yahoo-confirms.com Open in urlscan Pro
125.227.143.136 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://yahoo-confirms.com/
Submission: On December 17 via automatic, source phishtank (December 17th 2018, 6:52:24 am UTC)

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 125.227.143.136, located in Taipei, Taiwan and belongs to HINET Data Communication Business Group, TW. The main domain is yahoo-confirms.com.

This is the only time yahoo-confirms.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
7	125.227.143.136 125.227.143.136	3462 (HINET Dat...) (HINET Data Communication Business Group)
6	182.22.24.252 182.22.24.252	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
1	183.79.249.124 183.79.249.124	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
1	114.110.60.90 114.110.60.90	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
15	4

7 125.227.143.136 (Taipei, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 125-227-143-136.HINET-IP.hinet.net

yahoo-confirms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 182.22.24.252 (Tokyo, Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b8.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 183.79.249.124 (Akasaka, Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

yeas.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 114.110.60.90 (Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

logql.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	yahoo-confirms.com yahoo-confirms.com	194 KB
5	yimg.jp s.yimg.jp	155 KB
3	yahoo.co.jp yeas.yahoo.co.jp logql.yahoo.co.jp b8.yahoo.co.jp	2 KB
15	3

	Domain	Requested by
7	yahoo-confirms.com	yahoo-confirms.com
5	s.yimg.jp	yahoo-confirms.com
1	b8.yahoo.co.jp
1	logql.yahoo.co.jp	yahoo-confirms.com
1	yeas.yahoo.co.jp	yahoo-confirms.com
15	5

This site contains no links.

Subject Issuer	Validity	Valid
*.yahoo.co.jp Cybertrust Japan Public CA G3	`2018-12-05` - `2019-12-29`	a year	crt.sh
logql.yahoo.co.jp Cybertrust Japan Public CA G3	`2018-08-27` - `2019-08-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://yahoo-confirms.com/
Frame ID: 25F2053D7AC563519CCE891AE1D2D989
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

YUI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^YAHOO$/i

Page Statistics

15
Requests

47 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

352 kB
Transfer

346 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
yahoo-confirms.com/ 25 KB
25 KB 1072ms
321ms Document
text/html 125.227.143.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-confirms.com/
Protocol: HTTP/1.1
Server: 125.227.143.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-136.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: ed9410cd11d62f8f373abf4e087c73a6347922d938e9a0db4acc2a1e1d242ac1

Request headers

Host: yahoo-confirms.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: text/html
Last-Modified: Fri, 15 Sep 2017 01:14:34 GMT
Accept-Ranges: bytes
ETag: "0b990fdbf2dd31:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Mon, 17 Dec 2018 06:52:19 GMT
Content-Length: 25565

GET
H/1.1 200
OK login-min.css
yahoo-confirms.com/res/ 38 KB
38 KB 520ms
318ms Stylesheet
text/css 125.227.143.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-confirms.com/res/login-min.css
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: HTTP/1.1
Server: 125.227.143.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-136.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 58e691f9228f2c52a07e135f0c0b3cae7c1b7f0626d378b617ea4f3cc0113dd6

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-confirms.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://yahoo-confirms.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 17 Dec 2018 06:52:19 GMT
Last-Modified: Tue, 12 Sep 2017 07:22:40 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "0a09bea972bd31:0"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 38461

GET
H2 200 yj_r_34_2x.png
s.yimg.jp/c/logo/f/2.0/ 3 KB
4 KB 1262ms
262ms Image
image/png 182.22.24.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/c/logo/f/2.0/yj_r_34_2x.png
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.24.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b

Request headers

Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 17 Dec 2018 06:46:42 GMT
via: http/1.1 edge1358.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1303.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
last-modified: Tue, 03 Dec 2013 01:24:30 GMT
server: ATS
age: 324
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public
accept-ranges: bytes
content-type: image/png
content-length: 3304
expires: Mon, 17 Dec 2018 06:55:30 GMT

