www.rkat1.1r-p.xyz Open in urlscan Pro
103.41.65.144  Malicious Activity! Public Scan

URL: https://www.rkat1.1r-p.xyz/
Submission Tags: phishing rakuten Search All
Submission: On November 24 via api from JP — Scanned from JP

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 103.41.65.144, located in Hong Kong and belongs to SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK. The main domain is www.rkat1.1r-p.xyz.
TLS certificate: Issued by R3 on November 15th 2021. Valid for: 3 months.
This is the only time www.rkat1.1r-p.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: JCB (Financial) Rakuten (E-commerce)

Domain & IP information

IP Address AS Autonomous System
12 103.41.65.144 38197 (SUNHK-DAT...)
12 2
Apex Domain
Subdomains
Transfer
12 1r-p.xyz
www.rkat1.1r-p.xyz
473 KB
12 1
Domain Requested by
12 www.rkat1.1r-p.xyz www.rkat1.1r-p.xyz
12 1

This site contains no links.

Subject Issuer Validity Valid
www.rkat1.1r-p.xyz
R3
2021-11-15 -
2022-02-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.rkat1.1r-p.xyz/
Frame ID: 4E85B3FCC1CB06553530F8BFE0F583C8
Requests: 20 HTTP requests in this frame

Screenshot

Page Title

【楽天市場】Shopping is Entertainment! : インターネット最大級の通信販売、通販オンラインショッピングコミュニティ

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

473 kB
Transfer

1222 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.rkat1.1r-p.xyz/
522 B
454 B
Document
General
Full URL
https://www.rkat1.1r-p.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
c5d878954ea2ebc94a0addc971c3bd26962aead2b8469183686cf49678d48bf9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
jp-JP,jp;q=0.9

Response headers

last-modified
Wed, 24 Nov 2021 16:51:27 GMT
etag
"20a-5d18bab4046e8-gzip"
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-length
316
content-type
text/html
date
Wed, 24 Nov 2021 17:53:25 GMT
server
Apache
app.ccc92c8665f5b7dee2c3ed6923f75d3c.css
www.rkat1.1r-p.xyz/static/css/
888 KB
320 KB
Stylesheet
General
Full URL
https://www.rkat1.1r-p.xyz/static/css/app.ccc92c8665f5b7dee2c3ed6923f75d3c.css
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
a64fd829017c72736d9efff2e336d3a604828e2750eba42179981630790b8dfd

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://www.rkat1.1r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:53:25 GMT
content-encoding
gzip
last-modified
Wed, 26 May 2021 19:54:46 GMT
server
Apache
etag
"ddeb9-5c34103b46d80-gzip"
vary
Accept-Encoding
content-type
text/css
accept-ranges
bytes
manifest.5badeff0107497297dfb.js
www.rkat1.1r-p.xyz/static/js/
2 KB
1023 B
Script
General
Full URL
https://www.rkat1.1r-p.xyz/static/js/manifest.5badeff0107497297dfb.js
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
b1a49000867ba4db6ecf9fe45613575e2ace08816ea55c184786271597434ebe

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://www.rkat1.1r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:53:25 GMT
content-encoding
gzip
last-modified
Wed, 26 May 2021 19:54:46 GMT
server
Apache
etag
"643-5c34103b46d80-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
929
vendor.3082b0961e0e767dbf3c.js
www.rkat1.1r-p.xyz/static/js/
233 KB
82 KB
Script
General
Full URL
https://www.rkat1.1r-p.xyz/static/js/vendor.3082b0961e0e767dbf3c.js
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
fd727120c735d6a17851cde1b809eeee873f36b9a7800e3d3dd1693914df7b84

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://www.rkat1.1r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:53:25 GMT
content-encoding
gzip
last-modified
Wed, 26 May 2021 19:54:46 GMT
server
Apache
etag
"3a532-5c34103b46d80-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
app.28b38f23395a7e636a70.js
www.rkat1.1r-p.xyz/static/js/
5 KB
1 KB
Script
General
Full URL
https://www.rkat1.1r-p.xyz/static/js/app.28b38f23395a7e636a70.js
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
437fd83e1fc1b6f1eab8cf207242e37cf82fc3c6e75f1f7d0d58a848ee33baeb

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://www.rkat1.1r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:53:25 GMT
content-encoding
gzip
last-modified
Mon, 01 Nov 2021 13:31:54 GMT
server
Apache
etag
"1551-5cfba333c2680-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
1422
7.65204e31b093899cc548.js
www.rkat1.1r-p.xyz/static/js/
834 B
514 B
Script
General
Full URL
https://www.rkat1.1r-p.xyz/static/js/7.65204e31b093899cc548.js
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/static/js/manifest.5badeff0107497297dfb.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
fc9596390f2a7eb2e7ef37f9190c0a648e7ee84127cb845e4ee5616838b0c303

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://www.rkat1.1r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:53:26 GMT
content-encoding
gzip
last-modified
Mon, 01 Nov 2021 13:31:04 GMT
server
Apache
etag
"342-5cfba30413600-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
414
jump.php
www.rkat1.1r-p.xyz/
2 B
249 B
XHR
General
Full URL
https://www.rkat1.1r-p.xyz/jump.php
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/static/js/vendor.3082b0961e0e767dbf3c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
d8463bd3ba4b10e5916f65fa7b0c1f9f91f67ca40cc25b48810fb2f5a3340488

