Report - logn-mailo-a9e5.fixedquery.workers.dev/

Report Overview

Submitted URL
logn-mailo-a9e5.fixedquery.workers.dev/
IP
172.67.154.223
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-26 04:21:03
Access
public
Website Title
Yahoo
Final URL
logn-mailo-a9e5.fixedquery.workers.dev/
Tags
yahoo phishing suspicious
urlquery detections
Phishing - Yahoo
Suspicious - Suspicious Javascript code

Detections

urlquery
11
Network Intrusion Detection
0
Threat Detection Systems
4

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
api.ipify.org	3267	2014-01-05	2014-10-06	2024-04-25	439 B	249 B	172.67.74.152
s.yimg.com	375	1997-05-14	2012-05-21	2024-04-25	3.6 kB	110 kB	188.125.94.204
logn-mailo-a9e5.fixedquery.workers.dev	unknown	unknown	No data	No data	495 B	48 kB	172.67.154.223
dl.dropboxusercontent.com	12831	2012-01-13	2019-02-11	2019-03-28	471 B	529 kB	162.125.71.15

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	logn-mailo-a9e5.fixedquery.workers.dev/	Yahoo! Inc

PhishTank

Scan Date	Severity	Indicator	Alert
2024-04-08	medium	logn-mailo-a9e5.fixedquery.workers.dev/	Yahoo

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (10)

	URL	Size	First Seen	Last Seen
	api.ipify.org/?format=jsonp&callback=getIP	29 B	2023-03-07	2024-05-05
Pretty URL api.ipify.org/?format=jsonp&callback=getIP IP 172.67.74.152 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:16:09 Last Seen2024-05-05 16:28:32 Times Seen16662 Hash 90a39389063c7c5716745c3b3bb4fba1 a0903c9a7e90fa3c6ddb04d0ce36abbd4c7a004f eaa6745d9d0a7698235cd6af53aad1551d975506c8405d8303282fb6d2f7ab69 Loading...

	unknown	865 B	2024-04-26	2024-04-26
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 06:21:09 Last Seen2024-04-26 06:21:09 Times Seen1 Hash 47222bd1cd0de14e857619de6b3374b0 399fc415127f707f43d4c41a0dbd71befd99e0f6 e3650816cf490500921eb6fffe5c9fc4f94028e2567ea694847c4b6173af1b40 Loading...

	logn-mailo-a9e5.fixedquery.workers.dev/	47 kB	2024-04-26	2024-04-26
Pretty URL logn-mailo-a9e5.fixedquery.workers.dev/ IP 172.67.154.223 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-26 06:21:09 Last Seen2024-04-26 06:21:09 Times Seen1 Hash e840e16c48adba263374728b69c0d9f7 24adbae5613ea9c2ca747f45d8f09a61ee342cf5 7338f31e7f6eead8a1e8cbee2dbed0db0307b06e985832bfa39efe570c3b0bc2 Loading...

	unknown	35 kB	2024-04-26	2024-04-26
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 06:21:09 Last Seen2024-04-26 06:21:09 Times Seen1 Hash f530ffbb30264b173828e6a86224b712 f2032b2d9b573e0852dbd942b19cf1097d524a35 d3d7e52a1e5f0f3631ce1417441442ea64f5dfc4162a5aede663cdad37bac3ab Loading...

	unknown	24 kB	2024-04-26	2024-04-26
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-26 06:21:10 Last Seen2024-04-26 06:21:10 Times Seen1 Hash fc0a3eb7a9933880f4969ae22d78acc2 41f0c8510607b58d25a8972cf0ee532bca844cc5 0e539ef6ccbbac8e811cdccc0bade80eb3c0f5644aa885c3f76214d5ab04a7f5 Loading...

	unknown	605 B	2024-04-08	2024-04-26
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-08 17:54:14 Last Seen2024-04-26 06:47:30 Times Seen5 Hash 055750495c77b34c6a71decd16b7cc1a db8c925d7f3a5b54cdc65ab0676ca8765011e474 bf01ccea1616e23ccab6c9c2cdb1f14cd1939cc69737409dfa1abb0a22bb7792 Loading...

	unknown	250 B	2024-04-08	2024-04-26
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-08 17:54:14 Last Seen2024-04-26 06:47:30 Times Seen5 Hash 38bdaf1e1cf8f89f4a96d3b8471ff66b 0a7aa830f6f12712a8c31d523cbc7c466ca50057 4091df1bf572ffc357dd0dc61ca43ef4fa491f3a4e87b6fc883b667458be8405 Loading...

