paypay-cards.jp - urlscan.io

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 204.44.83.157, located in Los Angeles, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is paypay-cards.jp.
TLS certificate: Issued by R3 on March 12th 2022. Valid for: 3 months.

This is the only time paypay-cards.jp was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Line (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	204.44.83.157 204.44.83.157	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
1	147.92.144.180 147.92.144.180	38631 (LINE LINE...) (LINE LINE Corporation)
2	2600:9000:204... 2600:9000:2047:9000:4:e131:5cc0:93a1	16509 (AMAZON-02) (AMAZON-02)
4	4

1 204.44.83.157 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 204.44.83.157.static.quadranet.com

paypay-cards.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.92.144.180 (Japan)

ASN38631 (LINE LINE Corporation, JP)

access.line.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2047:9000:4:e131:5cc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.line-scdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	line-scdn.net static.line-scdn.net — Cisco Umbrella Rank: 41330	20 KB
1	line.me access.line.me — Cisco Umbrella Rank: 131738	79 KB
1	paypay-cards.jp paypay-cards.jp	2 KB
4	3

	Domain	Requested by
2	static.line-scdn.net	paypay-cards.jp
1	access.line.me	paypay-cards.jp
1	paypay-cards.jp
4	3

This site contains links to these domains. Also see Links.

Domain
terms.line.me

Subject Issuer	Validity	Valid
line-me.jp R3	`2022-03-12` - `2022-06-10`	3 months	crt.sh
*.line.me GlobalSign RSA OV SSL CA 2018	`2020-06-17` - `2022-09-05`	2 years	crt.sh
*.line-scdn.net GlobalSign RSA OV SSL CA 2018	`2020-06-19` - `2022-08-17`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://paypay-cards.jp/
Frame ID: B829E9F23099D2F8DA06D3BE60939F28
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

LINE Login

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

4
Requests

75 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

101 kB
Transfer

140 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://terms.line.me/line_rules/?lang=ja
Title: プライバシーポリシー

Search URL Search Domain Scan URL

URL: https://terms.line.me/line_terms/?lang=ja
Title: 利用規約

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
paypay-cards.jp/ 8 KB
2 KB 1129ms
660ms Document
text/html 204.44.83.157
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://paypay-cards.jp/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 204.44.83.157 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: 204.44.83.157.static.quadranet.com
Software: Apache /
Resource Hash: 789edec951617705050ff7fce8ca5d7b6cfd46f49609155b9c8a541777feb9a3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9

Response headers

access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-credentials: true
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-encoding: gzip
content-length: 1863
content-type: text/html;charset=utf-8
date: Sun, 13 Mar 2022 12:05:11 GMT
server: Apache

GET
H2 200 messages Show response
access.line.me/oauth2/v2.1/ 79 KB
79 KB 499ms
32ms Script
application/javascript 147.92.144.180
LINE LINE Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://access.line.me/oauth2/v2.1/messages

Requested by

Host: paypay-cards.jp
URL: https://paypay-cards.jp/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

147.92.144.180 , Japan, ASN38631 (LINE LINE Corporation, JP),

Reverse DNS

Software

Armeria/1.14.0 /

Resource Hash

683ad32b2c1f88da4f36f1664f608767ba6b4c0ce00271f4243836a7197374d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://paypay-cards.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Mar 2022 12:04:58 GMT
referrer-policy: strict-origin-when-cross-origin
server: Armeria/1.14.0
x-frame-options: DENY
content-type: application/javascript;charset=UTF-8
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-length: 80526
x-content-type-options: nosniff
expires: 0

GET
H2 200 chunk-common.css
static.line-scdn.net/line_web_login/17f43bae638/dist/css/ 50 KB
19 KB 119ms
11ms Stylesheet
text/css 2600:9000:2047:9000:4:e131:5cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.line-scdn.net/line_web_login/17f43bae638/dist/css/chunk-common.css

