![](/screenshots/ea2d9dd0-5ac0-4257-acf1-ae5e72e4937c.png)
rakunten-jp-cid.net
Open in
urlscan Pro
2606:4700:3031::ac43:8ca7
Malicious Activity!
Public Scan
Effective URL: https://rakunten-jp-cid.net/rms/nid/login?xbp=1&service_id=s266&return_url=?scid=wi_jp_internal_ichiba_unpaid_top_head&token...
Submission: On January 04 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1P5 on December 17th 2022. Valid for: 3 months.
This is the only time rakunten-jp-cid.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rakuten (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:10:... 2606:4700:10::6816:e8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 2606:4700:10:... 2606:4700:10::6816:1e8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 160.16.52.76 160.16.52.76 | 9370 (SAKURA-B ...) (SAKURA-B SAKURA Internet Inc.) | |
1 1 | 67.199.248.11 67.199.248.11 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 2606:4700:303... 2606:4700:3037::ac43:b70a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 2606:4700:303... 2606:4700:3034::6815:4151 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 9 | 2606:4700:303... 2606:4700:3031::ac43:8ca7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:303... 2606:4700:3035::ac43:a40e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 23.2.142.142 23.2.142.142 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 23.39.217.163 23.39.217.163 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
17 | 7 |
ASN9370 (SAKURA-B SAKURA Internet Inc., JP)
PTR: tk2-202-10572.vs.sakura.ne.jp
penpen-penpen.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-2-142-142.deploy.static.akamaitechnologies.com
static.id.rakuten.co.jp |
ASN16625 (AKAMAI-AS, US)
PTR: a23-39-217-163.deploy.static.akamaitechnologies.com
jp.rakuten-static.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
rakunten-jp-cid.net
1 redirects
rakunten-jp-cid.net |
39 KB |
2 |
rakuten-static.com
jp.rakuten-static.com — Cisco Umbrella Rank: 99403 |
668 B |
2 |
rakuten.co.jp
static.id.rakuten.co.jp |
7 KB |
2 |
server-kensho.jp
server-kensho.jp |
36 KB |
2 |
cutt.ly
2 redirects
cutt.ly — Cisco Umbrella Rank: 62473 |
797 B |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 356 |
65 KB |
1 |
jp-safelink-srv.net
1 redirects
jp-safelink-srv.net |
652 B |
1 |
awmci.us
awmci.us |
3 KB |
1 |
bit.ly
1 redirects
bit.ly — Cisco Umbrella Rank: 4707 |
233 B |
1 |
penpen-penpen.com
penpen-penpen.com |
1 KB |
17 | 10 |
Domain | Requested by | |
---|---|---|
9 | rakunten-jp-cid.net |
1 redirects
awmci.us
rakunten-jp-cid.net |
2 | jp.rakuten-static.com |
rakunten-jp-cid.net
|
2 | static.id.rakuten.co.jp |
rakunten-jp-cid.net
|
2 | server-kensho.jp |
rakunten-jp-cid.net
|
2 | cutt.ly | 2 redirects |
1 | cdnjs.cloudflare.com |
rakunten-jp-cid.net
|
1 | jp-safelink-srv.net | 1 redirects |
1 | awmci.us |
penpen-penpen.com
|
1 | bit.ly | 1 redirects |
1 | penpen-penpen.com | |
17 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
static.id.rakuten.co.jp |
privacy.rakuten.co.jp |
member.id.rakuten.co.jp |
ichiba.faq.rakuten.net |
grp02.id.rakuten.co.jp |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.penpen-penpen.com JPRS Domain Validation Authority - G4 |
2022-01-12 - 2023-01-31 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-07-02 - 2023-07-02 |
a year | crt.sh |
*.rakunten-jp-cid.net GTS CA 1P5 |
2022-12-17 - 2023-03-17 |
3 months | crt.sh |
*.server-kensho.jp GTS CA 1P5 |
2022-12-17 - 2023-03-17 |
3 months | crt.sh |
*.id.rakuten.co.jp DigiCert TLS RSA SHA256 2020 CA1 |
2022-05-29 - 2023-05-31 |
a year | crt.sh |
intl.rakuten-static.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-06-04 - 2023-06-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://rakunten-jp-cid.net/rms/nid/login?xbp=1&service_id=s266&return_url=?scid=wi_jp_internal_ichiba_unpaid_top_head&token=5FJGOL23CS
Frame ID: 5DE96E2B610FA190C27533A181339AB8
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/ea2d9dd0-5ac0-4257-acf1-ae5e72e4937c.png)
Page Title
RakutenPage not found – 直接アクセスは許可されていません!Page URL History Show full URLs
-
http://cutt.ly/M0JIAWN?SSL=9vurqenq
HTTP 301
https://cutt.ly/M0JIAWN?SSL=9vurqenq HTTP 301
https://penpen-penpen.com/ssl.html?443 Page URL
-
https://bit.ly/kensho-ssls
HTTP 301
https://awmci.us/_.html?kensho Page URL
-
https://jp-safelink-srv.net/kensho-akaunto/?secure
HTTP 301
https://rakunten-jp-cid.net/ HTTP 301
https://rakunten-jp-cid.net/rms/nid/login?xbp=1&service_id=s266&return_url=?scid=wi_jp_internal_ichiba_u... Page URL
Detected technologies
Detected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- /wp-(?:content|includes)/
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: こちら
Search URL Search Domain Scan URL
Title: 個人情報保護方針
Search URL Search Domain Scan URL
Title: ユーザID・パスワードを忘れた場合
Search URL Search Domain Scan URL
Title: ヘルプ
Search URL Search Domain Scan URL
Title: 楽天会員登録
