saffron-distributor.com Open in urlscan Pro
49.12.128.156 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://saffron-distributor.com/
Submission Tags: phishing
Submission: On April 19 via api (April 19th 2022, 10:54:00 am UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 49.12.128.156, located in Germany and belongs to HETZNER-AS, DE. The main domain is saffron-distributor.com.
TLS certificate: Issued by R3 on April 11th 2022. Valid for: 3 months.

This is the only time saffron-distributor.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	49.12.128.156 49.12.128.156	24940 (HETZNER-AS) (HETZNER-AS)
10	2a00:1288:80:... 2a00:1288:80:807::1	203220 (YAHOO-DEB) (YAHOO-DEB)
1	2a00:1288:110... 2a00:1288:110:c204::b000	34010 (YAHOO-IRD) (YAHOO-IRD)
12	3

1 49.12.128.156 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.156-128-12-49.clients.mizbanidc.net

saffron-distributor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fc.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c204::b000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

3p-udc.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	yimg.com s.yimg.com — Cisco Umbrella Rank: 420	262 KB
2	yahoo.com 3p-udc.yahoo.com — Cisco Umbrella Rank: 6046 fc.yahoo.com — Cisco Umbrella Rank: 1503	701 B
1	saffron-distributor.com saffron-distributor.com	9 KB
12	3

	Domain	Requested by
9	s.yimg.com	saffron-distributor.com s.yimg.com
1	fc.yahoo.com	s.yimg.com
1	3p-udc.yahoo.com	s.yimg.com
1	saffron-distributor.com
12	4

This site contains links to these domains. Also see Links.

Domain
www.yahoo.com
help.yahoo.com
legal.yahoo.com

Subject Issuer	Validity	Valid
*.saffron-distributor.com R3	`2022-04-11` - `2022-07-10`	3 months	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-03-14` - `2022-05-04`	2 months	crt.sh
yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-02-11` - `2022-08-10`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://saffron-distributor.com/
Frame ID: 3498A39F7233783CEF77B8410457C465
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Yahoo

Page Statistics

12
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

272 kB
Transfer

837 kB
Size

2
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.yahoo.com/

Search URL Search Domain Scan URL

URL: https://help.yahoo.com/kb/index?locale=en_US&page=product&y=PROD_ACCT
Title: Help

Search URL Search Domain Scan URL

URL: https://legal.yahoo.com/us/en/yahoo/terms/otos/index.html
Title: Terms

Search URL Search Domain Scan URL

URL: https://legal.yahoo.com/us/en/yahoo/privacy/index.html
Title: Privacy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
saffron-distributor.com/ 39 KB
9 KB 86ms
49ms Document
text/html 49.12.128.156
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://saffron-distributor.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 49.12.128.156 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.156-128-12-49.clients.mizbanidc.net
Software: / PHP/8.1.4
Resource Hash: be513eff4f40bee8a93bc7ef4b28a0db4125644511ab51856491a1111a58a569

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 19 Apr 2022 10:53:55 GMT
vary: Accept-Encoding
x-powered-by: PHP/8.1.4

GET
H2 200 yahoo-main.css
s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/ 480 KB
105 KB 49ms
15ms Stylesheet
text/css 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css

Requested by

Host: saffron-distributor.com
URL: https://saffron-distributor.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

f0c07b51ee40e2cc36ed4ff055772272b0b443fbb94dbe93c3875ef779b264a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://saffron-distributor.com/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Sat, 02 Apr 2022 08:09:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1478682
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
x-amz-request-id: MA2CABHMRBEY3FG5
x-amz-id-2: bajrllh14RQprNNNT09gRVYxH2vKIADDxjfXT0nQs/ADFSjJgAQ8u5lItCMCloaw9mdtqkCYHOo=
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 17 Nov 2021 19:10:41 GMT
server: ATS
etag: "9ff01699e7fa24e51dc90bc962ae63d6-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: public,max-age=31536000
accept-ranges: bytes

GET
H2 200 yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png
s.yimg.com/rz/p/ 1 KB
2 KB 47ms
14ms Image
image/png 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png

Requested by

Host: saffron-distributor.com
URL: https://saffron-distributor.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://saffron-distributor.com/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

ats-carp-promotion: 1
date: Mon, 18 Apr 2022 14:13:04 GMT
x-content-type-options: nosniff
age: 74452
x-amz-server-side-encryption: AES256
vary: Origin
content-length: 1346
x-amz-id-2: dnkHj6aDYfvxwbjNoBDauiFOu1nk12OzTc00zaBggND8XZ8TNqiXf46FcY+HCQpEh2Ksf30R0oA=
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 17 Apr 2022 21:30:57 GMT
server: ATS
etag: "cd166981c96c6d0f4b5a7d798c25878e"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: M34KC24JR892BP8V
x-xss-protection: 1; mode=block
cache-control: public,max-age=86400
accept-ranges: bytes
content-type: image/png
expires: Mon, 18 Apr 2022 23:00:00 GMT

GET
H2 200 yahoo_frontpage_en-US_s_f_w_bestfit_frontpage_2x.png
s.yimg.com/rz/p/ 1 KB
2 KB 16ms
16ms Image
image/png 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_w_bestfit_frontpage_2x.png

