groupe-baobab.com Open in urlscan Pro
204.152.210.84 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://groupe-baobab.com/
Effective URL:
https://groupe-baobab.com/
Submission Tags: gc
Submission: On May 27 via api (May 27th 2023, 6:14:43 am UTC) from JP — Scanned from JP

Summary HTTP 29 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 5 domains to perform 29 HTTP transactions. The main IP is 204.152.210.84, located in Los Angeles, United States and belongs to PACIFICRACK, US. The main domain is groupe-baobab.com.
TLS certificate: Issued by R3 on May 26th 2023. Valid for: 3 months.

This is the only time groupe-baobab.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rakuten (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
1 18	204.152.210.84 204.152.210.84	64270 (PACIFICRACK) (PACIFICRACK)
5	23.39.217.163 23.39.217.163	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:140b:1a0... 2600:140b:1a00:393::26b2	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.39.217.169 23.39.217.169	16625 (AKAMAI-AS) (AKAMAI-AS)
1	23.35.196.216 23.35.196.216	16625 (AKAMAI-AS) (AKAMAI-AS)
2	99.84.140.30 99.84.140.30	16509 (AMAZON-02) (AMAZON-02)
29	7

18 204.152.210.84 (Los Angeles, United States) 1 redirects

ASN64270 (PACIFICRACK, US)
PTR: 204.152.210.84.static.quadranet.com

groupe-baobab.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.39.217.163 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-39-217-163.deploy.static.akamaitechnologies.com

jp.rakuten-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
image.card.jp.rakuten-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:1a00:393::26b2 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

r.r10s.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.39.217.169 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-39-217-169.deploy.static.akamaitechnologies.com

www.rakuten.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.196.216 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-196-216.deploy.static.akamaitechnologies.com

rat.rakuten.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.84.140.30 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-140-30.nrt57.r.cloudfront.net

assets.withdesk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	groupe-baobab.com 1 redirects groupe-baobab.com	169 KB
5	rakuten-static.com jp.rakuten-static.com — Cisco Umbrella Rank: 171994 image.card.jp.rakuten-static.com	2 KB
4	rakuten.co.jp www.rakuten.co.jp — Cisco Umbrella Rank: 133144 rat.rakuten.co.jp — Cisco Umbrella Rank: 34292	14 KB
2	withdesk.com assets.withdesk.com — Cisco Umbrella Rank: 890189
1	r10s.jp r.r10s.jp — Cisco Umbrella Rank: 113399	11 KB
29	5

	Domain	Requested by
18	groupe-baobab.com	1 redirects groupe-baobab.com
4	image.card.jp.rakuten-static.com	groupe-baobab.com
3	www.rakuten.co.jp	groupe-baobab.com www.rakuten.co.jp
2	assets.withdesk.com	groupe-baobab.com
1	rat.rakuten.co.jp	www.rakuten.co.jp
1	r.r10s.jp	groupe-baobab.com
1	jp.rakuten-static.com	groupe-baobab.com
29	7

This site contains links to these domains. Also see Links.

Domain
r10.to
www.rakuten.co.jp
ichiba.faq.rakuten.net
static.id.rakuten.co.jp
www.jpcert.or.jp
privacy.rakuten.co.jp
www.rakuten-card.co.jp
grp12.ias.rakuten.co.jp
support.rakuten-card.jp

Subject Issuer	Validity	Valid
letsbuyjerseys.com R3	`2023-05-26` - `2023-08-24`	3 months	crt.sh
intl.rakuten-static.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-18` - `2024-04-17`	a year	crt.sh
*.r10s.jp GeoTrust RSA CA 2018	`2022-07-30` - `2023-08-02`	a year	crt.sh
www.rakuten.co.jp DigiCert SHA2 Extended Validation Server CA	`2023-02-16` - `2024-02-16`	a year	crt.sh
*.rakuten.co.jp GeoTrust RSA CA 2018	`2022-07-23` - `2023-07-26`	a year	crt.sh
assets.withdesk.com Amazon RSA 2048 M02	`2023-03-17` - `2024-04-14`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://groupe-baobab.com/
Frame ID: 461427AB84486B6C3A53E2997DE30701
Requests: 22 HTTP requests in this frame

Frame: https://www.rakuten.co.jp/com/rat/plugin/external/ral-iframe-rakuten.co.jp.html?o-id=https%3A%2F%2Fgroupe-baobab.com
Frame ID: 1C8F9F8E419EE3F2DE113E09642B2EB1
Requests: 6 HTTP requests in this frame

Frame: https://groupe-baobab.com/moban_pc/%E6%A5%BD%E5%A4%A9e-NAVI_%20%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%E7%94%BB%E9%9D%A2_files/saved_resource.html
Frame ID: 9B05C7AE4B2AF7967EA6A43E2FD26AF1
Requests: 1 HTTP requests in this frame

Frame: https://groupe-baobab.com/moban_pc/%E6%A5%BD%E5%A4%A9e-NAVI_%20%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%E7%94%BB%E9%9D%A2_files/saved_resource(1).html
Frame ID: 45D976A47D7F91F6515CEDDA9B68D63D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

[楽天市場]

Page URL History Show full URLs

http://groupe-baobab.com/ HTTP 301
https://groupe-baobab.com/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

29
Requests

41 %
HTTPS

17 %
IPv6

5
Domains

7
Subdomains

7
IPs

2
Countries

196 kB
Transfer

468 kB
Size

4
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://r10.to/hsXhgb
Title: サービス一覧