		Size	First Seen	Last Seen
	#1 Write - 2361f9b7b81544e8cada1c72be9a8ce0	35 kB	2024-04-26	2024-04-26
Pretty Observations First Seen2024-04-26 06:21:10 Last Seen2024-04-26 06:21:10 Times Seen1 Hash 2361f9b7b81544e8cada1c72be9a8ce0 70e99da8244e29e35d51c88f27bcb1cd3efc40ac e9cf41516ce16c5ad860b43fe6b30b0ff2fb471ae823a5aa1e3f608affa7463d Loading...

	#2 Write - 9cf0f92a63e6e36f8bed8cbb0a43bfac	24 kB	2024-04-26	2024-04-26
Pretty Observations First Seen2024-04-26 06:21:10 Last Seen2024-04-26 06:21:10 Times Seen1 Hash 9cf0f92a63e6e36f8bed8cbb0a43bfac afa99c491bf495e7628da8ce23d04b567d4ee202 53adafbc84fb04065f830f1fe4d4a82fb4c9ce14fc5c79457dc5d107a7df688f Loading...

	#3 Write - ebdae389761d9626224539969aff0985	12 kB	2024-04-26	2024-04-26
Pretty Observations First Seen2024-04-26 06:21:10 Last Seen2024-04-26 06:21:10 Times Seen1 Hash ebdae389761d9626224539969aff0985 5e4124c164fa99b6f04f454f57c095dface2f025 f2b1e3083ece0351a649fe3c1a75eb525b3ff1a8bf17fc44afe20f0aad64bd24 Loading...

HTTP Transactions (10)

URL IP Response Size

api.ipify.org/?format=jsonp&callback=getIP

172.67.74.152

200 OK

29 B

URL GET HTTP/2
api.ipify.org/?format=jsonp&callback=getIP
IP
172.67.74.152:443
ASN
#13335 CLOUDFLARENET

Requested by
https://logn-mailo-a9e5.fixedquery.workers.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectipify.org
FingerprintC8:1A:05:47:C5:73:C6:CE:DF:1D:A6:DE:00:11:A9:9A:8C:DB:EF:A7
ValidityThu, 21 Mar 2024 19:56:02 GMT - Wed, 19 Jun 2024 19:56:01 GMT

File type
ASCII text, with no line terminators
Size
29 B (29 bytes)
Hash
90a39389063c7c5716745c3b3bb4fba1
a0903c9a7e90fa3c6ddb04d0ce36abbd4c7a004f
eaa6745d9d0a7698235cd6af53aad1551d975506c8405d8303282fb6d2f7ab69

HTTP Headers

GET /?format=jsonp&callback=getIP HTTP/1.1
Host: api.ipify.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://logn-mailo-a9e5.fixedquery.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 04:20:38 GMT
content-type: application/javascript
content-length: 29
vary: Origin
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 87a3c80cff2d56cb-OSL
X-Firefox-Spdy: h2

s.yimg.com/wm/mbr/images/yahoo-apple-touch-v0.0.2.png

188.125.94.204

200 OK

13 kB

URL GET HTTP/2
s.yimg.com/wm/mbr/images/yahoo-apple-touch-v0.0.2.png
IP
188.125.94.204:443
ASN
#10310 YAHOO-1

Requested by
https://logn-mailo-a9e5.fixedquery.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
PNG image data, 180 x 180, 8-bit/color RGB, interlaced
Size
13 kB (12635 bytes)
Hash
a9d2dde886cd61f73365a84878c78475
6f1f1f7414116c4b01f04ee0a07b41202c2da539
b168c836ccef9cf1cbf7b2440bc11d26667c4ae19613f1e7cf5e6cdc303c7de4

HTTP Headers

GET /wm/mbr/images/yahoo-apple-touch-v0.0.2.png HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://logn-mailo-a9e5.fixedquery.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: 6Id6sdO7h7mI2g9n8319br940MQ2F0ShXKoMUjH/AkJu+1qi8jeD4RfCD6drT4/M/35D3OzCk8U=
x-amz-request-id: CY7TPG2JN964QBAC
date: Sun, 21 Apr 2024 16:31:13 GMT
last-modified: Thu, 12 Sep 2019 21:58:38 GMT
etag: "a9d2dde886cd61f73365a84878c78475"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=315360000
accept-ranges: bytes
content-type: image/png
server: ATS
content-length: 12635
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 388168
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
ats-carp-promotion: 1
X-Firefox-Spdy: h2

s.yimg.com/wm/mbr/images/checkbox-checked.svg

188.125.94.204

200 OK

659 B

URL GET HTTP/2
s.yimg.com/wm/mbr/images/checkbox-checked.svg
IP
188.125.94.204:443
ASN
#10310 YAHOO-1

