www.my-docomo.konshinyai.com Open in urlscan Pro
141.11.93.180 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.my-docomo.konshinyai.com/
Submission: On September 26 via api (September 26th 2023, 11:34:38 pm UTC) from JP — Scanned from JP

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 16 HTTP transactions. The main IP is 141.11.93.180, located in United Kingdom and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is www.my-docomo.konshinyai.com.
TLS certificate: Issued by R3 on September 26th 2023. Valid for: 3 months.

This is the only time www.my-docomo.konshinyai.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NTT Docomo (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
3	141.11.93.180 141.11.93.180	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
3	99.84.54.30 99.84.54.30	16509 (AMAZON-02) (AMAZON-02)
3	2404:6800:400... 2404:6800:4004:823::2008	15169 (GOOGLE) (GOOGLE)
4	2404:6800:400... 2404:6800:4004:823::200e	15169 (GOOGLE) (GOOGLE)
3	49.102.154.13 49.102.154.13	9605 (DOCOMO NT...) (DOCOMO NTT DOCOMO)
16	5

3 141.11.93.180 (United Kingdom)

ASN8100 (ASN-QUADRANET-GLOBAL, US)

www.my-docomo.konshinyai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 99.84.54.30 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-54-30.nrt20.r.cloudfront.net

cache.aif.cilite.docomo.ne.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4004:823::2008 (Australia)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2404:6800:4004:823::200e (Australia)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 49.102.154.13 (Japan)

ASN9605 (DOCOMO NTT DOCOMO, INC., JP)

id.smt.docomo.ne.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	docomo.ne.jp cache.aif.cilite.docomo.ne.jp id.smt.docomo.ne.jp — Cisco Umbrella Rank: 849152	10 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 96	21 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 111	269 KB
3	konshinyai.com www.my-docomo.konshinyai.com	11 KB
16	4

	Domain	Requested by
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	id.smt.docomo.ne.jp	www.googletagmanager.com www.my-docomo.konshinyai.com
3	www.googletagmanager.com	www.my-docomo.konshinyai.com www.googletagmanager.com
3	cache.aif.cilite.docomo.ne.jp	www.my-docomo.konshinyai.com
3	www.my-docomo.konshinyai.com	www.my-docomo.konshinyai.com
16	5

This site contains no links.

Subject Issuer	Validity	Valid
my-docomo.konshinyai.com R3	`2023-09-26` - `2023-12-25`	3 months	crt.sh
cache.aif.cilite.docomo.ne.jp GlobalSign RSA OV SSL CA 2018	`2022-10-04` - `2023-09-30`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-04` - `2023-11-27`	3 months	crt.sh
id.smt.docomo.ne.jp DigiCert TLS RSA SHA256 2020 CA1	`2023-09-05` - `2024-09-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.my-docomo.konshinyai.com/
Frame ID: 0A6A1B3462E0E4A6023FE139C06468D2
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

dアカウント - ログイン

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

16
Requests

100 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

4
Countries

312 kB
Transfer

960 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.my-docomo.konshinyai.com/ 9 KB
3 KB 1222ms
106ms Document
text/html 141.11.93.180
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.my-docomo.konshinyai.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 141.11.93.180 , United Kingdom, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software: nginx / PHP/8.0.30 PleskLin
Resource Hash: 85e90c467678065a6157cece1888a5a69f1f41a98c75f6bd5de038eaaa6d688e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

content-encoding: gzip
content-length: 3126
content-type: text/html; charset=UTF-8
date: Tue, 26 Sep 2023 23:34:33 GMT
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/8.0.30 PleskLin

GET
H2 200 auth_layout_v5_style.css
www.my-docomo.konshinyai.com/css/ 23 KB
5 KB 108ms
108ms Stylesheet
text/css 141.11.93.180
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.my-docomo.konshinyai.com/css/auth_layout_v5_style.css
Requested by: Host: www.my-docomo.konshinyai.com
URL: https://www.my-docomo.konshinyai.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 141.11.93.180 , United Kingdom, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 7b1b6413c51c87d59b5e1c0b183a51b177f40bbeb46bf4dbc222919f8348786b

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 23:34:33 GMT
content-encoding: br
last-modified: Sun, 24 Sep 2023 11:50:40 GMT
server: nginx
etag: W/"65102290-5b1b"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 auth_layout_v5_pc.css
www.my-docomo.konshinyai.com/css/ 8 KB
2 KB 107ms
107ms Stylesheet
text/css 141.11.93.180
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.my-docomo.konshinyai.com/css/auth_layout_v5_pc.css
Requested by: Host: www.my-docomo.konshinyai.com
URL: https://www.my-docomo.konshinyai.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 141.11.93.180 , United Kingdom, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 1ad700349780fb8b0e7ba59a25e15ec0acee5961255453321f36b9dab71c7f19

