my.rakuteu.jp.singin1.fbeewts.cn Open in urlscan Pro
204.44.95.91 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.rakuten-welcome-singin6.workers.dev/
Effective URL:
https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd
Submission: On March 01 via automatic, source phishtank (March 1st 2022, 11:07:14 am UTC) — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 204.44.95.91, located in Los Angeles, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is my.rakuteu.jp.singin1.fbeewts.cn.
TLS certificate: Issued by R3 on February 28th 2022. Valid for: 3 months.

This is the only time my.rakuteu.jp.singin1.fbeewts.cn was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.21.42.245 104.21.42.245	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 8	204.44.95.91 204.44.95.91	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
8	2

1 104.21.42.245 (None, )

ASN13335 (CLOUDFLARENET, US)

www.rakuten-welcome-singin6.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 204.44.95.91 (Los Angeles, United States) 1 redirects

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: 204.44.95.91.static.quadranet.com

my.rakuteu.jp.singin1.fbeewts.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	fbeewts.cn 1 redirects my.rakuteu.jp.singin1.fbeewts.cn	405 KB
1	workers.dev www.rakuten-welcome-singin6.workers.dev	610 B
8	2

	Domain	Requested by
8	my.rakuteu.jp.singin1.fbeewts.cn	1 redirects www.rakuten-welcome-singin6.workers.dev my.rakuteu.jp.singin1.fbeewts.cn
1	www.rakuten-welcome-singin6.workers.dev
8	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-02-23` - `2023-02-22`	a year	crt.sh
my.rakuteu.jp.singin1.fbeewts.cn R3	`2022-02-28` - `2022-05-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd
Frame ID: 12CAE059FFFED1351FAC34BD81367058
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

error

Page URL History Show full URLs

https://www.rakuten-welcome-singin6.workers.dev/ Page URL
https://my.rakuteu.jp.singin1.fbeewts.cn/ HTTP 302
https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd Page URL