Requested by
https://logn-mailo-a9e5.fixedquery.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
659 B (659 bytes)
Hash
ac8c4fbeda6efad9549cb41b992a8b3a
46f532f081af894297bce53a7d212e2d253a60bf
11b4310df6e27428e7cf86f316abdc10148ac5cf3c8bbbd5b85c88b9f6290c59

HTTP Headers

GET /wm/mbr/images/checkbox-checked.svg HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dl.dropboxusercontent.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-amz-id-2: pSb1dbxiNxZpCgp5cZxdHS8Nr0lPgVSSAHOey75ciUc08u7Y5EPG6fYh51TEcb08MMqv1AhrCzI=
x-amz-request-id: E0G4FP2E8CJWJZ73
date: Tue, 19 Mar 2024 06:36:27 GMT
last-modified: Fri, 24 Apr 2020 17:13:52 GMT
etag: "ac8c4fbeda6efad9549cb41b992a8b3a-df"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=315360000
accept-ranges: bytes
content-type: image/svg+xml
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin, Accept-Encoding
age: 3275053
content-encoding: gzip
content-length: 659
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Regular.woff2

188.125.94.204

200 OK

29 kB

URL GET HTTP/2
s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Regular.woff2
IP
188.125.94.204:443
ASN
#10310 YAHOO-1

Requested by
https://logn-mailo-a9e5.fixedquery.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28860, version 1.0
Size
29 kB (28860 bytes)
Hash
a99b283070afc519f4816e4300c515d2
65b78d03d56de125060e61069debfc47e38fb3df
fc0e2df417e7959509df87df6b4de2eb1479c8718bc2d8ab0bc70d3753c68560

HTTP Headers

GET /cv/ae/sports/fonts/2017/Yahoo_Sans-Regular.woff2 HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://logn-mailo-a9e5.fixedquery.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://dl.dropboxusercontent.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-amz-id-2: uLt12Khxt6U0S5W9vNFYSW7o5Wv+LrJ7PR8vq9F7RY9joq3nj+6wHnnhzAcccRqBNwCQcfE7LuE=
x-amz-request-id: GVY3TYE2B6SVKFXM
date: Tue, 19 Mar 2024 06:36:28 GMT
last-modified: Thu, 19 Apr 2018 19:06:41 GMT
etag: "a99b283070afc519f4816e4300c515d2"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000,public
x-amz-meta-created-date: Tue, 03 Oct 2017 06:22:51 GMT
x-amz-meta-mbst-etag: "YM:1:cb5e4811-e042-455c-b2b2-f984d5f70e0200055a9e8550b736"
x-amz-meta-x-ysws-mbst-vtime: 1507011771545398
expires: Sat, 05 Sep 2026 00:00:00 GMT
x-amz-meta-x-ysws-access: public
accept-ranges: bytes
content-type: font/woff2
server: ATS
content-length: 28860
referrer-policy: no-referrer-when-downgrade
age: 3275053
access-control-allow-origin: *
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
vary: Origin
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Semibold.woff2

188.125.94.204

200 OK

29 kB

URL GET HTTP/2
s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Semibold.woff2
IP
188.125.94.204:443
ASN
#10310 YAHOO-1

Requested by
https://logn-mailo-a9e5.fixedquery.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 29040, version 1.0
Size
29 kB (29040 bytes)
Hash
af9fdad7698452697b016850fff96423
710130c79bf56297f8abcc6d6c575172590133b0
b8989e0be6a0c3a8a407d8b69b7884eb5ebf401b7eee8b8b98c5eeec3ba497fa

HTTP Headers

GET /cv/ae/sports/fonts/2017/Yahoo_Sans-Semibold.woff2 HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://logn-mailo-a9e5.fixedquery.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://dl.dropboxusercontent.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-amz-id-2: DefxiOtub3VtkWJKb9V77nHKTonPT3kWoz6tJ30yAUn7bPK2K3b/rMN6mKb6Q8xBpakGSPr0YRo=
x-amz-request-id: A5FPZED3TJCHE41Q
date: Mon, 22 Apr 2024 18:48:56 GMT
last-modified: Thu, 19 Apr 2018 17:33:29 GMT
etag: "af9fdad7698452697b016850fff96423"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000,public
x-amz-meta-created-date: Tue, 03 Oct 2017 06:22:51 GMT
x-amz-meta-mbst-etag: "YM:1:95620d49-21c2-4044-b803-58b70c8e419700055a9e854fb9f1"
x-amz-meta-x-ysws-mbst-vtime: 1507011771480561
expires: Sat, 05 Sep 2026 00:00:00 GMT
x-amz-meta-x-ysws-access: public
accept-ranges: bytes
content-type: font/woff2
server: ATS
content-length: 29040
referrer-policy: no-referrer-when-downgrade
age: 293506
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
access-control-allow-origin: *
vary: Origin
ats-carp-promotion: 1
X-Firefox-Spdy: h2