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 23:34:33 GMT
content-encoding: br
last-modified: Sun, 24 Sep 2023 11:50:40 GMT
server: nginx
etag: W/"65102290-2105"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 logo_header.png
cache.aif.cilite.docomo.ne.jp/authsc/img/ 2 KB
2 KB 20ms
3ms Image
image/png 99.84.54.30
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.aif.cilite.docomo.ne.jp/authsc/img/logo_header.png
Requested by: Host: www.my-docomo.konshinyai.com
URL: https://www.my-docomo.konshinyai.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.54.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-54-30.nrt20.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 350f4d5bef39bf376d051c55cde14d8def0435a34f1cf5f3a5355fe0bc2cb356

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 23:38:43 GMT
via: 1.1 faff5936674857d8547ea36cef502088.cloudfront.net (CloudFront)
last-modified: Mon, 28 Nov 2022 09:09:58 GMT
server: AmazonS3
x-amz-cf-pop: NRT20-C3
age: 86151
etag: "15b668f14ee0f6e9d818c15a1796d5bf"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2120
x-amz-cf-id: Wh_LhEJW7ZMGFSNOaN6kL0uixMeQNDD2R_jBEd91UDGCPUzBWCWlyg==

GET
H2 200 footer_copyright.png
cache.aif.cilite.docomo.ne.jp/authsc/img/ 4 KB
4 KB 20ms
4ms Image
image/png 99.84.54.30
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.aif.cilite.docomo.ne.jp/authsc/img/footer_copyright.png
Requested by: Host: www.my-docomo.konshinyai.com
URL: https://www.my-docomo.konshinyai.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.54.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-54-30.nrt20.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2ab1bcc171226905497bcb68c1843ed401749ee5d935d33fb76d9bf1e382676c

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Mon, 25 Sep 2023 23:39:31 GMT
via: 1.1 faff5936674857d8547ea36cef502088.cloudfront.net (CloudFront)
last-modified: Mon, 28 Nov 2022 09:09:57 GMT
server: AmazonS3
x-amz-cf-pop: NRT20-C3
age: 86103
etag: "fb298c78cbfbdd5734434234e74fd08c"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 4084
x-amz-cf-id: 4Tt9QBYpvQD4OKjZDrIChY6s_O4tETc7O5f9k_q5I_eDIP4jc8ilbA==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 369 KB
101 KB 91ms
43ms Script
application/javascript 2404:6800:4004:823::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WZ9HH4

Requested by

Host: www.my-docomo.konshinyai.com
URL: https://www.my-docomo.konshinyai.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:823::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1a80ef7bc230ce9a06e5075ca6fad8055bd0d609f7edab2aa1b6d4aa1ab82736

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 23:34:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 102567
x-xss-protection: 0
last-modified: Tue, 26 Sep 2023 22:17:20 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 26 Sep 2023 23:34:33 GMT

GET
H2 200 bg_spring.png
cache.aif.cilite.docomo.ne.jp/authsc/img/ 102 B
419 B 4ms
3ms Image
image/png 99.84.54.30
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cache.aif.cilite.docomo.ne.jp/authsc/img/bg_spring.png
Requested by: Host: www.my-docomo.konshinyai.com
URL: https://www.my-docomo.konshinyai.com/css/auth_layout_v5_pc.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.54.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-54-30.nrt20.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 293b57cc384290eab34796b4a5be203a7de0bbd6c6bcfb9bc41596fe622b5ee9

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 14:25:37 GMT
via: 1.1 faff5936674857d8547ea36cef502088.cloudfront.net (CloudFront)
last-modified: Mon, 28 Nov 2022 09:09:59 GMT
server: AmazonS3
x-amz-cf-pop: NRT20-C3
age: 32937
etag: "7eb239a771c67d08c8a16b66ac0c1ced"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 102
x-amz-cf-id: Eh5cVc4vFfIC0YCrNoRM7VL8EuyXzTUEH6hGXReXe7oj1mERuDXb7Q==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 50ms
2ms Script
text/javascript 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ9HH4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 26 Sep 2023 23:30:38 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 235
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 27 Sep 2023 01:30:38 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 274 KB
91 KB 57ms
56ms Script
application/javascript 2404:6800:4004:823::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LN56SJ1ZSV&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ9HH4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:823::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