Search URL Search Domain Scan URL

URL: https://r10.to/hO0M6X
Title: 楽天銀行

Search URL Search Domain Scan URL

URL: https://r10.to/hr3olc
Title: 楽天証券

Search URL Search Domain Scan URL

URL: https://r10.to/hOhEJn
Title: 楽天生命

Search URL Search Domain Scan URL

URL: https://r10.to/hr6X6G
Title: 楽天ポイントカード

Search URL Search Domain Scan URL

URL: https://r10.to/hOJyRK
Title: 楽天Edy

Search URL Search Domain Scan URL

URL: https://r10.to/hb40SJ
Title: 楽天ペイ

Search URL Search Domain Scan URL

URL: https://r10.to/hO3ZS1
Title: 楽天の保険

Search URL Search Domain Scan URL

URL: https://r10.to/hO9oQt
Title: 自動車保険一括見積

Search URL Search Domain Scan URL

URL: https://r10.to/hsGi2W
Title: 楽天市場

Search URL Search Domain Scan URL

URL: https://www.rakuten.co.jp/
Title: 楽天市場

Search URL Search Domain Scan URL

URL: https://ichiba.faq.rakuten.net/
Title: ヘルプ

Search URL Search Domain Scan URL

URL: https://static.id.rakuten.co.jp/static/about_security/jpn/
Title: こちら

Search URL Search Domain Scan URL

URL: https://ichiba.faq.rakuten.net/detail/000033783
Title: こちら

Search URL Search Domain Scan URL

URL: https://www.jpcert.or.jp/pr/2017/pr170002.html

Search URL Search Domain Scan URL

URL: https://privacy.rakuten.co.jp/
Title: 個人情報保護方針

Search URL Search Domain Scan URL

URL: https://r10.to/hroftZ
Title: ユーザID・パスワードを忘れた場合

Search URL Search Domain Scan URL

URL: https://www.rakuten-card.co.jp/agreement/card_member/
Title: 会員規約（個人情報の取扱に関する同意条項）

Search URL Search Domain Scan URL

URL: https://www.rakuten-card.co.jp/personal/statement/
Title: プライバシーステートメント

Search URL Search Domain Scan URL

URL: https://grp12.ias.rakuten.co.jp/optout/
Title: 楽天グループ株式会社の個人情報の取扱い、および広告配信停止（オプトアウト）について

Search URL Search Domain Scan URL

URL: https://www.rakuten-card.co.jp/e-navi/index.xhtml
Title: 楽天会員に新規登録する楽天会員に新規登録してサービスを利用する（無料）

Search URL Search Domain Scan URL

URL: https://www.rakuten.co.jp/myrakuten/help/
Title: 楽天会員とは？

Search URL Search Domain Scan URL

URL: https://www.rakuten-card.co.jp/service/e-navi/login-support/?l-id=enavi_oo_enavi-login_to_login-support_pc
Title: ログインができない場合の解決方法

Search URL Search Domain Scan URL

URL: https://www.rakuten-card.co.jp/info/rules/site/
Title: ご利用にあたって（ご準備いただくもの/推奨環境）

Search URL Search Domain Scan URL

URL: https://support.rakuten-card.jp/category/show/17?site_domain=guest
Title: よくあるご質問

Search URL Search Domain Scan URL

URL: https://www.rakuten-card.co.jp/info/rules/credit_policy/
Title: クレジットポリシー

Search URL Search Domain Scan URL

URL: https://www.rakuten-card.co.jp/info/rules/menseki/
Title: 免責事項

Search URL Search Domain Scan URL

URL: https://www.rakuten-card.co.jp/info/rules/copy/
Title: コピーライト

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://groupe-baobab.com/ HTTP 301
https://groupe-baobab.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
groupe-baobab.com/
Redirect Chain

http://groupe-baobab.com/
https://groupe-baobab.com/

17 KB
6 KB

952ms
612ms

Document
text/html

204.152.210.84
PACIFICRACK

General

Domain/Path	Expires	Name / Value
groupe-baobab.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 39klprsb5rjm6vj75s1p1d8tef
.groupe-baobab.com/	1970-01-20 21:42:08	Name: _ra Value: 1685168075829\|c75f5e5d-1263-41df-8e88-f40dbf217acb
.rakuten.co.jp/	1970-01-20 21:42:08	Name: Rp Value: 5a8bb2ddb9e5ef406b429d73f264719fcbe2d06
.rakuten.co.jp/	1970-01-20 12:06:09	Name: rat_v Value: 844bcc5cb8eeec436b429e73f264719fcbe2d2f

Source	Level	URL Text
network	error	URL: https://assets.withdesk.com/js/bundle.db3aec88-a1a8-496b-8c1c-a1037c00d388.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://assets.withdesk.com/widget/js/bundle.db3aec88-a1a8-496b-8c1c-a1037c00d388.js Message: Failed to load resource: the server responded with a status of 403 ()

groupe-baobab.com Open in urlscan Pro 204.152.210.84 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

29 Requests

41 %HTTPS

17 %IPv6

5 Domains

7 Subdomains

7 IPs

2 Countries

196 kBTransfer

468 kBSize

4 Cookies

28 Outgoing links

Page URL History

Redirected requests

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

groupe-baobab.com Open in urlscan Pro
204.152.210.84 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

29
Requests

41 %
HTTPS

17 %
IPv6

5
Domains

7
Subdomains

7
IPs

2
Countries

196 kB
Transfer

468 kB
Size

4
Cookies

29 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!