rekuteent-qen.shop Open in urlscan Pro
2606:4700:3035::6815:284b Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://rekuteent-qen.shop/
Effective URL:
https://rekuteent-qen.shop/
Submission: On March 30 via api (March 30th 2022, 4:26:24 am UTC) from US — Scanned from DE

Summary HTTP 18 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3035::6815:284b, located in United States and belongs to CLOUDFLARENET, US. The main domain is rekuteent-qen.shop.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 29th 2022. Valid for: a year.

This is the only time rekuteent-qen.shop was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rakuten (E-commerce)

Domain & IP information

	IP Address		AS Autonomous System
1 19	2606:4700:303... 2606:4700:3035::6815:284b		13335 (CLOUDFLAR...) (CLOUDFLARENET)
18	1

19 2606:4700:3035::6815:284b (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

rekuteent-qen.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	rekuteent-qen.shop 1 redirects rekuteent-qen.shop	256 KB
18	1

	Domain	Requested by
19	rekuteent-qen.shop	1 redirects rekuteent-qen.shop
18	1

This site contains links to these domains. Also see Links.

Domain
r10.to
privacy.rakuten.co.jp
www.rakuten.co.jp
www.jpcert.or.jp

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-03-29` - `2023-03-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://rekuteent-qen.shop/
Frame ID: 79502581F0C05F22AD0ECDB40782695C
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

「楽天e-NAVI」会員個人情報明細設定確認

Page URL History Show full URLs

http://rekuteent-qen.shop/ HTTP 301
https://rekuteent-qen.shop/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

255 kB
Transfer

612 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://r10.to/hroftZ
Title: ユーザID・パスワードを忘れた場合