GET
H/1.1 200
OK ico_info.png
yahoo-confirms.com/res/ 164 B
410 B 690ms
310ms Image
image/png 125.227.143.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://yahoo-confirms.com/res/ico_info.png
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: HTTP/1.1
Server: 125.227.143.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-136.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 1f19d9b979d33abc721fa7241518f28f936301003f539d71706b11de3fd053fb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-confirms.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://yahoo-confirms.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 17 Dec 2018 06:52:19 GMT
Last-Modified: Tue, 12 Sep 2017 07:22:58 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "03556f5972bd31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 164

GET
H/1.1 200
OK rapidjp-1.0.0.js Show response
yahoo-confirms.com/res/ 51 KB
52 KB 313ms
313ms Script
application/x-javascript 125.227.143.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-confirms.com/res/rapidjp-1.0.0.js
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: HTTP/1.1
Server: 125.227.143.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-136.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 8fc22298b6c758c2a601cedae1718b0c01463af2e7b13859a85cb6bcdca2720a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-confirms.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://yahoo-confirms.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 17 Dec 2018 06:52:20 GMT
Last-Modified: Tue, 12 Sep 2017 07:23:20 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "024732982bd31:0"
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 52717

GET
H/1.1 200
OK mics-min.js Show response
yahoo-confirms.com/res/ 23 KB
23 KB 339ms
338ms Script
application/x-javascript 125.227.143.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-confirms.com/res/mics-min.js
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: HTTP/1.1
Server: 125.227.143.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-136.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 453e9fcbf918c3cefb3c440c2aab2fe2c9bc750350346b9fd1185eb3ecefbcaf

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-confirms.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://yahoo-confirms.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 17 Dec 2018 06:52:20 GMT
Last-Modified: Tue, 12 Sep 2017 07:23:24 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "07ed54982bd31:0"
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 23469

GET
H/1.1 200
OK login-min.js Show response
yahoo-confirms.com/res/ 52 KB
52 KB 383ms
298ms Script
application/x-javascript 125.227.143.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-confirms.com/res/login-min.js
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: HTTP/1.1
Server: 125.227.143.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-136.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: dbedcc8005da02053d5f03e5c2d4f0112a9fa471a9934e3d864668c52286ab32

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-confirms.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://yahoo-confirms.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 17 Dec 2018 06:52:20 GMT
Last-Modified: Thu, 22 Nov 2018 05:44:57 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "86628a802682d41:0"
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 52836

GET
H/1.1 200
OK yjbfp.js Show response
yahoo-confirms.com/res/ 4 KB
4 KB 941ms
323ms Script
application/x-javascript 125.227.143.136
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-confirms.com/res/yjbfp.js
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: HTTP/1.1
Server: 125.227.143.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-136.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 8571293a7cd686e1eda501350e8c7e2b2175eb7ca67b0bf58a72a90fa5ad75ee

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-confirms.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://yahoo-confirms.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 17 Dec 2018 06:52:20 GMT
Last-Modified: Tue, 12 Sep 2017 07:23:34 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "05fcba982bd31:0"
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 4033

GET
H2 200 a Show response
yeas.yahoo.co.jp/ 40 B
724 B 1375ms
320ms Script
text/javascript 183.79.249.124
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to

Full URL

https://yeas.yahoo.co.jp/a?f=2079962931&l=LIP&p=jp_common&domain=login.yahoo.co.jp&c=r&jcode=u&rnd=1545029527459

Requested by

Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

183.79.249.124 Akasaka, Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),

Reverse DNS

Software

ATS /

Resource Hash

41430257b5bf4f1c478be93f52b27de6d56d0d5c42d7a45dad9c3e7b08e26bbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 17 Dec 2018 06:52:08 GMT
via: http/1.1 edge2229.img.umd.yahoo.co.jp (ApacheTrafficServer [c sSf ])
x-content-type-options: nosniff
server: ATS
age: 0
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: private
content-type: text/javascript
content-length: 40
x-xss-protection: 1; mode=block

