nttdocomo-co-jp.fnsxrn.shop

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3035::6815:47f2, located in United States and belongs to CLOUDFLARENET, US. The main domain is nttdocomo-co-jp.fnsxrn.shop.
TLS certificate: Issued by R3 on July 9th 2021. Valid for: 3 months.

This is the only time nttdocomo-co-jp.fnsxrn.shop was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NTT Docomo (Telecommunication)

Domain & IP information

	IP Address		AS Autonomous System
7	2606:4700:303... 2606:4700:3035::6815:47f2		13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	1

7 2606:4700:3035::6815:47f2 (United States)

ASN13335 (CLOUDFLARENET, US)

nttdocomo-co-jp.fnsxrn.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	fnsxrn.shop nttdocomo-co-jp.fnsxrn.shop	20 KB
7	1

	Domain	Requested by
7	nttdocomo-co-jp.fnsxrn.shop	nttdocomo-co-jp.fnsxrn.shop
7	1

This site contains links to these domains. Also see Links.

Domain
id.smt.docomo.ne.jp
dpoint.onelink.me
www.nttdocomo.co.jp

Subject Issuer	Validity	Valid
*.fnsxrn.shop R3	`2021-07-09` - `2021-10-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE
Frame ID: 1823ED55F75032AC582C1806A851F36D
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

20 kB
Transfer

46 kB
Size

1
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://id.smt.docomo.ne.jp/

Search URL Search Domain Scan URL

URL: https://id.smt.docomo.ne.jp/src/utility/idpw_forget.html
Title: IDをお忘れの方

Search URL Search Domain Scan URL

URL: https://id.smt.docomo.ne.jp/src/utility/index.html
Title: dアカウントとは？

Search URL Search Domain Scan URL

URL: https://id.smt.docomo.ne.jp/src/utility/notice.html
Title: ご利用上の注意

Search URL Search Domain Scan URL

URL: https://dpoint.onelink.me/roGT?pid=dpc_login&af_dp=dpoint%3A%2F%2Ftop&af_web_dp=https%3A%2F%2Fdpoint.jp%2Fguide%2Fhowto_dpoint%2Fapp%2Findex.html

Search URL Search Domain Scan URL

URL: https://id.smt.docomo.ne.jp/src/utility/notice.html#p08
Title: 共用のパソコンやタブレットでの利用について

