dhl-track00.duckdns.org Open in urlscan Pro
54.180.143.88 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://dhl-track00.duckdns.org/yahoo/
Submission: On April 23 via api (April 23rd 2020, 2:54:13 pm UTC) from CA

Summary HTTP 11 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 11 HTTP transactions. The main IP is 54.180.143.88, located in Incheon, Korea, Republic Of and belongs to AMAZON-02, US. The main domain is dhl-track00.duckdns.org.

This is the only time dhl-track00.duckdns.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	54.180.143.88 54.180.143.88	16509 (AMAZON-02) (AMAZON-02)
8	2a00:1288:f03... 2a00:1288:f03d:1fa::4000	10310 (YAHOO-1) (YAHOO-1)
1 2	104.125.24.244 104.125.24.244	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1288:110... 2a00:1288:110:c204::b000	34010 (YAHOO-IRD) (YAHOO-IRD)
11	5

1 54.180.143.88 (Incheon, Korea, Republic Of)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-180-143-88.ap-northeast-2.compute.amazonaws.com

dhl-track00.duckdns.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fc.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.125.24.244 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-125-24-244.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c204::b000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

geo.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	yimg.com s.yimg.com	110 KB
2	yahoo.com fc.yahoo.com geo.yahoo.com	7 KB
2	scorecardresearch.com 1 redirects sb.scorecardresearch.com	1 KB
1	duckdns.org dhl-track00.duckdns.org	375 KB
11	4

	Domain	Requested by
7	s.yimg.com	dhl-track00.duckdns.org fc.yahoo.com s.yimg.com
2	sb.scorecardresearch.com	1 redirects dhl-track00.duckdns.org
1	geo.yahoo.com
1	fc.yahoo.com	dhl-track00.duckdns.org
1	dhl-track00.duckdns.org
11	5

This site contains links to these domains. Also see Links.

Domain
ca.yahoo.com
policies.oath.com

Subject Issuer	Validity	Valid
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-04-16` - `2020-05-31`	a month	crt.sh
*.scorecardresearch.com Sectigo RSA Organization Validation Secure Server CA	`2019-12-16` - `2020-12-25`	a year	crt.sh

This page contains 3 frames:

Primary Page: http://dhl-track00.duckdns.org/yahoo/
Frame ID: 5E122372DAAA5EB59BCA60ACE5369690
Requests: 10 HTTP requests in this frame

Frame: https://s.yimg.com/rq/darla/3-25-0/html/r-csc.html
Frame ID: EA9F954419F52A0DB52BDED142C3D99A
Requests: 1 HTTP requests in this frame

Frame: https://s.yimg.com/rq/darla/3-25-0/html/r-sf.html
Frame ID: F207B18829ADB0BCF42EF8D80BF0F595
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Win32|Win64/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

82 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

492 kB
Transfer

645 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://ca.yahoo.com/
Title:

Search URL Search Domain Scan URL

URL: https://policies.oath.com/ca/en/oath/terms/otos/index.html
Title: Terms

Search URL Search Domain Scan URL

URL: https://policies.oath.com/ca/en/oath/privacy/index.html
Title: Privacy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://sb.scorecardresearch.com/p?c1=2&c2=7241469&c5=794308018&ns_c=UTF-8&ns__t=1577184261195&c7=https%3A%2F%2Flogin.yahoo.com%2F&c14=-1 HTTP 302
https://sb.scorecardresearch.com/p2?c1=2&c2=7241469&c5=794308018&ns_c=UTF-8&ns__t=1577184261195&c7=https%3A%2F%2Flogin.yahoo.com%2F&c14=-1

