www.rkat2.2r-p.xyz
103.41.65.144  Malicious Activity!

Submitted URL: https://href.li/?https://www.rkat2.2r-p.xyz
Effective URL: https://www.rkat2.2r-p.xyz/
Submission: On November 22 via manual from NP — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 103.41.65.144, located in Hong Kong and belongs to SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK. The main domain is www.rkat2.2r-p.xyz.
TLS certificate: Issued by R3 on November 15th 2021. Valid for: 3 months.
This is the only time www.rkat2.2r-p.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rakuten (E-commerce)

Domain & IP information

IP Address AS Autonomous System
1 192.0.78.27 2635 (AUTOMATTIC)
8 103.41.65.144 38197 (SUNHK-DAT...)
9 2
Domain
Subdomains
Transfer
8 2r-p.xyz
www.rkat2.2r-p.xyz
406 KB
1 href.li
.href.li
302 B
9 2
Domain Requested by
8 www.rkat2.2r-p.xyz href.li
www.rkat2.2r-p.xyz
1 href.li
9 2

This site contains no links.

Subject Issuer Validity Valid
tls.automattic.com
R3
2021-10-19 -
2022-01-17
3 months crt.sh
www.rkat2.2r-p.xyz
R3
2021-11-15 -
2022-02-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.rkat2.2r-p.xyz/
Frame ID: 5368AC58E6A5E7148823C9908081CFB9
Requests: 9 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://href.li/?https://www.rkat2.2r-p.xyz Page URL
  2. https://www.rkat2.2r-p.xyz/ Page URL

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

406 kB
Transfer

1131 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://href.li/?https://www.rkat2.2r-p.xyz Page URL
  2. https://www.rkat2.2r-p.xyz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
www.rkat2.2r-p.xyz
href.li/?https://
444 B
302 B
Document
General
Full URL
https://href.li/?https://www.rkat2.2r-p.xyz
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.27 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
nginx
date
Mon, 22 Nov 2021 01:32:48 GMT
content-type
text/html; charset=utf-8
strict-transport-security
max-age=31536000
vary
Accept-Encoding
content-encoding
br
x-ac
2.hhn _dfw
Primary Request /
www.rkat2.2r-p.xyz/
522 B
453 B
Document
General
Full URL
https://www.rkat2.2r-p.xyz/
Requested by
Host: href.li
URL: https://href.li/?https://www.rkat2.2r-p.xyz
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
c5d878954ea2ebc94a0addc971c3bd26962aead2b8469183686cf49678d48bf9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

last-modified
Mon, 15 Nov 2021 12:41:28 GMT
etag
"20a-5d0d320b15250-gzip"
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-length
316
content-type
text/html
date
Mon, 22 Nov 2021 01:32:49 GMT
server
Apache
app.ccc92c8665f5b7dee2c3ed6923f75d3c.css
www.rkat2.2r-p.xyz/static/css/
888 KB
320 KB
Stylesheet
General
Full URL
https://www.rkat2.2r-p.xyz/static/css/app.ccc92c8665f5b7dee2c3ed6923f75d3c.css
Requested by
Host: www.rkat2.2r-p.xyz
URL: https://www.rkat2.2r-p.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
a64fd829017c72736d9efff2e336d3a604828e2750eba42179981630790b8dfd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rkat2.2r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 01:32:49 GMT
content-encoding
gzip
last-modified
Wed, 26 May 2021 19:54:46 GMT
server
Apache
etag
"ddeb9-5c34103b46d80-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
manifest.5badeff0107497297dfb.js
www.rkat2.2r-p.xyz/static/js/
2 KB
1023 B
Script
General
Full URL
https://www.rkat2.2r-p.xyz/static/js/manifest.5badeff0107497297dfb.js
Requested by
Host: www.rkat2.2r-p.xyz
URL: https://www.rkat2.2r-p.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
b1a49000867ba4db6ecf9fe45613575e2ace08816ea55c184786271597434ebe