s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png

188.125.94.204

200 OK

1.3 kB

URL GET HTTP/2
s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png
IP
188.125.94.204:443
ASN
#10310 YAHOO-1

Requested by
https://logn-mailo-a9e5.fixedquery.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
PNG image data, 240 x 72, 8-bit colormap, non-interlaced
Size
1.3 kB (1346 bytes)
Hash
cd166981c96c6d0f4b5a7d798c25878e
09031c4013138bb8bd54ab9092ac59aa47d7c60c
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338

HTTP Headers

GET /rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://logn-mailo-a9e5.fixedquery.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: MZDNc4Knu2nZ3QhK4ygVOdto5TX2FQpQg7ON1GYHSGfcCWVAxLlHxiAnWDqBhxdaYXdI6t7ytlQ=
x-amz-request-id: VDN8473C9XSXG8SQ
date: Thu, 25 Apr 2024 08:33:22 GMT
last-modified: Wed, 24 Apr 2024 21:32:20 GMT
etag: "cd166981c96c6d0f4b5a7d798c25878e"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=86400
expires: Thu, 25 Apr 2024 23:00:00 GMT
accept-ranges: bytes
content-type: image/png
server: ATS
content-length: 1346
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 71239
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
ats-carp-promotion: 1
X-Firefox-Spdy: h2

s.yimg.com/wm/mbr/images/yahoo-favicon-img-v0.0.2.ico

188.125.94.204

200 OK

1.4 kB

URL GET HTTP/2
s.yimg.com/wm/mbr/images/yahoo-favicon-img-v0.0.2.ico
IP
188.125.94.204:443
ASN
#10310 YAHOO-1

Requested by
https://logn-mailo-a9e5.fixedquery.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
Size
1.4 kB (1406 bytes)
Hash
b6814ae5582d7953821acbd76e977bb4
75a33fc706c2c6ba233e76c17337e466949f403c
4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3

HTTP Headers

GET /wm/mbr/images/yahoo-favicon-img-v0.0.2.ico HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://logn-mailo-a9e5.fixedquery.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: 92+auUa12jbWJOuM6Pxe9RkvIa5vSChBwsup9RKWvSJII1hgEnbu5Sd3bQaboUHljraxz3jSqP8=
x-amz-request-id: T51WBXAC2SY873A5
date: Wed, 24 Apr 2024 20:37:41 GMT
last-modified: Wed, 11 Sep 2019 18:01:04 GMT
etag: "b6814ae5582d7953821acbd76e977bb4"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=315360000
accept-ranges: bytes
content-type: image/vnd.microsoft.icon
server: ATS
content-length: 1406
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 114180
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Medium.woff2

188.125.94.204

200 OK

29 kB

URL GET HTTP/2
s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Medium.woff2
IP
188.125.94.204:443
ASN
#10310 YAHOO-1

Requested by
https://logn-mailo-a9e5.fixedquery.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 29228, version 1.0
Size
29 kB (29228 bytes)
Hash
7c7c02dcee2bf1c2528db6092d4ad1fa
988a01f705c074261490625c70f94b2642413693
d5312dacbe6f248c6c4b60251d7acf77bc3bc891cd9b880dead36d9babb288c4

HTTP Headers

GET /cv/ae/sports/fonts/2017/Yahoo_Sans-Medium.woff2 HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://logn-mailo-a9e5.fixedquery.workers.dev
DNT: 1
Connection: keep-alive
Referer: https://dl.dropboxusercontent.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
x-amz-id-2: oT8rxdX0BmPQW9ZPxv+cihL/63Lh2Gu7w3Ov/TyouzO/4i+q+Jp3j2nHCwOs8JuhMwGmQ5OD1fA=
x-amz-request-id: 30X55VFHEYM60VX3
date: Thu, 08 Feb 2024 03:26:45 GMT
last-modified: Thu, 19 Apr 2018 16:25:50 GMT
etag: "7c7c02dcee2bf1c2528db6092d4ad1fa"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000,public
x-amz-meta-created-date: Tue, 03 Oct 2017 06:22:52 GMT
x-amz-meta-mbst-etag: "YM:1:1bb49599-26ac-442e-b6b8-f4e40f067ea500055a9e855b6ecb"
x-amz-meta-x-ysws-mbst-vtime: 1507011772247755
expires: Sat, 05 Sep 2026 00:00:00 GMT
x-amz-meta-x-ysws-access: public
accept-ranges: bytes
content-type: font/woff2
server: ATS
content-length: 29228
referrer-policy: no-referrer-when-downgrade
age: 6742437
access-control-allow-origin: *
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
vary: Origin
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

logn-mailo-a9e5.fixedquery.workers.dev/

172.67.154.223

200 OK

47 kB

URL User Request GET HTTP/2
logn-mailo-a9e5.fixedquery.workers.dev/
IP
172.67.154.223:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectfixedquery.workers.dev
FingerprintD6:2B:E6:15:CC:29:F8:E8:97:9A:90:D2:91:90:9F:04:C8:E2:A3:FF
ValidityThu, 25 Apr 2024 08:21:05 GMT - Wed, 24 Jul 2024 08:21:04 GMT

File type
HTML document, ASCII text, with very long lines (46975)
Size
47 kB (47034 bytes)
Hash
947bb74475c7a475e902d0a83b0b6fe6
1e148ee29926298fae555a538b560dfcf7399458
9426545ea912acef75abb8376738915cb0d33800c3c16423258de180029bdef7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Yahoo
urlquery	suspicious	Suspicious - Suspicious Javascript code
OpenPhish	phishing	Yahoo! Inc
PhishTank	phishing	Yahoo

HTTP Headers

GET / HTTP/1.1
Host: logn-mailo-a9e5.fixedquery.workers.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 04:20:38 GMT
content-type: text/html;charset=UTF-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yOAdGbYW6VGtJUZmvmHWpQkh9CQBfBkZpkk9IOA2%2FS5z72UO%2Fqpz9K99HBw%2Fgva8C4ImUKJCgCSYk1e%2FTf6x4izQF6SSUgRmDY4S0%2BcsJ%2FCaAuQpRtPY9Knk0TtBCjMu7TEClVjedOeU1IjFRgR6JzuGwt71xuPU8w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3c80a196356be-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

dl.dropboxusercontent.com/s/yntjno1t8hokj3k/yahoo-main.css

162.125.71.15

200 OK

528 kB

URL GET HTTP/2
dl.dropboxusercontent.com/s/yntjno1t8hokj3k/yahoo-main.css
IP
162.125.71.15:443
ASN
#19679 DROPBOX

Requested by
https://logn-mailo-a9e5.fixedquery.workers.dev/
Certificate
IssuerDigiCert Inc
Subject*.dl.dropboxusercontent.com
Fingerprint66:F4:AC:24:6B:45:2B:53:3A:0C:7A:96:51:BC:36:53:B5:E8:39:40
ValidityMon, 25 Mar 2024 00:00:00 GMT - Tue, 11 Mar 2025 23:59:59 GMT

File type
ASCII text, with very long lines (42867)
Size
528 kB (527821 bytes)
Hash
c7b6b4fcc664b465b286a378712e3eaf
7f60a2ddeedb282ab44ebe3daa8bb124ccb2a96e
cb5649b939e53e8fee962915504b16f52294e77ad3d44a54af854a96760d0dae

HTTP Headers

GET /s/yntjno1t8hokj3k/yahoo-main.css HTTP/1.1
Host: dl.dropboxusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://logn-mailo-a9e5.fixedquery.workers.dev/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
accept-ranges: bytes
cache-control: max-age=60
content-disposition: inline; filename="yahoo-main.css"; filename*=UTF-8''yahoo-main.css
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
pragma: public
set-cookie: uc_session=LIn4rpGypB1OhGlBvbFNQvIDm4dgrJGEmDT1sJ7NIQDYL2R5x8xs2VvZ7dMBINu0; Domain=dropboxusercontent.com; HttpOnly; Path=/; SameSite=None; Secure
x-content-type-options: nosniff
x-server-response-time: 308
date: Fri, 26 Apr 2024 04:20:39 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
vary: Accept-Encoding
x-dropbox-response-origin: far_remote
x-dropbox-request-id: e37394713b414d8c80e2598d9bf2168f
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (10)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by