yuggajgv.run.place Open in urlscan Pro
107.150.4.245  Malicious Activity! Public Scan

URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Submission Tags: gc
Submission: On May 25 via api from JP — Scanned from JP

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 21 HTTP transactions. The main IP is 107.150.4.245, located in Los Angeles, United States and belongs to PACIFICRACK, US. The main domain is yuggajgv.run.place.
TLS certificate: Issued by R3 on April 30th 2023. Valid for: 3 months.
This is the only time yuggajgv.run.place was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rakuten (E-commerce)

Domain & IP information

IP Address AS Autonomous System
13 107.150.4.245 64270 (PACIFICRACK)
1 2600:140b:500... 20940 (AKAMAI-ASN1)
5 23.39.217.163 16625 (AKAMAI-AS)
1 2 63.140.50.17 16509 (AMAZON-02)
1 2600:140b:500... 20940 (AKAMAI-ASN1)
21 5
Apex Domain
Subdomains
Transfer
13 run.place
yuggajgv.run.place
202 KB
5 rakuten-static.com
image.card.jp.rakuten-static.com
2 KB
2 2o7.net
rakuten.112.2o7.net — Cisco Umbrella Rank: 783098
1 KB
2 go-mpulse.net
s.go-mpulse.net — Cisco Umbrella Rank: 1238
c.go-mpulse.net — Cisco Umbrella Rank: 615
50 KB
21 4
Domain Requested by
13 yuggajgv.run.place yuggajgv.run.place
5 image.card.jp.rakuten-static.com yuggajgv.run.place
2 rakuten.112.2o7.net 1 redirects yuggajgv.run.place
1 c.go-mpulse.net s.go-mpulse.net
1 s.go-mpulse.net yuggajgv.run.place
21 5
Subject Issuer Validity Valid
yuggajgv.run.place
R3
2023-04-30 -
2023-07-29
3 months crt.sh
akstat.io
DigiCert TLS RSA SHA256 2020 CA1
2023-04-05 -
2024-04-04
a year crt.sh
intl.rakuten-static.com
DigiCert TLS RSA SHA256 2020 CA1
2023-04-18 -
2024-04-17
a year crt.sh

This page contains 2 frames:

Primary Page: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Frame ID: 923045CEEDC9031D28AFF36C65B0A24C
Requests: 19 HTTP requests in this frame

Frame: https://yuggajgv.run.place/static/1/saved_resource.html
Frame ID: 387D691DC2548B1754352BB8E6A5A93B
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

楽天e-NAVI: ログイン画面

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

21
Requests

95 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

255 kB
Transfer

733 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14
  • https://rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/s91532388020766?AQB=1&ndh=1&t=25%2F4%2F2023%2011%3A30%3A44%204%200&ce=UTF-8&ns=rakuten&cdp=3&pageName=login&g=https%3A%2F%2Fyuggajgv.run.place%2Flogin.php%3Ftoken%3D%2527.2ac0773c838d8e97342e6d40b92&cc=JPY&ch=login&server=yuggajgv.run.place&events=event1&c4=allchecked&v4=allchecked&v17=D%3DUser-Agent&c36=login&v36=login&c41=login&c42=No%20Referrer%3Alogin&c43=login&c49=D%3Dg&c50=card&v51=No%20Referrer&v52=D%3DpageName&c61=PC&v61=D%3Dc61&c62=Chrome&v62=D%3Dc62&c63=D%3DUser-Agent&v63=D%3DUser-Agent&c69=0.006&c70=H.22.1-1.20120307&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&p=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B&AQE=1 HTTP 302
  • https://rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/s91532388020766?AQB=1&pccr=true&vidn=3237A3720E30A3B5-60001AE0C299F546&ndh=1&t=25%2F4%2F2023%2011%3A30%3A44%204%200&ce=UTF-8&ns=rakuten&cdp=3&pageName=login&g=https%3A%2F%2Fyuggajgv.run.place%2Flogin.php%3Ftoken%3D%2527.2ac0773c838d8e97342e6d40b92&cc=JPY&ch=login&server=yuggajgv.run.place&events=event1&c4=allchecked&v4=allchecked&v17=D%3DUser-Agent&c36=login&v36=login&c41=login&c42=No%20Referrer%3Alogin&c43=login&c49=D%3Dg&c50=card&v51=No%20Referrer&v52=D%3DpageName&c61=PC&v61=D%3Dc61&c62=Chrome&v62=D%3Dc62&c63=D%3DUser-Agent&v63=D%3DUser-Agent&c69=0.006&c70=H.22.1-1.20120307&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&p=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B&AQE=1

