urlscan.io logo urlscan.io
SecurityTrails logo

mercari-cardmu.com Open in urlscan Pro
160.16.121.107  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://mercari-cardmu.com/jp/login.html
Submission: On September 15 via automatic, source openphish — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 10 HTTP transactions. The main IP is 160.16.121.107, located in Tokyo, Japan and belongs to SAKURA-B SAKURA Internet Inc., JP. The main domain is mercari-cardmu.com.
TLS certificate: Issued by R3 on September 14th 2022. Valid for: 3 months.
This is the only time mercari-cardmu.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Mercari (E-commerce)

Domain & IP information

IP Address AS Autonomous System
5 160.16.121.107 9370 (SAKURA-B ...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
2 199.232.210.131 54113 (FASTLY)
10 4
Apex Domain
Subdomains		 Transfer
5 mercari-cardmu.com
mercari-cardmu.com
501 KB
2 mercdn.net
pcweb-assets.mercdn.net
3 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 355
10 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 976
29 KB
10 4
Domain Requested by
5 mercari-cardmu.com cdnjs.cloudflare.com
mercari-cardmu.com
2 pcweb-assets.mercdn.net mercari-cardmu.com
2 cdnjs.cloudflare.com mercari-cardmu.com
1 code.jquery.com mercari-cardmu.com
10 4

This site contains links to these domains. Also see Links.

Domain
www.mercari.com
Subject Issuer Validity Valid
mercari-cardmu.com
R3		 2022-09-14 -
2022-12-13		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-03 -
2023-08-02		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh
*.mercdn.net
GlobalSign GCC R3 DV TLS CA 2020		 2022-04-18 -
2023-05-20		 a year crt.sh

This page contains 1 frames:

Primary Page: https://mercari-cardmu.com/jp/login.html
Frame ID: 7C63CCDA318385052AD3F97B5DFC7DAA
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

ログイン - メルカリ スマホでかんたん フリマアプリ

Detected technologies

Overall confidence: 100%
Detected patterns
  • zepto.*\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

544 kB
Transfer

615 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.html
mercari-cardmu.com/jp/ 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mercari-cardmu.com/jp/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
160.16.121.107 Tokyo, Japan, ASN9370 (SAKURA-B SAKURA Internet Inc., JP),
Reverse DNS
tk2-236-27853.vs.sakura.ne.jp
Software
nginx/1.22.0 / Express
Resource Hash
60bd2a5d0576d73ebc92f6b90a6d12afe5488a19f84eb20c49d1d0ced9716e2c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
public, max-age=0
Connection
keep-alive
Content-Length
1398
Content-Type
text/html; charset=UTF-8
Date
Thu, 15 Sep 2022 03:02:07 GMT
ETag
W/"576-1833b33588a"
Last-Modified
Wed, 14 Sep 2022 08:52:44 GMT
Server
nginx/1.22.0
X-Powered-By
Express
zepto.min.js
cdnjs.cloudflare.com/ajax/libs/zepto/1.2.0/ 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/zepto/1.2.0/zepto.min.js
Requested by
Host: mercari-cardmu.com
URL: https://mercari-cardmu.com/jp/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
beb9f5e32ed61fbce010497242a9b6b8219242b5ffc636038e7891510c773725
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://mercari-cardmu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 03:02:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
10823118
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
8798
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:18:11 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb04043-6712"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j8MLN2U%2FSi7VxNylZEFqAgNztsJWHl8nAYl1sBtQNd81%2BJ5c5uPe1h%2F2fJLupBWbMdMtYoChVj4Ca6beLn6%2FR1qzs6qXLmSvrx7kA95Zz8khqobGmdkpMxILTySw9z%2FFrP9Y5QS%2F2HH%2BTGxtmMol1QlI"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
74ae1f280d0b20c1-NRT
expires
Tue, 05 Sep 2023 03:02:07 GMT
base64.min.js
cdnjs.cloudflare.com/ajax/libs/Base64/1.1.0/ 		1 KB
888 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/Base64/1.1.0/base64.min.js
Requested by
Host: mercari-cardmu.com
URL: https://mercari-cardmu.com/jp/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f94d7639ccd0a0e0aea9bc3b2b88ba1f3af4f15e2197ae7edceb731e0d5e62e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://mercari-cardmu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 03:02:07 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
11416583
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
549
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:03:57 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ced-431"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EbGA9yzneYguR6KYsM6UBG7mkCVLNP8gjWSv3Kkp1xwpgeBULQ1xNCfvXNDWQJC4Oi7lle2EQHc2yb6muri%2BE6LrgERKrJXXa1Z6DNbq%2FdMlwqVKZWKUU8UszZlGmbECQHLlYFm6fhwbPWfA82M5Jvgr"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
74ae1f280d0c20c1-NRT
expires
Tue, 05 Sep 2023 03:02:07 GMT
login
mercari-cardmu.com/jp/ 		12 KB
12 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mercari-cardmu.com/jp/login?v=&_=1663210927389
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/zepto/1.2.0/zepto.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
160.16.121.107 Tokyo, Japan, ASN9370 (SAKURA-B SAKURA Internet Inc., JP),
Reverse DNS
tk2-236-27853.vs.sakura.ne.jp
Software
nginx/1.22.0 / Express
Resource Hash
55fe994bae90fc890f00e5037c798401dbc5dae393a5e9b82e3c12b720a8b98c

