
HTTPS

67 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

56 kB
Transfer

54 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request auth.php Show response robertoi.com/l/webmails/index-rui.jsp/source/mobile/	15 KB 15 KB	795ms 232ms	Document text/html	94.156.253.199 WINTERSTORM
General Check archive.org Show headers Download Go to Full URL https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 94.156.253.199 , Bulgaria, ASN7411 (WINTERSTORM, US), Reverse DNS Software Apache / Resource Hash `d0832f903f3204f95c4ef3ee1a3ff901e2ab847c8be5626b4a65c46b29c4ec7e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 22 Aug 2023 15:31:09 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	base02_and.css robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/	15 KB 15 KB	189ms 145ms	Stylesheet text/css	94.156.253.199 WINTERSTORM
General Check archive.org Show headers Download Go to Full URL https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/base02_and.css Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 94.156.253.199 , Bulgaria, ASN7411 (WINTERSTORM, US), Reverse DNS Software Apache / Resource Hash `e1838e972a0860eeabe922ad57f89189df0ecc21e8def514bdad616e7daa9e26` Request headers accept-language en-US,en;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Tue, 22 Aug 2023 15:31:09 GMT Last-Modified Thu, 15 Jun 2023 10:23:34 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 15026
GET H/1.1	200 OK	global_and.css robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/	18 KB 18 KB	335ms 145ms	Stylesheet text/css	94.156.253.199 WINTERSTORM
General Check archive.org Show headers Download Go to Full URL https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/global_and.css Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 94.156.253.199 , Bulgaria, ASN7411 (WINTERSTORM, US), Reverse DNS Software Apache / Resource Hash `a66313d478d9a89bae72f3b66740bb5cc54716dd56ffce4d0fed631f60461394` Request headers accept-language en-US,en;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Tue, 22 Aug 2023 15:31:09 GMT Last-Modified Thu, 15 Jun 2023 10:23:34 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 18551
GET H/1.1	200 OK	info.css robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/	102 B 343 B	413ms 139ms	Stylesheet text/css	94.156.253.199 WINTERSTORM
General Check archive.org Show headers Download Go to Full URL https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/info.css Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 94.156.253.199 , Bulgaria, ASN7411 (WINTERSTORM, US), Reverse DNS Software Apache / Resource Hash `1be62ee1373b2feb21b1459288cd92754d29d7c3ccb008134b8538890bb98285` Request headers accept-language en-US,en;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Tue, 22 Aug 2023 15:31:09 GMT Last-Modified Thu, 15 Jun 2023 10:23:34 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 102
GET H2	200	logo_email_mb.gif webmail.biglobe.ne.jp/images2/common/	2 KB 2 KB	833ms 397ms	Image image/gif	2406:da14:5ff:9a00:9841:6d31:70e9:1646 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://webmail.biglobe.ne.jp/images2/common/logo_email_mb.gif Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2406:da14:5ff:9a00:9841:6d31:70e9:1646 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash `a4529c44c823be47ebb2d35dc9d12f227c966a1401b7351379382e8a2262a026` Request headers accept-language en-US,en;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 15:31:10 GMT cache-control no-store last-modified Thu, 21 Sep 2017 07:47:30 GMT server Apache accept-ranges bytes content-length 2223 content-type image/gif
GET H2	200	button_03.gif webmail.biglobe.ne.jp/mobile/images/	4 KB 4 KB	593ms 200ms	Image image/gif	2406:da14:5ff:9a00:9841:6d31:70e9:1646 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://webmail.biglobe.ne.jp/mobile/images/button_03.gif Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2406:da14:5ff:9a00:9841:6d31:70e9:1646 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash `6f47d8cbeebfb58186a00fad67c829cb96e9b5a389850e08ef6a472ae3822521` Request headers accept-language en-US,en;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 15:31:10 GMT cache-control no-store last-modified Fri, 11 Nov 2011 08:41:44 GMT server Apache accept-ranges bytes content-length 4059 content-type image/gif
GET H2	200	c31a2fc863.js Show response webmail.biglobe.ne.jp/blog/	342 B 498 B	594ms 201ms	Script application/javascript	2406:da14:5ff:9a00:9841:6d31:70e9:1646 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://webmail.biglobe.ne.jp/blog/c31a2fc863.js Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2406:da14:5ff:9a00:9841:6d31:70e9:1646 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash `759b1b9e6dc66f114fe61e0a384327b6dfc7ccaa40dad73a474168ca644e1f61` Request headers accept-language en-US,en;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 15:31:10 GMT cache-control no-store last-modified Mon, 21 May 2018 00:20:27 GMT server Apache accept-ranges bytes content-length 342 content-type application/javascript
GET		cursor.png ckejmhbmlajgoklhgbapkiccekfoccmk/assets/pictos/	0 0

GET H2	200	heute Show response member4.sso.biglobe.ne.jp/ Frame B14B	212 B 313 B	831ms 369ms	Document text/html	2406:da14:5e4:7d00:eff0:3ecf:6075:9319 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://member4.sso.biglobe.ne.jp/heute Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2406:da14:5e4:7d00:eff0:3ecf:6075:9319 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache / Resource Hash `d3b2ec4968667291c8398175533ffad1943cfdd78df2891b7ce52f36642c577e` Request headers Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 accept-language en-US,en;q=0.9 Response headers conetnt-type text/html; charset=utf-8 content-length 212 date Tue, 22 Aug 2023 15:31:11 GMT server Apache

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ckejmhbmlajgoklhgbapkiccekfoccmk
URL: chrome-extension://ckejmhbmlajgoklhgbapkiccekfoccmk/assets/pictos/cursor.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BIGLOBE (Telecommunication)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			robertoi.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: dd629f6a806f2f03dffa625db9f59038

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: chrome-extension://ckejmhbmlajgoklhgbapkiccekfoccmk/assets/pictos/cursor.png Message: Failed to load resource: net::ERR_UNKNOWN_URL_SCHEME

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ckejmhbmlajgoklhgbapkiccekfoccmk
member4.sso.biglobe.ne.jp
robertoi.com
webmail.biglobe.ne.jp
ckejmhbmlajgoklhgbapkiccekfoccmk
2406:da14:5e4:7d00:eff0:3ecf:6075:9319
2406:da14:5ff:9a00:9841:6d31:70e9:1646
94.156.253.199
1be62ee1373b2feb21b1459288cd92754d29d7c3ccb008134b8538890bb98285
6f47d8cbeebfb58186a00fad67c829cb96e9b5a389850e08ef6a472ae3822521
759b1b9e6dc66f114fe61e0a384327b6dfc7ccaa40dad73a474168ca644e1f61
a4529c44c823be47ebb2d35dc9d12f227c966a1401b7351379382e8a2262a026
a66313d478d9a89bae72f3b66740bb5cc54716dd56ffce4d0fed631f60461394
d0832f903f3204f95c4ef3ee1a3ff901e2ab847c8be5626b4a65c46b29c4ec7e
d3b2ec4968667291c8398175533ffad1943cfdd78df2891b7ce52f36642c577e
e1838e972a0860eeabe922ad57f89189df0ecc21e8def514bdad616e7daa9e26

robertoi.com Open in urlscan Pro 94.156.253.199 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

9 Requests

89 %HTTPS

67 %IPv6

3 Domains

4 Subdomains

4 IPs

2 Countries

56 kBTransfer

54 kBSize

1 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

robertoi.com Open in urlscan Pro
94.156.253.199 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

67 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

56 kB
Transfer

54 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!