Search URL Search Domain Scan URL

URL: https://privacy.rakuten.co.jp/
Title: 個人情報保護方針

Search URL Search Domain Scan URL

URL: https://www.rakuten.co.jp/myrakuten/help/
Title: 楽天会員とは？

Search URL Search Domain Scan URL

URL: https://www.jpcert.or.jp/m/pr/2017/pr170002.html

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://rekuteent-qen.shop/ HTTP 301
https://rekuteent-qen.shop/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response rekuteent-qen.shop/ Redirect Chain http://rekuteent-qen.shop/ https://rekuteent-qen.shop/	15 KB 5 KB	206ms 171ms	Document text/html	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `799ee14c82d4ca38986fffbc0d43ba8279d966e053848ce7ad0434a460dc63e4` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zrWakNwhhduWu1MH8vPMpCUqwSckBVCJqRZkCCf583FYkDP8oSlnb%2FtQ5ymZyE7lM%2F0sYmg1QnVssH1cQibFyJRUVl%2B73%2BHIKNlMKKppWr%2Be4CsRsl4HLb9YEv4MjZbXjKsuxjOyG0YawOyROjpxijY%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6f3e161f6b9c9be0-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 Redirect headers Date Wed, 30 Mar 2022 04:26:19 GMT Content-Type text/html; charset=iso-8859-1 Transfer-Encoding chunked Connection keep-alive Location https://rekuteent-qen.shop/ CF-Cache-Status DYNAMIC Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hi5%2F%2FdwHdcJRAoU95RBUk6yFFF5%2FXxBRhewvmbPheT2qzQzLlPU2cM1zTDmrS2vPr8KWrs1aDXjBbsWZbkc4LMv0rZOvd1b6R0ivkDaswjcW27lYzwDShq%2F9VgwEfTTqwBAIOdSvfIpGnP2FZc%2FF1PA%3D"}],"group":"cf-nel","max_age":604800} NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server cloudflare CF-RAY 6f3e161e5d638fe6-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	sp_common.css rekuteent-qen.shop/static/css/	227 KB 41 KB	24ms 23ms	Stylesheet text/css	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/static/css/sp_common.css Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `77efbb5f5cf06778aba823826dd8f9536b0bf1d47d1aa8ba97c7c9c0059ee8d9` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:18 GMT server cloudflare age 7157 etag W/"38b4d-5c777f4580c80-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FVc%2BujFQxQN9Wlb4Qf5avCpYAe3L6kwfYhYF2NEK3342H7Hf4VPMXaV3dktNPk2ZXGyySXVE%2B5rXZSD9CAZEaQMbZtNT7hK7A%2BFHPD3gziWOhByST80x04ogHmW3M2ELsRngJyLyRVD5%2BvEddQW2frY%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e16209d439be0-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	common.css rekuteent-qen.shop/static/css/	61 KB 14 KB	25ms 24ms	Stylesheet text/css	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/static/css/common.css Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `121aa517ace6525a925b27ef74e5055c63d427cbadaca3b69a850cc0804faac3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:20 GMT server cloudflare age 7157 etag W/"f48e-5c777f4769100-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FpkZ8LcY91kxQ5PPWd1I%2F2Tx3zuJTGbLj65PN5VJEc9poDeLneUtnsdXlvbf5m7BcB5UBM0MEoFUjA2SXzmkjAw%2BsXRb8lHBNj2h%2FhDGZwOcQzkQZYxKEae3JVeEKNU4jiw%2BRWoWCehxzYop3r7UHqc%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e16209d459be0-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	sdbutton.css rekuteent-qen.shop/static/css/	5 KB 1 KB	21ms 20ms	Stylesheet text/css	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/static/css/sdbutton.css Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11011118c3d568ad8f85fc1a425c6b23388cb6fe2b82bf70eecc62e1eb01180e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:20 GMT server cloudflare age 7157 etag W/"1250-5c777f4769100-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0DItbhjH5%2BvD9OcqizFp0DoLYrhr47XlzO5cezggnBDinlXGbs4ePW0kuCfZK6F%2BWr%2BU6o7iAhXe%2BWRIspiNYmTPS3vn5Xj6nVkER1Cv5BfmWFINafmejWqhbe9gcQgUKqJ9zvvxkYLmvFpDsOWGMYI%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e16209d469be0-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	jquery.js Show response rekuteent-qen.shop/static/js/	85 KB 31 KB	35ms 35ms	Script application/javascript	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/static/js/jquery.js Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `95f2c86bfe7ee21b7909359e9482891dfe0afad7308c0468ce9ecdfcadc20297` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 12:46:58 GMT server cloudflare age 7157 etag W/"152c0-5c77955341480-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QvzSiTISiVTx8XnZHubpGuofS0Q4ar2J1ssA0j4bkSvBFLTXc%2BET1G1C0xTM4Xyy8Kya1AnCxUoxjIarZqJliALviMCQZYgKT8rME9btrHz07rqOgach%2FiGpBC2mWCuyArUPyqnjZBn%2BtpLoN4jlpLU%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e16209d4b9be0-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	login.css rekuteent-qen.shop/static/css/	8 KB 2 KB	21ms 20ms	Stylesheet text/css	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/static/css/login.css Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5934fa5c59af64fddb141d602df8fd549777daa7894f2662c1612e9ca750b4c4` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:22 GMT server cloudflare age 7157 etag