megaledco.com Open in urlscan Pro
173.212.211.230 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://megaledco.com/aol/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822...
Submission Tags: @ipnigh
Submission: On January 08 via api (January 8th 2020, 12:16:47 am UTC) from GB

Summary HTTP 13 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 173.212.211.230, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is megaledco.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 24th 2019. Valid for: 3 months.

This is the only time megaledco.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) AOL (Online) Yahoo (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	173.212.211.230 173.212.211.230	51167 (CONTABO) (CONTABO)
10	2a00:1288:f03... 2a00:1288:f03d:1fa::2000	10310 (YAHOO-1) (YAHOO-1 - Oath Holdings Inc.)
1	188.125.89.204 188.125.89.204	10310 (YAHOO-1) (YAHOO-1 - Oath Holdings Inc.)
1	2a00:1288:110... 2a00:1288:110:c204::b000	34010 (YAHOO-IRD) (YAHOO-IRD)
13	4

1 173.212.211.230 (Nuremberg, Germany)

ASN51167 (CONTABO, DE)
PTR: vmi212339.contaboserver.net

megaledco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1288:f03d:1fa::2000 (United Kingdom)

ASN10310 (YAHOO-1 - Oath Holdings Inc., US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fc.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 188.125.89.204 (United Kingdom)

ASN10310 (YAHOO-1 - Oath Holdings Inc., US)
PTR: e1-ha.ycpi.via.yahoo.com

beap-bc.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c204::b000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

geo.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	yimg.com s.yimg.com	195 KB
3	yahoo.com fc.yahoo.com beap-bc.yahoo.com geo.yahoo.com	9 KB
1	megaledco.com megaledco.com	4 KB
13	3

	Domain	Requested by
9	s.yimg.com	megaledco.com fc.yahoo.com s.yimg.com
1	geo.yahoo.com
1	beap-bc.yahoo.com
1	fc.yahoo.com	s.yimg.com
1	megaledco.com
13	5

This site contains links to these domains. Also see Links.

Domain
help.yahoo.com
www.aol.com
help.aol.com
login.aol.com

Subject Issuer	Validity	Valid
megaledco.com cPanel, Inc. Certification Authority	`2019-12-24` - `2020-03-23`	3 months	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2019-12-10` - `2020-01-24`	a month	crt.sh
*.autos.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-01-06` - `2020-07-04`	6 months	crt.sh

This page contains 3 frames:

Primary Page: https://megaledco.com/aol/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Frame ID: 86559C93E999711ADF7035FB639CCFCD
Requests: 11 HTTP requests in this frame

Frame: https://s.yimg.com/rq/darla/3-21-0/html/r-csc.html
Frame ID: C8CC57F1EAF7D8615AB65E37C937D350
Requests: 1 HTTP requests in this frame

Frame: https://s.yimg.com/rq/darla/3-21-0/html/r-sf.html
Frame ID: 5D593D0AE30E4EE2416E705DC4A346BA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Pure CSS (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+(?:([\d.])+\/)?pure(?:-min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

207 kB
Transfer

623 kB
Size

2
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://help.yahoo.com/kb/index?page=content&y=PROD_ACCT&id=SLN4556&actp=productlink&locale=en_US
Title: More Info

Search URL Search Domain Scan URL

URL: https://www.aol.com/
Title:

Search URL Search Domain Scan URL

URL: https://help.aol.com/
Title: Help

Search URL Search Domain Scan URL

URL: https://login.aol.com/?display=login&lang=en-US&language=en-US&src=mail&done=https%3A%2F%2Fapi.login.aol.com%2Foauth2%2Frequest_auth%3Fclient_id%3Ddj0yJmk9VlN3cDhpNm1Id0szJmQ9WVdrOVdtRm1aMVU1Tm1zbWNHbzlNQS0tJnM9Y29uc3VtZXJzZWNyZXQmeD1mYQ--%26redirect_uri%3Dhttps%253A%252F%252Foidc.mail.aol.com%252Fcallback%26response_type%3Dcode%26scope%3Dmail-r%252Cycal-w%252Copenid%252Copenid2%252Cmail-w%252Cmail-x%252Csdps-r%252Cmsgr-w%26src%3Dmail%26language%3Den-US%26state%3Dhttps%253A%252F%252Fmail.aol.com%252F_cqr%252FloginSuccess%253F%2526siteState%253Duv%25253AAOL%25253Brt%25253ASTD%25253Bat%25253ASNS%25253Blc%25253Aen_US%25253Bld%25253Amail.aol.com%25253Bsnt%25253AScreenName%25253Bsid%25253Aa883c045-7a0f-4c6d-ba85-064e47a35098%25253Bqp%25253A%25253B%2526lang%253Den%2526locale%253DUS%26nonce%3DZy8cNH4Yd2AvKbE7ckfKSTnCMcERDdnn&prefill=0
Title: Not you?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request reconfirm.php Show response
megaledco.com/aol/ 10 KB
4 KB 147ms
60ms Document
text/html 173.212.211.230
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: https://megaledco.com/aol/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 173.212.211.230 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS: vmi212339.contaboserver.net
Software: Apache /
Resource Hash: 2b26c350a0d0870537458063903c076a2a5ddc8de3bf670c363153f0d430ad57