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://cutt.ly/M0JIAWN?SSL=9vurqenq
HTTP 301
https://cutt.ly/M0JIAWN?SSL=9vurqenq HTTP 301
https://penpen-penpen.com/ssl.html?443 Page URL
-
https://bit.ly/kensho-ssls
HTTP 301
https://awmci.us/_.html?kensho Page URL
-
https://jp-safelink-srv.net/kensho-akaunto/?secure
HTTP 301
https://rakunten-jp-cid.net/ HTTP 301
https://rakunten-jp-cid.net/rms/nid/login?xbp=1&service_id=s266&return_url=?scid=wi_jp_internal_ichiba_unpaid_top_head&token=5FJGOL23CS Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://cutt.ly/M0JIAWN?SSL=9vurqenq HTTP 301
- https://cutt.ly/M0JIAWN?SSL=9vurqenq HTTP 301
- https://penpen-penpen.com/ssl.html?443
- https://bit.ly/kensho-ssls HTTP 301
- https://awmci.us/_.html?kensho
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
ssl.html
penpen-penpen.com/ Redirect Chain
|
1 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_.html
awmci.us/ Redirect Chain
|
15 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login
rakunten-jp-cid.net/rms/nid/ Redirect Chain
|
15 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.css
rakunten-jp-cid.net/wp-content/plugins/wsc/resources/assets/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
server-kensho.jp/wp-includes/js/jquery/ |
88 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-migrate.min.js
server-kensho.jp/wp-includes/js/jquery/ |
11 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ |
262 KB 65 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
common_login.css
rakunten-jp-cid.net/wp-content/plugins/wsc/resources/assets/rkt/com/css/id/ |
16 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
loginstyle.css
rakunten-jp-cid.net/wp-content/plugins/wsc/resources/assets/rkt/com/css/id/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.validate1.9.0.min.js
rakunten-jp-cid.net/wp-content/plugins/wsc/resources/assets/rkt/js/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rakuten_pc_32px@2x_wm.png
static.id.rakuten.co.jp/static/com/img/id/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t.gif
jp.rakuten-static.com/1/im/ci/header/ |
43 B 318 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rakuten_pc_20px@2x.png
static.id.rakuten.co.jp/static/com/img/id/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pop.gif
jp.rakuten-static.com/1/im/ic/ui/ |
75 B 350 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
valapp.js
rakunten-jp-cid.net/wp-content/plugins/wsc/resources/assets/rkt/js/ |
42 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.js
rakunten-jp-cid.net/wp-content/plugins/wsc/resources/assets/js/ |
16 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
wp-emoji-release.min.js
rakunten-jp-cid.net/wp-includes/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rakuten (E-commerce)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange object| _wpemojiSettings object| byte_core object| wp_scam function| $ function| jQuery function| resize function| go_to_url function| buildTable function| syntaxHighlight object| WSC object| twemoji object| wp object| $this4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cutt.ly/ | Name: PHPSESSID Value: kah8pr7gjffna1j2fc04jaorl1 |
|
.bit.ly/ | Name: _bit Value: n043zR-2761bb65a27876263b-00w |
|
jp-safelink-srv.net/ | Name: PHPSESSID Value: 6cih9kkeee4o88q9pm3dn38jef |
|
rakunten-jp-cid.net/ | Name: PHPSESSID Value: 5fjgol23csnfn5l5grmrqch9t8 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
awmci.us
bit.ly
cdnjs.cloudflare.com
cutt.ly
jp-safelink-srv.net
jp.rakuten-static.com
penpen-penpen.com
rakunten-jp-cid.net
server-kensho.jp
static.id.rakuten.co.jp
160.16.52.76
23.2.142.142
23.39.217.163
2606:4700:10::6816:1e8
2606:4700:10::6816:e8
2606:4700:3031::ac43:8ca7
2606:4700:3034::6815:4151
2606:4700:3035::ac43:a40e
2606:4700:3037::ac43:b70a
2606:4700::6811:190e
67.199.248.11
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0d9027289ffa5d9f6c8b4e0782bb31bbff2cef5ee3708ccbcb7a22df9128bb21
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
62775ef2856f63d6399abc1d54077916df8d62b16414816012b9ff0fad4efada
6da28d7a134d543417892f859bad07f0ac729296d84618a57d30b31810cea58a
79c7c6cbe35f47ac159651f311ce2aa5f999d979290ae55460ec10abdeef5c53
7ab9a4d7f597471f82e8ebc6019525cd45f81decff7853062056a3c3417eba59
9da445dd701a7720d0eb4adac99eca74f439e08e524c8a44d8d7f874e8f74df6
9f1c295cba6a0947f5fe0bb69fb4726f1176fd37f9b547c0844222fa5dc25942
a931d758e10b5f646f42e4b1100ee31b7ce4cdf5a86d59133424b65c8802788b
aa1aef5e994d96b79b8dd31b851a5bc3050c9c8e26fb783389e9dad98431ac75
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1e7b1800b49923b7427132e7ed5e599f4da7f2d9463fe2e585982daf5a10db5
bd2796c924d3d6f829b71e3de0bfd219f63309101f04b89ef5de46bf8b184d4a
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
d344637c437a46793abc3177ae34800b6975e1094a3690c1815957de68da9ea4
ebacb659cd25254a02b0a6f88c824f3c0aa79ab70889e7942edd837f71dc5a28