shopping-yahoo-jp.top

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 172.67.204.154, located in United States and belongs to CLOUDFLARENET, US. The main domain is shopping-yahoo-jp.top.
TLS certificate: Issued by GTS CA 1P5 on May 7th 2023. Valid for: 3 months.

This is the only time shopping-yahoo-jp.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	172.67.204.154 172.67.204.154	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	182.22.16.123 182.22.16.123	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
6	2

1 172.67.204.154 (United States)

ASN13335 (CLOUDFLARENET, US)

shopping-yahoo-jp.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 182.22.16.123 (Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	yimg.jp s.yimg.jp — Cisco Umbrella Rank: 7868	17 KB
1	shopping-yahoo-jp.top shopping-yahoo-jp.top	4 KB
6	2

	Domain	Requested by
5	s.yimg.jp	shopping-yahoo-jp.top s.yimg.jp
1	shopping-yahoo-jp.top
6	2

This site contains links to these domains. Also see Links.

Domain
www.yahoo.co.jp

Subject Issuer	Validity	Valid
shopping-yahoo-jp.top GTS CA 1P5	`2023-05-07` - `2023-08-05`	3 months	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2023-04-12` - `2024-05-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://shopping-yahoo-jp.top/mblogin.php
Frame ID: 4ECFCA1B8CF035D69B818F5923B974BA
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ログイン - Yahoo! JAPAN

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

21 kB
Transfer

61 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.yahoo.co.jp/
Title: Yahoo! JAPAN

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request mblogin.php Show response
shopping-yahoo-jp.top/ 16 KB
4 KB 860ms
542ms Document
text/html 172.67.204.154
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://shopping-yahoo-jp.top/mblogin.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

172.67.204.154 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9785a1bd178cd789fe36a1f006ffe5727c04c9adcddabf37a2ed3f693b387b4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7c3ab5b688c13c09-NRT
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 07 May 2023 16:06:23 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hxLuAZOnqynw2lFbotbbv7uZvIAytaWkDCvcfNNT434jqPmYAsjCLJnsMw6l64ZpXAsEuiety2s%2Ffe2XUXoJnWeRD%2BmguRun4kFw3EmR3RDYymnUPVX%2F5UbhbOnIzl0VpgzWeXFe3GM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 login-min.css
s.yimg.jp/images/login/sp/css/login/3.5.7/ 37 KB
9 KB 11ms
3ms Stylesheet
text/css 182.22.16.123
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
Requested by: Host: shopping-yahoo-jp.top
URL: https://shopping-yahoo-jp.top/mblogin.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.16.123 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 989c61ddad78e4812ae5c49c1d1b97c3d4a4188c256fd867afbfb4ea86a2f820

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://shopping-yahoo-jp.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sun, 07 May 2023 16:06:22 GMT
content-encoding: gzip
last-modified: Tue, 25 Jan 2022 16:32:34 GMT
server: ATS
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 1
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
content-length: 8593

GET
H2 200 items08-min.css
s.yimg.jp/images/login/sp/css/theme/1.2.1/ 690 B
761 B 12ms
4ms Stylesheet
text/css 182.22.16.123
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/login/sp/css/theme/1.2.1/items08-min.css
Requested by: Host: shopping-yahoo-jp.top
URL: https://shopping-yahoo-jp.top/mblogin.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.16.123 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 6c8f83a3cb3e8105f61230d06cc1f03553a37a8c66c0d0305c38fa94af4e9ec9

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://shopping-yahoo-jp.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sun, 07 May 2023 16:06:22 GMT
last-modified: Tue, 25 Jan 2022 16:32:35 GMT
server: ATS
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 1
content-type: text/css
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
accept-ranges: bytes
content-length: 690

GET
H2 200 mail144.png
s.yimg.jp/images/mail/appicon/ 3 KB
3 KB 11ms
4ms Image
image/png 182.22.16.123
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/images/mail/appicon/mail144.png
Requested by: Host: shopping-yahoo-jp.top
URL: https://shopping-yahoo-jp.top/mblogin.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.16.123 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 5fc1c33a80df575fc437542bdb8fbc2916a42b0a238e1d5dae2d442a02324f50

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://shopping-yahoo-jp.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sun, 07 May 2023 16:05:52 GMT
content-encoding: gzip
last-modified: Tue, 25 Jan 2022 16:33:13 GMT
server: ATS
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 31
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
content-length: 3242

GET
H2 200 yj_r_34_2x.png
s.yimg.jp/c/logo/f/2.0/ 3 KB
3 KB 2ms
2ms Image
image/png 182.22.16.123
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/c/logo/f/2.0/yj_r_34_2x.png
Requested by: Host: s.yimg.jp
URL: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.16.123 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sun, 07 May 2023 16:05:17 GMT
content-encoding: gzip
last-modified: Tue, 25 Jan 2022 00:33:06 GMT
server: ATS
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 66
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
content-length: 3332

GET
H2 200 ico_palette.png
s.yimg.jp/images/login/sp/img/theme/1.3.0/ 512 B
604 B 2ms
2ms Image
image/png 182.22.16.123
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/images/login/sp/img/theme/1.3.0/ico_palette.png
Requested by: Host: s.yimg.jp
URL: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.16.123 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 9bdc87263763478099797018ae7f0ea332b466a7324bb67a08f83090856d5fb1

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://s.yimg.jp/images/login/sp/css/login/3.5.7/login-min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sun, 07 May 2023 16:04:09 GMT
last-modified: Tue, 25 Jan 2022 16:32:38 GMT
server: ATS
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
age: 134
content-type: image/png
cache-control: public, max-age=600
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
accept-ranges: bytes
content-length: 512

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo Japan (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| varify

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			shopping-yahoo-jp.top/	1969-12-31 23:59:59	Name: PHPSESSID Value: 4liqlloubjl05r0b42vcffn1jn

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

s.yimg.jp
shopping-yahoo-jp.top
172.67.204.154
182.22.16.123
479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b
5fc1c33a80df575fc437542bdb8fbc2916a42b0a238e1d5dae2d442a02324f50
6c8f83a3cb3e8105f61230d06cc1f03553a37a8c66c0d0305c38fa94af4e9ec9
9785a1bd178cd789fe36a1f006ffe5727c04c9adcddabf37a2ed3f693b387b4d
989c61ddad78e4812ae5c49c1d1b97c3d4a4188c256fd867afbfb4ea86a2f820
9bdc87263763478099797018ae7f0ea332b466a7324bb67a08f83090856d5fb1

shopping-yahoo-jp.top Open in urlscan Pro 172.67.204.154 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

21 kBTransfer

61 kBSize

1 Cookies

1 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

shopping-yahoo-jp.top Open in urlscan Pro
172.67.204.154 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

21 kB
Transfer

61 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!