GET
H2 200 h8qhkudl3cnqd9ii35oc-a.jpg
s.yimg.jp/bdv/prem/knqkkf3xsup0sxxrlct1/ttf_sry9xdivutrce0e8/m_fhm2ucijbyqquaejrf/ 146 KB
147 KB 264ms
264ms Image
image/jpeg 182.22.24.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/bdv/prem/knqkkf3xsup0sxxrlct1/ttf_sry9xdivutrce0e8/m_fhm2ucijbyqquaejrf/h8qhkudl3cnqd9ii35oc-a.jpg
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.24.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: fa5913fa6e206db2bcd1683e4ba42983f5d300660e037feeb827fd5baf57168e

Request headers

Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 16 Dec 2018 14:28:49 GMT
via: http/1.1 edge1307.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1303.img.bbt.yahoo.co.jp (ApacheTrafficServer [cMsSf ])
last-modified: Wed, 06 Sep 2017 03:24:01 GMT
server: ATS
age: 58998
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 149831
expires: Sun, 23 Dec 2018 14:28:49 GMT

GET
H2 200 theme_btn.png
s.yimg.jp/images/login/pc/img/login/1.0.0/ 591 B
1 KB 262ms
262ms Image
image/png 182.22.24.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/images/login/pc/img/login/1.0.0/theme_btn.png
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.24.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 642d234f2cee13b77a639f9b80df4c70c3c5bf3a73f6e99fda73c489ec618137

Request headers

Referer: http://yahoo-confirms.com/res/login-min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 17 Dec 2018 06:48:24 GMT
via: http/1.1 edge1356.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1303.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
last-modified: Fri, 07 Mar 2014 04:16:36 GMT
server: ATS
age: 223
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public
accept-ranges: bytes
content-type: image/png
content-length: 591
expires: Mon, 17 Dec 2018 06:57:17 GMT

GET
H2 200 btn_clear.png
s.yimg.jp/images/login/sp/img/theme/1.2.1/ 740 B
1 KB 523ms
523ms Image
image/png 182.22.24.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/images/login/sp/img/theme/1.2.1/btn_clear.png
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.24.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 2c2852bce600f225fb5fab38313e5f9c6019b8d46c3bcd756e4a608bb27a4e58

Request headers

Referer: http://yahoo-confirms.com/res/login-min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 17 Dec 2018 06:48:57 GMT
via: http/1.1 edge1327.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1303.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
last-modified: Tue, 23 Apr 2013 08:18:36 GMT
server: ATS
age: 190
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public
accept-ranges: bytes
content-type: image/png
content-length: 740
expires: Mon, 17 Dec 2018 06:57:02 GMT

GET
H2 200 lib2obf_b8.js Show response
s.yimg.jp/bdv/yahoo/javascript/csc/20060824/ 2 KB
2 KB 262ms
262ms Script
application/javascript 182.22.24.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/bdv/yahoo/javascript/csc/20060824/lib2obf_b8.js
Requested by: Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.24.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 990a245fe622fc5c6f73b0154585a8c14cc07ad4cbdb7a9b2114458fba12dc37

Request headers

Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Mon, 17 Dec 2018 06:52:04 GMT
content-encoding: gzip
last-modified: Tue, 12 Jun 2007 10:31:37 GMT
server: ATS
age: 4
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public
accept-ranges: bytes
content-type: application/javascript
content-length: 945
via: http/1.1 edge1358.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1303.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
expires: Mon, 17 Dec 2018 06:58:59 GMT

POST
H2 200 yql Show response
logql.yahoo.co.jp/v1/public/ 306 B
1 KB 1371ms
291ms XHR
text/plain 114.110.60.90
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to

Full URL

https://logql.yahoo.co.jp/v1/public/yql?yhlVer=2&yhlClient=rapid&yhlS=2079962931&yhlCT=2&yhlBTMS=1545029528860&yhlClientVer=3.25.1&yhlRnd=12MDtzHyCggzZTJZjpryou8s&yhlCompressed=0

Requested by

Host: yahoo-confirms.com
URL: http://yahoo-confirms.com/res/rapidjp-1.0.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