Search URL Search Domain Scan URL

URL: https://www.nttdocomo.co.jp/utility/privacy/
Title: プライバシーポリシー

Search URL Search Domain Scan URL

URL: https://id.smt.docomo.ne.jp/src/dlogin/rules.html
Title: ご利用規約/ご注意事項

Search URL Search Domain Scan URL

URL: https://id.smt.docomo.ne.jp/src/utility/terms.html
Title: ご利用にあたって

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request anidlogin_mltdom.php Show response nttdocomo-co-jp.fnsxrn.shop/	9 KB 3 KB	388ms 323ms	Document text/html	2606:4700:3035::6815:47f2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:47f2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `db2a7b63e6439e204669f867c949fdadb51778059f0352d7e63cf01a32054e13` Request headers :method GET :authority nttdocomo-co-jp.fnsxrn.shop :scheme https :path /anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 09 Jul 2021 12:42:12 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding set-cookie PHPSESSID=a8lpl17d30rcshfiojf75a5aeu; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZCgmErfAZpiOmvVk9TRcjMnupSmrg5BGUO7msCE6CuuiFSnFm%2FIWmz7JbuvyEqCs0zND9aZqQwsgfRHM%2FAkNHmTxthXbX%2FlvVm7efmKDCU5s8BUu2FvOHvq%2BAwvs5CHTv5wAWxkJm%2BbK0HCW2U%2BvlqFtMdVI"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 66c1a1802cb64a55-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H3-29	200	auth_layout_v5_style.css nttdocomo-co-jp.fnsxrn.shop/static/	22 KB 6 KB	48ms 26ms	Stylesheet text/css	2606:4700:3035::6815:47f2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nttdocomo-co-jp.fnsxrn.shop/static/auth_layout_v5_style.css Requested by Host: nttdocomo-co-jp.fnsxrn.shop URL: https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:47f2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9605073b0212a97d985cae452dc3d78813f2cc3240ba3f32d2047282c1f47761` Request headers :path /static/auth_layout_v5_style.css pragma no-cache cookie PHPSESSID=a8lpl17d30rcshfiojf75a5aeu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority nttdocomo-co-jp.fnsxrn.shop referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE :scheme https sec-fetch-site same-origin :method GET Referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 09 Jul 2021 12:42:12 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 18786 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 last-modified Wed, 07 Jul 2021 05:39:24 GMT server cloudflare etag W/"60e53e0c-58bc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SkDKRNjhGq32OOMPsxdQrxk2wqpXtwIO8hVIwrOygZm7S9QkK%2F7QODTkEKuxU3S5d8TEdwAaTfB9z978CdvqlFUsMAFJO3ScHp1ssAPC06k%2FEug%2BWTa6Cd09%2BunRInU17HGHE3hylvmU5MCt4%2Fi1Y0L9KzzY"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=43200 cf-ray 66c1a18258c41f39-FRA expires Fri, 09 Jul 2021 19:29:06 GMT
GET H3-29	200	auth_layout_v5_pc.css nttdocomo-co-jp.fnsxrn.shop/static/	8 KB 3 KB	46ms 24ms	Stylesheet text/css	2606:4700:3035::6815:47f2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://nttdocomo-co-jp.fnsxrn.shop/static/auth_layout_v5_pc.css Requested by Host: nttdocomo-co-jp.fnsxrn.shop URL: https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:47f2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `cf02b95fe0f3352f78ef1b8f6dae22cc2359dedab54354d022da738d2c8fdc69` Request headers :path /static/auth_layout_v5_pc.css pragma no-cache cookie PHPSESSID=a8lpl17d30rcshfiojf75a5aeu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority nttdocomo-co-jp.fnsxrn.shop referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE :scheme https sec-fetch-site same-origin :method GET Referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 09 Jul 2021 12:42:12 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 18786 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 last-modified Wed, 07 Jul 2021 05:39:24 GMT server cloudflare etag W/"60e53e0c-20a6" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=K12ZFGz%2BWW7RFKWMOGxbHoYds3XXy54sgkSDtrw7YeiRI5EUmLttv2bztBZpM4uiIngONDu3Vp6pemRrR441OchLg2r58jbYVQSc%2BsacVTC839xNnosZHwPA1S7BIMCoxPQzR%2F%2FyhMoRfI9P1%2FjHrPmgVPLF"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=43200 cf-ray 66c1a18258c91f39-FRA expires Fri, 09 Jul 2021 19:29:06 GMT
GET H3-29	200	logo_header.png nttdocomo-co-jp.fnsxrn.shop/static/	2 KB 3 KB	40ms 19ms	Image image/png	2606:4700:3035::6815:47f2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://nttdocomo-co-jp.fnsxrn.shop/static/logo_header.png Requested by Host: nttdocomo-co-jp.fnsxrn.shop URL: https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:47f2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `350f4d5bef39bf376d051c55cde14d8def0435a34f1cf5f3a5355fe0bc2cb356` Request headers :path /static/logo_header.png pragma no-cache cookie PHPSESSID=a8lpl17d30rcshfiojf75a5aeu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority nttdocomo-co-jp.fnsxrn.shop referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE :scheme https sec-fetch-site same-origin :method GET Referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 09 Jul 2021 12:42:12 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 22028 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 2120 last-modified Wed, 07 Jul 2021 05:39:24 GMT server cloudflare etag "60e53e0c-848" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=iOMDYeLGsUwXPZXIS6qpe2cJ%2B79Zv5gRWSrAp1Jw8qbOwGH%2FJnL2lb7YezaUboPF1Q0S4CjZCXuLm9I19747bldNic%2FSyGLNJdzwcZ0IZLfrWH7aR2UzeQYnwApKaCOw5%2Fs40yUqFshjEe2ZxbFDBC3ecZ0F"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 66c1a18258c71f39-FRA expires Sun, 08 Aug 2021 06:35:04 GMT