W/"1ee9-5c777f4951580-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W3YEIaTcNzD6Q2UkVCPcJJIDPa3%2FuXInxG8dritGFpMhLzKMGhqoIMtQj9VnDTcpeNVnWLKf3Nk7ugmQmSr2Lap71Pjc2iFcvbNPINe%2FVQ6aRyZ0dgY3PsIK16pRZeFxrh3%2FXqbBq2gkquXhq9d4NNA%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e16209d479be0-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	challenger.css rekuteent-qen.shop/static/css/	2 KB 889 B	22ms 22ms	Stylesheet text/css	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/static/css/challenger.css Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7a6a7a40c68cebdf9ce6829ffdf782b7da922d049cf39c3ba911b5491f4683e7` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:22 GMT server cloudflare age 7157 etag W/"742-5c777f4951580-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TXFclLPgeFL662QwZwbO9sCOQXj7VJIZP4Kx%2B9g2nYZWsKJB5C6hWkfLOkaQoEjHViG18ycojp0Ulr%2BbuI%2FqVaT2b%2FBqC9cFnqXvVC4dyJRr4%2BtznjDlwTtHfYl2GhuvzbtkVMUhtRxCgFz6NU18CSw%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e16209d489be0-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	rc-logo_cardenavi_2.svg rekuteent-qen.shop/static/picture/	9 KB 4 KB	27ms 27ms	Image image/svg+xml	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rekuteent-qen.shop/static/picture/rc-logo_cardenavi_2.svg Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `77466d0200849ec13ab960b689dca4b5b99e804adb47b6154e986efcd8c7f6b1` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:26 GMT server cloudflare age 7156 etag W/"2356-5c777f4d21e80-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5oS03Cm5sHdUc09RgF8fm5XJO3lrzY4jcAt78d6I7WtnlfkylqyO%2FmVtN8JTrQXPVy8S%2F9SHcJe4OD6IlP8eed9TMZrSovLwIBAjgQm7stCO8ErT27I5qfrLC9FiXSzcrXDbbAiuQIzsB7wvLpsU%2FaM%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e1620da9f9170-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	stop_540x249.png rekuteent-qen.shop/static/picture/	57 KB 57 KB	19ms 19ms	Image image/png	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rekuteent-qen.shop/static/picture/stop_540x249.png Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 7156 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 58080 last-modified Mon, 19 Jul 2021 11:08:32 GMT server cloudflare etag "e2e0-5c777f52dac00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7KyCW%2BJTRd9nXn5pMw0mSAFN3%2F9umzCBNQ78te%2BuF6kWgbvdsyyTdd1rrqaX3CfyEP%2F%2Fe4VihvlJGDZgRJ99V5bAF2HV2C91qCtS4e6c4ArJvvedO8IJucjuFiHTwn%2F%2BkpdaSEc%2BdL6ubqa6NeVfCUw%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 6f3e1620eabc9170-FRA
GET H3	200	s_code.js Show response rekuteent-qen.shop/static/js/	68 KB 22 KB	27ms 27ms	Script application/javascript	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/static/js/s_code.js Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `960abdbe80f92171902a46760bfa776eab85b8c5e7b1a84950132c92c44a51a9` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:34 GMT server cloudflare age 7156 etag W/"11016-5c777f54c3080-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hWELUxMRQ9P5yQIr8ZE4GjiDgyvlAPNPmjTeM4kesgFup%2FOtYmysfEkPwM%2F9NfI7bn%2B5o6gc8JBwWp2XWsVFo1jQMmLePDqvii3X%2B0QNAVWtTHGCQ3E5gfQZq2z2%2FIiXlKOBHFYQzmbgseMFXgv3eB8%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e1620ca7b9170-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	rexicon-32-eye-f.svg rekuteent-qen.shop/static/fonts/	2 KB 1 KB	42ms 42ms	Image image/svg+xml	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rekuteent-qen.shop/static/fonts/rexicon-32-eye-f.svg Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/static/css/login.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/static/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:32 GMT server cloudflare age 7156 etag W/"71e-5c777f52dac00-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pf%2BOM3LJFZQndsKTGlTDwGxoA%2BO3gZd2Mcw%2BqK8gB934iKeQlSjb1mLtGXs%2BlNjpFiM35k0g7R33hPSmpoUcBy1zSTwPdim8dWxhTD%2BFPOhLsNLRsOjDkvZfnZqA4akkP1ipz%2BMRYca7Q%2Bk1m8ugT1I%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e1620eac89170-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	rexicon-32-check.svg rekuteent-qen.shop/static/fonts/	2 KB 1 KB	43ms 42ms	Image image/svg+xml	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rekuteent-qen.shop/static/fonts/rexicon-32-check.svg Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/static/css/login.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/static/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:40 GMT server cloudflare age 7156 etag W/"71e-5c777f5a7be00-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=76Wl543wmPxRybu1WajC10KV18ssWd7TvPs%2BmnAz81k4SD6XOKryEFxlxCxi0mv48%2BgHylyqCSqM7s9K6GgYQ6wX0%2BEmknmnIqOiCUtf5G9SecT4xBOIUIpL5g%2FidOrXKMWmCkyy43o%2FUtrPIgv2YiQ%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e1620eaca9170-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	rexicon-32-new-window-l.svg rekuteent-qen.shop/static/fonts/	2 KB 1 KB	42ms 42ms	Image image/svg+xml	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rekuteent-qen.shop/static/fonts/rexicon-32-new-window-l.svg Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/static/css/login.