nttdocomo.nrest.xyz Open in urlscan Pro
103.245.211.81  Malicious Activity! Public Scan

URL: https://nttdocomo.nrest.xyz/
Submission Tags: krdtest
Submission: On February 14 via api from JP — Scanned from JP

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 18 HTTP transactions. The main IP is 103.245.211.81, located in Hong Kong and belongs to HKKFGL-AS-AP HK Kwaifong Group Limited, HK. The main domain is nttdocomo.nrest.xyz.
TLS certificate: Issued by R3 on February 14th 2022. Valid for: 3 months.
This is the only time nttdocomo.nrest.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NTT Docomo (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
11 103.245.211.81 133115 (HKKFGL-AS...)
3 2a03:2880:f05... 32934 (FACEBOOK)
4 2a03:2880:f15... 32934 (FACEBOOK)
18 3
Apex Domain
Subdomains
Transfer
11 nrest.xyz
nttdocomo.nrest.xyz
176 KB
4 facebook.com
www.facebook.com — Cisco Umbrella Rank: 97
674 B
3 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 126
201 KB
18 3
Domain Requested by
11 nttdocomo.nrest.xyz nttdocomo.nrest.xyz
4 www.facebook.com nttdocomo.nrest.xyz
3 connect.facebook.net nttdocomo.nrest.xyz
connect.facebook.net
18 3

This site contains no links.

Subject Issuer Validity Valid
nttdocomo.nrest.xyz
R3
2022-02-14 -
2022-05-15
3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-11-23 -
2022-02-21
3 months crt.sh

This page contains 1 frames:

Primary Page: https://nttdocomo.nrest.xyz/
Frame ID: 90815EF1EF12D43F7BA8F12703535ACA
Requests: 18 HTTP requests in this frame

Screenshot

Page Title

Document

Detected technologies

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

378 kB
Transfer

1227 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
nttdocomo.nrest.xyz/
6 KB
2 KB
Document
General
Full URL
https://nttdocomo.nrest.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
4996d2eb2cd4bdceff02609ac53f8f71e122976bae83acbdaf6188196accb1c2

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
jp-JP,jp;q=0.9

Response headers

expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
vary
Accept-Encoding
content-encoding
gzip
content-length
2231
content-type
text/html; charset=UTF-8
date
Mon, 14 Feb 2022 04:58:13 GMT
server
Apache
layui.css
nttdocomo.nrest.xyz/assets/files/style/css/
78 KB
14 KB
Stylesheet
General
Full URL
https://nttdocomo.nrest.xyz/assets/files/style/css/layui.css
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
e9de678882d0dca40cf75c96ef145d0f97cba2ea27734f04158b5d9b82eb6d36

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:13 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 06:30:48 GMT
server
Apache
etag
"137db-5c50476d89600-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
14326
normalize.css
nttdocomo.nrest.xyz/assets/files/style/css/
6 KB
2 KB
Stylesheet
General
Full URL
https://nttdocomo.nrest.xyz/assets/files/style/css/normalize.css
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
2e16a67f6d66d11462890ffbb47a2d9097ac0a9fa09695ab78637ef0cc66766a

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:13 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 06:30:58 GMT
server
Apache
etag
"1955-5c50477712c80-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
1757
style.css
nttdocomo.nrest.xyz/assets/files/style/css/
3 KB
797 B
Stylesheet
General
Full URL
https://nttdocomo.nrest.xyz/assets/files/style/css/style.css
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
db06310df8b2bc77275f8fc03f5e71cc136bfd6ce22cf571f5bc9cb57392e82d

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:13 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 06:31:08 GMT
server
Apache
etag
"ca0-5c5047809c300-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
710
layui.js
nttdocomo.nrest.xyz/assets/files/style/
284 KB
92 KB
Script
General
Full URL
https://nttdocomo.nrest.xyz/assets/files/style/layui.js
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
2ab9c8d891c7dcc844c389b51ef0a7a85b14c5a49b15b540e46928937a216e00

