rtyjytfds.fartit.com

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 47.91.11.190, located in Tokyo, Japan and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is rtyjytfds.fartit.com.
TLS certificate: Issued by R3 on June 1st 2023. Valid for: 3 months.

This is the only time rtyjytfds.fartit.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: au ID (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	47.74.13.180 47.74.13.180	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1 7	47.91.11.190 47.91.11.190	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
6	1

1 47.74.13.180 (Tokyo, Japan) 1 redirects

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

tb16601.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 47.91.11.190 (Tokyo, Japan) 1 redirects

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

rtyjytfds.fartit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	fartit.com 1 redirects rtyjytfds.fartit.com	118 KB
1	tb16601.cc 1 redirects tb16601.cc	94 B
6	2

	Domain	Requested by
7	rtyjytfds.fartit.com	1 redirects rtyjytfds.fartit.com
1	tb16601.cc	1 redirects
6	2

This site contains no links.

Subject Issuer	Validity	Valid
hytrdfs.dynssl.com R3	`2023-06-01` - `2023-08-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://rtyjytfds.fartit.com/login.php
Frame ID: 5E9D9923984ED8AF01773A74AB9E77CF
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

au IDログイン

Page URL History Show full URLs

https://tb16601.cc/index.php?id=08ynzuifurt1uz9la9kc5r4ki HTTP 302
https://rtyjytfds.fartit.com/ HTTP 302
https://rtyjytfds.fartit.com/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

