view89iyah0092i0attach38irs92ios17i03.netlify.app

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 2600:1f18:2489:8201::c8, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is view89iyah0092i0attach38irs92ios17i03.netlify.app.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on January 15th 2024. Valid for: a year.

This is the only time view89iyah0092i0attach38irs92ios17i03.netlify.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2600:1f18:248... 2600:1f18:2489:8201::c8	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4998:1c:... 2001:4998:1c:800::1000	14779 (YAHOO) (YAHOO)
1	2600:141b:900... 2600:141b:9000::b833:95d9	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	3

2 2600:1f18:2489:8201::c8 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

view89iyah0092i0attach38irs92ios17i03.netlify.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:1c:800::1000 (United States)

ASN14779 (YAHOO, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:9000::b833:95d9 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

th.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	netlify.app view89iyah0092i0attach38irs92ios17i03.netlify.app	2 KB
1	bing.com th.bing.com — Cisco Umbrella Rank: 198	39 KB
1	yimg.com s.yimg.com — Cisco Umbrella Rank: 712	2 KB
4	3

	Domain	Requested by
2	view89iyah0092i0attach38irs92ios17i03.netlify.app	view89iyah0092i0attach38irs92ios17i03.netlify.app
1	th.bing.com	view89iyah0092i0attach38irs92ios17i03.netlify.app
1	s.yimg.com	view89iyah0092i0attach38irs92ios17i03.netlify.app
4	3

This site contains links to these domains. Also see Links.

Domain
account.live.com

Subject Issuer	Validity	Valid
*.netlify.app DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-15` - `2025-02-14`	a year	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-03-04` - `2024-04-24`	2 months	crt.sh
r.bing.com Microsoft Azure ECC TLS Issuing CA 05	`2023-10-18` - `2024-06-27`	8 months	crt.sh

This page contains 1 frames:

Primary Page: https://view89iyah0092i0attach38irs92ios17i03.netlify.app/
Frame ID: DD516A0E203B2700D89C03A692FA0D38
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Yahoo Mail | Sign in to Yahoo Mail

Detected technologies

Netlify (Web Servers) Expand

Overall confidence: 100%
Detected patterns

^https?://[^/]+\.netlify\.(?:com|app)/

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

43 kB
Transfer

46 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fcontextid%3d796F05AD372B6B25%26bk%3d1527904891&id=38936&uiflavor=web&cobrandid=140703588335528&uaid=d9c1b58bf69145d98c0dddf2c55abe77&mkt=EN-US&lc=1033&bk=1527904891
Title: Stay signed in

Search URL Search Domain Scan URL

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fcontextid%3+6d796F05AD372B6B25%26bk%3d1527904891&id=38936&uiflavor=web&cobrandid=140703588335528&uaid=d9c1b58bf69145d98c0dddf2c55abe77&mkt=EN-US&lc=1033&bk=1527904891
Title: Forgot Username?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
view89iyah0092i0attach38irs92ios17i03.netlify.app/ 2 KB
1 KB 240ms
82ms Document
text/html 2600:1f18:2489:8201::c8
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://view89iyah0092i0attach38irs92ios17i03.netlify.app/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:2489:8201::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Netlify /

Resource Hash

ff16d7ad076ce0a94c71d84e9a6c0b31e9c6bedf28292025350dc179f76dd778

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; fwd=miss
content-encoding: br
content-length: 816
content-type: text/html; charset=UTF-8
date: Tue, 05 Mar 2024 16:13:40 GMT
etag: "8d2d39612a627888a4d5552afe483403-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-nf-request-id: 01HR7P8REA3Q0EGEJB2J88PEJH

GET
H2 200 style.css
view89iyah0092i0attach38irs92ios17i03.netlify.app/ 4 KB
1 KB 83ms
82ms Stylesheet
text/css 2600:1f18:2489:8201::c8
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://view89iyah0092i0attach38irs92ios17i03.netlify.app/style.css