065106c613bb34bedaf4b18c1edb1dbdcd64c7d8e723263560827dce988abb99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 23:34:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93168
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 26 Sep 2023 23:34:33 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 216 KB
78 KB 94ms
93ms Script
application/javascript 2404:6800:4004:823::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FF11YZDLB7&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ9HH4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:823::2008 , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

49792c69f2ceb1f2cb71e66c7fe719766dccc31d0a57d64a042e07c51edd9121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 23:34:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79477
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 26 Sep 2023 23:34:33 GMT

GET
H/1.1 200
OK dac_authls.js Show response
id.smt.docomo.ne.jp/js/ 11 B
208 B 28ms
17ms Script
text/javascript 49.102.154.13
DOCOMO NTT DOCOMO

General

Check archive.org

Show headers Download Go to

Full URL

https://id.smt.docomo.ne.jp/js/dac_authls.js?1695771273631

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ9HH4

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

49.102.154.13 , Japan, ASN9605 (DOCOMO NTT DOCOMO, INC., JP),

Reverse DNS

Software

Resource Hash

a3c9fd0c973e9c8c2108768d614d2e9b12a691784ca3208801951773c95bdc8b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Tue, 26 Sep 2023 23:34:33 GMT
Last-Modified: Wed, 22 Dec 2021 06:15:29 GMT
Content-Length: 11
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=UTF-8

GET
H/1.1 200
OK empty.gif
id.smt.docomo.ne.jp/img/ 43 B
219 B 24ms
13ms Image
image/gif 49.102.154.13
DOCOMO NTT DOCOMO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id.smt.docomo.ne.jp/img/empty.gif?t=g&acs_url=https://www.my-docomo.konshinyai.com/

Requested by

Host: www.my-docomo.konshinyai.com
URL: https://www.my-docomo.konshinyai.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

49.102.154.13 , Japan, ASN9605 (DOCOMO NTT DOCOMO, INC., JP),

Reverse DNS

Software

Resource Hash

db5d64a9ea32ed3abb874f295003ef2465cecc2f669efe951930e182c34a5013

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Tue, 26 Sep 2023 23:34:33 GMT
Last-Modified: Fri, 21 Sep 2018 12:33:35 GMT
Content-Length: 43
X-Frame-Options: SAMEORIGIN
Content-Type: image/gif

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
218 B 39ms
38ms XHR
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=350835969&t=pageview&_s=1&dl=https%3A%2F%2Fwww.my-docomo.konshinyai.com%2F&dp=%2F&ul=en-us&de=UTF-8&dt=d%E3%82%A2%E3%82%AB%E3%82%A6%E3%83%B3%E3%83%88%20-%20%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABCAAAACAAM~&jid=890017987&gjid=252210014&cid=1586858926.1695771274&tid=UA-47453928-10&_gid=1254933287.1695771274&_r=1&_slc=1&gtm=45He39p0n71WZ9HH4&cd1=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.5938.92%20Safari%2F537.36&cd2=&cd3=SPSPW001&cd4=&z=700881458

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.my-docomo.konshinyai.com/
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 26 Sep 2023 23:34:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.my-docomo.konshinyai.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dac_auth_v3.js Show response
id.smt.docomo.ne.jp/js/ 3 KB
3 KB 13ms
12ms Script
text/javascript 49.102.154.13
DOCOMO NTT DOCOMO

General

Check archive.org

Show headers Download Go to

Full URL

https://id.smt.docomo.ne.jp/js/dac_auth_v3.js?1695771273631

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ9HH4

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

49.102.154.13 , Japan, ASN9605 (DOCOMO NTT DOCOMO, INC., JP),

Reverse DNS

Software

Resource Hash

2509dd3d94f53ba150ebd0d43bf71ff531c8fbef45b17279112111ce3b8482d9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

Date: Tue, 26 Sep 2023 23:34:33 GMT
Last-Modified: Wed, 15 Dec 2021 07:29:21 GMT
Content-Length: 2832
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=UTF-8

