URL: https://yca.org/?lang_ID=cahaya128
Submission Tags: @phish_report
Submission: On December 24 via api from FI — Scanned from FI

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2607:f1c0:100f:f000::205, located in United States and belongs to IONOS-AS IONOS SE, DE. The main domain is yca.org.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G2 on June 20th 2024. Valid for: a year.
This is the only time yca.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2607:f1c0:100... 8560 (IONOS-AS ...)
1 64.190.63.136 47846 (SEDO-AS S...)
3 2
Apex Domain
Subdomains
Transfer
2 yca.org
yca.org
3 KB
1 sedoparking.com
sedoparking.com — Cisco Umbrella Rank: 54753
3 KB
3 2
Domain Requested by
2 yca.org
1 sedoparking.com yca.org
3 2

This site contains links to these domains. Also see Links.

Domain
www.ionos.de
sedoparking.com
Subject Issuer Validity Valid
*.yca.org
Encryption Everywhere DV TLS CA - G2
2024-06-20 -
2025-07-05
a year crt.sh
sedoparking.com
Encryption Everywhere DV TLS CA - G2
2024-12-23 -
2025-12-23
a year crt.sh

This page contains 1 frames:

Primary Page: https://yca.org/?lang_ID=cahaya128
Frame ID: 554EF702C854D9BEE2E5306DDA7F4C2C
Requests: 3 HTTP requests in this frame

Screenshot


Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

6 kB
Transfer

20 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
yca.org/
1 KB
1 KB
Document
General
Full URL
https://yca.org/?lang_ID=cahaya128
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2607:f1c0:100f:f000::205 , United States, ASN8560 (IONOS-AS IONOS SE, DE),
Reverse DNS
Software
Apache /
Resource Hash
ab5fc6e036dd1743c60b18d7627ba59af68b36d6e98be3c973718234983a2a3e
Security Headers
Name Value
X-Frame-Options deny

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

content-length
1271
content-type
text/html
date
Tue, 24 Dec 2024 10:52:37 GMT
server
Apache
x-frame-options
deny
park.js
sedoparking.com/frmpark/yca.org/IONOSParkingUS/
18 KB
3 KB
Script
General
Full URL
https://sedoparking.com/frmpark/yca.org/IONOSParkingUS/park.js
Requested by
Host: yca.org
URL: https://yca.org/?lang_ID=cahaya128
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.190.63.136 , Germany, ASN47846 (SEDO-AS SEDO GmbH, DE),
Reverse DNS
Software
Parking/1.0 /
Resource Hash
f5c6f71546ca824cca01c6a300a3a6c590485a1896737856ade4351e0a883ccb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://yca.org/

Response headers

x-cache-miss-from
parking-7df97dc48-gpq8l
content-encoding
gzip
date
Tue, 24 Dec 2024 10:52:37 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Parking/1.0
favicon.ico
yca.org/
1 KB
1 KB
Other
General
Full URL
https://yca.org/favicon.ico
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2607:f1c0:100f:f000::205 , United States, ASN8560 (IONOS-AS IONOS SE, DE),
Reverse DNS
Software
Apache /
Resource Hash
ab5fc6e036dd1743c60b18d7627ba59af68b36d6e98be3c973718234983a2a3e
Security Headers
Name Value
X-Frame-Options deny

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://yca.org/?lang_ID=cahaya128

Response headers

content-length
1271
date
Tue, 24 Dec 2024 10:52:37 GMT
content-type
text/html
server
Apache
x-frame-options
deny

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| google_afd_request object| setup object| contentContainer function| insertScript function| google_afd_ad_request_done function| loadGoogleToken function| loadContentFrame function| requestCookieConsent function| addCss function| addHtml

0 Cookies

5 Console Messages

Source Level URL
Text
network error URL: https://yca.org/?lang_ID=cahaya128
Message:
Failed to load resource: the server responded with a status of 500 ()
rendering warning URL: https://yca.org/?lang_ID=cahaya128(Line 24)
Message:
Error parsing a meta element's content: ';' is not a valid key-value pair separator. Please use ',' instead.
javascript warning URL: https://yca.org/?lang_ID=cahaya128(Line 30)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://sedoparking.com/frmpark/yca.org/IONOSParkingUS/park.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://yca.org/?lang_ID=cahaya128(Line 30)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://sedoparking.com/frmpark/yca.org/IONOSParkingUS/park.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://yca.org/favicon.ico
Message:
Failed to load resource: the server responded with a status of 500 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options deny

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sedoparking.com
yca.org
2607:f1c0:100f:f000::205
64.190.63.136
ab5fc6e036dd1743c60b18d7627ba59af68b36d6e98be3c973718234983a2a3e
f5c6f71546ca824cca01c6a300a3a6c590485a1896737856ade4351e0a883ccb