Report - stizx.pages.dev/

Report Overview

Submitted URL
stizx.pages.dev/
IP
188.114.97.1
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-17 17:12:20
Access
public
Website Title
Yahoo - login
Final URL
stizx.pages.dev/
Tags
phishing suspicious
urlquery detections
Phishing - Generic phishing
Suspicious - Suspicious Javascript code

Detections

urlquery
7
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2024-04-17	430 B	31 kB	142.251.209.138
s.yimg.com	375	1997-05-14	2012-05-21	2024-04-17	911 B	4.4 kB	87.248.119.252
stizx.pages.dev	unknown	2020-09-02	2023-07-09	2024-04-10	902 B	167 kB	188.114.97.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-17	medium	stizx.pages.dev/	Yahoo! Inc
2024-03-02	medium	stizx.pages.dev/login_files/loga	Yahoo! Inc

PhishTank

Scan Date	Severity	Indicator	Alert
2024-03-01	medium	stizx.pages.dev/	Yahoo
2024-03-01	medium	stizx.pages.dev/login_files/loga	Yahoo

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	stizx.pages.dev/	188 B	2023-05-15	2024-04-21
Pretty URL stizx.pages.dev/ IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-05-15 01:19:59 Last Seen2024-04-21 19:26:03 Times Seen49 Hash 6e81fdff3c2412636a19b367d2338490 e840a8d8ee8a41761ec26029bb55713264cf9ca1 001489b6420644a4f846d36dd16fe053f0fd09f0689ceaa6e624200e29fffb41 Loading...

	stizx.pages.dev/	8 B	2023-03-07	2024-04-21
Pretty URL stizx.pages.dev/ IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 22:06:56 Last Seen2024-04-21 19:26:03 Times Seen57 Hash 0e8aed218808bf75a54aaaec1011b745 cec6aaf5ea4ab304b49d8f6ee38fccbc8b7ae279 f60ee088850d101237e4054c94afa821472ae3902d71dd9bafa0f7f3189b9d66 Loading...

	stizx.pages.dev/	888 B	2023-05-15	2024-04-21
Pretty URL stizx.pages.dev/ IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-05-15 01:19:59 Last Seen2024-04-21 19:26:03 Times Seen54 Hash 25209b1c3025521edd27bf75eed24642 441efb4c689b5fdba68d2346a0ae2f677325fddb 399ace66fefde4871b02e121186bbd6226378d258e70f33956fee4f53168cb26 Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js	87 kB	2023-03-07	2024-04-30
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js IP 142.251.209.138 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:00 Last Seen2024-04-30 16:54:43 Times Seen63633 Hash c9f5aeeca3ad37bf2aa006139b935f0a 1055018c28ab41087ef9ccefe411606893dabea2 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Loading...

	stizx.pages.dev/	2.3 kB	2023-03-13	2024-04-21
Pretty URL stizx.pages.dev/ IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 01:45:34 Last Seen2024-04-21 19:26:03 Times Seen55 Hash 56397e9f6bcecaa70c113fef0afcdfd0 c38bdf08008f04072b0e405c00a05468d7870e62 ac4963bae823dada56958127c5ba3375877ab4c0d42e70d98af3f44ec4d33d87 Loading...

	stizx.pages.dev/	481 B	2023-03-07	2024-04-21
Pretty URL stizx.pages.dev/ IP 188.114.97.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 22:06:56 Last Seen2024-04-21 19:26:03 Times Seen55 Hash 7742393efb6a6efeaf9b96c49dd12f58 5d22ce3cbba9915418f04b298258a4ed73f523e8 b7b3af3543b7a8ce4a57ca216bdeefbf8f248276be7c606def55d899afc323f8 Loading...

HTTP Transactions (5)

URL IP Response Size

ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

142.251.209.138

200 OK

30 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
IP
142.251.209.138:443
ASN
#15169 GOOGLE

Requested by
https://stizx.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint47:5A:64:7D:9F:47:34:07:31:91:97:F7:04:42:7A:D5:EA:AD:07:4E
ValidityMon, 04 Mar 2024 07:16:44 GMT - Mon, 27 May 2024 07:16:43 GMT

File type
JavaScript source, ASCII text, with very long lines (32058)
Size
30 kB (30306 bytes)
Hash
c9f5aeeca3ad37bf2aa006139b935f0a
1055018c28ab41087ef9ccefe411606893dabea2
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

HTTP Headers

GET /ajax/libs/jquery/3.2.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stizx.pages.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30306
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Apr 2024 19:28:21 GMT
expires: Fri, 11 Apr 2025 19:28:21 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 510213
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png

87.248.119.252

200 OK

1.3 kB

URL GET HTTP/2
s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png
IP
87.248.119.252:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://stizx.pages.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
PNG image data, 240 x 72, 8-bit colormap, non-interlaced
Size
1.3 kB (1346 bytes)
Hash
cd166981c96c6d0f4b5a7d798c25878e
09031c4013138bb8bd54ab9092ac59aa47d7c60c
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338