Request headers

Host: megaledco.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1

Response headers

Date: Wed, 08 Jan 2020 00:16:30 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 3661
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 combo
s.yimg.com/zz/ 28 KB
6 KB 19ms
19ms Stylesheet
text/css 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/zz/combo?yui-s:pure/0.5.0/pure-min.css&yui-s:pure/0.5.0/grids-responsive-min.css

Requested by

Host: megaledco.com
URL: https://megaledco.com/aol/reconfirm.php?sf58gfd1s689sxd2sdf8angf264s9df23sd2f1n495K3L2C151645172991f1477dbd26917ef3822423f62e984a91f1477dbd26917ef3822423f62e984a91f1477dbd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

56509fcb8d84185984927217765bf1afab5b5e217a3c06377bf1388377bb0d1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://megaledco.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Thu, 18 Apr 2019 18:38:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22829856
status: 200
strict-transport-security: max-age=15552000
content-length: 5607
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 18 Apr 2019 18:38:55 GMT
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=567648000, Public
expires: Sat, 05 Sep 2026 00:00:00 GMT

GET
H2 200 aol-main.css
s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/ 209 KB
47 KB 51ms
51ms Stylesheet
text/css 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/aol-main.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

ede45bcb9c471636bb30c78141af29bbd617ff762b8791cec1a8d31361f3bd66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://megaledco.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 06 Nov 2019 22:01:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5364884
x-amz-server-side-encryption: AES256
status: 200
strict-transport-security: max-age=15552000
x-amz-request-id: D22EA55875AD2BEE
x-amz-id-2: NnQaPLl6X16wKSrMklQydiom8rJmsSvS3o5ZhVw5u4wZ3Mm4t5OdEbcJP9BR2AFE/Lerz3IFLBo=
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 27 Aug 2018 17:09:15 GMT
server: ATS
etag: "9f5f453c052f3b9f9b27eabc53d289fe-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: public,max-age=315360000
accept-ranges: bytes

GET
H2 200 aol-logo-black-v.0.0.2.png
s.yimg.com/wm/assets/images/ns/ 16 KB
16 KB 51ms
50ms Image
image/png 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/wm/assets/images/ns/aol-logo-black-v.0.0.2.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://megaledco.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 17 Sep 2019 15:41:52 GMT
x-amz-meta-created-date: Thu, 16 Nov 2017 19:59:27 GMT
age: 9707679
x-amz-server-side-encryption: AES256
status: 200
content-length: 16340
strict-transport-security: max-age=15552000
x-amz-request-id: 14C65D9277BBF054
x-amz-id-2: 9DXetRj1s8X0U6mZAbps1QBKJO+RRAGBrsNh1TUmYBNoZrNyzs1Va4kbbq/ATlmE0gMYnbfUSaM=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 04 May 2018 01:23:57 GMT
server: ATS
etag: "f9e0f24b60732cd95150a37fb003b871"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: max-age=31536000; public
x-amz-meta-x-ysws-mbst-vtime: 1510862367682930
x-amz-meta-x-ysws-access: public
x-amz-meta-mbst-etag: "YM:1:3570f846-88d6-4c90-bd91-179d937c363c00055e1f0ebaf172"
x-content-type-options: nosniff
expires: Sat, 04 May 2019 01:23:56 GMT