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
dhl-track00.duckdns.org/yahoo/ 375 KB
375 KB 608ms
592ms Document
text/html 54.180.143.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://dhl-track00.duckdns.org/yahoo/
Protocol: HTTP/1.1
Server: 54.180.143.88 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-180-143-88.ap-northeast-2.compute.amazonaws.com
Software: Apache/2.4.41 (Win64) OpenSSL/1.1.1c PHP/7.2.29 / PHP/7.2.29
Resource Hash: d788b261d015feaf256043eb3a93fe1a2d93d373b86266bbb85d781acbd9aaef

Request headers

Host: dhl-track00.duckdns.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 23 Apr 2020 14:53:49 GMT
Server: Apache/2.4.41 (Win64) OpenSSL/1.1.1c PHP/7.2.29
X-Powered-By: PHP/7.2.29
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png
s.yimg.com/rz/p/ 1 KB
2 KB 53ms
17ms Image
image/png 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png

Requested by

Host: dhl-track00.duckdns.org
URL: http://dhl-track00.duckdns.org/yahoo/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://dhl-track00.duckdns.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 22 Apr 2020 23:49:00 GMT
x-content-type-options: nosniff
age: 54298
x-amz-server-side-encryption: AES256
status: 200
vary: Origin
x-amz-request-id: 921F04AAC53171B3
x-amz-id-2: Ms6hlf5cQ/Az/hbidHwox22RjsJqQl5bTrb1ItG4fC/vxFLS93PtukIdrC2mRZ3jPva3ZIIb4jE=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 21 Apr 2020 21:34:01 GMT
server: ATS
etag: "cd166981c96c6d0f4b5a7d798c25878e"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: public,max-age=86400
content-length: 1346
expires: Wed, 22 Apr 2020 23:00:00 GMT

GET
H2 200 yahoo_frontpage_en-US_s_f_w_bestfit_frontpage_2x.png
s.yimg.com/rz/p/ 1 KB
2 KB 53ms
18ms Image
image/png 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_w_bestfit_frontpage_2x.png

Requested by

Host: dhl-track00.duckdns.org
URL: http://dhl-track00.duckdns.org/yahoo/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

4f47ef8ff3dad2a78360ab207cf35ff2905622511c0426109f6e225052cf5637

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://dhl-track00.duckdns.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 22 Apr 2020 23:17:16 GMT
x-content-type-options: nosniff
age: 56201
x-amz-server-side-encryption: AES256
status: 200
vary: Origin
x-amz-request-id: 44792C23FAB60EEB
x-amz-id-2: 9JK3T9vUB2qnAYWVaiANrpj+SBrkUs83P6vgpm8Yg/zoswIjvYHEQFgmNz0K8ixo/FpGi7W0cnc=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 21 Apr 2020 21:34:01 GMT
server: ATS
etag: "dd31f56b9e4dff40eb87447c3dc55b84"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: public,max-age=86400
content-length: 1391
expires: Wed, 22 Apr 2020 23:00:00 GMT

GET
H2 200 rapid-3.53.3.js Show response
s.yimg.com/wm/mbr/js/ 46 KB
17 KB 21ms
21ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wm/mbr/js/rapid-3.53.3.js

Requested by

Host: dhl-track00.duckdns.org
URL: http://dhl-track00.duckdns.org/yahoo/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

7bd440561281e97648a7c7e9905f727cf5a244824fed4572aa978efeadbbc500

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://dhl-track00.duckdns.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Mon, 16 Mar 2020 14:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3286389
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 17047
x-amz-id-2: pwjIWITEAq8ddh2ZY10DzpJZ78kw9ai/zH4VvzlrE17firPhR/3utYFF6itWgBNSCGSbusEkbqw=
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 28 Mar 2019 21:32:12 GMT
server: ATS
etag: "4bda224130c3ac287f18c9b0d9062205-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 8BD77263278D3E2D
x-xss-protection: 1; mode=block
cache-control: public,max-age=315360000
accept-ranges: bytes
content-type: application/javascript

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f8b3cec38178f350625a2e3f4051a503a1460a1ac0e55eb15402eafb5211bcb0