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.rkat1.1r-p.xyz/
Accept-Language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 24 Nov 2021 17:53:26 GMT
content-encoding
gzip
server
Apache
vary
Accept-Encoding
access-control-allow-methods
POST
content-type
text/html;charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials
true
content-length
22
expires
Thu, 19 Nov 1981 08:52:00 GMT
0.b3fe094d8803ee607756.js
www.rkat1.1r-p.xyz/static/js/
377 B
354 B
Script
General
Full URL
https://www.rkat1.1r-p.xyz/static/js/0.b3fe094d8803ee607756.js
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/static/js/manifest.5badeff0107497297dfb.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
e7408fc75da8f46c624b67dfd325c5efa1c502382683695ebb8f9900c788bb5b

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://www.rkat1.1r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:53:27 GMT
content-encoding
gzip
last-modified
Wed, 03 Nov 2021 09:59:34 GMT
server
Apache
etag
"179-5cfdf778ded80-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
254
3.eb010dac19d4d626513a.js
www.rkat1.1r-p.xyz/static/js/
27 KB
10 KB
Script
General
Full URL
https://www.rkat1.1r-p.xyz/static/js/3.eb010dac19d4d626513a.js
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/static/js/manifest.5badeff0107497297dfb.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
efa4a78ce7fb6710e9838eb511ea6e661a9eda03cedf6e1d1537809ef877839e

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://www.rkat1.1r-p.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:53:27 GMT
content-encoding
gzip
last-modified
Wed, 03 Nov 2021 10:00:52 GMT
server
Apache
etag
"6c5b-5cfdf7c341d00-gzip"
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
10297
ichiba_chat_appender_v1_0.css
www.rkat1.1r-p.xyz/public/pc/css/
0
0
Stylesheet
General
Full URL
https://www.rkat1.1r-p.xyz/public/pc/css/ichiba_chat_appender_v1_0.css
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/static/js/vendor.3082b0961e0e767dbf3c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://www.rkat1.1r-p.xyz/rms-nid-vc__event=login&service_id=top-1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:53:27 GMT
server
Apache
content-length
265
content-type
text/html; charset=iso-8859-1
api_session.php
www.rkat1.1r-p.xyz/api/
0
29 B
XHR
General
Full URL
https://www.rkat1.1r-p.xyz/api/api_session.php
Requested by
Host: www.rkat1.1r-p.xyz
URL: https://www.rkat1.1r-p.xyz/static/js/vendor.3082b0961e0e767dbf3c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.rkat1.1r-p.xyz/rms-nid-vc__event=login&service_id=top-1
Accept-Language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
date
Wed, 24 Nov 2021 17:53:27 GMT
access-control-allow-credentials
true
server
Apache
content-length
0
access-control-allow-methods
POST
content-type
text/html;charset=utf-8
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6da28d7a134d543417892f859bad07f0ac729296d84618a57d30b31810cea58a

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
43 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/gif
stop_540x249.bdb2ec6.png
www.rkat1.1r-p.xyz/static/img/
57 KB
57 KB
Image
General
Full URL
https://www.rkat1.1r-p.xyz/static/img/stop_540x249.bdb2ec6.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.41.65.144 , Hong Kong, ASN38197 (SUNHK-DATA-AS-AP Sun Network Hong Kong Limited - HongKong Backbone, HK),
Reverse DNS
Software
Apache /
Resource Hash
e1039b942a52729c7bd4fe9427a4f8a86816142ef90dd2be9b6ffcd353145a02

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
https://www.rkat1.1r-p.xyz/rms-nid-vc__event=login&service_id=top-1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 17:53:27 GMT
last-modified
Wed, 26 May 2021 19:54:46 GMT
server
Apache
accept-ranges
bytes
etag
"e2e0-5c34103b46d80"
content-length
58080
content-type
image/png
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
62775ef2856f63d6399abc1d54077916df8d62b16414816012b9ff0fad4efada

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
75 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7ab9a4d7f597471f82e8ebc6019525cd45f81decff7853062056a3c3417eba59

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/
442 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
175cf3a6b7549f715fffaddc3ec5c9f92717e7c5f63b7e36ea9592e091a80a67

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
849cd9d1c481a1b45559f5e833f40e13ee666842e6f8ba72c8e1cad9c8c15f6d

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/
60 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d8aac016132945bbe5a1f88a60206628c5d7c12e69917cb5fcbee4a7c24440c6

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/
360 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
33be38e33c8eb9aa13a4ed44c2e2813207bef13a5ba265818e485f0ebbc83f3b

Request headers

Accept-Language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: JCB (Financial) Rakuten (E-commerce)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| webpackJsonp object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill

1 Cookies

Domain/Path Name / Value
www.rkat1.1r-p.xyz/ Name: PHPSESSID
Value: 0gh0nqabk85roib2a8j6bers76

1 Console Messages

Source Level URL
Text
network error URL: https://www.rkat1.1r-p.xyz/public/pc/css/ichiba_chat_appender_v1_0.css
Message:
Failed to load resource: the server responded with a status of 404 ()