![](/screenshots/4648d5c8-1bf2-4063-a39a-559d08f30e1e.png)
chenfeng.cyou
Open in
urlscan Pro
204.44.85.114
Malicious Activity!
Public Scan
Effective URL: https://chenfeng.cyou/login.php
Submission: On January 01 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on December 31st 2022. Valid for: 3 months.
This is the only time chenfeng.cyou was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rakuten (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 10 | 204.44.85.114 204.44.85.114 | 64270 (PACIFICRACK) (PACIFICRACK) | |
4 | 104.84.57.215 104.84.57.215 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 23.37.56.209 23.37.56.209 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 133.237.61.118 133.237.61.118 | 23820 (RAKUTEN R...) (RAKUTEN Rakuten Group) | |
15 | 4 |
ASN64270 (PACIFICRACK, US)
PTR: 204.44.85.114.static.quadranet.com
chenfeng.cyou |
ASN16625 (AKAMAI-AS, US)
PTR: a104-84-57-215.deploy.static.akamaitechnologies.com
image.card.jp.rakuten-static.com | |
jp.rakuten-static.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-37-56-209.deploy.static.akamaitechnologies.com
static.id.rakuten.co.jp |
ASN23820 (RAKUTEN Rakuten Group, Inc., JP)
PTR: challenger02.api.rakuten.co.jp
challenger.api.rakuten.co.jp |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
chenfeng.cyou
1 redirects
chenfeng.cyou |
228 KB |
4 |
rakuten-static.com
image.card.jp.rakuten-static.com — Cisco Umbrella Rank: 527167 jp.rakuten-static.com — Cisco Umbrella Rank: 99403 |
5 KB |
2 |
rakuten.co.jp
static.id.rakuten.co.jp challenger.api.rakuten.co.jp |
4 KB |
15 | 3 |
Domain | Requested by | |
---|---|---|
10 | chenfeng.cyou |
1 redirects
chenfeng.cyou
|
3 | jp.rakuten-static.com |
chenfeng.cyou
|
1 | challenger.api.rakuten.co.jp |
chenfeng.cyou
|
1 | static.id.rakuten.co.jp |
chenfeng.cyou
|
1 | image.card.jp.rakuten-static.com |
chenfeng.cyou
|
15 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.rakuten-card.co.jp |
www.rakuten.co.jp |
static.id.rakuten.co.jp |
www.jpcert.or.jp |
member.id.rakuten.co.jp |
privacy.rakuten.co.jp |
ichiba.faq.rakuten.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
chenfeng.cyou R3 |
2022-12-31 - 2023-03-31 |
3 months | crt.sh |
intl.rakuten-static.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-04 - 2023-06-07 |
a year | crt.sh |
*.id.rakuten.co.jp DigiCert TLS RSA SHA256 2020 CA1 |
2022-05-29 - 2023-05-31 |
a year | crt.sh |
*.api.rakuten.co.jp DigiCert TLS RSA SHA256 2020 CA1 |
2022-07-22 - 2023-08-22 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://chenfeng.cyou/login.php
Frame ID: BEF5C1B7D243721F0E6EC187ED3FE6CA
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/4648d5c8-1bf2-4063-a39a-559d08f30e1e.png)
Page Title
【楽天】ログインPage URL History Show full URLs
-
https://chenfeng.cyou/
HTTP 302
https://chenfeng.cyou/login.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: 楽天市場へ
Search URL Search Domain Scan URL
Title: 楽天カードトップへ
Search URL Search Domain Scan URL
Title: よくあるご質問
Search URL Search Domain Scan URL
Title: こちら
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: 個人情報保護方針
Search URL Search Domain Scan URL
Title: ユーザID・パスワードを忘れた場合
Search URL Search Domain Scan URL
Title: ヘルプ
Search URL Search Domain Scan URL
Title: 楽天会員とは?
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://chenfeng.cyou/
HTTP 302
https://chenfeng.cyou/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
chenfeng.cyou/ Redirect Chain
|
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common_login.css
chenfeng.cyou/com/css/id/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginstyle.css
chenfeng.cyou/com/css/id/ |
1000 B 591 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
chenfeng.cyou/ |
158 KB 160 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rc-logo_CardEnavi_1.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/common/logo/ |
9 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t.gif
jp.rakuten-static.com/1/im/ci/header/ |
43 B 337 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stop_540x249.png
chenfeng.cyou/com/img/id/ |
57 KB 57 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rakuten_pc_20px@2x.png
static.id.rakuten.co.jp/static/com/img/id/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pc_login_warning.png
chenfeng.cyou/com/img/icon/ |
670 B 741 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
challenger.css
challenger.api.rakuten.co.jp/static/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pop.gif
jp.rakuten-static.com/1/im/ic/ui/ |
75 B 369 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_btn_red_btm.gif
chenfeng.cyou/com/img/login/ |
442 B 536 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_btn_red_top.gif
chenfeng.cyou/com/img/login/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_btn_arrow.gif
chenfeng.cyou/com/img/id// |
260 B 260 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info.gif
jp.rakuten-static.com/1/im/ic/ui/ |
360 B 655 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rakuten (E-commerce)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange string| ip object| it function| save function| listen function| setOperateCode function| setisonlie1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
chenfeng.cyou/ | Name: PHPSESSID Value: uoi70b8hht0b6rbc8e2ioppr29 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
challenger.api.rakuten.co.jp
chenfeng.cyou
image.card.jp.rakuten-static.com
jp.rakuten-static.com
static.id.rakuten.co.jp
104.84.57.215
133.237.61.118
204.44.85.114
23.37.56.209
02e2c0dfb92c647f2dd29bd459fa3e73be5e0ae1302b1d7117127a9d27af638a
175cf3a6b7549f715fffaddc3ec5c9f92717e7c5f63b7e36ea9592e091a80a67
243741d0fd578219a8a40b166481845038610031528c5ae851783e228de53867
33be38e33c8eb9aa13a4ed44c2e2813207bef13a5ba265818e485f0ebbc83f3b
4c7ab92d6c538f5e7aba3b1609e28db52d18c6f4e50d6216884596c9def1c7b8
62775ef2856f63d6399abc1d54077916df8d62b16414816012b9ff0fad4efada
71f56625e8403042548151b1694675c56b6a650508ab1cc7cb8034e5b2497ce8
7ab9a4d7f597471f82e8ebc6019525cd45f81decff7853062056a3c3417eba59
7ac823606e44dc5bc9effb3fd28385d101c9362ad9b2f6456fa59039d9832930
849cd9d1c481a1b45559f5e833f40e13ee666842e6f8ba72c8e1cad9c8c15f6d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b91ef2f1d8ee6026c2a977b5696d8bbc3385098924527b9d9300423d4018074c
d56343b79893b1bf2adb6b90f159b8bb06b982cf461403a4c04f97608bc3aeb7
d5bd47efbf5b0cf47fec9e7400993f8f97362000b13f6be453ce8efc4e1ef0d7
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02