GET H3-29	404	banner06.jpg nttdocomo-co-jp.fnsxrn.shop/	548 B 548 B	337ms 317ms	Image text/html	2606:4700:3035::6815:47f2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://nttdocomo-co-jp.fnsxrn.shop/banner06.jpg Requested by Host: nttdocomo-co-jp.fnsxrn.shop URL: https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:47f2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090` Request headers :path /banner06.jpg pragma no-cache cookie PHPSESSID=a8lpl17d30rcshfiojf75a5aeu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority nttdocomo-co-jp.fnsxrn.shop referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE :scheme https sec-fetch-site same-origin :method GET Referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 09 Jul 2021 12:42:12 GMT content-encoding br cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=IyelFGLLvPhGWnecPV6t4cPksbDjteDFh101JQ896p7T67xX7ccVQaQYtwqg3l9%2BXIlC%2FcO3mv9FXNv1kMiC4f2i0upQVt4Yfpijt6jUOa5LuiXmnbI%2BS009%2FAdaRV%2Fzyk90CT13mcAIjGomXglEoDtUN0sl"}],"group":"cf-nel","max_age":604800} content-type text/html cache-control max-age=14400 cf-ray 66c1a18258c51f39-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H3-29	200	footer_copyright.png nttdocomo-co-jp.fnsxrn.shop/static/	4 KB 5 KB	38ms 18ms	Image image/png	2606:4700:3035::6815:47f2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://nttdocomo-co-jp.fnsxrn.shop/static/footer_copyright.png Requested by Host: nttdocomo-co-jp.fnsxrn.shop URL: https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:47f2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d27fb126f122a2a567a0eb0a6b9d32edc61ff441a3d99522f8bc989b297ecce3` Request headers :path /static/footer_copyright.png pragma no-cache cookie PHPSESSID=a8lpl17d30rcshfiojf75a5aeu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority nttdocomo-co-jp.fnsxrn.shop referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE :scheme https sec-fetch-site same-origin :method GET Referer https://nttdocomo-co-jp.fnsxrn.shop/anidlogin_mltdom.php?arcv=eAGNi0sKwjAURfeSsSQvn5dPR03yGhegO6gDEWoKBoKIe7fVDXhH58I50WYgEwx5SNnFgBAmRGchEYG3sShMSYNJ5Khkj0Wbom32zqkEytCoQEmw0sN3LwZsYKfjdGYHJne8trY-BiF67_ze2qXOdal8rvy2iuX5u2KTld5tuRHa_7v3BzWBNaE User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 09 Jul 2021 12:42:12 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 22028 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 4006 last-modified Wed, 07 Jul 2021 05:39:24 GMT server cloudflare etag "60e53e0c-fa6" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=iRZw%2F2XKfIEgQuKfbBW4tdfGWSN9OSVASKOpt6oMwsQCiUTOgrRXFoi9gnwLSJOKZwggZ0MNCRLpoYCUwjILrkcWk%2FYenqxxX0JpX7YUS1rjZeD%2F%2FtIbB929xvP7padT5fQHkDngwDIGfzdvzpeUdD%2Fveq3h"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 66c1a18258be1f39-FRA expires Sun, 08 Aug 2021 06:35:04 GMT
GET H3-29	200	bg_spring.png nttdocomo-co-jp.fnsxrn.shop/static/	102 B 698 B	17ms 17ms	Image image/png	2606:4700:3035::6815:47f2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://nttdocomo-co-jp.fnsxrn.shop/static/bg_spring.png Requested by Host: nttdocomo-co-jp.fnsxrn.shop URL: https://nttdocomo-co-jp.fnsxrn.shop/static/auth_layout_v5_pc.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:47f2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `293b57cc384290eab34796b4a5be203a7de0bbd6c6bcfb9bc41596fe622b5ee9` Request headers :path /static/bg_spring.png pragma no-cache cookie PHPSESSID=a8lpl17d30rcshfiojf75a5aeu accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority nttdocomo-co-jp.fnsxrn.shop referer https://nttdocomo-co-jp.fnsxrn.shop/static/auth_layout_v5_pc.css :scheme https sec-fetch-site same-origin :method GET Referer https://nttdocomo-co-jp.fnsxrn.shop/static/auth_layout_v5_pc.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 09 Jul 2021 12:42:12 GMT cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 18785 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 102 last-modified Wed, 07 Jul 2021 05:39:24 GMT server cloudflare etag "60e53e0c-66" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lG55hORUhHoj4H5NTS7QBqIBqkYXzfEhAXgGeqXaqlhhujnzvWXPVxZyfoJ0kaU8pcUw8GdaUtEkfEWYcEQ7y32HRJfbpqu9LsRR7mlxGU0%2FCYWpfdXlEl%2F2xJPd%2F7irQW%2BnmZOynU4LSciAnejdBLgICObR"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 66c1a18289071f39-FRA expires Sun, 08 Aug 2021 07:29:07 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NTT Docomo (Telecommunication)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			nttdocomo-co-jp.fnsxrn.shop/	1969-12-31 23:59:59	Name: PHPSESSID Value: a8lpl17d30rcshfiojf75a5aeu

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nttdocomo-co-jp.fnsxrn.shop
2606:4700:3035::6815:47f2
293b57cc384290eab34796b4a5be203a7de0bbd6c6bcfb9bc41596fe622b5ee9
350f4d5bef39bf376d051c55cde14d8def0435a34f1cf5f3a5355fe0bc2cb356
9605073b0212a97d985cae452dc3d78813f2cc3240ba3f32d2047282c1f47761
cf02b95fe0f3352f78ef1b8f6dae22cc2359dedab54354d022da738d2c8fdc69
d27fb126f122a2a567a0eb0a6b9d32edc61ff441a3d99522f8bc989b297ecce3
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
db2a7b63e6439e204669f867c949fdadb51778059f0352d7e63cf01a32054e13

nttdocomo-co-jp.fnsxrn.shop Open in urlscan Pro 2606:4700:3035::6815:47f2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

20 kBTransfer

46 kBSize

1 Cookies

9 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

nttdocomo-co-jp.fnsxrn.shop Open in urlscan Pro
2606:4700:3035::6815:47f2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

20 kB
Transfer

46 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!