urlscan.io logo urlscan.io
SecurityTrails logo

rakuen.ml123.shop Open in urlscan Pro
194.38.22.186  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://rakuen.ml123.shop/?acc=FU87F65D
Effective URL: https://rakuen.ml123.shop/login
Submission Tags: gc
Submission: On April 26 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 19 HTTP transactions. The main IP is 194.38.22.186, located in Dnipro, Ukraine and belongs to NTSERVICE-AS, UA. The main domain is rakuen.ml123.shop.
TLS certificate: Issued by R3 on April 9th 2024. Valid for: 3 months.
This is the only time rakuen.ml123.shop was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rakuten (E-commerce)

Domain & IP information

IP Address AS Autonomous System
1 16 194.38.22.186 48693 (NTSERVICE-AS)
4 23.192.194.15 20940 (AKAMAI-ASN1)
19 2
Apex Domain
Subdomains		 Transfer
16 ml123.shop
rakuen.ml123.shop
221 KB
4 rakuten-static.com
image.card.jp.rakuten-static.com — Cisco Umbrella Rank: 533507
jp.rakuten-static.com — Cisco Umbrella Rank: 222795
5 KB
19 2
Domain Requested by
16 rakuen.ml123.shop 1 redirects rakuen.ml123.shop
3 jp.rakuten-static.com rakuen.ml123.shop
1 image.card.jp.rakuten-static.com rakuen.ml123.shop
19 3
Subject Issuer Validity Valid
rakuen.liees.shop
R3		 2024-04-09 -
2024-07-08		 3 months crt.sh
intl.rakuten-static.com
DigiCert TLS RSA SHA256 2020 CA1		 2024-02-18 -
2025-02-19		 a year crt.sh

This page contains 1 frames:

Primary Page: https://rakuen.ml123.shop/login
Frame ID: 3608793514BE69646361986233E46C39
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

【楽天】ログイン

Page URL History Show full URLs

  1. https://rakuen.ml123.shop/?acc=FU87F65D HTTP 302
    https://rakuen.ml123.shop/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

225 kB
Transfer

485 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://rakuen.ml123.shop/?acc=FU87F65D HTTP 302
    https://rakuen.ml123.shop/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
rakuen.ml123.shop/
Redirect Chain
  • https://rakuen.ml123.shop/?acc=FU87F65D
  • https://rakuen.ml123.shop/login
17 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
bc77ef547bd33e6ee1e6f7ef6a6984ffd8f5a59c31d1ba19b1cfe84e5bc1d75a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
ja-JP,ja;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 26 Apr 2024 05:04:27 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

