aeon-jp.perfectaffairsevents.com Open in urlscan Pro
47.74.9.224 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://aeon-jp.perfectaffairsevents.com/
Submission: On March 03 via automatic, source phishtank (March 3rd 2024, 5:50:07 am UTC) — Scanned from JP

Summary HTTP 10 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 10 HTTP transactions. The main IP is 47.74.9.224, located in Tokyo, Japan and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is aeon-jp.perfectaffairsevents.com.
TLS certificate: Issued by R3 on March 1st 2024. Valid for: 3 months.

This is the only time aeon-jp.perfectaffairsevents.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Mercari (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
6	47.74.9.224 47.74.9.224	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1	2606:4700::68... 2606:4700::6812:1aaa	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
10	6

6 47.74.9.224 (Tokyo, Japan)

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

aeon-jp.perfectaffairsevents.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
zlrnncy.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1aaa (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipregistry.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	perfectaffairsevents.com aeon-jp.perfectaffairsevents.com	303 KB
1	bing.com bat.bing.com — Cisco Umbrella Rank: 375	560 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 822	724 B
1	t.co t.co — Cisco Umbrella Rank: 674	377 B
1	zlrnncy.cn zlrnncy.cn	347 B
1	ipregistry.co api.ipregistry.co — Cisco Umbrella Rank: 113588	1 KB
10	6

	Domain	Requested by
5	aeon-jp.perfectaffairsevents.com	aeon-jp.perfectaffairsevents.com
1	bat.bing.com
1	analytics.twitter.com
1	t.co
1	zlrnncy.cn	aeon-jp.perfectaffairsevents.com
1	api.ipregistry.co	aeon-jp.perfectaffairsevents.com
10	6

This site contains links to these domains. Also see Links.

Domain
help.jp.mercari.com
static.jp.mercari.com
policies.google.com

Subject Issuer	Validity	Valid
knab.cn R3	`2024-03-01` - `2024-05-30`	3 months	crt.sh
ipregistry.co Cloudflare Inc ECC CA-3	`2023-10-03` - `2024-10-02`	a year	crt.sh
zlrnncy.cn R3	`2024-03-01` - `2024-05-30`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-26` - `2024-11-25`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-02` - `2024-10-31`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-01-21` - `2024-06-27`	5 months	crt.sh

This page contains 1 frames:

Primary Page: https://aeon-jp.perfectaffairsevents.com/
Frame ID: 47BB2CBFFA83A4FA2E23C21357DB7A33
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ログイン - メルカリAppleGoogleFacebook

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

10
Requests

50 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

307 kB
Transfer

950 kB
Size

7
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://help.jp.mercari.com/guide/categories/tos_list/
Title: 利用規約

Search URL Search Domain Scan URL

URL: https://static.jp.mercari.com/privacy
Title: プライバシーポリシー

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy
Title: プライバシーポリシー

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: 利用規約

Search URL Search Domain Scan URL

URL: https://static.jp.mercari.com/tos
Title: メルカリ利用規約

Search URL Search Domain Scan URL

URL: https://static.jp.mercari.com/tokutei
Title: 特定商取引に関する表記

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
aeon-jp.perfectaffairsevents.com/ 602 B
507 B 235ms
3ms Document
text/html 47.74.9.224
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://aeon-jp.perfectaffairsevents.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 47.74.9.224 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 0909c6783a6315b9a492a10dad89f9f689d3159b6638c10f84a5290f37a77e2e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 369
content-type: text/html
date: Sun, 03 Mar 2024 05:50:02 GMT
etag: "25a-61013392df480-gzip"
last-modified: Mon, 29 Jan 2024 10:36:50 GMT
server: Apache
vary: Accept-Encoding

GET
H2 200 cnflj.js Show response
aeon-jp.perfectaffairsevents.com/ 368 B
429 B 6ms
3ms Script
application/javascript 47.74.9.224
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://aeon-jp.perfectaffairsevents.com/cnflj.js
Requested by: Host: aeon-jp.perfectaffairsevents.com
URL: https://aeon-jp.perfectaffairsevents.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 47.74.9.224 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 075a8dcb37a5b1f9c2f9053d5bb0bb68bb3ac043e424907822f17111f4703d00

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://aeon-jp.perfectaffairsevents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Sun, 03 Mar 2024 05:50:02 GMT
content-encoding: gzip
last-modified: Fri, 01 Mar 2024 17:12:04 GMT
server: Apache
etag: "170-6129c799b0c88-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 335

GET
H2 200 chunk-vendors.872deca2.js Show response
aeon-jp.perfectaffairsevents.com/static/js/ 639 KB
239 KB 15ms
13ms Script
application/javascript 47.74.9.224
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://aeon-jp.perfectaffairsevents.com/static/js/chunk-vendors.872deca2.js
Requested by: Host: aeon-jp.perfectaffairsevents.com
URL: https://aeon-jp.perfectaffairsevents.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 47.74.9.224 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 54137c820ca3ec40cae8a72f9df1bc8b107e34cf22ec6d4214cc864318c0d358

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://aeon-jp.perfectaffairsevents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Sun, 03 Mar 2024 05:50:02 GMT
content-encoding: gzip
last-modified: Mon, 29 Jan 2024 10:34:32 GMT
server: Apache
etag: "9fa1f-6101330f43e00-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 app.c3252715.js Show response
aeon-jp.perfectaffairsevents.com/static/js/ 105 KB
51 KB 14ms
14ms Script
application/javascript 47.74.9.224
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://aeon-jp.perfectaffairsevents.com/static/js/app.c3252715.js
Requested by: Host: aeon-jp.perfectaffairsevents.com
URL: https://aeon-jp.perfectaffairsevents.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 47.74.9.224 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: de77b4ba09d35157bd60a37880ecaf550b12f4d1720bfd71aefec3b302718e25

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://aeon-jp.perfectaffairsevents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Sun, 03 Mar 2024 05:50:02 GMT
content-encoding: gzip
last-modified: Mon, 29 Jan 2024 10:34:32 GMT
server: Apache
etag: "1a228-6101330f43e00-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 app.80e1a2a0.css
aeon-jp.perfectaffairsevents.com/static/css/ 199 KB
13 KB 8ms
6ms Stylesheet
text/css 47.74.9.224
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://aeon-jp.perfectaffairsevents.com/static/css/app.80e1a2a0.css
Requested by: Host: aeon-jp.perfectaffairsevents.com
URL: https://aeon-jp.perfectaffairsevents.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 47.74.9.224 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: 3ad112c95c6a72005e55e5af27f6469eeb2f10370a8a4ddb359276a7498a421f

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://aeon-jp.perfectaffairsevents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Sun, 03 Mar 2024 05:50:02 GMT
content-encoding: gzip
last-modified: Mon, 29 Jan 2024 10:34:32 GMT
server: Apache
etag: "31d97-6101330f43e00-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 12860

GET
H2 200 / Show response
api.ipregistry.co/ 2 KB
1 KB 68ms
49ms XHR
application/json 2606:4700::6812:1aaa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipregistry.co/?key=c33ltw8ssdbfb5nb
Requested by: Host: aeon-jp.perfectaffairsevents.com
URL: https://aeon-jp.perfectaffairsevents.com/static/js/chunk-vendors.872deca2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1aaa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aedc232d515378b6a93e0e53907292f8d74c73216d750a5127f31cc370c108bd

Request headers

Accept: application/json, text/plain, */*
Referer: https://aeon-jp.perfectaffairsevents.com/
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Sun, 03 Mar 2024 05:50:02 GMT
content-encoding: br
ipregistry-credits-consumed: 1
cf-cache-status: DYNAMIC
server: cloudflare
ipregistry-credits-remaining: 81335
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Ipregistry-Credits-Remaining, Ipregistry-Credits-Consumed, Ipregistry-Version, Ipregistry-Pod
ipregistry-version: 1
cf-ray: 85e758c0be323c03-NRT
alt-svc: h3=":443"; ma=86400
ipregistry-pod: ipregistry-api-5966c778f9-n4c5d

GET
H2 200 ip Show response
zlrnncy.cn/index/api/ 3 B
347 B 315ms
11ms XHR
text/html 47.74.9.224
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to

Full URL: https://zlrnncy.cn/index/api/ip
Requested by: Host: aeon-jp.perfectaffairsevents.com
URL: https://aeon-jp.perfectaffairsevents.com/static/js/chunk-vendors.872deca2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 47.74.9.224 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache /
Resource Hash: f9171164593756e56fb197327b529a4955590566560dbe62d586bff41be9d297

Request headers

Accept: application/json, text/plain, */*
Referer: https://aeon-jp.perfectaffairsevents.com/
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Mar 2024 05:50:02 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type, X-Auth-Token, x-token
content-length: 23
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 88c7f436124f03d80bedbe94d8a7beab68ab1785248d9ee3f0226591f76798e5

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 adsct
t.co/1/i/ 43 B
377 B 106ms
98ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=090ebd6a-5cb0-4e54-a1d6-20d0e6ed379a&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=748057a8-547d-4415-ae7d-8b4d4839a391&tw_document_href=https%3A%2F%2Flogin.jp.mercari.com%2Fsignin%3Fparams%3Dclient_id%253DbP4zN6jIZQeutikiUFpbx307DVK1pmoW%2526code_challenge%253DMqsLCOtvNNUXG84w6Yh8u7BVoLPCYZlepzP1yaVOKa4%2526code_challenge_method%253DS256%2526nonce%253DsL1xj7cBye.J%2526redirect_uri%253Dhttps%25253A%25252F%25252Fjp.mercari.com%25252Fauth%25252Fcallback%2526response_type%253Dcode%2526scope%253Dmercari%252Bopenid%2526state%253DeyJwYXRoIjoiLz91dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZ1dG1fY29udGVudD05NTE1MjkyOTc0XzE3MDUyMDAzNjFfNjgwNjM5Njk5NTNfNjQyNjg4MDA2NTA2X2t3ZC03NDk5Nzg1NzQxNzAmdXRtX2NhbXBhaWduPWJyYW5kJmdhZF9zb3VyY2U9MSZnY2xpZD1DandLQ0FpQTVMMnRCaEJURWl3QWRTeEpYNWhuSVZ1RUNYLXR4OEI2SmNFdHdqeEpVVVRoRzEyeVpfNnVoR0kzeldDWWljSFJWeVF6U3hvQ1lPTVFBdkRfQndFIiwicmFuZG9tIjoieEw2TGp4ejZELlkxIn0%25253D%2526ui_locales%253Dja&tw_iframe_status=0&txn_id=oclwa&type=javascript&version=2.3.29

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://aeon-jp.perfectaffairsevents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-response-time: 96
date: Sun, 03 Mar 2024 05:50:02 GMT
strict-transport-security: max-age=0
server: tsa_m
content-type: image/gif;charset=utf-8
x-transaction-id: b42f029da0e1efc5
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: ff89144c3a3e07bc4a3e192fc1ee9c6f75abb8db098af465e1c4198d0868dd73
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
724 B 109ms
99ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=090ebd6a-5cb0-4e54-a1d6-20d0e6ed379a&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=748057a8-547d-4415-ae7d-8b4d4839a391&tw_document_href=https%3A%2F%2Flogin.jp.mercari.com%2Fsignin%3Fparams%3Dclient_id%253DbP4zN6jIZQeutikiUFpbx307DVK1pmoW%2526code_challenge%253DMqsLCOtvNNUXG84w6Yh8u7BVoLPCYZlepzP1yaVOKa4%2526code_challenge_method%253DS256%2526nonce%253DsL1xj7cBye.J%2526redirect_uri%253Dhttps%25253A%25252F%25252Fjp.mercari.com%25252Fauth%25252Fcallback%2526response_type%253Dcode%2526scope%253Dmercari%252Bopenid%2526state%253DeyJwYXRoIjoiLz91dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZ1dG1fY29udGVudD05NTE1MjkyOTc0XzE3MDUyMDAzNjFfNjgwNjM5Njk5NTNfNjQyNjg4MDA2NTA2X2t3ZC03NDk5Nzg1NzQxNzAmdXRtX2NhbXBhaWduPWJyYW5kJmdhZF9zb3VyY2U9MSZnY2xpZD1DandLQ0FpQTVMMnRCaEJURWl3QWRTeEpYNWhuSVZ1RUNYLXR4OEI2SmNFdHdqeEpVVVRoRzEyeVpfNnVoR0kzeldDWWljSFJWeVF6U3hvQ1lPTVFBdkRfQndFIiwicmFuZG9tIjoieEw2TGp4ejZELlkxIn0%25253D%2526ui_locales%253Dja&tw_iframe_status=0&txn_id=oclwa&type=javascript&version=2.3.29

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_m /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://aeon-jp.perfectaffairsevents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-response-time: 96
date: Sun, 03 Mar 2024 05:50:02 GMT
strict-transport-security: max-age=631138519
server: tsa_m
content-type: image/gif;charset=utf-8
x-transaction-id: 12034425a5fce9fc
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: e672aef17cf7c9c7e53883584f235a099659b2d9fab19de2401d59443d2ab610
content-length: 43

GET
H2 204 0
bat.bing.com/action/ 0
560 B 71ms
55ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=27031631&tm=gtm002&Ver=2&mid=5c5d52b1-1669-436c-acd4-0edc05e88543&sid=0e6e7050b9b111eebe3239fc1e424a79&vid=d8dff630b82111eeb77b87d3217082ec&vids=0&msclkid=N&uach=pv%3D15.0.0&pi=918639831&lg=zh-CN&sw=1280&sh=720&sc=24&tl=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20-%20%E3%83%A1%E3%83%AB%E3%82%AB%E3%83%AA&p=https%3A%2F%2Flogin.jp.mercari.com%2Fsignin%3Fparams%3Dclient_id%253DbP4zN6jIZQeutikiUFpbx307DVK1pmoW%2526code_challenge%253DMqsLCOtvNNUXG84w6Yh8u7BVoLPCYZlepzP1yaVOKa4%2526code_challenge_method%253DS256%2526nonce%253DsL1xj7cBye.J%2526redirect_uri%253Dhttps%25253A%25252F%25252Fjp.mercari.com%25252Fauth%25252Fcallback%2526response_type%253Dcode%2526scope%253Dmercari%252Bopenid%2526state%253DeyJwYXRoIjoiLz91dG1fc291cmNlPWdvb2dsZSZ1dG1fbWVkaXVtPWNwYyZ1dG1fY29udGVudD05NTE1MjkyOTc0XzE3MDUyMDAzNjFfNjgwNjM5Njk5NTNfNjQyNjg4MDA2NTA2X2t3ZC03NDk5Nzg1NzQxNzAmdXRtX2NhbXBhaWduPWJyYW5kJmdhZF9zb3VyY2U9MSZnY2xpZD1DandLQ0FpQTVMMnRCaEJURWl3QWRTeEpYNWhuSVZ1RUNYLXR4OEI2SmNFdHdqeEpVVVRoRzEyeVpfNnVoR0kzeldDWWljSFJWeVF6U3hvQ1lPTVFBdkRfQndFIiwicmFuZG9tIjoieEw2TGp4ejZELlkxIn0%25253D%2526ui_locales%253Dja&r=https%3A%2F%2Fjp.mercari.com%2F&lt=1161&evt=pageLoad&sv=1&rn=774596

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://aeon-jp.perfectaffairsevents.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 03 Mar 2024 05:50:02 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 55311D1E35934BE7ACC12350ECC4CD77 Ref B: TYAEDGE0714 Ref C: 2024-03-03T05:50:02Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Mercari (E-commerce)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bing.com/	1970-01-21 04:12:21	Name: MUID Value: 38AAB3CF404F6D36049CA7F841A56C09
.bat.bing.com/	1970-01-20 19:00:49	Name: MR Value: 0
.t.co/	1970-01-21 04:26:45	Name: muc_ads Value: 19a7bd9d-b7be-4af2-9bdb-d38c7327d85f
.twitter.com/	1970-01-21 04:26:45	Name: guest_id_marketing Value: v1%3A170944500286054487
.twitter.com/	1970-01-21 04:26:45	Name: guest_id_ads Value: v1%3A170944500286054487
.twitter.com/	1970-01-21 04:26:45	Name: personalization_id Value: "v1_NpDPXjijKpuknsMy5s3EUQ=="
.twitter.com/	1970-01-21 04:26:45	Name: guest_id Value: v1%3A170944500286054487

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://aeon-jp.perfectaffairsevents.com/signin/params/client_id Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://aeon-jp.perfectaffairsevents.com/signin/params/client_id Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://aeon-jp.perfectaffairsevents.com/signin/params/client_id Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://aeon-jp.perfectaffairsevents.com/signin/params/client_id Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://aeon-jp.perfectaffairsevents.com/signin/params/client_id Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://aeon-jp.perfectaffairsevents.com/signin/params/client_id Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://aeon-jp.perfectaffairsevents.com/signin/params/client_id Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aeon-jp.perfectaffairsevents.com
analytics.twitter.com
api.ipregistry.co
bat.bing.com
t.co
zlrnncy.cn
104.244.42.131
104.244.42.69
2606:4700::6812:1aaa
2620:1ec:c11::200
47.74.9.224
075a8dcb37a5b1f9c2f9053d5bb0bb68bb3ac043e424907822f17111f4703d00
0909c6783a6315b9a492a10dad89f9f689d3159b6638c10f84a5290f37a77e2e
3ad112c95c6a72005e55e5af27f6469eeb2f10370a8a4ddb359276a7498a421f
54137c820ca3ec40cae8a72f9df1bc8b107e34cf22ec6d4214cc864318c0d358
88c7f436124f03d80bedbe94d8a7beab68ab1785248d9ee3f0226591f76798e5
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aedc232d515378b6a93e0e53907292f8d74c73216d750a5127f31cc370c108bd
de77b4ba09d35157bd60a37880ecaf550b12f4d1720bfd71aefec3b302718e25
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f9171164593756e56fb197327b529a4955590566560dbe62d586bff41be9d297

aeon-jp.perfectaffairsevents.com Open in urlscan Pro 47.74.9.224 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

50 %HTTPS

40 %IPv6

6 Domains

6 Subdomains

6 IPs

2 Countries

307 kBTransfer

950 kBSize

7 Cookies

6 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

7 Cookies

7 Console Messages

Indicators

aeon-jp.perfectaffairsevents.com Open in urlscan Pro
47.74.9.224 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

50 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

307 kB
Transfer

950 kB
Size

7
Cookies

10 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!