paypay-cards.jp
Open in
urlscan Pro
204.44.83.157
Malicious Activity!
Public Scan
Submission: On March 14 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on March 12th 2022. Valid for: 3 months.
This is the only time paypay-cards.jp was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Line (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 204.44.83.157 204.44.83.157 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL) | |
1 | 147.92.144.180 147.92.144.180 | 38631 (LINE LINE...) (LINE LINE Corporation) | |
2 | 2600:9000:221... 2600:9000:221b:f800:4:e131:5cc0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 4 |
ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 204.44.83.157.static.quadranet.com
paypay-cards.jp |
ASN16509 (AMAZON-02, US)
static.line-scdn.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
line-scdn.net
static.line-scdn.net — Cisco Umbrella Rank: 41330 |
20 KB |
1 |
line.me
access.line.me — Cisco Umbrella Rank: 131738 |
79 KB |
1 |
paypay-cards.jp
paypay-cards.jp |
2 KB |
4 | 3 |
Domain | Requested by | |
---|---|---|
2 | static.line-scdn.net |
paypay-cards.jp
|
1 | access.line.me |
paypay-cards.jp
|
1 | paypay-cards.jp | |
4 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
terms.line.me |
Subject Issuer | Validity | Valid | |
---|---|---|---|
line-me.jp R3 |
2022-03-12 - 2022-06-10 |
3 months | crt.sh |
*.line.me GlobalSign RSA OV SSL CA 2018 |
2020-06-17 - 2022-09-05 |
2 years | crt.sh |
*.line-scdn.net GlobalSign RSA OV SSL CA 2018 |
2020-06-19 - 2022-08-17 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://paypay-cards.jp/
Frame ID: B5B789697FDE3179EC76083534A6C468
Requests: 5 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: プライバシーポリシー
Search URL Search Domain Scan URL
Title: 利用規約
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
paypay-cards.jp/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
messages
access.line.me/oauth2/v2.1/ |
79 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-common.css
static.line-scdn.net/line_web_login/17f43bae638/dist/css/ |
50 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
static.line-scdn.net/line_web_login/17f43bae638/dist/css/ |
1 KB 756 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Line (Online)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored string| currentLang object| lang1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
paypay-cards.jp/ | Name: PHPSESSID Value: ko6hu8dstai6o358o95dncs8om |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
access.line.me
paypay-cards.jp
static.line-scdn.net
147.92.144.180
204.44.83.157
2600:9000:221b:f800:4:e131:5cc0:93a1
2be31bee37debc654f3f4a153ddf67e0bf469d921ce9814f6b2e58125074846b
65bd5b068341284d2924ffd3dc7e148854d363c10fe2965cef6fdecacf245202
683ad32b2c1f88da4f36f1664f608767ba6b4c0ce00271f4243836a7197374d8
789edec951617705050ff7fce8ca5d7b6cfd46f49609155b9c8a541777feb9a3
847d75b96b7fbb7a0495dcd04d2b1185bf598f5bcbeb37b130c114845b467d69