Report - wilaja3452poverts.pages.dev/

Report Overview

Submitted URL
wilaja3452poverts.pages.dev/
IP
172.66.47.167
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-17 17:09:50
Access
public
Website Title
Yahoo - login
Final URL
wilaja3452poverts.pages.dev/
Tags
phishing suspicious
urlquery detections
Phishing - Generic phishing
Suspicious - Suspicious Javascript code

Detections

urlquery
6
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-04-17	442 B	31 kB	142.251.209.138
wilaja3452poverts.pages.dev	unknown	2020-09-02	2023-08-27	2024-03-20	950 B	288 kB	172.66.47.167
s.yimg.com	375	1997-05-14	2012-05-21	2024-04-17	937 B	4.4 kB	87.248.119.251

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	wilaja3452poverts.pages.dev/	Yahoo! Inc
2024-04-17	medium	wilaja3452poverts.pages.dev/	Yahoo! Inc

PhishTank

Scan Date	Severity	Indicator	Alert
2023-10-12	medium	wilaja3452poverts.pages.dev/login_files/loga	Yahoo
2023-10-12	medium	wilaja3452poverts.pages.dev/	Yahoo

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (8)

	URL	Size	First Seen	Last Seen
	unknown	674 B	2023-08-28	2024-04-30
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-28 02:10:54 Last Seen2024-04-30 07:46:44 Times Seen29 Hash 33f2fac3ef990472696e174641bd353c b6a49e419ed8cf086aae14487c57563da7c7c9fa fe52ea3d1f43dd18ed6b68b42a4af96b342469f96ff8263edb4cd465298adcee Loading...

	wilaja3452poverts.pages.dev/	254 kB	2023-08-28	2024-04-30
Pretty URL wilaja3452poverts.pages.dev/ IP 172.66.47.167 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-08-28 02:10:54 Last Seen2024-04-30 07:46:44 Times Seen29 Hash 068fb91dde91a9e1832ec85ec4920fa8 09209358d923cb280d4c9fdd0f9d9592a518ba95 66b54286c4ffb825df43c3fcb2c970f3755006ccadaae229cf1d81b23ab28bda Loading...

	unknown	190 B	2023-08-28	2024-04-30
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-28 02:10:54 Last Seen2024-04-30 07:46:44 Times Seen29 Hash e82736f285cb394d000829487fe1c269 2307d30f148b818cf1b3e3f065ac569afb6b9d83 d80c73d0346cf83f16f3093261adae3b4b2cf0b8a01e11ebe9b9bb27759f7d16 Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js	87 kB	2023-03-07	2024-04-30
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js IP 142.251.209.138 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:00 Last Seen2024-04-30 15:09:17 Times Seen63629 Hash c9f5aeeca3ad37bf2aa006139b935f0a 1055018c28ab41087ef9ccefe411606893dabea2 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Loading...

	unknown	83 B	2023-08-28	2024-04-30
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-28 02:10:54 Last Seen2024-04-30 07:46:44 Times Seen29 Hash f2289544b1d1ac05fe39eccd3cfb4c91 18f2d90a7ff5fdd1ac8ed9d3c51ea24a463a1322 dfd94a580538b5e33d008eb094bc5103bd1559537e036a2784236bacb2c012fd Loading...

	unknown	969 B	2023-08-28	2024-04-30
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-28 02:10:54 Last Seen2024-04-30 07:46:44 Times Seen29 Hash c3856e4527bb7ee89014788d79bc6ab3 8ef78b84922baab9e1078b2067f5a458dca6d1d5 ff8457f9d8cb5f16d2b6f0ac92c711d87f48afd25fad3bd648623e8b083c43d3 Loading...

	unknown	2.4 kB	2023-08-28	2024-04-30
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-28 02:10:54 Last Seen2024-04-30 07:46:44 Times Seen29 Hash a75cd509cbf348083ad608170c7c486e dec3a097df0498d2e0a6bf1236c78ce7e2659a3b 49476c1a8329e8348d96f0685f9e75f9a5616c9bd92c4b5c7c4786a7803668e2 Loading...

		Size	First Seen	Last Seen
	#1 Write - 733df24ed7d7e0f69a2c14de8a04fbe3	85 kB	2023-08-28	2024-04-30
Pretty Observations First Seen2023-08-28 02:10:54 Last Seen2024-04-30 07:46:44 Times Seen29 Hash 733df24ed7d7e0f69a2c14de8a04fbe3 43833b79637c837f74076446c60a6b2203f33b09 9b487945b0bbf372e2843bf4e14ab9e56c0069cc4b6799ef7cdc432eeff1f429 Loading...

HTTP Transactions (5)

URL IP Response Size

ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

142.251.209.138

200 OK

30 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
IP
142.251.209.138:443
ASN
#15169 GOOGLE

Requested by
https://wilaja3452poverts.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint47:5A:64:7D:9F:47:34:07:31:91:97:F7:04:42:7A:D5:EA:AD:07:4E
ValidityMon, 04 Mar 2024 07:16:44 GMT - Mon, 27 May 2024 07:16:43 GMT

File type
JavaScript source, ASCII text, with very long lines (32058)
Size
30 kB (30306 bytes)
Hash
c9f5aeeca3ad37bf2aa006139b935f0a
1055018c28ab41087ef9ccefe411606893dabea2
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

HTTP Headers

GET /ajax/libs/jquery/3.2.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wilaja3452poverts.pages.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30306
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Apr 2024 19:28:21 GMT
expires: Fri, 11 Apr 2025 19:28:21 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 510063
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

wilaja3452poverts.pages.dev/login_files/loga

172.66.47.167

200 OK

32 kB

URL GET HTTP/3
wilaja3452poverts.pages.dev/login_files/loga
IP
172.66.47.167:443
ASN
#13335 CLOUDFLARENET