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/static/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:40 GMT server cloudflare age 7156 etag W/"71e-5c777f5a7be00-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vjWPo5jd09nXH9h6njPujuQk7e5Z0CG5D2C7e%2Fy3vlzCfRB0nEeDL15BCvkRL8zpwBqV9ORbdGCvS%2FQ%2FD199uA0bDg6E3%2BOTWqv%2FN1F%2F7ZQmcAqHbLAAe%2Fnp6PdEDV4JpUdpRGXxdBCMTBDvooWk7G4%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e1620eacc9170-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	rexicon-32-chevron-right.svg rekuteent-qen.shop/static/fonts/	2 KB 1 KB	42ms 42ms	Image image/svg+xml	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rekuteent-qen.shop/static/fonts/rexicon-32-chevron-right.svg Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/static/css/login.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/static/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:34 GMT server cloudflare age 7156 etag W/"71e-5c777f54c3080-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5g%2FJCmh5RYoDhgdcs7Zp7oXqEQf1FL0SgXpxb4MxoWbuIzpUnskYT36nFPF46Ga7XpX2biM5lDnfj0nXfh0sIwWGcRhxcNwCtJLPGRPMblrD2HdJJoExohY7%2By42Bg%2ByzlGApJLz%2Fthn2utXwXcMNo8%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e1620eacd9170-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	rexicon-32-sign-info-l.svg rekuteent-qen.shop/static/fonts/	2 KB 1 KB	19ms 19ms	Image image/svg+xml	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rekuteent-qen.shop/static/fonts/rexicon-32-sign-info-l.svg Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/static/css/login.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/static/css/login.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status HIT last-modified Mon, 19 Jul 2021 11:08:34 GMT server cloudflare age 7156 etag W/"71e-5c777f54c3080-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lQT3ycI%2FNr%2FbHhq2dIztIBh2LQLuWnnd5%2F5xxjyZRcgSlQW9CrissiEkCEFRIFtSUgVXVPL%2B5vTTlvkg9fCZb%2FNSEqmNPCPi5%2BpW6ctVo5vJ9rQOHJIUlcGbmnjN5wsB6tlY954AEUbEGDzGDWMtPqw%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6f3e16214b709170-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	rex_icon.png rekuteent-qen.shop/static/images/	69 KB 69 KB	20ms 20ms	Image image/png	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rekuteent-qen.shop/static/images/rex_icon.png Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/static/css/sp_common.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `915d7d7f0dc23fb06f2532550fdf71c1dcb21622dd6eb47b2edfde085a73d87d` Request headers Accept-Language de-DE,de;q=0.9 Referer https://rekuteent-qen.shop/static/css/sp_common.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 7156 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 70318 last-modified Mon, 19 Jul 2021 11:08:32 GMT server cloudflare etag "112ae-5c777f52dac00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T0LADg792zbmcBXZHJNZWEGS7G5wvhpvpXrmNfg9upffT%2B20iZFq2%2BdW7x7YqjLCak27iMH8VVNKOPxu9GUhi5NJktN2Kj%2B9XknIbEoAttQ%2BaMWXpo3amBRzNTvgo%2BSaBQa4XJ3AGYXwIZOgyec9UJU%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 6f3e16214b719170-FRA
GET H3	404	3723e1b35a094d16b6bfb1fedc8207e7.woff rekuteent-qen.shop/static/fonts/	0 0	170ms 170ms	Font text/html	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/static/fonts/3723e1b35a094d16b6bfb1fedc8207e7.woff Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/static/css/sp_common.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://rekuteent-qen.shop/static/css/sp_common.css Origin https://rekuteent-qen.shop Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:19 GMT content-encoding br cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=20htXDb3DTP64TvRU4CVKZBM0zpuBngKe7l%2FVQD%2B91NUrNXbBOgQuaXQ429KPCHSx%2B6gVWgZRCcKbOVaQGRste1uaR0XmJ9YkeDCmPVRv0HTzrNlrSLE9BC4wIWd67hd61KtahUGZVga6q5d9I0YdB8%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 6f3e16214b729170-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	404	25bc0cc914b040e68262c159840cee19.woff rekuteent-qen.shop/static/fonts/	0 0	166ms 166ms	Font text/html	2606:4700:3035::6815:284b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rekuteent-qen.shop/static/fonts/25bc0cc914b040e68262c159840cee19.woff Requested by Host: rekuteent-qen.shop URL: https://rekuteent-qen.shop/static/css/sp_common.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::6815:284b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://rekuteent-qen.shop/static/css/sp_common.css Origin https://rekuteent-qen.shop Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers date Wed, 30 Mar 2022 04:26:20 GMT content-encoding br cf-cache-status EXPIRED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PorQ%2BBVv7fQxTBtfXdvUih5qyTh8%2FoiV6Dw00UTy1WDs7J75Jnxb5gg1ocKkuCl6d4JHTu%2BNrYG9oXAyRIxG6VCJKdzJjpu6tWCPRChgOSheNNq81ZvZc%2B1t5ndaCOZBPN16tYA9F5HYJhMV0%2ByL3J0%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 6f3e16225dad9170-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rakuten (E-commerce)