HTTP Headers

GET /rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stizx.pages.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: LooxGuNcbFll9TRiZlVBxYFpYS+usP9EkQM7Cl8XGY1MWmlpTxLgbenRvRZHosZl1nMGq6ge6LU=
x-amz-request-id: JSNYMCD8CWDQQDRE
date: Wed, 17 Apr 2024 12:18:40 GMT
last-modified: Tue, 16 Apr 2024 21:32:09 GMT
etag: "cd166981c96c6d0f4b5a7d798c25878e"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=86400
expires: Wed, 17 Apr 2024 23:00:00 GMT
accept-ranges: bytes
content-type: image/png
server: ATS
content-length: 1346
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 17596
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

s.yimg.com/wm/mbr/images/yahoo-favicon-img-v0.0.2.ico

87.248.119.252

200 OK

1.4 kB

URL GET HTTP/2
s.yimg.com/wm/mbr/images/yahoo-favicon-img-v0.0.2.ico
IP
87.248.119.252:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://stizx.pages.dev/
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
FingerprintF9:49:E1:CC:DE:98:74:FF:9B:DF:28:DC:D8:43:B9:82:99:B1:60:DB
ValidityTue, 02 Apr 2024 00:00:00 GMT - Wed, 22 May 2024 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
Size
1.4 kB (1406 bytes)
Hash
b6814ae5582d7953821acbd76e977bb4
75a33fc706c2c6ba233e76c17337e466949f403c
4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3

HTTP Headers

GET /wm/mbr/images/yahoo-favicon-img-v0.0.2.ico HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://stizx.pages.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: LBJ1ScuvICDL/czymX+obFDzgr6uxiOlVqcgy6S+0lMLJJV7svjte9/hhOE/0Q5iU41p4fnS6hZukzQKknSAcylVQGhKq+UX6+bXGLqdVQc=
x-amz-request-id: 9S9PB908RQ2MSY7B
date: Tue, 16 Apr 2024 22:15:52 GMT
last-modified: Wed, 11 Sep 2019 18:01:04 GMT
etag: "b6814ae5582d7953821acbd76e977bb4"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=315360000
accept-ranges: bytes
content-type: image/vnd.microsoft.icon
server: ATS
content-length: 1406
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 68164
strict-transport-security: max-age=31536000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

stizx.pages.dev/

188.114.97.1

200 OK

88 kB

URL User Request GET HTTP/2
stizx.pages.dev/
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectstizx.pages.dev
FingerprintB3:5E:67:D1:59:01:C5:F4:B9:CC:E4:36:61:A8:E1:E1:FA:20:72:7C
ValiditySat, 02 Mar 2024 01:06:59 GMT - Fri, 31 May 2024 01:06:58 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
88 kB (87601 bytes)
Hash
16c842bb324cb2f7144fab35782d1e64
28de4c3b003b33ab8d81baafd63b09a40cde8847
1e011f734e7a29052a6e76cf6f2537515860b910121fcebdd739219741597f66

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Generic phishing
urlquery	suspicious	Suspicious - Suspicious Javascript code
OpenPhish	phishing	Yahoo! Inc
PhishTank	phishing	Yahoo

HTTP Headers

GET / HTTP/1.1
Host: stizx.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 17 Apr 2024 17:11:54 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"a8939e5a085463ed0b92e943f45878d6"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1WyHYuGOSdQPeJ%2BXCg%2FR91VzMhP0lZm3GAEOlnrFOCauZ6paFG0%2B1viAy720q2FSbmPf4KKh7Z3j9SjzgsBpjluB0HH%2BeMmK9g2TKbmkkYcJG6q43ASRU27yxI4LuGVqDgw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875e09759b4cabd8-CPH
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

stizx.pages.dev/login_files/loga

188.114.97.1

200 OK

78 kB

URL GET HTTP/3
stizx.pages.dev/login_files/loga
IP
188.114.97.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://stizx.pages.dev/
Certificate
IssuerGoogle Trust Services LLC
Subjectstizx.pages.dev
FingerprintB3:5E:67:D1:59:01:C5:F4:B9:CC:E4:36:61:A8:E1:E1:FA:20:72:7C
ValiditySat, 02 Mar 2024 01:06:59 GMT - Fri, 31 May 2024 01:06:58 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
78 kB (77536 bytes)
Hash
352fa67e29cd0ca8d5521e700ad0f42c
d7c4ba4a3f9879466e2dcc02d7a1a01c962cf633
79b3d1e860104132911e2248dccb6a540dd31154d1a482131158d7d14d058ca2

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Yahoo! Inc
PhishTank	phishing	Yahoo

HTTP Headers

GET /login_files/loga HTTP/1.1
Host: stizx.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://stizx.pages.dev/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 17 Apr 2024 17:11:55 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
etag: W/"a8939e5a085463ed0b92e943f45878d6"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vCZWXpv0fg6ZvAWWcIzQZMFOVMqlFkB%2F9hkGiBdlXFtUpsSvuiw%2BFT56QB9nf%2FJNS6veASEhTTNjlUBmaeW7YE8wxh%2FGbKeA0gmk6mUqOd0YIc6x0roF%2Fnm8WOrBxJ9aGpc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 875e097c8da992d4-CPH
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (5)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP