![](/screenshots/e40a9466-b122-40cf-829b-2c1461015268.png)
yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com
Open in
urlscan Pro
91.218.247.99
Malicious Activity!
Public Scan
Submission: On November 19 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on November 19th 2018. Valid for: 3 months.
This is the only time yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Yahoo (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 91.218.247.99 91.218.247.99 | 49335 (NCONNECT-AS) (NCONNECT-AS) | |
1 | 2a00:1288:7c:... 2a00:1288:7c:800::4000 | 43428 (YAHOO-ULS) (YAHOO-ULS) | |
1 2 | 23.57.19.23 23.57.19.23 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
3 | 3 |
ASN49335 (NCONNECT-AS, RU)
PTR: anemone11.steeldns.com
yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-57-19-23.deploy.static.akamaitechnologies.com
sb.scorecardresearch.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
scorecardresearch.com
1 redirects
sb.scorecardresearch.com |
1 KB |
1 |
yimg.com
s.yimg.com |
4 KB |
1 |
google-com-19lkrh79aeg98.com
yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com |
29 KB |
3 | 3 |
Domain | Requested by | |
---|---|---|
2 | sb.scorecardresearch.com |
1 redirects
yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com
|
1 | s.yimg.com |
yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com
|
1 | yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com | |
3 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.yahoo.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com Let's Encrypt Authority X3 |
2018-11-19 - 2019-02-17 |
3 months | crt.sh |
*.yahoo.com DigiCert SHA2 High Assurance Server CA |
2018-11-15 - 2018-12-07 |
23 days | crt.sh |
*.scorecardresearch.com COMODO RSA Organization Validation Secure Server CA |
2017-12-06 - 2018-12-26 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com/
Frame ID: 6F660342CC8EA2D9F71461C642E4011C
Requests: 3 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: Trouble signing in?
Search URL Search Domain Scan URL
Title: Sign up
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://sb.scorecardresearch.com/p?c1=2&c2=7241469&c5=360602527&ns_c=UTF-8&ns__t=1534885674349&c7=https%3A%2F%2Flogin.yahoo.com%2Fm%2F%3F.src%3Dym%26.lang%3Den-en%26.intl%3Dnl&c14=-1 HTTP 302
- https://sb.scorecardresearch.com/p2?c1=2&c2=7241469&c5=360602527&ns_c=UTF-8&ns__t=1534885674349&c7=https%3A%2F%2Flogin.yahoo.com%2Fm%2F%3F.src%3Dym%26.lang%3Den-en%26.intl%3Dnl&c14=-1
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com/ |
100 KB 29 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
yahoo_en-US_f_p_bestfit_2x.png
s.yimg.com/rz/d/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p2
sb.scorecardresearch.com/ Redirect Chain
|
43 B 406 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Yahoo (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| pageStartTime object| I13N_config object| COUNTRY_CODES_MAP string| bucket string| currentURL string| comscoreBeaconUrl0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
s.yimg.com
sb.scorecardresearch.com
yahoo.com-1fkvkag9a929g.google-com-19lkrh79aeg98.com
23.57.19.23
2a00:1288:7c:800::4000
91.218.247.99
19b644434cfa9f5d12e1e90a3c2d062aacf27da9ecbe8393df77383ab3c00208
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
6572883fdbfcd4a6149e58a2628f4366baab283d35e005abec7d5d41d2c10765