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 42ms
42ms Ping
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-LN56SJ1ZSV&gtm=45je39p0&_p=350835969&cid=1586858926.1695771274&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&dl=https%3A%2F%2Fwww.my-docomo.konshinyai.com%2F&sid=1695771273&sct=1&seg=0&dt=d%E3%82%A2%E3%82%AB%E3%82%A6%E3%83%B3%E3%83%88%20-%20%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3&en=page_view&_fv=1&_ss=1&ep.user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.5938.92%20Safari%2F537.36&ep.referrer=&ep.screen_id=SPSPW001&ep.msg_code=&ep.FGT003_ID=%E9%9D%9E%E3%83%A1%E3%83%BC%E3%83%AB%E3%82%A2%E3%83%89%E3%83%AC%E3%82%B9&ep.CJ_scr_id_%E5%86%8D%E8%AA%8D%E8%A8%BCAPI=
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LN56SJ1ZSV&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Sep 2023 23:34:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.my-docomo.konshinyai.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 39ms
39ms Ping
text/plain 2404:6800:4004:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-FF11YZDLB7&gtm=45je39p0&_p=350835969&cid=1586858926.1695771274&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1695771273&sct=1&seg=0&dl=https%3A%2F%2Fwww.my-docomo.konshinyai.com%2F&dt=d%E3%82%A2%E3%82%AB%E3%82%A6%E3%83%B3%E3%83%88%20-%20%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3&en=page_view&_fv=1&_ss=1&ep.user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F117.0.5938.92%20Safari%2F537.36&ep.referrer=&ep.screen_id=SPSPW001&ep.msg_code=
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-FF11YZDLB7&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2404:6800:4004:823::200e , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.my-docomo.konshinyai.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Sep 2023 23:34:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.my-docomo.konshinyai.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NTT Docomo (Telecommunication)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.konshinyai.com/	1970-01-21 00:38:51	Name: _auth_pv Value: GA1.2.1586858926.1695771274
.konshinyai.com/	1970-01-20 15:04:17	Name: _auth_pv_gid Value: GA1.2.1254933287.1695771274
.konshinyai.com/	1970-01-20 15:02:51	Name: _gat_UA-47453928-10 Value: 1
.www.my-docomo.konshinyai.com/	1970-01-21 00:38:51	Name: _auth_pv_ga Value: GA1.4.1586858926.1695771274
.www.my-docomo.konshinyai.com/	1970-01-21 00:38:51	Name: _auth_pv_ga_LN56SJ1ZSV Value: GS1.4.1695771273.1.0.1695771273.0.0.0
.www.my-docomo.konshinyai.com/	1970-01-21 00:38:51	Name: _auth_pv_ga_FF11YZDLB7 Value: GS1.4.1695771273.1.0.1695771273.0.0.0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cache.aif.cilite.docomo.ne.jp
id.smt.docomo.ne.jp
www.google-analytics.com
www.googletagmanager.com
www.my-docomo.konshinyai.com
141.11.93.180
2404:6800:4004:823::2008
2404:6800:4004:823::200e
49.102.154.13
99.84.54.30
065106c613bb34bedaf4b18c1edb1dbdcd64c7d8e723263560827dce988abb99
1a80ef7bc230ce9a06e5075ca6fad8055bd0d609f7edab2aa1b6d4aa1ab82736
1ad700349780fb8b0e7ba59a25e15ec0acee5961255453321f36b9dab71c7f19
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
2509dd3d94f53ba150ebd0d43bf71ff531c8fbef45b17279112111ce3b8482d9
293b57cc384290eab34796b4a5be203a7de0bbd6c6bcfb9bc41596fe622b5ee9
2ab1bcc171226905497bcb68c1843ed401749ee5d935d33fb76d9bf1e382676c
350f4d5bef39bf376d051c55cde14d8def0435a34f1cf5f3a5355fe0bc2cb356
49792c69f2ceb1f2cb71e66c7fe719766dccc31d0a57d64a042e07c51edd9121
7b1b6413c51c87d59b5e1c0b183a51b177f40bbeb46bf4dbc222919f8348786b
85e90c467678065a6157cece1888a5a69f1f41a98c75f6bd5de038eaaa6d688e
a3c9fd0c973e9c8c2108768d614d2e9b12a691784ca3208801951773c95bdc8b
db5d64a9ea32ed3abb874f295003ef2465cecc2f669efe951930e182c34a5013
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

www.my-docomo.konshinyai.com Open in urlscan Pro 141.11.93.180 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

40 %IPv6

4 Domains

5 Subdomains

5 IPs

4 Countries

312 kBTransfer

960 kBSize

6 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

6 Cookies

Indicators

www.my-docomo.konshinyai.com Open in urlscan Pro
141.11.93.180 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

4
Countries

312 kB
Transfer

960 kB
Size

6
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!