robertoi.com Open in urlscan Pro
94.156.253.199 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php
Submission: On August 22 via manual (August 22nd 2023, 7:51:55 am UTC) from JP — Scanned from JP

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 94.156.253.199, located in Bulgaria and belongs to WINTERSTORM, US. The main domain is robertoi.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 18th 2023. Valid for: 3 months.

This is the only time robertoi.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BIGLOBE (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
4	94.156.253.199 94.156.253.199	7411 (WINTERSTORM) (WINTERSTORM)
3	52.69.208.245 52.69.208.245	16509 (AMAZON-02) (AMAZON-02)
1	13.113.169.163 13.113.169.163	16509 (AMAZON-02) (AMAZON-02)
9	4

4 94.156.253.199 (Bulgaria)

ASN7411 (WINTERSTORM, US)

robertoi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.69.208.245 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-69-208-245.ap-northeast-1.compute.amazonaws.com

webmail.biglobe.ne.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.113.169.163 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-113-169-163.ap-northeast-1.compute.amazonaws.com

member4.sso.biglobe.ne.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	biglobe.ne.jp webmail.biglobe.ne.jp member4.sso.biglobe.ne.jp	7 KB
4	robertoi.com robertoi.com	49 KB
0	Failed function sub() { [native code] }. Failed
9	3

	Domain	Requested by
4	robertoi.com	robertoi.com
3	webmail.biglobe.ne.jp	robertoi.com
1	member4.sso.biglobe.ne.jp	robertoi.com
0	ckejmhbmlajgoklhgbapkiccekfoccmk Failed	robertoi.com
9	4

This site contains no links.

Subject Issuer	Validity	Valid
robertoi.com cPanel, Inc. Certification Authority	`2023-08-18` - `2023-11-16`	3 months	crt.sh
webmail.biglobe.ne.jp Amazon RSA 2048 M01	`2023-02-10` - `2023-12-21`	10 months	crt.sh
member4.sso.biglobe.ne.jp GlobalSign Extended Validation CA - SHA256 - G3	`2022-08-29` - `2023-09-30`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php
Frame ID: 3EBB7E546B87CD2A3D30B296D84DE585
Requests: 8 HTTP requests in this frame

Frame: https://member4.sso.biglobe.ne.jp/heute
Frame ID: 686C6540997367E4D01897A358238798
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