cache-control
no-cache,must-revalidate no-cache
content-type
text/html; charset=utf-8
date
Fri, 26 Apr 2024 05:04:25 GMT
location
login
server
nginx
strict-transport-security
max-age=31536000
common_login.css
rakuen.ml123.shop/letian/css/id/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rakuen.ml123.shop/letian/css/id/common_login.css
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
e14f659c9f7ab5a05c4befc7144d5bfbceb9d34ca5a1fcb225318ad1b1b351ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:29 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Wed, 27 Mar 2024 17:56:40 GMT
server
nginx
etag
W/"66045dd8-2c5e"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=60
expires
Fri, 26 Apr 2024 05:05:29 GMT
loginstyle.css
rakuen.ml123.shop/letian/css/id/ 		1000 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rakuen.ml123.shop/letian/css/id/loginstyle.css
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
71f56625e8403042548151b1694675c56b6a650508ab1cc7cb8034e5b2497ce8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:29 GMT
strict-transport-security
max-age=31536000
last-modified
Sun, 24 Apr 2022 19:12:30 GMT
server
nginx
etag
"6265a11e-3e8"
x-cache
HIT
content-type
text/css
cache-control
max-age=60
accept-ranges
bytes
content-length
1000
expires
Fri, 26 Apr 2024 05:05:29 GMT
loading.css
rakuen.ml123.shop/letian/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rakuen.ml123.shop/letian/css/loading.css
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
5779854489c6d1cd097b534efd6ce86b9624569a098c8df39d1a06ea818404fa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:29 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Wed, 17 Jan 2024 01:09:38 GMT
server
nginx
etag
W/"65a728d2-1169"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=60
expires
Fri, 26 Apr 2024 05:05:29 GMT
rc-logo_CardEnavi_1.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/common/logo/ 		9 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/common/logo/rc-logo_CardEnavi_1.svg
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.192.194.15 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-192-194-15.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b91ef2f1d8ee6026c2a977b5696d8bbc3385098924527b9d9300423d4018074c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 18 Jun 2018 02:16:49 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=7776000
accept-ranges
bytes
content-length
3235
x-xss-protection
1; mode=block
expires
Fri, 08 Mar 2024 13:34:28 GMT
t.gif
jp.rakuten-static.com/1/im/ci/header/ 		43 B
318 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jp.rakuten-static.com/1/im/ci/header/t.gif
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.192.194.15 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-192-194-15.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 26 Apr 2024 05:04:28 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 03 Jul 2012 07:20:22 GMT
Server
Apache
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
43
X-XSS-Protection
1; mode=block
stop_540x249.png
rakuen.ml123.shop/letian/image/id/ 		57 KB
57 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rakuen.ml123.shop/letian/image/id/stop_540x249.png
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:29 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 26 Apr 2022 07:02:02 GMT
server
nginx
etag
"626798ea-e2e0"
x-cache
HIT
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
content-length
58080
expires
Fri, 26 Apr 2024 05:05:29 GMT
Rakuten_pc_20px@2x.png
rakuen.ml123.shop/letian/image/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rakuen.ml123.shop/letian/image/Rakuten_pc_20px@2x.png
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
62775ef2856f63d6399abc1d54077916df8d62b16414816012b9ff0fad4efada
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:29 GMT
strict-transport-security
max-age=31536000
last-modified
Fri, 21 Oct 2022 15:53:18 GMT
server
nginx
etag
"6352c06e-9b4"
x-cache
HIT
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
content-length
2484
expires
Fri, 26 Apr 2024 05:05:29 GMT
pc_login_warning.png
rakuen.ml123.shop/letian/image/icon/ 		670 B
893 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rakuen.ml123.shop/letian/image/icon/pc_login_warning.png
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
d56343b79893b1bf2adb6b90f159b8bb06b982cf461403a4c04f97608bc3aeb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:29 GMT
strict-transport-security
max-age=31536000
last-modified
Sun, 24 Apr 2022 19:13:00 GMT
server
nginx
etag
"6265a13c-29e"
x-cache
HIT
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
content-length
670
expires
Fri, 26 Apr 2024 05:05:29 GMT
challenger.css
rakuen.ml123.shop/letian/css/ 		2 KB
904 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rakuen.ml123.shop/letian/css/challenger.css
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
d5bd47efbf5b0cf47fec9e7400993f8f97362000b13f6be453ce8efc4e1ef0d7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:29 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Fri, 21 Oct 2022 15:53:08 GMT
server
nginx
etag
W/"6352c064-74f"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=60
expires
Fri, 26 Apr 2024 05:05:29 GMT
pop.gif
jp.rakuten-static.com/1/im/ic/ui/ 		75 B
350 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jp.rakuten-static.com/1/im/ic/ui/pop.gif
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.192.194.15 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-192-194-15.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7ab9a4d7f597471f82e8ebc6019525cd45f81decff7853062056a3c3417eba59
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 26 Apr 2024 05:04:28 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 08 Dec 2008 04:13:32 GMT
Server
Apache
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
75
X-XSS-Protection
1; mode=block
layui.js
rakuen.ml123.shop/layui280r2/ 		284 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rakuen.ml123.shop/layui280r2/layui.js
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
4c40569803b5c1639369b4d49b7072d3672e503e3c44a197b0ab3258842236b8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:29 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sun, 13 Nov 2022 22:55:50 GMT
server
nginx
etag
W/"637175f6-4705b"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=60
expires
Fri, 26 Apr 2024 05:05:29 GMT
jquery-3.6.1.min.js
rakuen.ml123.shop/jQuery/ 		88 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rakuen.ml123.shop/jQuery/jquery-3.6.1.min.js
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:29 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Wed, 16 Nov 2022 12:42:50 GMT
server
nginx
etag
W/"6374daca-15e40"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=60
expires
Fri, 26 Apr 2024 05:05:29 GMT
bg_btn_red_btm.gif
rakuen.ml123.shop/letian/image/login/ 		442 B
665 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rakuen.ml123.shop/letian/image/login/bg_btn_red_btm.gif
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/letian/css/id/common_login.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
175cf3a6b7549f715fffaddc3ec5c9f92717e7c5f63b7e36ea9592e091a80a67
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/letian/css/id/common_login.css
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:32 GMT
strict-transport-security
max-age=31536000
last-modified
Sun, 24 Apr 2022 19:14:48 GMT
server
nginx
etag
"6265a1a8-1ba"
x-cache
HIT
content-type
image/gif
cache-control
max-age=60
accept-ranges
bytes
content-length
442
expires
Fri, 26 Apr 2024 05:05:32 GMT
bg_btn_red_top.gif
rakuen.ml123.shop/letian/image/login/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rakuen.ml123.shop/letian/image/login/bg_btn_red_top.gif
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/letian/css/id/common_login.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
849cd9d1c481a1b45559f5e833f40e13ee666842e6f8ba72c8e1cad9c8c15f6d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/letian/css/id/common_login.css
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:32 GMT
strict-transport-security
max-age=31536000
last-modified
Sun, 24 Apr 2022 19:14:44 GMT
server
nginx
etag
"6265a1a4-75d"
x-cache
HIT
content-type
image/gif
cache-control
max-age=60
accept-ranges
bytes
content-length
1885
expires
Fri, 26 Apr 2024 05:05:32 GMT
icon_btn_arrow.gif
rakuen.ml123.shop/letian/image/login/ 		548 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rakuen.ml123.shop/letian/image/login/icon_btn_arrow.gif
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/letian/css/id/common_login.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/letian/css/id/common_login.css
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:32 GMT
server
nginx
content-length
548
content-type
text/html
info.gif
jp.rakuten-static.com/1/im/ic/ui/ 		360 B
636 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jp.rakuten-static.com/1/im/ic/ui/info.gif
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/letian/css/id/common_login.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.192.194.15 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-192-194-15.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
33be38e33c8eb9aa13a4ed44c2e2813207bef13a5ba265818e485f0ebbc83f3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 26 Apr 2024 05:04:32 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 02 Sep 2009 10:59:02 GMT
Server
Apache
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
360
X-XSS-Protection
1; mode=block
favicon.ico
rakuen.ml123.shop/ 		5 KB
5 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://rakuen.ml123.shop/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
14c25bfeb3cc1c6c35caed64957232c509b01ad7b099583be8ec5e09f11ae9c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://rakuen.ml123.shop/login
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:36 GMT
strict-transport-security
max-age=31536000
last-modified
Tue, 31 Jan 2023 15:38:12 GMT
server
nginx
etag
"63d935e4-1536"
content-type
image/x-icon
cache-control
no-cache
accept-ranges
bytes
content-length
5430
online
rakuen.ml123.shop/ajax/ 		0
222 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://rakuen.ml123.shop/ajax/online
Requested by
Host: rakuen.ml123.shop
URL: https://rakuen.ml123.shop/jQuery/jquery-3.6.1.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.38.22.186 Dnipro, Ukraine, ASN48693 (NTSERVICE-AS, UA),
Reverse DNS
mail1.jinqiaoit.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language
ja-JP,ja;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept
*/*
Referer
https://rakuen.ml123.shop/login
X-Requested-With
XMLHttpRequest
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 26 Apr 2024 05:04:41 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
cache-control
no-cache
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rakuten (E-commerce)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| layui function| lay number| errors object| layer object| jQuery1124048732125722566555 function| $ function| jQuery function| check_login_btn_ function| onchange_username function| onchange_password function| obtainstatus function| onclick_userLogin

