urlscan.io logo urlscan.io
SecurityTrails logo

deeprootshc.com Open in urlscan Pro
137.220.234.53  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://drucizrac21.life/ucindai94.php
Effective URL: https://deeprootshc.com/login
Submission: On August 22 via manual from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 137.220.234.53, located in Tokyo, Japan and belongs to BCPL-SG BGPNET Global ASN, SG. The main domain is deeprootshc.com.
TLS certificate: Issued by R3 on August 21st 2023. Valid for: 3 months.
This is the only time deeprootshc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sumitomo Mitsui Trust Bank (Financial)

Domain & IP information

IP Address AS Autonomous System
1 1 103.157.142.94 137443 (ANCHGLOBA...)
1 7 137.220.234.53 64050 (BCPL-SG B...)
6 2
Apex Domain
Subdomains		 Transfer
7 deeprootshc.com
deeprootshc.com
139 KB
1 drucizrac21.life
drucizrac21.life
116 B
6 2
Domain Requested by
7 deeprootshc.com 1 redirects deeprootshc.com
1 drucizrac21.life 1 redirects
6 2

This site contains links to these domains. Also see Links.

Domain
www.smtb.jp
faq.smtb.jp
sp.direct.smtb.jp
Subject Issuer Validity Valid
deeprootshc.com
R3		 2023-08-21 -
2023-11-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://deeprootshc.com/login
Frame ID: 4AD09E2738D802584D5FBD52D0A5115D
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

三井住友信託ダイレクト　ログイン

Page URL History Show full URLs

  1. https://drucizrac21.life/ucindai94.php HTTP 302
    https://deeprootshc.com/ HTTP 302
    https://deeprootshc.com/login Page URL

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

139 kB
Transfer

537 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://drucizrac21.life/ucindai94.php HTTP 302
    https://deeprootshc.com/ HTTP 302
    https://deeprootshc.com/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login
deeprootshc.com/
Redirect Chain
  • https://drucizrac21.life/ucindai94.php
  • https://deeprootshc.com/
  • https://deeprootshc.com/login
655 B
843 B 		Document
General
Check archive.org
Download Go to
Full URL
https://deeprootshc.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
137.220.234.53 Tokyo, Japan, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
14b9e302325faf5130f8315d895e551091464b3ac588bb844345212eb4f6e18e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
accept-language
ja-JP

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,X-Requested-with, Origin
access-control-allow-methods
POST,GET,OPTIONS,DELETE
access-control-allow-origin
*
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 22 Aug 2023 00:04:24 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,X-Requested-with, Origin
access-control-allow-methods
POST,GET,OPTIONS,DELETE
access-control-allow-origin
*
cache-control
no-cache,must-revalidate
content-type
text/html; charset=utf-8
date
Tue, 22 Aug 2023 00:04:24 GMT
location
login
server
nginx
strict-transport-security
max-age=31536000
chunk-vendors.4bcc9784.js
deeprootshc.com/js/ 		153 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://deeprootshc.com/js/chunk-vendors.4bcc9784.js
Requested by
Host: deeprootshc.com
URL: https://deeprootshc.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
137.220.234.53 Tokyo, Japan, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
1fc6ebbae22dbbf6ad7dfd97d707d70a15afa8b0d6f5c0f9e575e9f95361149f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
ja-JP
Referer
https://deeprootshc.com/login
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Tue, 22 Aug 2023 00:04:24 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Mon, 21 Aug 2023 01:17:44 GMT
server
nginx
etag
W/"64e2bb38-26468"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Tue, 22 Aug 2023 12:04:24 GMT
app.b0fb06b1.js
deeprootshc.com/js/ 		54 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://deeprootshc.com/js/app.b0fb06b1.js
Requested by
Host: deeprootshc.com
URL: https://deeprootshc.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
137.220.234.53 Tokyo, Japan, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
c0305d1d91da8f85f1b359c6f328203d908ddaa8d154a881edfe06c3d04c2de8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
ja-JP
Referer
https://deeprootshc.com/login
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Tue, 22 Aug 2023 00:04:24 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Mon, 21 Aug 2023 01:17:44 GMT
server
nginx
etag
W/"64e2bb38-d910"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=43200
expires
Tue, 22 Aug 2023 12:04:24 GMT
app.36725ff1.css
deeprootshc.com/css/ 		316 KB
57 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://deeprootshc.com/css/app.36725ff1.css
Requested by
Host: deeprootshc.com
URL: https://deeprootshc.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
137.220.234.53 Tokyo, Japan, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
c92778874c3f9511d79dbeaddc01dd75663440b1afadd422a1ad73f08ffe57a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
ja-JP
Referer
https://deeprootshc.com/login
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Tue, 22 Aug 2023 00:04:24 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Sun, 20 Aug 2023 22:44:04 GMT
server
nginx
etag
W/"64e29734-4ef84"
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=43200
expires
Tue, 22 Aug 2023 12:04:24 GMT
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3bd7320be21d57ce259ce84da90e763d25e5853861e3865cf62ee20b073236ec

Request headers

accept-language
ja-JP
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e33596e6ab8095d16f6aeb2ab4324fa0c7a8c766503b998b51a5299e479ce98d

Request headers

accept-language
ja-JP
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/png
c.gif
deeprootshc.com/assets/img/ 		548 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://deeprootshc.com/assets/img/c.gif
Requested by
Host: deeprootshc.com
URL: https://deeprootshc.com/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
137.220.234.53 Tokyo, Japan, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090

Request headers

accept-language
ja-JP
Referer
https://deeprootshc.com/login
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date
Tue, 22 Aug 2023 00:04:24 GMT
server
nginx
content-length
548
content-type
text/html
truncated
/ 		642 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a51c662b1298636333af6eaefde49ba5fa4456fab9e373cfaf167fcb0672b48f

Request headers

accept-language
ja-JP
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		78 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a290188e7a0c20b546669ecfc7bbbf4a2086b9b96475f80ce678dd0d5fd911a9

Request headers

accept-language
ja-JP
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/gif
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
97f960e714be72640366e2cc5ce2a512d92f1b17484c80e457c4b201cbb1ed41

Request headers

accept-language
ja-JP
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/png
getoptions
deeprootshc.com/index/ 		680 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://deeprootshc.com/index/getoptions?t=1692414761488
Requested by
Host: deeprootshc.com
URL: https://deeprootshc.com/js/chunk-vendors.4bcc9784.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
137.220.234.53 Tokyo, Japan, ASN64050 (BCPL-SG BGPNET Global ASN, SG),
Reverse DNS
Software
nginx /
Resource Hash
87b6908b1aafbda5fb5b6785681a2e8298f49876f0c7bf81806ab4ad98eaefd9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://deeprootshc.com/login
accept-language
ja-JP
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 22 Aug 2023 00:04:25 GMT
strict-transport-security
max-age=31536000
server
nginx
access-control-allow-methods
POST,GET,OPTIONS,DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Content-Length,Accept-Encoding,X-Requested-with, Origin
truncated
/ 		411 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
74455c23a578e9f125608254763298d966189b60aff1254ad6ee4e07a2f3e53c

Request headers

accept-language
ja-JP
Referer
User-Agent
Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sumitomo Mitsui Trust Bank (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| webpackChunkvvv function| clearImmediate function| setImmediate

1 Cookies

Domain/Path Name / Value
deeprootshc.com/ Name: PHPSESSID
Value: d23ffaf9508c27119d46a80df3de5e40

1 Console Messages

Source Level URL
Text
network error URL: https://deeprootshc.com/assets/img/c.gif
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000