Request headers

Accept
*/*
Referer
https://mercari-cardmu.com/jp/login.html
X-Requested-With
XMLHttpRequest
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Thu, 15 Sep 2022 03:02:07 GMT
Server
nginx/1.22.0
Connection
keep-alive
X-Powered-By
Express
ETag
W/"2f04-jxvyXDPzHu5kGmYCV7MRExj4LLQ"
Content-Length
12036
Content-Type
text/html; charset=utf-8
app.jp.css
mercari-cardmu.com/jp/assets/css/ 		318 KB
318 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://mercari-cardmu.com/jp/assets/css/app.jp.css?365456439
Requested by
Host: mercari-cardmu.com
URL: https://mercari-cardmu.com/jp/login.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
160.16.121.107 Tokyo, Japan, ASN9370 (SAKURA-B SAKURA Internet Inc., JP),
Reverse DNS
tk2-236-27853.vs.sakura.ne.jp
Software
nginx/1.22.0 / Express
Resource Hash
6f958c7ffa35885ae373e1e73d9d544638292b82e5db1e776b192aadd3c65f3b

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://mercari-cardmu.com/jp/login.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Thu, 15 Sep 2022 03:02:07 GMT
Last-Modified
Wed, 14 Sep 2022 08:52:44 GMT
Server
nginx/1.22.0
X-Powered-By
Express
ETag
W/"4f653-1833b33588a"
Content-Type
text/css; charset=UTF-8
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
325203
jquery-2.2.4.min.js
code.jquery.com/ 		84 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-2.2.4.min.js
Requested by
Host: mercari-cardmu.com
URL: https://mercari-cardmu.com/jp/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Referer
https://mercari-cardmu.com/
Origin
https://mercari-cardmu.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 15 Sep 2022 03:02:07 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-14e4a"
vary
Accept-Encoding
x-hw
1663210927.dop031.sj3.t,1663210927.cds210.sj3.hn,1663210927.cds214.sj3.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
29811
logo.svg
pcweb-assets.mercdn.net/assets/img/common/common/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pcweb-assets.mercdn.net/assets/img/common/common/logo.svg?3660596335
Requested by
Host: mercari-cardmu.com
URL: https://mercari-cardmu.com/jp/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.210.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
f4c823301da0441f633837b7b207f4711269ff5c49e8d82f66df3324031a30cc
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://mercari-cardmu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 03:02:07 GMT
content-encoding
br
age
54094
x-guploader-uploadid
ADPycdugfY_vI46Ai0o921rDVVffijtnQgtSaEWzrGP_hCXQcMrpoPPUscKbCGcRgMTb9BNE7Zwieeyn2_K87dtjJR183PVAlLzA
x-cache
HIT
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
strict-transport-security
max-age=31557600
content-length
1052
via
1.1 varnish
x-served-by
cache-nrt-rjtf7700055-NRT
last-modified
Mon, 16 May 2022 08:10:23 GMT
server
UploadServer
vary
Origin,Accept-Encoding
x-goog-hash
crc32c=mcReyQ==, md5=iK368yrhtcTExjQ9XRXPUA==
x-goog-generation
1652688623621251
access-control-allow-origin
*
expires
Tue, 06 Sep 2022 20:16:02 GMT
cache-control
public,max-age=0,s-maxage=86400,no-transform
x-goog-stored-content-length
1132
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
1
logo-gray.svg
pcweb-assets.mercdn.net/assets/img/common/common/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pcweb-assets.mercdn.net/assets/img/common/common/logo-gray.svg?3660596335
Requested by
Host: mercari-cardmu.com
URL: https://mercari-cardmu.com/jp/login.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.210.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
0f34f7d169129d40b428ac87ea520dce5c3acafe7d25699aaddf13a3b381d150
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://mercari-cardmu.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Thu, 15 Sep 2022 03:02:07 GMT
content-encoding
br
age
54093
x-guploader-uploadid
ADPycdsU7QSG0TsN7iVYCdQSKK0XMSoMwqUNHBC024qZ5ogFkrwyDN_3OWqCiABOEHShYh3ETmZWthvbGVYKk_9nc75RCg
x-cache
HIT
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
strict-transport-security
max-age=31557600
content-length
993
via
1.1 varnish
x-served-by
cache-nrt-rjtf7700055-NRT
last-modified
Mon, 16 May 2022 08:10:23 GMT
server
UploadServer
vary
Origin,Accept-Encoding
x-goog-hash
crc32c=ZLiKIQ==, md5=GZYLL0AOTjvP1MOOlMPykQ==
x-goog-generation
1652688623646975
access-control-allow-origin
*
expires
Thu, 15 Sep 2022 12:00:33 GMT
cache-control
public,max-age=0,s-maxage=86400,no-transform
x-goog-stored-content-length
1067
accept-ranges
bytes
content-type
image/svg+xml
x-cache-hits
1
SourceSansPro-Regular.ttf.woff2
mercari-cardmu.com/jp/assets/fonts/ 		85 KB
85 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://mercari-cardmu.com/jp/assets/fonts/SourceSansPro-Regular.ttf.woff2?37328315
Requested by
Host: mercari-cardmu.com
URL: https://mercari-cardmu.com/jp/assets/css/app.jp.css?365456439
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
160.16.121.107 Tokyo, Japan, ASN9370 (SAKURA-B SAKURA Internet Inc., JP),
Reverse DNS
tk2-236-27853.vs.sakura.ne.jp
Software
nginx/1.22.0 / Express
Resource Hash
27c06ca531d01f12d9e28d869000985e4cf84dd0724afe578e942d44f09d19c2

Request headers

Referer
https://mercari-cardmu.com/jp/assets/css/app.jp.css?365456439
Origin
https://mercari-cardmu.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Thu, 15 Sep 2022 03:02:07 GMT
Last-Modified
Wed, 14 Sep 2022 08:52:44 GMT
Server
nginx/1.22.0
X-Powered-By
Express
ETag
W/"1533c-1833b33588a"
Content-Type
application/font-woff2
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86844
SourceSansPro-Semibold.ttf.woff2
mercari-cardmu.com/jp/assets/fonts/ 		84 KB
84 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://mercari-cardmu.com/jp/assets/fonts/SourceSansPro-Semibold.ttf.woff2?37328315
Requested by
Host: mercari-cardmu.com
URL: https://mercari-cardmu.com/jp/assets/css/app.jp.css?365456439
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
160.16.121.107 Tokyo, Japan, ASN9370 (SAKURA-B SAKURA Internet Inc., JP),
Reverse DNS
tk2-236-27853.vs.sakura.ne.jp
Software
nginx/1.22.0 / Express
Resource Hash
b96f55ccea2c4ad959ca841fa881a893e7df33a2e575d621a81d2f1063b429c4

Request headers

Referer
https://mercari-cardmu.com/jp/assets/css/app.jp.css?365456439
Origin
https://mercari-cardmu.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Date
Thu, 15 Sep 2022 03:02:07 GMT
Last-Modified
Wed, 14 Sep 2022 08:52:44 GMT
Server
nginx/1.22.0
X-Powered-By
Express
ETag
W/"150b4-1833b33588a"
Content-Type
application/font-woff2
Cache-Control
public, max-age=0
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86196

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mercari (E-commerce)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| Zepto function| $ function| getQueryString function| jQuery

1 Cookies

Domain/Path Name / Value
mercari-cardmu.com/ Name: mercar:sid
Value: s%3Ad2b7b129-ee0e-4a35-ba30-5acd5cdd4617.igo%2BONADTTuyVmG9B47SnawJO9sCVdMqqzA416JcePE

2 Console Messages

Source Level URL
Text
javascript warning URL: https://mercari-cardmu.com/jp/login.html(Line 26)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-2.2.4.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://mercari-cardmu.com/jp/login.html(Line 26)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-2.2.4.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.