GET
H2 200 bundle.js Show response
s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/ 125 KB
34 KB 20ms
20ms Script
application/javascript 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/bundle.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

f1e1b9390d4497fbd0f027e3d3562d2a8fbe4a7acd829c904a6cbeea07883eee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://megaledco.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 08 Jan 2020 00:09:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 424
x-amz-server-side-encryption: AES256
status: 200
strict-transport-security: max-age=15552000
content-length: 34523
x-amz-id-2: BjmQUvY248GzWYGc0brgF9v8i/3IMN3OUaedcEx7r1HughsuRuK2KbiIiFbiAeT3ky6x3mAnf2g=
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 27 Aug 2018 17:09:14 GMT
server: ATS
etag: "11305ce4ad122ee44d98fad6158137da-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
x-amz-request-id: 7BFF279B2551CAF6
x-xss-protection: 1; mode=block
cache-control: public,max-age=315360000
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 fuji-spinner-1.0.1.svg
s.yimg.com/wm/modern/images/ 5 KB
942 B 17ms
17ms Image
image/svg+xml 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/wm/modern/images/fuji-spinner-1.0.1.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

186034da48941b64b5f6b4d8a0176fb86e2ad6adda436b8eeef521b0166d06c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/aol-main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Mon, 09 Dec 2019 04:57:44 GMT
content-encoding: gzip
x-amz-meta-created-date: Sat, 18 Mar 2017 00:20:34 GMT
age: 2575127
x-amz-server-side-encryption: AES256
status: 200
content-length: 614
strict-transport-security: max-age=15552000
x-amz-request-id: DA87964EC6059481
x-amz-id-2: 7dGwOzaVV7tR02zvDlSvZMmDX+nCNG5XRgQfyOpdavIe+fsILCg7HoTRo3HNKzschZvy/rGbz9c=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 04 May 2018 05:02:09 GMT
server: ATS
etag: "1371fb7ea1d9f283b0964f6d9fedf183-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: image/svg+xml
x-xss-protection: 1; mode=block
cache-control: max-age=31536000; public
x-amz-meta-x-ysws-mbst-vtime: 1489796434429139
x-amz-meta-x-ysws-access: public
x-amz-meta-mbst-etag: "YM:1:9245687e-14b4-4f74-a865-1fdb03b2bc6000054af6434304d3"
x-content-type-options: nosniff
expires: Sat, 04 May 2019 05:02:08 GMT

GET
H2 200 client.php Show response
fc.yahoo.com/sdarla/php/ 18 KB
8 KB 200ms
199ms Script
text/javascript 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=150003036&ref=https%3A%2F%2Flogin.aol.com%2Faccount%2Fchallenge%2Fpassword

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wm/mbr/2f308471ab1a6da2448769b5cdba9a5fec09b8da/bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

fe22080c081d9306b51efbb7b188249db2ecacf5c360fdb347e1ac3b09a3684a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://megaledco.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 08 Jan 2020 00:16:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
status: 200
strict-transport-security: max-age=15552000
content-length: 7689
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: private,no-cache,no-store
x-robots-tag: noindex, noarchive, nosnippet, nofollow

GET
H2 200 boot.js Show response
s.yimg.com/rq/darla/ 7 KB
4 KB 17ms
16ms Script
application/javascript 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/darla/boot.js

Requested by

Host: fc.yahoo.com
URL: https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=150003036&ref=https%3A%2F%2Flogin.aol.com%2Faccount%2Fchallenge%2Fpassword

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

399b130c78d6cf2360018852bb5ae44e56a0f51d2315261b00cb01799d6692f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://megaledco.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Tue, 07 Jan 2020 01:01:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83711
x-amz-server-side-encryption: AES256
status: 200
strict-transport-security: max-age=15552000
content-length: 3609
x-amz-id-2: OCbWb5tvwqlq0BjdZQx7I6oQqPk4gna7T1u3qvOpp+ujax8ART46gtOx76RAt5x8myL6Jf1GOvM=
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 19 Dec 2019 18:51:16 GMT
server: ATS
etag: "f1ffdbe3986033ef98f1dc0b3babbfe6-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
x-amz-request-id: 03150071412CD9BD
x-xss-protection: 1; mode=block
cache-control: public,max-age=86400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 g-r-min.js Show response
s.yimg.com/rq/darla/3-21-0/js/ 205 KB
87 KB 17ms
17ms Script
application/javascript 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/darla/3-21-0/js/g-r-min.js

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/rq/darla/boot.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