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:13 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 06:31:24 GMT
server
Apache
etag
"4710e-5c50478fde700-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
footer_copyright.png
nttdocomo.nrest.xyz/img/
3 KB
3 KB
Image
General
Full URL
https://nttdocomo.nrest.xyz/img/footer_copyright.png
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
02b1e9d916850a1ece07884ac5a194e51b17715f69068b596f312dba41b7a0bd

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:14 GMT
last-modified
Sun, 13 Feb 2022 17:32:30 GMT
server
Apache
accept-ranges
bytes
etag
"c5f-5d7e9af2f0780"
content-length
3167
content-type
image/png
jquery.min.js
nttdocomo.nrest.xyz/assets/files/js/
94 KB
33 KB
Script
General
Full URL
https://nttdocomo.nrest.xyz/assets/files/js/jquery.min.js
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:14 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 06:32:30 GMT
server
Apache
etag
"1762a-5c5047cecfb80-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
33225
laydate.css
nttdocomo.nrest.xyz/assets/files/style/css/modules/laydate/default/
0
0
Stylesheet
General
Full URL
https://nttdocomo.nrest.xyz/assets/files/style/css/modules/laydate/default/laydate.css?v=5.3.1
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/assets/files/style/layui.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:14 GMT
server
Apache
content-length
266
content-type
text/html; charset=iso-8859-1
layer.css
nttdocomo.nrest.xyz/assets/files/style/css/modules/layer/default/
14 KB
3 KB
Stylesheet
General
Full URL
https://nttdocomo.nrest.xyz/assets/files/style/css/modules/layer/default/layer.css?v=3.5.1
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/assets/files/style/layui.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
5cdf3edb27b0c9f8e48918c486e9ae65a9e5beab806b64c4a7bc5bac53c0f540

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:14 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 06:36:22 GMT
server
Apache
etag
"37bf-5c5048ac10580-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
2789
code.css
nttdocomo.nrest.xyz/assets/files/style/css/modules/
1 KB
568 B
Stylesheet
General
Full URL
https://nttdocomo.nrest.xyz/assets/files/style/css/modules/code.css?v=2
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/assets/files/style/layui.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
3f27194c2e479212781a76f993b778d724ac9838e780b19472c0357cd3081431

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:14 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 06:37:02 GMT
server
Apache
etag
"527-5c5048d235f80-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
491
fbevents.js
connect.facebook.net/en_US/
99 KB
27 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f05a:100:face:b00c:0:3 Tai Wan, Hong Kong, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
26236
x-xss-protection
0
pragma
public
x-fb-debug
SRQxFStDJshmApl778d5HugT1F6pnKz6gp0xe9GY5J2SOuj3HidapO9V8J3iXH23NVG8D7/JnCdeScOcEKy8bw==
x-fb-trip-id
1679558926
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Mon, 14 Feb 2022 04:58:14 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
iconfont.woff2
nttdocomo.nrest.xyz/assets/files/style/font/
25 KB
26 KB
Font
General
Full URL
https://nttdocomo.nrest.xyz/assets/files/style/font/iconfont.woff2?v=256
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/assets/files/style/css/layui.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.245.211.81 , Hong Kong, ASN133115 (HKKFGL-AS-AP HK Kwaifong Group Limited, HK),
Reverse DNS
Software
Apache /
Resource Hash
bef73f87b8a3972427dcece922ed8f59d1d01c4a3fd572316efa70de9aec9c09