Requested by
https://wilaja3452poverts.pages.dev/
Certificate
IssuerLet's Encrypt
Subjectwilaja3452poverts.pages.dev
Fingerprint2A:EA:3B:8E:C6:90:C2:55:FF:C4:22:02:08:C8:71:C6:8E:13:81:A6
ValidityTue, 20 Feb 2024 16:47:22 GMT - Mon, 20 May 2024 16:47:21 GMT

File type
data
Size
32 kB (32272 bytes)
Hash
769d0644c0fab6abdc3749f772fa357d
40a9372621289eb0666aea9b87b0e89848a6cbfc
3cb518f8382f38a9450363dd4b258082d0be54eb7ce7b6bf14cabfbce5e3b15a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Yahoo! Inc
PhishTank	phishing	Yahoo

HTTP Headers

GET /login_files/loga HTTP/1.1
Host: wilaja3452poverts.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://wilaja3452poverts.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 17 Apr 2024 17:09:24 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"d13bf6cc991deb37224368583938513e"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cFG2d5lBn1efHqy%2BcMDoPjryhrln%2FVf70E74ENmCt0jV8DYIT6Q4lL6YX%2BHdF%2FdB%2FequhaAVP%2F%2FajghgRcLJoCBHQGUtdvTm1ukoXICg4Q7Gzs9Zb8klMxHRd2yeLooVSn5vBQnFVhvfbap91Mc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875e05cdcbeb8f58-CPH
content-encoding: br
alt-svc: h3=":443"; ma=86400

s.yimg.com/wm/mbr/images/yahoo-favicon-img-v0.0.2.ico

87.248.119.251

200 OK

1.4 kB

URL GET HTTP/2
s.yimg.com/wm/mbr/images/yahoo-favicon-img-v0.0.2.ico
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://wilaja3452poverts.pages.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
Size
1.4 kB (1406 bytes)
Hash
b6814ae5582d7953821acbd76e977bb4
75a33fc706c2c6ba233e76c17337e466949f403c
4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3

HTTP Headers

GET /wm/mbr/images/yahoo-favicon-img-v0.0.2.ico HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wilaja3452poverts.pages.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: 1bO1Edc1/OiL/k2yyprIuOwBd1UkISBwN1kqFJQx+En+VsUA90u0Uj/2xU6xZ3Lo8G17Okoq4BGE7kH1WNHGA3TDjBOl3wLdegTTigJvCag=
x-amz-request-id: H0AWW8TR85ZKNGVK
date: Wed, 17 Apr 2024 07:54:01 GMT
last-modified: Wed, 11 Sep 2019 18:01:04 GMT
etag: "b6814ae5582d7953821acbd76e977bb4"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=315360000
accept-ranges: bytes
content-type: image/vnd.microsoft.icon
server: ATS
content-length: 1406
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 33325
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png

87.248.119.251

200 OK

1.3 kB

URL GET HTTP/2
s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://wilaja3452poverts.pages.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
PNG image data, 240 x 72, 8-bit colormap, non-interlaced
Size
1.3 kB (1346 bytes)
Hash
cd166981c96c6d0f4b5a7d798c25878e
09031c4013138bb8bd54ab9092ac59aa47d7c60c
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338

HTTP Headers

GET /rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://wilaja3452poverts.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: mycFr4fQcsWYWQH8XFahD0f+6Vl/5bii2tZUVeOvg1Gz3KrdkEWwMNTsm+Dg/hXEPsn9GiSmyyk=
x-amz-request-id: VSWZF8A168F2A1ZH
date: Wed, 17 Apr 2024 04:40:18 GMT
last-modified: Tue, 16 Apr 2024 21:32:09 GMT
etag: "cd166981c96c6d0f4b5a7d798c25878e"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=86400
expires: Wed, 17 Apr 2024 23:00:00 GMT
accept-ranges: bytes
content-type: image/png
server: ATS
content-length: 1346
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 44949
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

wilaja3452poverts.pages.dev/

172.66.47.167

200 OK

254 kB

URL User Request GET HTTP/2
wilaja3452poverts.pages.dev/
IP
172.66.47.167:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectwilaja3452poverts.pages.dev
Fingerprint2A:EA:3B:8E:C6:90:C2:55:FF:C4:22:02:08:C8:71:C6:8E:13:81:A6
ValidityTue, 20 Feb 2024 16:47:22 GMT - Mon, 20 May 2024 16:47:21 GMT

File type
HTML document, ASCII text, with very long lines (65503), with CRLF line terminators
Size
254 kB (253842 bytes)
Hash
6a0b32e63e9c47abe05290994ece6e78
1beb96c3c9c0d8bc51fdd16dacf00d3376cdf9b0
1401f6fb58a8a225ede651a8a4d8e80ef75fb1742d047322f36d3773a98921b6

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Yahoo! Inc
PhishTank	phishing	Yahoo

HTTP Headers

GET / HTTP/1.1
Host: wilaja3452poverts.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 17 Apr 2024 17:09:24 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"d13bf6cc991deb37224368583938513e"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LWYiCejl%2BBKB1TnePZg88b%2B6pk2icbh74ze8oR6At1TuvD%2BvKaZ9ZK0IBVk%2FZ6wNGEqjU7RdOWKvgquaVq7uBJ4jBWqhVb9%2BxpjGhCxgmUmgD1oYgN2db4NMa87z%2Flms7x3xFAla1BHG5Cy72tY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875e05cbbd1babd5-CPH
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (8)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (5)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash