guodkxu.cn
Open in
urlscan Pro
2606:4700:3033::6815:38b7
Malicious Activity!
Public Scan
Effective URL: https://guodkxu.cn/pc/login.php?https://login.account.rakuten.com/session/upgrade?token=@St.ott-v2.gwADdOZ3MavRpvso...
Submission Tags: gc
Submission: On September 19 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1P5 on September 12th 2023. Valid for: 3 months.
This is the only time guodkxu.cn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rakuten (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3035::ac43:9b47 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 10 | 2606:4700:303... 2606:4700:3033::6815:38b7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
guodkxu.cn
2 redirects
guodkxu.cn |
85 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
11 | 2 |
Domain | Requested by | |
---|---|---|
11 | guodkxu.cn |
2 redirects
guodkxu.cn
|
0 | scrapbook Failed |
guodkxu.cn
|
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.guodkxu.cn GTS CA 1P5 |
2023-09-12 - 2023-12-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://guodkxu.cn/pc/login.php?https://login.account.rakuten.com/session/upgrade?token=@St.ott-v2.gwADdOZ3MavRpvsoL25QQ6eSggqgcu2z.bQv5kXoZzcUZEvYyiCbjU49TpgxhhVguT1Dxo-_FJ6XWilABboVOG2RrKYeHTmaJpYOAerSx5McvvyytQ76N9wIE7FfP2N6udrOHUanJmw_8tG6TO11aDZMj8QEBfi519xKZ7gidT-qj6HlZZHiYjfZDrPz3cB40xXNk1I8i5McndBFbabMx4ZoAidmCG42fOPWYfZlbx5qKt1UzJWW2acpXVgwTxiNE3gVUpKAJRIdimyI4w6dbFKCC6mUSRmh4wQ0PpTILD7ml2-mRzoDvmttrIAUPtv3SOsvUNTMYfWDNDBneZ1lRiPBlq80o01T-ERsKiuAVtv8ke7e8MEFPJeYQXjfIW2Nyon5-1ddORBHm-JyH6x22gTpGOg5FskmXrML6FvMW0rRnef3325EIRWz66QeyaoSoZHF7tT4yoF01_kRmSmcib-4sLnWIUqqCxS7JjEGBQ4D9UkimVMeilQ39vxOLqx-hUb-oYBNk-x2A-kMWoK9Harbzt17w2AIaK0sdZUs3i6CnS4-ZVkD8cPDoRPpVBR6ruJJ38MIJl6E6iHlcMeq5NXIBV2nxCI2fVUEDrxuHyMvn7pqnkyrzocSFn2gQkGa327LrxDjWSVzYcBBeDI3K8mf-P9EDPNaWoBuYIS00bLERnolhqdxoRtV4mPIsGV9iaKhFNAYpvvtgWhtQLiru2qjaql3n9DTcIhcgGp4gzVc_4CC1-8Km7cm5b8tpbPLSho4hEqVT9CatoAf8e_nhb8I8cL7ru0994UTxbvjfbjTl1n2EpsWVjXO_TFhMgvxPi72wfEFkShs-0p5bsMrfO_-c7YQkU8XaiLTEPSCquRrLcqbkI4o0tiUuJKrqeOZ7SSI4eOyCBK6LduGyjAVJz5T1HQTOuABPalP0JrxQKrvNaKnwGDaimF6xr01omCR8DDr49WYjSNZkzWXwha9DYCo0boPXeXNaLIaEGbqL-ypV31YVFw5yg0WcV3WO9WX7wnC3K6XxLSrY5WUX_3lRFsH6Vfom5tUK06SFokEl6_o1sFCEC_vpmQpysSel1RpKOSjOzpLAbD54xOXoTBq_n7976tAuvaKf3z9W_2Aj2danEAxmryZU_jQfsz30RWWrKDBHtsnjmzdAgLn1aR68xkyJc7GlEr-ZH7mWa6bTEMG9wnAXW7Z34Y_qp-xHkYeYk-NqkU5RH0JvQA-Yt08N8FwOyz9OhIznpoEmjWFUkJyAOBcpphtNgoSGxSI0mM17qiv3PgUwZV72wh7I4P7AvfOtDn_yydDPzOWa6Vvgo_O2q163Mk6hlniRTEUr-HiCH_mBYTpZhEBlxeO1oreSXbCzMBhBPjFJ4T8q6VF186wksx9ma9ZJA4gK523m7fdhslquMbV2Ag1VWI0oSJvkxHJXJVLi7fs77b6WUwNyhfskyZDZVw-wJfIKG5XdYjBs5gGR1lga0OITpNM8lXLLyECw2MtGpYb7sawjVZiXKF19URKgTAtBAIuHf0igW88JF_H7onMbcZ_U8iqMxSkSnuGisQZlldUkE-HcYVfD-J-6Z2e4iKAja3oiHKv33hS1LurUlJx8lQ73sARVf99N6q2ade0FKlL2qQwo8DlEHAhIKu8Nh0cW1sTbFAzRgh-yMZ_SCTe3ujAzGgwYA_vGK_L9sIg5mz0KoLzkpoQPAnfIVpFnaNGiSEXLHct0Tq-KherZGECibDsZm-5huBlbvLqygj7wYUa-ag8O4_rR1IJtzCjX_JqkeilnI4mW4Zt6VzOx3yzqUl5X0HpXgRyxgWCuv-19IozTLCDSsw
Frame ID: 7481E7088D305D54019B3C4C1127C0C4
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
【楽天】ログインPage URL History Show full URLs
-
http://guodkxu.cn/
HTTP 301
https://guodkxu.cn/ HTTP 302
https://guodkxu.cn/pc/login.php?https://login.account.rakuten.com/session/upgrade?token=@St.ott... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://guodkxu.cn/
HTTP 301
https://guodkxu.cn/ HTTP 302
https://guodkxu.cn/pc/login.php?https://login.account.rakuten.com/session/upgrade?token=@St.ott-v2.gwADdOZ3MavRpvsoL25QQ6eSggqgcu2z.bQv5kXoZzcUZEvYyiCbjU49TpgxhhVguT1Dxo-_FJ6XWilABboVOG2RrKYeHTmaJpYOAerSx5McvvyytQ76N9wIE7FfP2N6udrOHUanJmw_8tG6TO11aDZMj8QEBfi519xKZ7gidT-qj6HlZZHiYjfZDrPz3cB40xXNk1I8i5McndBFbabMx4ZoAidmCG42fOPWYfZlbx5qKt1UzJWW2acpXVgwTxiNE3gVUpKAJRIdimyI4w6dbFKCC6mUSRmh4wQ0PpTILD7ml2-mRzoDvmttrIAUPtv3SOsvUNTMYfWDNDBneZ1lRiPBlq80o01T-ERsKiuAVtv8ke7e8MEFPJeYQXjfIW2Nyon5-1ddORBHm-JyH6x22gTpGOg5FskmXrML6FvMW0rRnef3325EIRWz66QeyaoSoZHF7tT4yoF01_kRmSmcib-4sLnWIUqqCxS7JjEGBQ4D9UkimVMeilQ39vxOLqx-hUb-oYBNk-x2A-kMWoK9Harbzt17w2AIaK0sdZUs3i6CnS4-ZVkD8cPDoRPpVBR6ruJJ38MIJl6E6iHlcMeq5NXIBV2nxCI2fVUEDrxuHyMvn7pqnkyrzocSFn2gQkGa327LrxDjWSVzYcBBeDI3K8mf-P9EDPNaWoBuYIS00bLERnolhqdxoRtV4mPIsGV9iaKhFNAYpvvtgWhtQLiru2qjaql3n9DTcIhcgGp4gzVc_4CC1-8Km7cm5b8tpbPLSho4hEqVT9CatoAf8e_nhb8I8cL7ru0994UTxbvjfbjTl1n2EpsWVjXO_TFhMgvxPi72wfEFkShs-0p5bsMrfO_-c7YQkU8XaiLTEPSCquRrLcqbkI4o0tiUuJKrqeOZ7SSI4eOyCBK6LduGyjAVJz5T1HQTOuABPalP0JrxQKrvNaKnwGDaimF6xr01omCR8DDr49WYjSNZkzWXwha9DYCo0boPXeXNaLIaEGbqL-ypV31YVFw5yg0WcV3WO9WX7wnC3K6XxLSrY5WUX_3lRFsH6Vfom5tUK06SFokEl6_o1sFCEC_vpmQpysSel1RpKOSjOzpLAbD54xOXoTBq_n7976tAuvaKf3z9W_2Aj2danEAxmryZU_jQfsz30RWWrKDBHtsnjmzdAgLn1aR68xkyJc7GlEr-ZH7mWa6bTEMG9wnAXW7Z34Y_qp-xHkYeYk-NqkU5RH0JvQA-Yt08N8FwOyz9OhIznpoEmjWFUkJyAOBcpphtNgoSGxSI0mM17qiv3PgUwZV72wh7I4P7AvfOtDn_yydDPzOWa6Vvgo_O2q163Mk6hlniRTEUr-HiCH_mBYTpZhEBlxeO1oreSXbCzMBhBPjFJ4T8q6VF186wksx9ma9ZJA4gK523m7fdhslquMbV2Ag1VWI0oSJvkxHJXJVLi7fs77b6WUwNyhfskyZDZVw-wJfIKG5XdYjBs5gGR1lga0OITpNM8lXLLyECw2MtGpYb7sawjVZiXKF19URKgTAtBAIuHf0igW88JF_H7onMbcZ_U8iqMxSkSnuGisQZlldUkE-HcYVfD-J-6Z2e4iKAja3oiHKv33hS1LurUlJx8lQ73sARVf99N6q2ade0FKlL2qQwo8DlEHAhIKu8Nh0cW1sTbFAzRgh-yMZ_SCTe3ujAzGgwYA_vGK_L9sIg5mz0KoLzkpoQPAnfIVpFnaNGiSEXLHct0Tq-KherZGECibDsZm-5huBlbvLqygj7wYUa-ag8O4_rR1IJtzCjX_JqkeilnI4mW4Zt6VzOx3yzqUl5X0HpXgRyxgWCuv-19IozTLCDSsw Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
guodkxu.cn/pc/ Redirect Chain
|
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ichiba_chat_appender_v1_0.css
guodkxu.cn/pc/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
common_login.css
guodkxu.cn/pc/static/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
loginstyle.css
scrapbook:download:error:sstatic/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
rakuten_pc_32px@2x_wm.png
guodkxu.cn/pc/static/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
t.gif
guodkxu.cn/pc/static/ |
43 B 519 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
stop_540x249.png
guodkxu.cn/pc/static/ |
57 KB 57 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
rakuten_pc_20px@2x.png
guodkxu.cn/pc/static/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
challenger.css
scrapbook:download:error:static/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pop.gif
guodkxu.cn/pc/static/ |
75 B 548 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
common_login.css
guodkxu.cn/pc/static/ |
11 KB 11 KB |
Image
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:sstatic/css/loginstyle.css
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:static/css/challenger.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rakuten (E-commerce)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
guodkxu.cn/ | Name: PHPSESSID Value: 38c1e4id1lfh5hknq8k0er896e |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
guodkxu.cn
scrapbook
scrapbook
2606:4700:3033::6815:38b7
2606:4700:3035::ac43:9b47
281c5ae8bf152f644e12a943ec5d59681e1950c54fb6c0b3cc77539bf5e69340
62775ef2856f63d6399abc1d54077916df8d62b16414816012b9ff0fad4efada
6da28d7a134d543417892f859bad07f0ac729296d84618a57d30b31810cea58a
7ab9a4d7f597471f82e8ebc6019525cd45f81decff7853062056a3c3417eba59
c51074f2c48a771074f75cbb2e383d05cde7369aa2e5c7b97969e5f7c9f8fede
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5ed5dcfe7dfbfa060c4964056b8724f2e235baf5d49b40af3212cb8bf38a9ed