0e2db19684570a3cda1ec5a2f03c334e7886bffb2d7ad12f90711cf4a7cb9a67

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://megaledco.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Tue, 07 Jan 2020 10:54:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48112
x-amz-server-side-encryption: AES256
status: 200
strict-transport-security: max-age=15552000
content-length: 88379
x-amz-id-2: pR6AUyIBKypqaJsBOzn8C9cNZg8sdQ0IylbdtPpiXqdtKPltvgwZduKRTPQLXYu/1WWxBOBfkeg=
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 12 Dec 2019 21:20:02 GMT
server: ATS
etag: "7a604d95d0da4d1485821447f2bf1ff0-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
x-amz-request-id: 68C752F47E925C09
x-xss-protection: 1; mode=block
cache-control: public,max-age=31536000
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 r-csc.html
s.yimg.com/rq/darla/3-21-0/html/ Frame C8CC 0
0 17ms
17ms Document
text/html 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/darla/3-21-0/html/r-csc.html

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/rq/darla/3-21-0/js/g-r-min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: s.yimg.com
:scheme: https
:path: /rq/darla/3-21-0/html/r-csc.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://megaledco.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://megaledco.com/

Response headers

status: 200
x-amz-id-2: Lf7JyXvzUq6qacg5raAVuGhTH6lOeNxO1RjXEkqGOL9qPr3wjpAp5U0psS1hzbJhFkA84Bheo0A=
x-amz-request-id: 47F2897B19A4F972
date: Tue, 07 Jan 2020 23:11:51 GMT
last-modified: Thu, 12 Dec 2019 21:20:00 GMT
etag: "1ff9b6e511ccd76562520a75bae161d2-df"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=31536000
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin, Accept-Encoding
content-encoding: gzip
content-length: 1160
age: 3882
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff

GET
H2 200 r-sf.html
s.yimg.com/rq/darla/3-21-0/html/ Frame 5D59 0
0 17ms
17ms Document
text/html 2a00:1288:f03d:1fa::2000
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/darla/3-21-0/html/r-sf.html

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/rq/darla/3-21-0/js/g-r-min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: s.yimg.com
:scheme: https
:path: /rq/darla/3-21-0/html/r-sf.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://megaledco.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://megaledco.com/

Response headers

status: 200
x-amz-id-2: M84Fd5DSYXPCeDgP701EzkLpMtwQ+ZNHxqks/ztul+t/bzFpxKE8x5DZnTyi3NJrdgUU3xQyNTI=
x-amz-request-id: 1BA5464325171554
date: Tue, 07 Jan 2020 23:11:51 GMT
last-modified: Thu, 12 Dec 2019 21:20:00 GMT
etag: "38af3d4f8c84f11502b04431eb9d3a13-df"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=31536000
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin, Accept-Encoding
content-encoding: gzip
content-length: 753
age: 3881
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff

GET
H2 200 av
beap-bc.yahoo.com/ 43 B
487 B 196ms
86ms Image
image/gif 188.125.89.204
Oath Holdings Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://beap-bc.yahoo.com/av?v=1.0.0&f=150003036%2CbJl5TDEwLjLld329vkzQbgTsMmEwMQAAAADN672I%2C-1&p=%5B10611349%2CRICH%2C1440x1024%2C999999%2C999999%2C999999%2C0%2C100%2C1%2C26507554%2C-1%5D&cb=1578442592666

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

188.125.89.204 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US),

Reverse DNS

e1-ha.ycpi.via.yahoo.com

Software

ATS /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://megaledco.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 08 Jan 2020 00:16:32 GMT
referrer-policy: no-referrer-when-downgrade
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
status: 200
cache-control: no-cache, private
x-content-type-options: nosniff
content-type: image/gif
content-length: 43
x-xss-protection: 1; mode=block
accept-charset: utf-8

GET
H2 200 p
geo.yahoo.com/ 43 B
594 B 152ms
65ms Image
image/gif 2a00:1288:110:c204::b000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://geo.yahoo.com/p?_E=adperf&outcm=performance&etrg=backgroundPost&usergenf=0&etag=performance%2Cdarla&s=150003036&pvid=bJl5TDEwLjLld329vkzQbgTsMmEwMQAAAADN672I&D_bv=1.0.0&D_ts=0&D_v=sdarla_3-21-0&D_l=122%2C8%2C514%2C255%2C0%2C0%2C267%2C123%2C7&D_m=0&test=&D_e=&D_p=8%2C10611349%2CRICH%2C1440x1024%2C999999%2C999999%2C999999%2C0%2C0%2C181%2C-1%2C100%2C26507554%2C-1%2C2%2CbJl5TDEwLjLld329vkzQbgTsMmEwMQAAAADN672I%3A-1%3ARICH%2C1%2C2%2C3%2C2%2C0%2C2%2C0%2C0%2C5%2C1%2C5%2C2%2C0%2C0%2C0%2C0%2C100%2C3%2C3%2Chttps%253A%2F%2Fmegaledco.com%2Faol%2Freconfirm.php%253F%2C%2C0%2Ctrue%2C3%2C0%2C0%2C3000%2C0%2C0%2C-1%2C-1%2C-1%2C-1%3B&D_res=%7B%22RICH%22%3A%5B%7B%22name%22%3A%22https%3A%2F%2Foao-js-tag.onemobile.yahoo.com%2Fadmax%2FadServe.do%3FcTag%3Dad975587%26brxdSectionId%3D334156555%26brxdPublisherId%3D29284317594%26ypubblob%3D%257CbJl5TDEwLjLld329vkzQbgTsMmEwMQAAAADN672I%257C150003036%257CRICH%257C442589893%26req(url)%3Dhttps%253A%2F%2Flogin.aol.com%2Faccount%2Fchallenge%2Fpassword%26secure%3D1%26brxdSiteId%3D47391085%26dcn%3D2c9d2b500167671917481e702b4d0025%26yadpos%3D%26pos%3D334156555_21%26csrtype%3D5%26ybkt%3D%26wd%3D1440%26ht%3D1024%26ua%3DMozilla%2F5.0%2520%2528X11%253B%2520Linux%2520x86_64%2529%2520AppleWebKit%2F537.36%2520%2528KHTML%252C%2520like%2520Gecko%2529%2520HeadlessChrome%2F78.0.3904.108%2520Safari%2F537.36%26of%3Djs%26sd%3D1%22%2C%22dur%22%3A127%2C%22st%22%3A50%2C%22ssl%22%3Anull%2C%22dns%22%3Anull%2C%22conn%22%3Anull%7D%2C%7B%22name%22%3A%22https%3A%2F%2Fs.yimg.com%2Frq%2Fdarla%2F3-21-0%2Fjs%2Fsfext-min.js%22%2C%22dur%22%3A17%2C%22st%22%3A22%2C%22ssl%22%3A0%2C%22dns%22%3A0%2C%22conn%22%3A0%7D%5D%7D&t=1578442596255

Protocol

Security

TLS 1.3, , CHACHA20_POLY1305

Server

2a00:1288:110:c204::b000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://megaledco.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 08 Jan 2020 00:16:36 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
status: 200
cache-control: no-cache, no-store, private
strict-transport-security: max-age=31536000
content-type: image/gif
content-length: 43
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) AOL (Online) Yahoo (Online)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			s.yimg.com/	1970-01-19 06:27:23	Name: nexagesd Value: 1
			s.yimg.com/	1970-01-19 15:12:58	Name: nexagesuid Value: c697d54ded3f4d2c89f0895695021ed5

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://s.yimg.com/rq/darla/3-21-0/js/g-r-min.js(Line 3) Message: DARLA notice: 425
console-api	log	URL: https://s.yimg.com/rq/darla/3-21-0/js/g-r-min.js(Line 3) Message: DARLA notice: 426

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

beap-bc.yahoo.com
fc.yahoo.com
geo.yahoo.com
megaledco.com
s.yimg.com
173.212.211.230
188.125.89.204
2a00:1288:110:c204::b000
2a00:1288:f03d:1fa::2000
0e2db19684570a3cda1ec5a2f03c334e7886bffb2d7ad12f90711cf4a7cb9a67
186034da48941b64b5f6b4d8a0176fb86e2ad6adda436b8eeef521b0166d06c5
2b26c350a0d0870537458063903c076a2a5ddc8de3bf670c363153f0d430ad57
399b130c78d6cf2360018852bb5ae44e56a0f51d2315261b00cb01799d6692f4
56509fcb8d84185984927217765bf1afab5b5e217a3c06377bf1388377bb0d1b
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
ede45bcb9c471636bb30c78141af29bbd617ff762b8791cec1a8d31361f3bd66
f1e1b9390d4497fbd0f027e3d3562d2a8fbe4a7acd829c904a6cbeea07883eee
f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690
fe22080c081d9306b51efbb7b188249db2ecacf5c360fdb347e1ac3b09a3684a

megaledco.com Open in urlscan Pro 173.212.211.230 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

3 Domains

5 Subdomains

4 IPs

2 Countries

207 kBTransfer

623 kBSize

2 Cookies

4 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

2 Cookies

2 Console Messages

Indicators

megaledco.com Open in urlscan Pro
173.212.211.230 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

5
Subdomains

4
IPs

2
Countries

207 kB
Transfer

623 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!