21 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
yuggajgv.run.place/
48 KB
15 KB
Document
General
Full URL
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
0324b97f33de7a494429c15d2b98c1002d11f3b134fe64eb54bcc81c718529e0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
ja-JP

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
15031
content-type
text/html; charset=utf-8
date
Thu, 25 May 2023 11:30:43 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding
login.css
yuggajgv.run.place/static/1/
11 KB
3 KB
Stylesheet
General
Full URL
https://yuggajgv.run.place/static/1/login.css
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
5f99b5fb5150c5b137166ab89940ee679294dd7073336b80fa85f810ab0688e8

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:43 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
etag
"2d89-5e8b69ca05b40-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
2546
ral-1.8.1.js
yuggajgv.run.place/static/1/
29 KB
10 KB
Script
General
Full URL
https://yuggajgv.run.place/static/1/ral-1.8.1.js
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
99d3ec89a43fa27d170fcbd760034e1616dac184383dae0e43b457788b404e78

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:43 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
etag
"7276-5e8b69ca05b40-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
9949
jquery-3.4.1.min.js
yuggajgv.run.place/static/1/
86 KB
30 KB
Script
General
Full URL
https://yuggajgv.run.place/static/1/jquery-3.4.1.min.js
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:43 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
etag
"15851-5e8b69ca05b40-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
30677
jquery-migrate-3.1.0.min.js
yuggajgv.run.place/static/1/
9 KB
3 KB
Script
General
Full URL
https://yuggajgv.run.place/static/1/jquery-migrate-3.1.0.min.js
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
c9c25e5db965f66edd1ca79a3db5c19191fc06e3fdf5298f9bff2ae4ef926c17

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:43 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
etag
"231e-5e8b69ca05b40-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
3292
login.js
yuggajgv.run.place/static/1/
2 KB
786 B
Script
General
Full URL
https://yuggajgv.run.place/static/1/login.js
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
b3b56ecf18e2df1fd4e935c9de0360bf4362ad67d7b7e1fa098ce488afed3248

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:43 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
etag
"8bb-5e8b69ca05b40-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
732
challenger.css
yuggajgv.run.place/static/1/
2 KB
684 B
Stylesheet
General
Full URL
https://yuggajgv.run.place/static/1/challenger.css
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
d5bd47efbf5b0cf47fec9e7400993f8f97362000b13f6be453ce8efc4e1ef0d7

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:43 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
etag
"74f-5e8b69ca05b40-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
content-length
630
BGD27-RKZLH-HC9BY-VXAAE-E5EDR
s.go-mpulse.net/boomerang/
205 KB
50 KB
Script
General
Full URL
https://s.go-mpulse.net/boomerang/BGD27-RKZLH-HC9BY-VXAAE-E5EDR
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2600:140b:5000:1bb::11a6 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:43 GMT
content-encoding
br
last-modified
Tue, 09 May 2023 01:31:02 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
x-n
S
timing-allow-origin
*
content-length
50393
rc-logo_CardEnavi_1.svg
yuggajgv.run.place/static/1/
9 KB
3 KB
Image
General
Full URL
https://yuggajgv.run.place/static/1/rc-logo_CardEnavi_1.svg
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
b91ef2f1d8ee6026c2a977b5696d8bbc3385098924527b9d9300423d4018074c

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:44 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
etag
"2356-5e8b69ca05b40-gzip"
vary
Accept-Encoding
content-type
image/svg+xml
accept-ranges
bytes
content-length
3235
spacer.gif
yuggajgv.run.place/static/1/
49 B
103 B
Image
General
Full URL
https://yuggajgv.run.place/static/1/spacer.gif
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
229a4c6e872bb11a3325501e43ef3e506d1ebb9be98ed79321d7c879d98e695e

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:44 GMT
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
accept-ranges
bytes
etag
"31-5e8b69ca05b40"
content-length
49
content-type
image/gif
stop_540x249.png
yuggajgv.run.place/static/1/
57 KB
57 KB
Image
General
Full URL
https://yuggajgv.run.place/static/1/stop_540x249.png
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:44 GMT
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
accept-ranges
bytes
etag
"e2e0-5e8b69ca05b40"
content-length
58080
content-type
image/png
s_code.js
yuggajgv.run.place/static/1/
68 KB
21 KB
Script
General
Full URL
https://yuggajgv.run.place/static/1/s_code.js
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
a5d4b62dbc1e744844c913c945d7e3f9892990a382d2ebb349e74274c46d6543

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:44 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
etag
"10ff4-5e8b69ca05b40-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
21363
saved_resource.html
yuggajgv.run.place/static/1/ Frame 387D
248 B
283 B
Document
General
Full URL
https://yuggajgv.run.place/static/1/saved_resource.html
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
2b95cec0ca02606508b391a9748001431fe830ce3837a6907e07470079c134a6

Request headers

Referer
https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
ja-JP

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
223
content-type
text/html
date
Thu, 25 May 2023 11:30:44 GMT
etag
"f8-5e8b69ca05b40-gzip"
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
vary
Accept-Encoding
rexicon-32-eye-f.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/
294 B
440 B
Image
General
Full URL
https://image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/rexicon-32-eye-f.svg
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/static/1/login.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.39.217.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-39-217-163.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
14d72db96bbb479c505f417e6dd2d1ac6e84f44af2c37a95001b8b178fe97686
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Apr 2019 07:21:19 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=7776000
accept-ranges
bytes
content-length
217
x-xss-protection
1; mode=block
expires
Fri, 15 Oct 2021 05:59:51 GMT
BGD27-RKZLH-HC9BY-VXAAE-E5EDR
yuggajgv.run.place/static/1/ Frame 387D
205 KB
58 KB
Script
General
Full URL
https://yuggajgv.run.place/static/1/BGD27-RKZLH-HC9BY-VXAAE-E5EDR
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/static/1/saved_resource.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
107.150.4.245 Los Angeles, United States, ASN64270 (PACIFICRACK, US),
Reverse DNS
107.150.4.245.static.quadranet.com
Software
Apache /
Resource Hash
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/static/1/saved_resource.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:44 GMT
content-encoding
gzip
last-modified
Thu, 15 Sep 2022 12:44:53 GMT
server
Apache
accept-ranges
bytes
etag
"33413-5e8b69ca05b40-gzip"
vary
Accept-Encoding
s91532388020766
rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/
Redirect Chain
  • https://rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/s91532388020766?AQB=1&ndh=1&t=25%2F4%2F2023%2011%3A30%3A44%204%200&ce=UTF-8&ns=rakuten&cdp=3&pageName=login&g=https%3A%2F%2Fyuggajgv.run.place...
  • https://rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/s91532388020766?AQB=1&pccr=true&vidn=3237A3720E30A3B5-60001AE0C299F546&ndh=1&t=25%2F4%2F2023%2011%3A30%3A44%204%200&ce=UTF-8&ns=rakuten&cdp=3&...
43 B
268 B
Image
General
Full URL
https://rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/s91532388020766?AQB=1&pccr=true&vidn=3237A3720E30A3B5-60001AE0C299F546&ndh=1&t=25%2F4%2F2023%2011%3A30%3A44%204%200&ce=UTF-8&ns=rakuten&cdp=3&pageName=login&g=https%3A%2F%2Fyuggajgv.run.place%2Flogin.php%3Ftoken%3D%2527.2ac0773c838d8e97342e6d40b92&cc=JPY&ch=login&server=yuggajgv.run.place&events=event1&c4=allchecked&v4=allchecked&v17=D%3DUser-Agent&c36=login&v36=login&c41=login&c42=No%20Referrer%3Alogin&c43=login&c49=D%3Dg&c50=card&v51=No%20Referrer&v52=D%3DpageName&c61=PC&v61=D%3Dc61&c62=Chrome&v62=D%3Dc62&c63=D%3DUser-Agent&v63=D%3DUser-Agent&c69=0.006&c70=H.22.1-1.20120307&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&p=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B&AQE=1
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/login.php?token=%27.2ac0773c838d8e97342e6d40b92
Protocol
H2
Server
63.140.50.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 25 May 2023 11:30:44 GMT
x-content-type-options
nosniff
last-modified
Fri, 26 May 2023 11:30:44 GMT
server
jag
etag
3618540537116688384-4619651629651190211
vary
*
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-length
43
x-xss-protection
1; mode=block
expires
Wed, 24 May 2023 11:30:44 GMT

Redirect headers

pragma
no-cache
date
Thu, 25 May 2023 11:30:44 GMT
x-content-type-options
nosniff
last-modified
Fri, 26 May 2023 11:30:44 GMT
server
jag
vary
Origin
p3p
CP="This is not a P3P policy"
access-control-allow-origin
*
location
https://rakuten.112.2o7.net/b/ss/rakutenkcdev/1/H.22.1/s91532388020766?AQB=1&pccr=true&vidn=3237A3720E30A3B5-60001AE0C299F546&ndh=1&t=25%2F4%2F2023%2011%3A30%3A44%204%200&ce=UTF-8&ns=rakuten&cdp=3&pageName=login&g=https%3A%2F%2Fyuggajgv.run.place%2Flogin.php%3Ftoken%3D%2527.2ac0773c838d8e97342e6d40b92&cc=JPY&ch=login&server=yuggajgv.run.place&events=event1&c4=allchecked&v4=allchecked&v17=D%3DUser-Agent&c36=login&v36=login&c41=login&c42=No%20Referrer%3Alogin&c43=login&c49=D%3Dg&c50=card&v51=No%20Referrer&v52=D%3DpageName&c61=PC&v61=D%3Dc61&c62=Chrome&v62=D%3Dc62&c63=D%3DUser-Agent&v63=D%3DUser-Agent&c69=0.006&c70=H.22.1-1.20120307&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&p=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B&AQE=1
content-type
text/plain;charset=utf-8
cache-control
no-cache, no-store, max-age=0, no-transform, private
content-length
0
x-xss-protection
1; mode=block
expires
Wed, 24 May 2023 11:30:44 GMT
rexicon-32-check.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/
288 B
441 B
Image
General
Full URL
https://image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/rexicon-32-check.svg
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/static/1/login.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.39.217.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-39-217-163.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
027955e7d4d65ff988f8a9b9b586a843d9d0c3c79ed47ad5f4046e83e6bbd2ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Apr 2019 07:21:19 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=7776000
accept-ranges
bytes
content-length
218
x-xss-protection
1; mode=block
expires
Wed, 13 Oct 2021 03:02:27 GMT
rexicon-32-new-window-l.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/
445 B
490 B
Image
General
Full URL
https://image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/rexicon-32-new-window-l.svg
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/static/1/login.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.39.217.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-39-217-163.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
4d1de4ecb415cada2052d1d3733ab2d123691707583cab3e3f9a1ebfa96dd232
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Apr 2019 07:21:19 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=7776000
accept-ranges
bytes
content-length
266
x-xss-protection
1; mode=block
expires
Wed, 13 Oct 2021 08:02:09 GMT
rexicon-32-chevron-right.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/
315 B
452 B
Image
General
Full URL
https://image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/rexicon-32-chevron-right.svg
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/static/1/login.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.39.217.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-39-217-163.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
61f30c6851b1ef5e73f3371bf5e5dff51f4e968c85b353744d45d32c480483bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Thu, 25 May 2023 11:30:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Apr 2019 07:21:19 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=7776000
accept-ranges
bytes
content-length
229
x-xss-protection
1; mode=block
expires
Wed, 02 Nov 2022 03:14:34 GMT
rexicon-32-sign-info-l.svg
image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/
473 B
517 B
Image
General
Full URL
https://image.card.jp.rakuten-static.com/r-enavi/WebImages/enavi/login/rexicon-32-sign-info-l.svg
Requested by
Host: yuggajgv.run.place
URL: https://yuggajgv.run.place/static/1/login.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.39.217.163 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-39-217-163.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
4c20c5e7e9e5dd269c9cf036bdcfdee942dfc45dcdb80e043c695f9337168405
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

unused62
8096267
date
Thu, 25 May 2023 11:30:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Apr 2019 07:21:19 GMT
server
Apache
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=7776000
accept-ranges
bytes
content-length
279
x-xss-protection
1; mode=block
expires
Wed, 13 Oct 2021 02:33:42 GMT
config.json
c.go-mpulse.net/api/
51 B
323 B
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=BGD27-RKZLH-HC9BY-VXAAE-E5EDR&d=yuggajgv.run.place&t=5616714&v=1.720.0&sl=0&si=19f92ac7-44ac-4880-b0fe-84ddf192ae10-rv7pb7&plugins=AK,ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=&ak.ai=691193
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/BGD27-RKZLH-HC9BY-VXAAE-E5EDR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2600:140b:5000:18a::11a6 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
503e5231837a0fea130419b5a515a98cbf03ec483fe581e31093c472874bcd2c

Request headers

accept-language
ja-JP
Referer
https://yuggajgv.run.place/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 25 May 2023 11:30:44 GMT
Cache-Control
private, max-age=120, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
51
Content-Type
application/json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rakuten (E-commerce)

60 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless undefined| $ function| jQuery function| ctlDupSend function| setCheckboxValue function| setCheckboxValueDev function| setFocus object| BOOMR_mq string| BOOMR_API_key object| BOOMR number| _countAA function| doBBBd object| __challenger_stats object| __challenger_events boolean| doRefresh object| __challenger_conf object| __challenger function| Fingerprint2Shrinked object| RAL object| trackingParam object| allInputs string| scParamKey string| scParamValue function| BOOMR_check_doc_domain object| ErrorStackParser object| UserTimingCompression object| accountSetting number| _scStartTime object| rakutenSC string| s_account object| s function| s_doPlugins function| isAndroid function| isChrome function| isSmartphone function| isSafari string| s_code string| s_objectID function| s_gi function| do_PrePlugins function| do_PostPlugins function| sendSCRequest function| c_r function| c_w string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft function| s_c object| s_c_il number| s_c_in string| s_tnt object| s_i_rakuten number| BOOMR_onload number| BOOMR_configt

5 Cookies

Domain/Path Name / Value
yuggajgv.run.place/ Name: PHPSESSID
Value: d5o3giocajv8i2e4fvg7pk23qh
.run.place/ Name: _ra
Value: 1685014244195|8a307dca-4fbc-4097-8d04-39bd1ad7aa57
.yuggajgv.run.place/ Name: s_sess
Value: %20s_cc%3Dtrue%3B%20s_prevsite%3Dcard%3B%20s_sq%3D%3B
.rakuten.112.2o7.net/ Name: s_vi
Value: [CS]v1|3237A3720E30A3B5-60001AE0C299F546[CE]
.yuggajgv.run.place/ Name: RT
Value: "z=1&dm=yuggajgv.run.place&si=19f92ac7-44ac-4880-b0fe-84ddf192ae10&ss=li31z2tx&sl=1&tt=177&rl=1&ld=19y"

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.go-mpulse.net
image.card.jp.rakuten-static.com
rakuten.112.2o7.net
s.go-mpulse.net
yuggajgv.run.place
107.150.4.245
23.39.217.163
2600:140b:5000:18a::11a6
2600:140b:5000:1bb::11a6
63.140.50.17
027955e7d4d65ff988f8a9b9b586a843d9d0c3c79ed47ad5f4046e83e6bbd2ce
0324b97f33de7a494429c15d2b98c1002d11f3b134fe64eb54bcc81c718529e0
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
14d72db96bbb479c505f417e6dd2d1ac6e84f44af2c37a95001b8b178fe97686
229a4c6e872bb11a3325501e43ef3e506d1ebb9be98ed79321d7c879d98e695e
2b95cec0ca02606508b391a9748001431fe830ce3837a6907e07470079c134a6
4c20c5e7e9e5dd269c9cf036bdcfdee942dfc45dcdb80e043c695f9337168405
4d1de4ecb415cada2052d1d3733ab2d123691707583cab3e3f9a1ebfa96dd232
503e5231837a0fea130419b5a515a98cbf03ec483fe581e31093c472874bcd2c
5f99b5fb5150c5b137166ab89940ee679294dd7073336b80fa85f810ab0688e8
61f30c6851b1ef5e73f3371bf5e5dff51f4e968c85b353744d45d32c480483bc
99d3ec89a43fa27d170fcbd760034e1616dac184383dae0e43b457788b404e78
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a5d4b62dbc1e744844c913c945d7e3f9892990a382d2ebb349e74274c46d6543
b3b56ecf18e2df1fd4e935c9de0360bf4362ad67d7b7e1fa098ce488afed3248
b91ef2f1d8ee6026c2a977b5696d8bbc3385098924527b9d9300423d4018074c
c9c25e5db965f66edd1ca79a3db5c19191fc06e3fdf5298f9bff2ae4ef926c17
d5bd47efbf5b0cf47fec9e7400993f8f97362000b13f6be453ce8efc4e1ef0d7
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02