Request headers

Referer
https://nttdocomo.nrest.xyz/assets/files/style/css/layui.css
Origin
https://nttdocomo.nrest.xyz
Accept-Language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:14 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 06:40:28 GMT
server
Apache
etag
"656c-5c504996aaf00-gzip"
vary
Accept-Encoding
content-type
font/woff2
accept-ranges
bytes
content-length
25987
456104455915656
connect.facebook.net/signals/config/
307 KB
87 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/456104455915656?v=2.9.52&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f05a:100:face:b00c:0:3 Tai Wan, Hong Kong, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
a1e416ac618c349ed71f978973318ca4dad744a442c513451c898ba1cb2a2a90
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
Ab6yIWABExNf4+99xBI1a8hW+b9hpZx8soFq988/CavhVwn3Lw81eEt44/0pCxDvuk3IMvVKDIGYox33jnoPTg==
x-fb-trip-id
1679558926
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Mon, 14 Feb 2022 04:58:14 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
457778832610908
connect.facebook.net/signals/config/
307 KB
87 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/457778832610908?v=2.9.52&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f05a:100:face:b00c:0:3 Tai Wan, Hong Kong, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
41b48b06f9f71ce1cd720ce2b834b5fb32c5994a8151ca9b061e7c1659029bba
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
8160O3A1objvGRnUZIctSLx0GxUujhy7PROEF1Nmcx+oDeou7aYQvcJkbjRGAt7YBv4jfC+a/dHeoC1yuJm2eg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Mon, 14 Feb 2022 04:58:15 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/
44 B
407 B
Image
General
Full URL
https://www.facebook.com/tr/?id=456104455915656&ev=PageView&dl=https%3A%2F%2Fnttdocomo.nrest.xyz%2F&rl=&if=false&ts=1644814695002&sw=1600&sh=1200&v=2.9.52&r=stable&ec=0&o=30&fbp=fb.1.1644814695000.1440875059&it=1644814694417&coo=false&rqm=GET
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f15a:181:face:b00c:0:25de Tai Wan, Hong Kong, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:15 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Mon, 14 Feb 2022 04:58:15 GMT
/
www.facebook.com/tr/
44 B
91 B
Image
General
Full URL
https://www.facebook.com/tr/?id=457778832610908&ev=PageView&dl=https%3A%2F%2Fnttdocomo.nrest.xyz%2F&rl=&if=false&ts=1644814695401&sw=1600&sh=1200&v=2.9.52&r=stable&ec=0&o=30&fbp=fb.1.1644814695000.1440875059&it=1644814694417&coo=false&rqm=GET
Requested by
Host: nttdocomo.nrest.xyz
URL: https://nttdocomo.nrest.xyz/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f15a:181:face:b00c:0:25de Tai Wan, Hong Kong, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:15 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=3,i
expires
Mon, 14 Feb 2022 04:58:15 GMT
/
www.facebook.com/tr/
44 B
88 B
Image
General
Full URL
https://www.facebook.com/tr/?id=456104455915656&ev=Microdata&dl=https%3A%2F%2Fnttdocomo.nrest.xyz%2F&rl=&if=false&ts=1644814696509&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Document%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.52&r=stable&ec=1&o=30&fbp=fb.1.1644814695000.1440875059&it=1644814694417&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f15a:181:face:b00c:0:25de Tai Wan, Hong Kong, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:16 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=3,i
expires
Mon, 14 Feb 2022 04:58:16 GMT
/
www.facebook.com/tr/
44 B
88 B
Image
General
Full URL
https://www.facebook.com/tr/?id=457778832610908&ev=Microdata&dl=https%3A%2F%2Fnttdocomo.nrest.xyz%2F&rl=&if=false&ts=1644814696903&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Document%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.52&r=stable&ec=1&o=30&fbp=fb.1.1644814695000.1440875059&it=1644814694417&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f15a:181:face:b00c:0:25de Tai Wan, Hong Kong, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://nttdocomo.nrest.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Mon, 14 Feb 2022 04:58:16 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=3,i
expires
Mon, 14 Feb 2022 04:58:16 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NTT Docomo (Telecommunication)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| layui function| lay number| errors object| layer object| jQuery112407571180510883226 function| fbq function| _fbq function| $ function| jQuery

3 Cookies

Domain/Path Name / Value
nttdocomo.nrest.xyz/ Name: PHPSESSID
Value: ohrea1ag3ms58p4vg33ldvoqg3
.nrest.xyz/ Name: _fbp
Value: fb.1.1644814695000.1440875059
.facebook.com/ Name: fr
Value: 0sfmRgNqNLsCb6DRj..BiCeFn...1.0.BiCeFn.

1 Console Messages

Source Level URL
Text
network error URL: https://nttdocomo.nrest.xyz/assets/files/style/css/modules/laydate/default/laydate.css?v=5.3.1
Message:
Failed to load resource: the server responded with a status of 404 ()