56 kB
Transfer

54 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request auth.php Show response robertoi.com/l/webmails/index-rui.jsp/source/mobile/	15 KB 15 KB	2374ms 1534ms	Document text/html	94.156.253.199 WINTERSTORM
General Check archive.org Show headers Download Go to Full URL https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 94.156.253.199 , Bulgaria, ASN7411 (WINTERSTORM, US), Reverse DNS Software Apache / Resource Hash `d0832f903f3204f95c4ef3ee1a3ff901e2ab847c8be5626b4a65c46b29c4ec7e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 accept-language jp-jp,jp;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Tue, 22 Aug 2023 07:51:49 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	base02_and.css robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/	15 KB 15 KB	282ms 281ms	Stylesheet text/css	94.156.253.199 WINTERSTORM
General Check archive.org Show headers Download Go to Full URL https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/base02_and.css Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 94.156.253.199 , Bulgaria, ASN7411 (WINTERSTORM, US), Reverse DNS Software Apache / Resource Hash `e1838e972a0860eeabe922ad57f89189df0ecc21e8def514bdad616e7daa9e26` Request headers accept-language jp-jp,jp;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Tue, 22 Aug 2023 07:51:50 GMT Last-Modified Thu, 15 Jun 2023 10:23:34 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 15026
GET H/1.1	200 OK	global_and.css robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/	18 KB 18 KB	517ms 276ms	Stylesheet text/css	94.156.253.199 WINTERSTORM
General Check archive.org Show headers Download Go to Full URL https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/global_and.css Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 94.156.253.199 , Bulgaria, ASN7411 (WINTERSTORM, US), Reverse DNS Software Apache / Resource Hash `a66313d478d9a89bae72f3b66740bb5cc54716dd56ffce4d0fed631f60461394` Request headers accept-language jp-jp,jp;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Tue, 22 Aug 2023 07:51:51 GMT Last-Modified Thu, 15 Jun 2023 10:23:34 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 18551
GET H/1.1	200 OK	info.css robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/	102 B 342 B	784ms 266ms	Stylesheet text/css	94.156.253.199 WINTERSTORM
General Check archive.org Show headers Download Go to Full URL https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/resource/style/info.css Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 94.156.253.199 , Bulgaria, ASN7411 (WINTERSTORM, US), Reverse DNS Software Apache / Resource Hash `1be62ee1373b2feb21b1459288cd92754d29d7c3ccb008134b8538890bb98285` Request headers accept-language jp-jp,jp;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers Date Tue, 22 Aug 2023 07:51:51 GMT Last-Modified Thu, 15 Jun 2023 10:23:34 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 102
GET H2	200	logo_email_mb.gif webmail.biglobe.ne.jp/images2/common/	2 KB 2 KB	412ms 42ms	Image image/gif	52.69.208.245 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://webmail.biglobe.ne.jp/images2/common/logo_email_mb.gif Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.69.208.245 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-69-208-245.ap-northeast-1.compute.amazonaws.com Software Apache / Resource Hash `a4529c44c823be47ebb2d35dc9d12f227c966a1401b7351379382e8a2262a026` Request headers accept-language jp-jp,jp;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 07:51:51 GMT cache-control no-store last-modified Thu, 21 Sep 2017 07:47:30 GMT server Apache accept-ranges bytes content-length 2223 content-type image/gif
GET H2	200	button_03.gif webmail.biglobe.ne.jp/mobile/images/	4 KB 4 KB	169ms 39ms	Image image/gif	52.69.208.245 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://webmail.biglobe.ne.jp/mobile/images/button_03.gif Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.69.208.245 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-69-208-245.ap-northeast-1.compute.amazonaws.com Software Apache / Resource Hash `6f47d8cbeebfb58186a00fad67c829cb96e9b5a389850e08ef6a472ae3822521` Request headers accept-language jp-jp,jp;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 07:51:51 GMT cache-control no-store last-modified Fri, 11 Nov 2011 08:41:44 GMT server Apache accept-ranges bytes content-length 4059 content-type image/gif
GET H2	200	c31a2fc863.js Show response webmail.biglobe.ne.jp/blog/	342 B 498 B	169ms 41ms	Script application/javascript	52.69.208.245 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://webmail.biglobe.ne.jp/blog/c31a2fc863.js Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.69.208.245 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-69-208-245.ap-northeast-1.compute.amazonaws.com Software Apache / Resource Hash `759b1b9e6dc66f114fe61e0a384327b6dfc7ccaa40dad73a474168ca644e1f61` Request headers accept-language jp-jp,jp;q=0.9 Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 Response headers date Tue, 22 Aug 2023 07:51:51 GMT cache-control no-store last-modified Mon, 21 May 2018 00:20:27 GMT server Apache accept-ranges bytes content-length 342 content-type application/javascript
GET H2	200	heute Show response member4.sso.biglobe.ne.jp/ Frame 686C	121 B 217 B	699ms 189ms	Document text/html	13.113.169.163 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://member4.sso.biglobe.ne.jp/heute Requested by Host: robertoi.com URL: https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.113.169.163 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-113-169-163.ap-northeast-1.compute.amazonaws.com Software Apache / Resource Hash `bda03c913a1f09b16593f0567316ada97278e4f57c073234329c5cc30c19f498` Request headers Referer https://robertoi.com/l/webmails/index-rui.jsp/source/mobile/auth.php Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36 accept-language jp-jp,jp;q=0.9 Response headers conetnt-type text/html; charset=utf-8 date Tue, 22 Aug 2023 07:51:52 GMT server Apache
GET		cursor.png ckejmhbmlajgoklhgbapkiccekfoccmk/assets/pictos/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ckejmhbmlajgoklhgbapkiccekfoccmk
URL: chrome-extension://ckejmhbmlajgoklhgbapkiccekfoccmk/assets/pictos/cursor.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BIGLOBE (Telecommunication)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			robertoi.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 13df8b7d3c4f6742b8b8af40a52d7b93

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: chrome-extension://ckejmhbmlajgoklhgbapkiccekfoccmk/assets/pictos/cursor.png Message: Failed to load resource: net::ERR_UNKNOWN_URL_SCHEME

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ckejmhbmlajgoklhgbapkiccekfoccmk
member4.sso.biglobe.ne.jp
robertoi.com
webmail.biglobe.ne.jp
ckejmhbmlajgoklhgbapkiccekfoccmk
13.113.169.163
52.69.208.245
94.156.253.199
1be62ee1373b2feb21b1459288cd92754d29d7c3ccb008134b8538890bb98285
6f47d8cbeebfb58186a00fad67c829cb96e9b5a389850e08ef6a472ae3822521
759b1b9e6dc66f114fe61e0a384327b6dfc7ccaa40dad73a474168ca644e1f61
a4529c44c823be47ebb2d35dc9d12f227c966a1401b7351379382e8a2262a026
a66313d478d9a89bae72f3b66740bb5cc54716dd56ffce4d0fed631f60461394
bda03c913a1f09b16593f0567316ada97278e4f57c073234329c5cc30c19f498
d0832f903f3204f95c4ef3ee1a3ff901e2ab847c8be5626b4a65c46b29c4ec7e
e1838e972a0860eeabe922ad57f89189df0ecc21e8def514bdad616e7daa9e26

robertoi.com Open in urlscan Pro 94.156.253.199 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

9 Requests

89 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

4 IPs

2 Countries

56 kBTransfer

54 kBSize

1 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

robertoi.com Open in urlscan Pro
94.156.253.199 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

2
Countries

56 kB
Transfer

54 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!