Requested by

Host: view89iyah0092i0attach38irs92ios17i03.netlify.app
URL: https://view89iyah0092i0attach38irs92ios17i03.netlify.app/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2600:1f18:2489:8201::c8 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Netlify /

Resource Hash

b3f162b9d17c77bbaf400761dcd6ba63b7efb8b240ede34619c3ed726c0f089f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://view89iyah0092i0attach38irs92ios17i03.netlify.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

x-nf-request-id: 01HR7P8RH2EHN9HAMBHFVWPRED
date: Tue, 05 Mar 2024 16:13:40 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: Netlify
age: 0
cache-status: "Netlify Edge"; fwd=miss
etag: "ffad78373960db6876f477de75a54075-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public,max-age=0,must-revalidate
accept-ranges: bytes

GET
H2 200 yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png
s.yimg.com/rz/p/ 1 KB
2 KB 238ms
66ms Image
image/png 2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png

Requested by

Host: view89iyah0092i0attach38irs92ios17i03.netlify.app
URL: https://view89iyah0092i0attach38irs92ios17i03.netlify.app/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://view89iyah0092i0attach38irs92ios17i03.netlify.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

ats-carp-promotion: 1, 1
date: Mon, 04 Mar 2024 18:50:35 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: 6H5DN2NCE3FXGY5P
age: 76986
x-amz-server-side-encryption: AES256
content-length: 1346
x-amz-id-2: iWrvsQZ+9j28NBet5FXVD6gLnbAkp6GZsZ++cupOwZlVXLyb1Pf0GZ6mgnz2rsTcrE5pB331rno=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 03 Mar 2024 21:30:44 GMT
server: ATS
etag: "cd166981c96c6d0f4b5a7d798c25878e"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin
content-type: image/png
cache-control: public,max-age=86400
accept-ranges: bytes
expires: Tue, 05 Mar 2024 00:00:00 GMT

GET
H2 200 OIP.vTFEGc4xA6c4E61SU_ldeAHaJe
th.bing.com/th/id/ 39 KB
39 KB 321ms
138ms Image
image/jpeg 2600:141b:9000::b833:95d9
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://th.bing.com/th/id/OIP.vTFEGc4xA6c4E61SU_ldeAHaJe?rs=1&pid=ImgDetMain
Requested by: Host: view89iyah0092i0attach38irs92ios17i03.netlify.app
URL: https://view89iyah0092i0attach38irs92ios17i03.netlify.app/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000::b833:95d9 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: e8f6b2e3a0b243e50ee01203957454fd3212a45c18511a6ac64eab14014ad32d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://view89iyah0092i0attach38irs92ios17i03.netlify.app/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Tue, 05 Mar 2024 16:13:41 GMT
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
x-check-cacheable: YES
akamai-grn: 0.d59533b8.1709655221.17331a70
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
x-cache: TCP_MISS from a184-51-149-213.deploy.akamaitechnologies.com (AkamaiGHost/11.4.2.2-54697487) (-)
content-type: image/jpeg
cache-control: public, max-age=518635
timing-allow-origin: *
access-control-allow-headers: *
content-length: 39552
alt-svc: h3=":443"; ma=93600

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

s.yimg.com
th.bing.com
view89iyah0092i0attach38irs92ios17i03.netlify.app
2001:4998:1c:800::1000
2600:141b:9000::b833:95d9
2600:1f18:2489:8201::c8
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338
b3f162b9d17c77bbaf400761dcd6ba63b7efb8b240ede34619c3ed726c0f089f
e8f6b2e3a0b243e50ee01203957454fd3212a45c18511a6ac64eab14014ad32d
ff16d7ad076ce0a94c71d84e9a6c0b31e9c6bedf28292025350dc179f76dd778

view89iyah0092i0attach38irs92ios17i03.netlify.app Open in urlscan Pro 2600:1f18:2489:8201::c8 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

43 kBTransfer

46 kBSize

0 Cookies

2 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

view89iyah0092i0attach38irs92ios17i03.netlify.app Open in urlscan Pro
2600:1f18:2489:8201::c8 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

43 kB
Transfer

46 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!