114.110.60.90 , Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),

Reverse DNS

Software

ATS /

Resource Hash

abf86b7e7083825a699cfd829c0c581abc36297c5f257b8bce87b54f3eb5f674

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Referer: http://yahoo-confirms.com/
Origin: http://yahoo-confirms.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 17 Dec 2018 06:52:10 GMT
x-content-type-options: nosniff
x-yql-host: logql3314.data.kks.ynwp.yahoo.co.jp
age: 0
p3p: policyref="https://privacy.yahoo.co.jp/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
pragma: no-cache
server: ATS
strict-transport-security: max-age=0
access-control-allow-methods: POST, OPTIONS
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://yahoo-confirms.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
expires: Wed, 01 Mar 1995 00:00:00 GMT

GET
H/1.1 200
OK b
b8.yahoo.co.jp/ 43 B
680 B 1040ms
286ms Image
image/gif 182.22.24.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://b8.yahoo.co.jp/b?P=USemADEyNy6VwbzGWbeoLwG3MjE5LgAAAADfApjA&T=15kf808p3%2fX%3d1505209390%2fE%3d2079962931%2fR%3djp_c_s_ad%2fK%3d5%2fV%3d1.1%2fW%3dJ%2fY%3djp%2fF%3d2314146438%2fH%3dc2VjdXJlPXRydWUgc2VjdXJlPVwidFwiIGFkY3Zlcj02LjguMQ--%2fS%3d1%2fJ%3d59B7AC2E&Q=0&O=0.06556150905694502

Protocol

HTTP/1.1

Server

182.22.24.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

ATS /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://yahoo-confirms.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 17 Dec 2018 06:52:10 GMT
Via: http/1.1 edge1307.img.bbt.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Age: 0
X-Frame-Options: SAMEORIGIN
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, no-store, private, no-cache=Set-Cookie, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo Japan (Online)

43 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: http://yahoo-confirms.com/res/rapidjp-1.0.0.js(Line 2) Message: RAPID WARNING: Specified module not in DOM: noticeBox

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b8.yahoo.co.jp
logql.yahoo.co.jp
s.yimg.jp
yahoo-confirms.com
yeas.yahoo.co.jp
114.110.60.90
125.227.143.136
182.22.24.252
183.79.249.124
1f19d9b979d33abc721fa7241518f28f936301003f539d71706b11de3fd053fb
2c2852bce600f225fb5fab38313e5f9c6019b8d46c3bcd756e4a608bb27a4e58
41430257b5bf4f1c478be93f52b27de6d56d0d5c42d7a45dad9c3e7b08e26bbc
453e9fcbf918c3cefb3c440c2aab2fe2c9bc750350346b9fd1185eb3ecefbcaf
479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b
58e691f9228f2c52a07e135f0c0b3cae7c1b7f0626d378b617ea4f3cc0113dd6
642d234f2cee13b77a639f9b80df4c70c3c5bf3a73f6e99fda73c489ec618137
8571293a7cd686e1eda501350e8c7e2b2175eb7ca67b0bf58a72a90fa5ad75ee
8fc22298b6c758c2a601cedae1718b0c01463af2e7b13859a85cb6bcdca2720a
990a245fe622fc5c6f73b0154585a8c14cc07ad4cbdb7a9b2114458fba12dc37
abf86b7e7083825a699cfd829c0c581abc36297c5f257b8bce87b54f3eb5f674
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
dbedcc8005da02053d5f03e5c2d4f0112a9fa471a9934e3d864668c52286ab32
ed9410cd11d62f8f373abf4e087c73a6347922d938e9a0db4acc2a1e1d242ac1
fa5913fa6e206db2bcd1683e4ba42983f5d300660e037feeb827fd5baf57168e

yahoo-confirms.com Open in urlscan Pro 125.227.143.136 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

47 %HTTPS

0 %IPv6

3 Domains

5 Subdomains

4 IPs

2 Countries

352 kBTransfer

346 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

43 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

yahoo-confirms.com Open in urlscan Pro
125.227.143.136 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

47 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

352 kB
Transfer

346 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!