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

405 kB
Transfer

1127 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.rakuten-welcome-singin6.workers.dev/ Page URL
https://my.rakuteu.jp.singin1.fbeewts.cn/ HTTP 302
https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response www.rakuten-welcome-singin6.workers.dev/	80 B 610 B	1786ms 1421ms	Document text/html	104.21.42.245 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.rakuten-welcome-singin6.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.42.245 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6507d3e823050fa968f7ec1474d7c801c6187a494025443854d4b028bbfadb9c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Tue, 01 Mar 2022 11:07:05 GMT content-type text/html;charset=UTF-8 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8UHy52CQoBjXL3HJFAr5GgLDNRrBxjB4Pa9uriuMk6HbCqZ%2BGEKXTDVYMt31YNY2KsnRm%2Fgo0P5Pw2o%2Fc6RIz%2FXldxK9OyD3mRBFohwiGLzmjm6uFMBtoPsiZ5ZTj4RPjhx002Sq2BqwIrZIATpOnBZ2w8UEhvZclY0%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} vary Accept-Encoding server cloudflare cf-ray 6e516d487e03914d-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	Primary Request tkletd Show response my.rakuteu.jp.singin1.fbeewts.cn/ Redirect Chain https://my.rakuteu.jp.singin1.fbeewts.cn/ https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd	465 B 404 B	145ms 144ms	Document text/html	204.44.95.91 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd Requested by Host: www.rakuten-welcome-singin6.workers.dev URL: https://www.rakuten-welcome-singin6.workers.dev/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.95.91 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS 204.44.95.91.static.quadranet.com Software Apache / Resource Hash `9ae829f2c9d124b2877bb31d7f63df469ffdb0528bbda0182f3331065007e0ed` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.rakuten-welcome-singin6.workers.dev/ Response headers date Tue, 01 Mar 2022 11:07:20 GMT server Apache last-modified Tue, 04 Jan 2022 20:52:29 GMT etag "1d1-5d4c7d0ba3d40-gzip" accept-ranges bytes vary Accept-Encoding content-encoding gzip content-length 275 content-type text/html Redirect headers date Tue, 01 Mar 2022 11:07:19 GMT server Apache expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache location /tkletd content-length 0 content-type text/html; charset=UTF-8
GET H2	200	app.0.475949025756437161641329533511.css my.rakuteu.jp.singin1.fbeewts.cn/static/css/	888 KB 320 KB	157ms 156ms	Stylesheet text/css	204.44.95.91 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://my.rakuteu.jp.singin1.fbeewts.cn/static/css/app.0.475949025756437161641329533511.css Requested by Host: my.rakuteu.jp.singin1.fbeewts.cn URL: https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.95.91 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS 204.44.95.91.static.quadranet.com Software Apache / Resource Hash `50e07faf560988234e5df80673e0a999e59185f0368e7147698f9a740a9ec41b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 11:07:20 GMT content-encoding gzip last-modified Tue, 04 Jan 2022 20:52:29 GMT server Apache etag "ddeb9-5d4c7d0ba3d40-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes
GET H2	200	1641329533511.0.48641303117262181641329533511.js Show response my.rakuteu.jp.singin1.fbeewts.cn/static/js/	235 KB 83 KB	444ms 443ms	Script application/javascript	204.44.95.91 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://my.rakuteu.jp.singin1.fbeewts.cn/static/js/1641329533511.0.48641303117262181641329533511.js Requested by Host: my.rakuteu.jp.singin1.fbeewts.cn URL: https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.95.91 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS 204.44.95.91.static.quadranet.com Software Apache / Resource Hash `a53d91879923830d440079b863c417955fbb12a445b37efd7276816a4855c20f` Request headers Accept-Language de-DE,de;q=0.9 Referer https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 11:07:20 GMT content-encoding gzip last-modified Tue, 04 Jan 2022 20:52:29 GMT server Apache etag "3aa93-5d4c7d0ba3d40-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes
GET H2	200	app.0.48641303117262181641329533511.js Show response my.rakuteu.jp.singin1.fbeewts.cn/static/js/	3 KB 1 KB	152ms 152ms	Script application/javascript	204.44.95.91 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://my.rakuteu.jp.singin1.fbeewts.cn/static/js/app.0.48641303117262181641329533511.js Requested by Host: my.rakuteu.jp.singin1.fbeewts.cn URL: https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.95.91 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS 204.44.95.91.static.quadranet.com Software Apache / Resource Hash `e7e71b989f1a93a94fa36af4a903e402ebaa4cc045f2285466f9a7edfd2fa7e7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 11:07:20 GMT content-encoding gzip last-modified Tue, 04 Jan 2022 20:52:29 GMT server Apache etag "d7d-5d4c7d0ba3d40-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 1258
GET H2	200	6.0.794035821237571641329533511.js Show response my.rakuteu.jp.singin1.fbeewts.cn/static/js/	540 B 435 B	145ms 144ms	Script application/javascript	204.44.95.91 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://my.rakuteu.jp.singin1.fbeewts.cn/static/js/6.0.794035821237571641329533511.js Requested by Host: my.rakuteu.jp.singin1.fbeewts.cn URL: https://my.rakuteu.jp.singin1.fbeewts.cn/static/js/1641329533511.0.48641303117262181641329533511.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.95.91 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS 204.44.95.91.static.quadranet.com Software Apache / Resource Hash `40a84841504590398c48bb729b687e65278fbe7e499bb4d522d4005a30164cdb` Request headers Accept-Language de-DE,de;q=0.9 Referer https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 11:07:21 GMT content-encoding gzip last-modified Tue, 04 Jan 2022 20:52:29 GMT server Apache etag "21c-5d4c7d0ba3d40-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 358
GET H2	403	jump.php Show response my.rakuteu.jp.singin1.fbeewts.cn/api/	0 106 B	329ms 329ms	XHR text/html	204.44.95.91 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://my.rakuteu.jp.singin1.fbeewts.cn/api/jump.php Requested by Host: my.rakuteu.jp.singin1.fbeewts.cn URL: https://my.rakuteu.jp.singin1.fbeewts.cn/static/js/1641329533511.0.48641303117262181641329533511.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.95.91 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS 204.44.95.91.static.quadranet.com Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept application/json, text/plain, / Referer https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers pragma no-cache date Tue, 01 Mar 2022 11:07:21 GMT server Apache access-control-allow-methods * content-type text/html;charset=utf-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true content-length 0 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	7.0.794035821237571641329533511.js Show response my.rakuteu.jp.singin1.fbeewts.cn/static/js/	481 B 381 B	144ms 144ms	Script application/javascript	204.44.95.91 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://my.rakuteu.jp.singin1.fbeewts.cn/static/js/7.0.794035821237571641329533511.js Requested by Host: my.rakuteu.jp.singin1.fbeewts.cn URL: https://my.rakuteu.jp.singin1.fbeewts.cn/static/js/1641329533511.0.48641303117262181641329533511.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 204.44.95.91 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS 204.44.95.91.static.quadranet.com Software Apache / Resource Hash `6c42febe6cf671cab2fb091e85d43d87fbab0c24c3306143f74da33904a7e5e2` Request headers Accept-Language de-DE,de;q=0.9 Referer https://my.rakuteu.jp.singin1.fbeewts.cn/tkletd User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36 Response headers date Tue, 01 Mar 2022 11:07:21 GMT content-encoding gzip last-modified Tue, 04 Jan 2022 20:52:29 GMT server Apache etag "1e1-5d4c7d0ba3d40-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 327

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			my.rakuteu.jp.singin1.fbeewts.cn/	1969-12-31 23:59:59	Name: PHPSESSID Value: apor3ue4muik6hj9m4l2heut52

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://my.rakuteu.jp.singin1.fbeewts.cn/api/jump.php Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

my.rakuteu.jp.singin1.fbeewts.cn
www.rakuten-welcome-singin6.workers.dev
104.21.42.245
204.44.95.91
40a84841504590398c48bb729b687e65278fbe7e499bb4d522d4005a30164cdb
50e07faf560988234e5df80673e0a999e59185f0368e7147698f9a740a9ec41b
6507d3e823050fa968f7ec1474d7c801c6187a494025443854d4b028bbfadb9c
6c42febe6cf671cab2fb091e85d43d87fbab0c24c3306143f74da33904a7e5e2
9ae829f2c9d124b2877bb31d7f63df469ffdb0528bbda0182f3331065007e0ed
a53d91879923830d440079b863c417955fbb12a445b37efd7276816a4855c20f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7e71b989f1a93a94fa36af4a903e402ebaa4cc045f2285466f9a7edfd2fa7e7

my.rakuteu.jp.singin1.fbeewts.cn Open in urlscan Pro 204.44.95.91 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

405 kBTransfer

1127 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

12 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

my.rakuteu.jp.singin1.fbeewts.cn Open in urlscan Pro
204.44.95.91 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

405 kB
Transfer

1127 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions