![](/screenshots/fa0264c4-6404-45dc-9cef-b7d0dce12864.png)
raketun.qs5990.net
Open in
urlscan Pro
165.154.19.161
Malicious Activity!
Public Scan
Effective URL: https://raketun.qs5990.net/login
Submission Tags: gc
Submission: On March 21 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on March 20th 2024. Valid for: 3 months.
This is the only time raketun.qs5990.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rakuten (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 12 | 165.154.19.161 165.154.19.161 | 135377 (UCLOUD-HK...) (UCLOUD-HK-AS-AP UCLOUD INFORMATION TECHNOLOGY HK LIMITED) | |
4 | 23.39.217.163 23.39.217.163 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
15 | 2 |
ASN135377 (UCLOUD-HK-AS-AP UCLOUD INFORMATION TECHNOLOGY HK LIMITED, HK)
raketun.qs5990.net |
ASN16625 (AKAMAI-AS, US)
PTR: a23-39-217-163.deploy.static.akamaitechnologies.com
image.card.jp.rakuten-static.com | |
jp.rakuten-static.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
qs5990.net
1 redirects
raketun.qs5990.net |
237 KB |
4 |
rakuten-static.com
image.card.jp.rakuten-static.com jp.rakuten-static.com — Cisco Umbrella Rank: 337015 |
5 KB |
15 | 2 |
Domain | Requested by | |
---|---|---|
12 | raketun.qs5990.net |
1 redirects
raketun.qs5990.net
|
3 | jp.rakuten-static.com |
raketun.qs5990.net
|
1 | image.card.jp.rakuten-static.com |
raketun.qs5990.net
|
15 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.rakuten-card.co.jp |
www.rakuten.co.jp |
static.id.rakuten.co.jp |
www.jpcert.or.jp |
member.id.rakuten.co.jp |
privacy.rakuten.co.jp |
ichiba.faq.rakuten.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
raketun.qs5990.net R3 |
2024-03-20 - 2024-06-18 |
3 months | crt.sh |
intl.rakuten-static.com DigiCert TLS RSA SHA256 2020 CA1 |
2024-01-16 - 2024-04-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://raketun.qs5990.net/login
Frame ID: 9D9378DEA9FB086104536F4ECE58F923
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/fa0264c4-6404-45dc-9cef-b7d0dce12864.png)
Page Title
【楽天】ログインPage URL History Show full URLs
-
https://raketun.qs5990.net/
HTTP 302
https://raketun.qs5990.net/login Page URL
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: 楽天市場へ
Search URL Search Domain Scan URL
Title: 楽天カードトップへ
Search URL Search Domain Scan URL
Title: よくあるご質問
Search URL Search Domain Scan URL
Title: こちら
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: 個人情報保護方針
Search URL Search Domain Scan URL
Title: ユーザID・パスワードを忘れた場合
Search URL Search Domain Scan URL
Title: ヘルプ
Search URL Search Domain Scan URL
Title: 楽天会員とは?
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://raketun.qs5990.net/
HTTP 302
https://raketun.qs5990.net/login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
raketun.qs5990.net/ Redirect Chain
|
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common_login.css
raketun.qs5990.net/com/css/id/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginstyle.css
raketun.qs5990.net/com/css/id/ |
1000 B 568 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
raketun.qs5990.net/com/img/ |
158 KB 159 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rc-logo_CardEnavi_1.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/common/logo/ |
9 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t.gif
jp.rakuten-static.com/1/im/ci/header/ |
43 B 318 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stop_540x249.png
raketun.qs5990.net/com/img/id/ |
57 KB 57 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Rakuten_pc_20px@2x.png
raketun.qs5990.net/com/my/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pc_login_warning.png
raketun.qs5990.net/com/img/icon/ |
670 B 749 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
challenger.css
raketun.qs5990.net/com/my/ |
2 KB 707 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pop.gif
jp.rakuten-static.com/1/im/ic/ui/ |
75 B 350 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_btn_red_btm.gif
raketun.qs5990.net/com/img/login/ |
442 B 513 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg_btn_red_top.gif
raketun.qs5990.net/com/img/login/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon_btn_arrow.gif
raketun.qs5990.net/com/img/id// |
7 KB 7 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info.gif
jp.rakuten-static.com/1/im/ic/ui/ |
360 B 636 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rakuten (E-commerce)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| ip object| it undefined| lis function| save function| listen function| setOperateCode function| setisonlie1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
raketun.qs5990.net/ | Name: PHPSESSID Value: d39282534f8905fea07cafdeff85bae4 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
image.card.jp.rakuten-static.com
jp.rakuten-static.com
raketun.qs5990.net
165.154.19.161
23.39.217.163
175cf3a6b7549f715fffaddc3ec5c9f92717e7c5f63b7e36ea9592e091a80a67
1a1b2f850593ebc2625940e92286dd3a884a5f706b834951645673d665638055
243741d0fd578219a8a40b166481845038610031528c5ae851783e228de53867
33be38e33c8eb9aa13a4ed44c2e2813207bef13a5ba265818e485f0ebbc83f3b
62775ef2856f63d6399abc1d54077916df8d62b16414816012b9ff0fad4efada
71f56625e8403042548151b1694675c56b6a650508ab1cc7cb8034e5b2497ce8
7ab9a4d7f597471f82e8ebc6019525cd45f81decff7853062056a3c3417eba59
849cd9d1c481a1b45559f5e833f40e13ee666842e6f8ba72c8e1cad9c8c15f6d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b91ef2f1d8ee6026c2a977b5696d8bbc3385098924527b9d9300423d4018074c
bd7ea74d660a644bc3cd578b52e0e1efc9bd9750674b69d0e72fa1644a265bdc
d56343b79893b1bf2adb6b90f159b8bb06b982cf461403a4c04f97608bc3aeb7
d5bd47efbf5b0cf47fec9e7400993f8f97362000b13f6be453ce8efc4e1ef0d7
e0be92988014b2f77dcedfaf4dde0f0db63427e8e98a345472b0ad6d62436155
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02