Request headers

Referer: http://dhl-track00.duckdns.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H/1.1

200
OK

p2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/p?c1=2&c2=7241469&c5=794308018&ns_c=UTF-8&ns__t=1577184261195&c7=https%3A%2F%2Flogin.yahoo.com%2F&c14=-1
https://sb.scorecardresearch.com/p2?c1=2&c2=7241469&c5=794308018&ns_c=UTF-8&ns__t=1577184261195&c7=https%3A%2F%2Flogin.yahoo.com%2F&c14=-1

43 B
406 B

28ms
28ms

Image
image/gif

104.125.24.244
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p2?c1=2&c2=7241469&c5=794308018&ns_c=UTF-8&ns__t=1577184261195&c7=https%3A%2F%2Flogin.yahoo.com%2F&c14=-1
Requested by: Host: dhl-track00.duckdns.org
URL: http://dhl-track00.duckdns.org/yahoo/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.125.24.244 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-125-24-244.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: http://dhl-track00.duckdns.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 23 Apr 2020 14:53:57 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/p2?c1=2&c2=7241469&c5=794308018&ns_c=UTF-8&ns__t=1577184261195&c7=https%3A%2F%2Flogin.yahoo.com%2F&c14=-1
Pragma: no-cache
Date: Thu, 23 Apr 2020 14:53:57 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 client.php Show response
fc.yahoo.com/sdarla/php/ 11 KB
6 KB 215ms
194ms Script
text/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794308018&ref=https%3A%2F%2Flogin.yahoo.com%2F

Requested by

Host: dhl-track00.duckdns.org
URL: http://dhl-track00.duckdns.org/yahoo/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

92c8b65ec036b8d9af9d50672e7e890d06147c720c9f435915612d71fba6943a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://dhl-track00.duckdns.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 14:53:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
status: 200
vary: Accept-Encoding
content-length: 5969
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
content-type: text/javascript;charset=UTF-8
cache-control: private,no-cache,no-store
x-robots-tag: noindex, noarchive, nosnippet, nofollow

GET
H2 200 boot.js Show response
s.yimg.com/rq/darla/ 7 KB
4 KB 19ms
19ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/darla/boot.js

Requested by

Host: fc.yahoo.com
URL: https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794308018&ref=https%3A%2F%2Flogin.yahoo.com%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

2f8dc56539cb6ea4ba5d6821da9465d07e5bbd39cf28dfbe8688420d5014e2f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://dhl-track00.duckdns.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 22 Apr 2020 23:50:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54197
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 3609
x-amz-id-2: CMIpouDCZTTsbR+bfDOHhOVHeIqEOV/0I7wzidw2GyYnmNg8Elsw5iQflAdGRQYWgkm/VE72ZzE=
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 14 Apr 2020 19:54:35 GMT
server: ATS
etag: "8d4e9809830ad42e77c39a0d30c8ba0f-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 7930097704A2112A
x-xss-protection: 1; mode=block
cache-control: public,max-age=86400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 g-r-min.js Show response
s.yimg.com/rq/darla/3-25-0/js/ 202 KB
85 KB 18ms
13ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/darla/3-25-0/js/g-r-min.js

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/rq/darla/boot.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

4c1c2688a72f29b9e248b5fa1787fe359ab1e99f2407f82352e5e7ae9be8d6be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://dhl-track00.duckdns.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 21 Apr 2020 10:17:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 189388
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 87266
x-amz-id-2: /76TYN98OMNXiQDiKDZdWnBNkPFJSPlErTDcj6TPk9MtNy/gQE4ClOIrQenaQ14JGqupiat6ErA=
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 14 Apr 2020 19:54:38 GMT
server: ATS
etag: "2a6dc5cce97550b8daf0ccbea54e8929-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 7953A1C741A356CE
x-xss-protection: 1; mode=block
cache-control: public,max-age=31536000
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 r-csc.html
s.yimg.com/rq/darla/3-25-0/html/ Frame EA9F 0
0 17ms
17ms Document
text/html 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/darla/3-25-0/html/r-csc.html