118 kB
Transfer

335 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tb16601.cc/index.php?id=08ynzuifurt1uz9la9kc5r4ki HTTP 302
https://rtyjytfds.fartit.com/ HTTP 302
https://rtyjytfds.fartit.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response rtyjytfds.fartit.com/ Redirect Chain https://tb16601.cc/index.php?id=08ynzuifurt1uz9la9kc5r4ki https://rtyjytfds.fartit.com/ https://rtyjytfds.fartit.com/login.php	10 KB 3 KB	363ms 363ms	Document text/html	47.91.11.190 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://rtyjytfds.fartit.com/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.91.11.190 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software Apache / Resource Hash `68498a720500c7de3e8bd9e768ab4f72655a17352c0b828dea27fbe598d4c36c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 accept-language ja-JP Response headers cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-encoding gzip content-length 3054 content-type text/html; charset=utf-8 date Fri, 02 Jun 2023 10:10:12 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Accept-Encoding Redirect headers cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-encoding gzip content-length 23 content-type text/html; charset=utf-8 date Fri, 02 Jun 2023 10:10:11 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location login.php pragma no-cache server Apache vary Accept-Encoding
GET H2	200	idk.css rtyjytfds.fartit.com/css/	43 KB 9 KB	6ms 4ms	Stylesheet text/css	47.91.11.190 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://rtyjytfds.fartit.com/css/idk.css Requested by Host: rtyjytfds.fartit.com URL: https://rtyjytfds.fartit.com/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.91.11.190 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software Apache / Resource Hash `ed650bdcf0d4e67da479c1af6fbd3214654014ec5a20b58919ca23c00ffa8429` Request headers accept-language ja-JP Referer https://rtyjytfds.fartit.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Fri, 02 Jun 2023 10:10:12 GMT content-encoding gzip last-modified Thu, 27 Apr 2023 09:15:08 GMT server Apache etag "ab8c-5fa4dcaf47f00-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 8967
GET H2	200	checkboxRadio.css rtyjytfds.fartit.com/css/	4 KB 976 B	4ms 3ms	Stylesheet text/css	47.91.11.190 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://rtyjytfds.fartit.com/css/checkboxRadio.css Requested by Host: rtyjytfds.fartit.com URL: https://rtyjytfds.fartit.com/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.91.11.190 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software Apache / Resource Hash `3161eb2799583d9009881d3d9e669044f2afc39ad040db4ab4b8254a03e6fe6b` Request headers accept-language ja-JP Referer https://rtyjytfds.fartit.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Fri, 02 Jun 2023 10:10:12 GMT content-encoding gzip last-modified Mon, 06 Sep 2021 02:32:48 GMT server Apache etag "ea4-5cb4a76ff1400-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 887
GET H2	200	au_id.jpg rtyjytfds.fartit.com/image/	34 KB 34 KB	5ms 2ms	Image image/jpeg	47.91.11.190 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Show image Full URL https://rtyjytfds.fartit.com/image/au_id.jpg Requested by Host: rtyjytfds.fartit.com URL: https://rtyjytfds.fartit.com/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.91.11.190 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software Apache / Resource Hash `1ec5abc3e4e21e84224089afccec3c1677323ec02fe04f2bbf6083a9b9d3fc2d` Request headers accept-language ja-JP Referer https://rtyjytfds.fartit.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Fri, 02 Jun 2023 10:10:12 GMT last-modified Mon, 06 Sep 2021 02:33:20 GMT server Apache accept-ranges bytes etag "87da-5cb4a78e75c00" content-length 34778 content-type image/jpeg
GET H2	200	jquery-2.0.3.js Show response rtyjytfds.fartit.com/js/	245 KB 71 KB	16ms 12ms	Script application/javascript	47.91.11.190 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://rtyjytfds.fartit.com/js/jquery-2.0.3.js Requested by Host: rtyjytfds.fartit.com URL: https://rtyjytfds.fartit.com/login.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.91.11.190 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software Apache / Resource Hash `cbb66f73861ac5aef51bac8f1d2d66676a1650fc5fe828cd3b98fc61a68c89cf` Request headers accept-language ja-JP Referer https://rtyjytfds.fartit.com/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers date Fri, 02 Jun 2023 10:10:12 GMT content-encoding gzip last-modified Sun, 18 Jul 2021 05:04:04 GMT server Apache etag "3d45b-5c75ebfe71900-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes
GET H2	200	api.php Show response rtyjytfds.fartit.com/	13 B 84 B	3ms 3ms	XHR text/html	47.91.11.190 ALIBABA-CN-NET Al...
General Check archive.org Show headers Download Go to Full URL https://rtyjytfds.fartit.com/api.php?act=ip_save&_r=0.3151464320815205 Requested by Host: rtyjytfds.fartit.com URL: https://rtyjytfds.fartit.com/js/jquery-2.0.3.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.91.11.190 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN), Reverse DNS Software Apache / Resource Hash `aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794` Request headers Accept / Referer https://rtyjytfds.fartit.com/login.php X-Requested-With XMLHttpRequest accept-language ja-JP User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36 Response headers pragma no-cache date Fri, 02 Jun 2023 10:10:12 GMT content-encoding gzip server Apache vary Accept-Encoding content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-length 33 expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: au ID (Telecommunication)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			rtyjytfds.fartit.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: hec28b1u61k1v1l4su686i65e5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

rtyjytfds.fartit.com
tb16601.cc
47.74.13.180
47.91.11.190
1ec5abc3e4e21e84224089afccec3c1677323ec02fe04f2bbf6083a9b9d3fc2d
3161eb2799583d9009881d3d9e669044f2afc39ad040db4ab4b8254a03e6fe6b
68498a720500c7de3e8bd9e768ab4f72655a17352c0b828dea27fbe598d4c36c
aa3d21398252adb9f16b5208884b4da22eec9f2019a0139b114a61f178396794
cbb66f73861ac5aef51bac8f1d2d66676a1650fc5fe828cd3b98fc61a68c89cf
ed650bdcf0d4e67da479c1af6fbd3214654014ec5a20b58919ca23c00ffa8429

rtyjytfds.fartit.com Open in urlscan Pro 47.91.11.190 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

118 kBTransfer

335 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

Indicators

rtyjytfds.fartit.com Open in urlscan Pro
47.91.11.190 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

118 kB
Transfer

335 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!