1 Cookies

Domain/Path Name / Value
rakuen.ml123.shop/ Name: PHPSESSID
Value: a0749429b45e83b93970d77ef44dd8f0

2 Console Messages

Source Level URL
Text
network error URL: https://rakuen.ml123.shop/letian/image/login/icon_btn_arrow.gif
Message:
Failed to load resource: the server responded with a status of 404 ()
recommendation verbose URL: https://rakuen.ml123.shop/login
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

image.card.jp.rakuten-static.com
jp.rakuten-static.com
rakuen.ml123.shop
194.38.22.186
23.192.194.15
14c25bfeb3cc1c6c35caed64957232c509b01ad7b099583be8ec5e09f11ae9c3
175cf3a6b7549f715fffaddc3ec5c9f92717e7c5f63b7e36ea9592e091a80a67
33be38e33c8eb9aa13a4ed44c2e2813207bef13a5ba265818e485f0ebbc83f3b
4c40569803b5c1639369b4d49b7072d3672e503e3c44a197b0ab3258842236b8
5779854489c6d1cd097b534efd6ce86b9624569a098c8df39d1a06ea818404fa
62775ef2856f63d6399abc1d54077916df8d62b16414816012b9ff0fad4efada
71f56625e8403042548151b1694675c56b6a650508ab1cc7cb8034e5b2497ce8
7ab9a4d7f597471f82e8ebc6019525cd45f81decff7853062056a3c3417eba59
849cd9d1c481a1b45559f5e833f40e13ee666842e6f8ba72c8e1cad9c8c15f6d
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b91ef2f1d8ee6026c2a977b5696d8bbc3385098924527b9d9300423d4018074c
bc77ef547bd33e6ee1e6f7ef6a6984ffd8f5a59c31d1ba19b1cfe84e5bc1d75a
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
d56343b79893b1bf2adb6b90f159b8bb06b982cf461403a4c04f97608bc3aeb7
d5bd47efbf5b0cf47fec9e7400993f8f97362000b13f6be453ce8efc4e1ef0d7
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02
e14f659c9f7ab5a05c4befc7144d5bfbceb9d34ca5a1fcb225318ad1b1b351ab
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855