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/rq/darla/3-25-0/js/g-r-min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: s.yimg.com
:scheme: https
:path: /rq/darla/3-25-0/html/r-csc.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://dhl-track00.duckdns.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://dhl-track00.duckdns.org/

Response headers

status: 200
x-amz-id-2: rXifDV5I0uWj1AA7OwojXaPk05whbkQla4xzVp3U6UB6LbFemCz4pBwKn3OgYH1sptRShUadmkg=
x-amz-request-id: 2ADEF860FCF0E36E
date: Thu, 16 Apr 2020 20:56:58 GMT
last-modified: Tue, 14 Apr 2020 19:54:37 GMT
etag: "1ff9b6e511ccd76562520a75bae161d2-df"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=31536000
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin, Accept-Encoding
age: 583021
ats-carp-promotion: 1
content-encoding: gzip
content-length: 1160
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff

GET
H2 200 r-sf.html
s.yimg.com/rq/darla/3-25-0/html/ Frame F207 0
0 17ms
16ms Document
text/html 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/darla/3-25-0/html/r-sf.html

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/rq/darla/3-25-0/js/g-r-min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: s.yimg.com
:scheme: https
:path: /rq/darla/3-25-0/html/r-sf.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://dhl-track00.duckdns.org/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://dhl-track00.duckdns.org/

Response headers

status: 200
x-amz-id-2: iBv5U36XuBHPbdsf2+ut/7Lb0kzIZkSp1ttnjy+HIUIRixBLybbKEusIHgxfzH8742XbIP/0h1Q=
x-amz-request-id: 9478A466B475EEB0
date: Wed, 15 Apr 2020 11:44:05 GMT
last-modified: Tue, 14 Apr 2020 19:54:37 GMT
etag: "38af3d4f8c84f11502b04431eb9d3a13-df"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=31536000
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin, Accept-Encoding
age: 702594
ats-carp-promotion: 1
content-encoding: gzip
content-length: 753
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff

GET
H/1.1 200
OK p
geo.yahoo.com/ 43 B
715 B 122ms
79ms Image
image/gif 2a00:1288:110:c204::b000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://geo.yahoo.com/p?_E=adperf&outcm=performance&etrg=backgroundPost&usergenf=0&etag=performance%2Cdarla&s=794308018&pvid=errNgzEwLjLHW5wcTqtfkQC8MmEwMQAAAABrEi9P&D_bv=1.0.0&D_ts=0&D_v=sdarla_3-25-0&D_l=119%2C11%2C2997%2C2673%2C0%2C0%2C335%2C120%2C11&D_m=0&test=&D_e=&D_p=7%2C0%2CRICH%2C1440x1024%2C999999%2C999999%2C999999%2C0%2C0%2C187%2C-1%2C-1%2C-1%2C-1%2C2%2CerrNgzEwLjLHW5wcTqtfkQC8MmEwMQAAAABrEi9P%3A-1%3ARICH%2C2%2C2%2C0%2C2%2C0%2C2%2C0%2C0%2C0%2C1%2C0%2C2%2C0%2C0%2C0%2C0%2C0%2C0%2C3%2Chttp%253A%2F%2Fdhl-track00.duckdns.org%2Fyahoo%2F%2C%2C0%2C2%2C3%2C0%2C0%2C5000%2C0%2C-1%2C-1%2C-1%2C174%2C174%3B&D_res=%7B%22RICH%22%3A%5B%7B%22name%22%3A%22https%3A%2F%2Feu-central-1.onemobile.yahoo.com%2Fadmax%2FadEvent.do%3Ftidi%3D770771327%26sitepid%3D217660%26posi%3D941602%26grp%3D%253F%253F%253F%26nl%3D1587653637270%26rts%3D1587653637229%26pix%3D1%26et%3D1%26a%3DerrNgzEwLjLHW5wcTqtfkQC8MmEwMQAAAABrEi9P-0%26m%3DaXAtMTAtMjItMTE4LTE1Nw..%26b%3DMTA4Mzg7Q0EgLSBIb3VzZS9QU0EgQmFja3VwOz8_Pzs7OztkNzFhNWQ3YzBlN2M0ZmY4OTAwNWIyYmQ3OTRkNjg3NTstMTsxNTg3NjUyMjAx%26xdi%3DPz8_fD8_P3w_Pz98MA..%26xoi%3DMHxERVU.%26hb%3Dtrue%26type%3D5%26af%3D7%26brxdPublisherId%3D26720242308%26brxdSiteId%3D8521051%26dety%3D5%22%2C%22dur%22%3A89%2C%22st%22%3A93%2C%22ssl%22%3Anull%2C%22dns%22%3Anull%2C%22conn%22%3Anull%7D%2C%7B%22name%22%3A%22https%3A%2F%2Fs.yimg.com%2Fdh%2Fap%2Fdefault%2F151202%2FUK_Mail___onnet_Login_A.jpg%22%2C%22dur%22%3A37%2C%22st%22%3A93%2C%22ssl%22%3A0%2C%22dns%22%3A0%2C%22conn%22%3A0%7D%2C%7B%22name%22%3A%22https%3A%2F%2Fs.yimg.com%2Frq%2Fdarla%2F3-25-0%2Fjs%2Fsfext-min.js%22%2C%22dur%22%3A35%2C%22st%22%3A24%2C%22ssl%22%3A0%2C%22dns%22%3A0%2C%22conn%22%3A0%7D%2C%7B%22first-paint%22%3A174%2C%22first-contentful-paint%22%3A174%7D%5D%7D&t=1587653638228

Protocol

HTTP/1.1

Server

2a00:1288:110:c204::b000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: http://dhl-track00.duckdns.org/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 23 Apr 2020 14:53:58 GMT
X-Content-Type-Options: nosniff
Server: ATS
Age: 0
X-Frame-Options: DENY
P3P: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Cache-Control: no-cache, no-store, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo (Online)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://s.yimg.com/rq/darla/3-25-0/js/g-r-min.js(Line 3) Message: DARLA notice: 425
console-api	log	URL: https://s.yimg.com/rq/darla/3-25-0/js/g-r-min.js(Line 3) Message: DARLA notice: 426

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dhl-track00.duckdns.org
fc.yahoo.com
geo.yahoo.com
s.yimg.com
sb.scorecardresearch.com
104.125.24.244
2a00:1288:110:c204::b000
2a00:1288:f03d:1fa::4000
54.180.143.88
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
2f8dc56539cb6ea4ba5d6821da9465d07e5bbd39cf28dfbe8688420d5014e2f4
4c1c2688a72f29b9e248b5fa1787fe359ab1e99f2407f82352e5e7ae9be8d6be
4f47ef8ff3dad2a78360ab207cf35ff2905622511c0426109f6e225052cf5637
7bd440561281e97648a7c7e9905f727cf5a244824fed4572aa978efeadbbc500
92c8b65ec036b8d9af9d50672e7e890d06147c720c9f435915612d71fba6943a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
d788b261d015feaf256043eb3a93fe1a2d93d373b86266bbb85d781acbd9aaef
f8b3cec38178f350625a2e3f4051a503a1460a1ac0e55eb15402eafb5211bcb0

dhl-track00.duckdns.org Open in urlscan Pro 54.180.143.88 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

82 %HTTPS

50 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

492 kBTransfer

645 kBSize

0 Cookies

3 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

dhl-track00.duckdns.org Open in urlscan Pro
54.180.143.88 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

492 kB
Transfer

645 kB
Size

0
Cookies

11 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!