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://rekuteent-qen.shop/(Line 13) Message: X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.
network	error	URL: https://rekuteent-qen.shop/static/fonts/3723e1b35a094d16b6bfb1fedc8207e7.woff Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://rekuteent-qen.shop/static/fonts/25bc0cc914b040e68262c159840cee19.woff Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

rekuteent-qen.shop
2606:4700:3035::6815:284b
11011118c3d568ad8f85fc1a425c6b23388cb6fe2b82bf70eecc62e1eb01180e
121aa517ace6525a925b27ef74e5055c63d427cbadaca3b69a850cc0804faac3
5934fa5c59af64fddb141d602df8fd549777daa7894f2662c1612e9ca750b4c4
77466d0200849ec13ab960b689dca4b5b99e804adb47b6154e986efcd8c7f6b1
77efbb5f5cf06778aba823826dd8f9536b0bf1d47d1aa8ba97c7c9c0059ee8d9
799ee14c82d4ca38986fffbc0d43ba8279d966e053848ce7ad0434a460dc63e4
7a6a7a40c68cebdf9ce6829ffdf782b7da922d049cf39c3ba911b5491f4683e7
915d7d7f0dc23fb06f2532550fdf71c1dcb21622dd6eb47b2edfde085a73d87d
95f2c86bfe7ee21b7909359e9482891dfe0afad7308c0468ce9ecdfcadc20297
960abdbe80f92171902a46760bfa776eab85b8c5e7b1a84950132c92c44a51a9
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

rekuteent-qen.shop Open in urlscan Pro 2606:4700:3035::6815:284b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

255 kBTransfer

612 kBSize

0 Cookies

4 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

38 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

rekuteent-qen.shop Open in urlscan Pro
2606:4700:3035::6815:284b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

255 kB
Transfer

612 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!