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rkat2.2r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 01:32:49 GMT
content-encoding
gzip
last-modified
Wed, 26 May 2021 19:54:46 GMT
server
Apache
etag
"643-5c34103b46d80-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
929
vendor.3082b0961e0e767dbf3c.js
www.rkat2.2r-p.xyz/static/js/
233 KB
82 KB
Script
General
Full URL
https://www.rkat2.2r-p.xyz/static/js/vendor.3082b0961e0e767dbf3c.js
Requested by
Host: www.rkat2.2r-p.xyz
URL: https://www.rkat2.2r-p.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
fd727120c735d6a17851cde1b809eeee873f36b9a7800e3d3dd1693914df7b84

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rkat2.2r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 01:32:49 GMT
content-encoding
gzip
last-modified
Wed, 26 May 2021 19:54:46 GMT
server
Apache
etag
"3a532-5c34103b46d80-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
app.28b38f23395a7e636a70.js
www.rkat2.2r-p.xyz/static/js/
5 KB
1 KB
Script
General
Full URL
https://www.rkat2.2r-p.xyz/static/js/app.28b38f23395a7e636a70.js
Requested by
Host: www.rkat2.2r-p.xyz
URL: https://www.rkat2.2r-p.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
437fd83e1fc1b6f1eab8cf207242e37cf82fc3c6e75f1f7d0d58a848ee33baeb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rkat2.2r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 01:32:49 GMT
content-encoding
gzip
last-modified
Mon, 01 Nov 2021 13:31:54 GMT
server
Apache
etag
"1551-5cfba333c2680-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
1422
7.65204e31b093899cc548.js
www.rkat2.2r-p.xyz/static/js/
834 B
514 B
Script
General
Full URL
https://www.rkat2.2r-p.xyz/static/js/7.65204e31b093899cc548.js
Requested by
Host: www.rkat2.2r-p.xyz
URL: https://www.rkat2.2r-p.xyz/static/js/manifest.5badeff0107497297dfb.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
fc9596390f2a7eb2e7ef37f9190c0a648e7ee84127cb845e4ee5616838b0c303

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rkat2.2r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 01:32:50 GMT
content-encoding
gzip
last-modified
Mon, 01 Nov 2021 13:31:04 GMT
server
Apache
etag
"342-5cfba30413600-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
414
jump.php
www.rkat2.2r-p.xyz/
194 B
279 B
XHR
General
Full URL
https://www.rkat2.2r-p.xyz/jump.php
Requested by
Host: www.rkat2.2r-p.xyz
URL: https://www.rkat2.2r-p.xyz/static/js/vendor.3082b0961e0e767dbf3c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
afca372f9959cb6c46bde573d25172c1b223dac52cba20ffad3c8fc2ea09cc8e

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.rkat2.2r-p.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 01:32:50 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
access-control-allow-methods
POST
content-type
text/html;charset=utf-8
access-control-allow-origin
*
access-control-allow-credentials
true
content-length
170
8.02bae15d0924cc345fff.js
www.rkat2.2r-p.xyz/static/js/
777 B
477 B
Script
General
Full URL
https://www.rkat2.2r-p.xyz/static/js/8.02bae15d0924cc345fff.js
Requested by
Host: www.rkat2.2r-p.xyz
URL: https://www.rkat2.2r-p.xyz/static/js/manifest.5badeff0107497297dfb.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
80e2593c47131caa9197b5ed4fe5986d8db144e3414dc3b11cbffe444729afcb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.rkat2.2r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 01:32:51 GMT
content-encoding
gzip
last-modified
Wed, 03 Nov 2021 10:08:14 GMT
server
Apache
etag
"309-5cfdf968c7f80-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
377

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rakuten (E-commerce)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| webpackJsonp object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://www.rkat2.2r-p.xyz/jump.php
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000