Requested by

Host: paypay-cards.jp
URL: https://paypay-cards.jp/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2047:9000:4:e131:5cc0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

VOS /

Resource Hash

2be31bee37debc654f3f4a153ddf67e0bf469d921ce9814f6b2e58125074846b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://paypay-cards.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 02 Mar 2022 02:51:59 GMT
content-encoding: br
vary: Accept-Encoding,Origin
age: 983578
x-cache: Hit from cloudfront
last-modified: Tue, 01 Mar 2022 04:26:37 GMT
server: VOS
cache-control: max-age=2592000
etag: W/"4eb84242e1d34af5e62573bf972313bf"
strict-transport-security: max-age=15768000
x-amz-version-id: eWu2PWpeCnV-qd8xnLKEgS0kd7q8rGt
via: 1.1 22dd0cfa5d39643df60dc4671a3173a4.cloudfront.net (CloudFront)
x-rgw-object-type: Normal
x-amz-cf-pop: KIX56-C1
content-type: text/css
x-amz-cf-id: K_85OrWW2Ho8fpTim5XKd00BIxEzf_Mm5GPUKpm75tpxBuRFs0HHLw==

GET
H2 200 index.css
static.line-scdn.net/line_web_login/17f43bae638/dist/css/ 1 KB
756 B 122ms
13ms Stylesheet
text/css 2600:9000:2047:9000:4:e131:5cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.line-scdn.net/line_web_login/17f43bae638/dist/css/index.css

Requested by

Host: paypay-cards.jp
URL: https://paypay-cards.jp/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2047:9000:4:e131:5cc0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

VOS /

Resource Hash

65bd5b068341284d2924ffd3dc7e148854d363c10fe2965cef6fdecacf245202

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://paypay-cards.jp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 02 Mar 2022 02:51:59 GMT
content-encoding: br
vary: Accept-Encoding,Origin
age: 983578
x-cache: Hit from cloudfront
last-modified: Tue, 01 Mar 2022 04:26:37 GMT
server: VOS
cache-control: max-age=2592000
etag: W/"93714b9e12d579c1ca773e30a8a862c9"
strict-transport-security: max-age=15768000
x-amz-version-id: pq1uucDLAcXwVsPIBGO4ug8BzVBYY.n
via: 1.1 22dd0cfa5d39643df60dc4671a3173a4.cloudfront.net (CloudFront)
x-rgw-object-type: Normal
x-amz-cf-pop: KIX56-C1
content-type: text/css
x-amz-cf-id: KfFnHeqlm5iNlD4GfODzi8gFPM9ZDI6kALs2Taw8CfA9r2r0Cjw5Hg==

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 847d75b96b7fbb7a0495dcd04d2b1185bf598f5bcbeb37b130c114845b467d69

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Line (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			paypay-cards.jp/	1969-12-31 23:59:59	Name: PHPSESSID Value: vdq1225f32nifc1sni9b08h377

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

access.line.me
paypay-cards.jp
static.line-scdn.net
147.92.144.180
204.44.83.157
2600:9000:2047:9000:4:e131:5cc0:93a1
2be31bee37debc654f3f4a153ddf67e0bf469d921ce9814f6b2e58125074846b
65bd5b068341284d2924ffd3dc7e148854d363c10fe2965cef6fdecacf245202
683ad32b2c1f88da4f36f1664f608767ba6b4c0ce00271f4243836a7197374d8
789edec951617705050ff7fce8ca5d7b6cfd46f49609155b9c8a541777feb9a3
847d75b96b7fbb7a0495dcd04d2b1185bf598f5bcbeb37b130c114845b467d69

paypay-cards.jp Open in urlscan Pro 204.44.83.157 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

4 Requests

75 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

101 kBTransfer

140 kBSize

1 Cookies

2 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

paypay-cards.jp Open in urlscan Pro
204.44.83.157 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

101 kB
Transfer

140 kB
Size

1
Cookies

4 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!