Requested by

Host: saffron-distributor.com
URL: https://saffron-distributor.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

4f47ef8ff3dad2a78360ab207cf35ff2905622511c0426109f6e225052cf5637

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://saffron-distributor.com/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Tue, 19 Apr 2022 10:27:01 GMT
x-content-type-options: nosniff
age: 1615
x-amz-server-side-encryption: AES256
vary: Origin
content-length: 1391
x-amz-id-2: RnyJjBsnX/aPdb3jgYClN0lpZM3lYfEoS8AUlI8mB6YxPP71/1IoYXIwPZucAXyx82ttXkuY2V8=
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 18 Apr 2022 21:31:43 GMT
server: ATS
etag: "dd31f56b9e4dff40eb87447c3dc55b84"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: X4NRN9293MY1JHEM
x-xss-protection: 1; mode=block
cache-control: public,max-age=86400
accept-ranges: bytes
content-type: image/png
expires: Tue, 19 Apr 2022 23:00:00 GMT

GET
H2 200 rapid-3.53.30.js Show response
s.yimg.com/ss/ 49 KB
18 KB 38ms
38ms Script
application/javascript 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/ss/rapid-3.53.30.js

Requested by

Host: saffron-distributor.com
URL: https://saffron-distributor.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

7bc917ebee12bcd521ae88840228032579459c25a3ccf8953d8a2dbe5e085be9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://saffron-distributor.com/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Tue, 19 Apr 2022 10:46:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 460
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 17971
x-amz-id-2: YsUNs5bxVFfGOW3q6QeFiDDCDHAa1qSGQULSGicdDuiuAS1Gg2QvBfX3RZK+lh4lUCsD4yNNZGA=
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 29 Jun 2021 01:45:07 GMT
server: ATS
etag: "665798d28ecf9be7cbc434e75267920d-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: W6Q4NBTCP024X2T9
x-xss-protection: 1; mode=block
cache-control: max-age=31536000, immutable
x-amz-version-id: .Bcg25AHAdRCkTvv5tMdNmGVEjznZ_m3
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 bundle.js Show response
s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/ 180 KB
49 KB 15ms
15ms Script
application/javascript 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/bundle.js

Requested by

Host: saffron-distributor.com
URL: https://saffron-distributor.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

8753bd16e941a2f55b24dd9ea5e9b76b88792d4d04e95cffa5619fb6e7ee29b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://saffron-distributor.com/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Thu, 31 Mar 2022 23:32:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1596074
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
x-amz-request-id: 1HC4GG9SEM9WGGNG
x-amz-id-2: vSuqrT4PiGJ0nEr5eLayZ9btHSvcvFY5az7p9LrBHE5F3cJQfG9VUVfz5+FTEzuZpZryFmJ6hdI=
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 17 Nov 2021 19:10:41 GMT
server: ATS
etag: "6e3023f1f8ba48f4b6c9f6b17fed5f0e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: public,max-age=31536000
accept-ranges: bytes

GET
H2 200 Yahoo_Sans-Regular.woff2
s.yimg.com/cv/ae/sports/fonts/2017/ 28 KB
29 KB 44ms
17ms Font
font/woff2 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Regular.woff2

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

fc0e2df417e7959509df87df6b4de2eb1479c8718bc2d8ab0bc70d3753c68560

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css
Origin: https://saffron-distributor.com
accept-language: de-DE,de;q=0.9
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

ats-carp-promotion: 1
date: Fri, 01 Apr 2022 09:22:01 GMT
x-amz-meta-created-date: Tue, 03 Oct 2017 06:22:51 GMT
age: 1560716
x-amz-server-side-encryption: AES256
x-amz-meta-x-ysws-mbst-vtime: 1507011771545398
strict-transport-security: max-age=15552000
x-amz-request-id: WG270MPSQ8DQ5N64
x-amz-id-2: a1w8JGb5vZ6QRXalaHxwXI12CdtqPFwwy1RGWF0jU5wwgHNIIAx8X68t87iNAc4f4bdSLo3kV+g=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 19 Apr 2018 19:06:41 GMT
server: ATS
etag: "a99b283070afc519f4816e4300c515d2"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin
content-type: font/woff2
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000,public
content-length: 28860
x-amz-meta-x-ysws-access: public
x-amz-meta-mbst-etag: "YM:1:cb5e4811-e042-455c-b2b2-f984d5f70e0200055a9e8550b736"
x-content-type-options: nosniff
expires: Sat, 05 Sep 2026 00:00:00 GMT

GET
H2 200 Yahoo_Sans-Semibold.woff2
s.yimg.com/cv/ae/sports/fonts/2017/ 28 KB
29 KB 70ms
43ms Font
font/woff2 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Semibold.woff2

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b8989e0be6a0c3a8a407d8b69b7884eb5ebf401b7eee8b8b98c5eeec3ba497fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css
Origin: https://saffron-distributor.com
accept-language: de-DE,de;q=0.9
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

ats-carp-promotion: 1
date: Tue, 29 Mar 2022 21:01:05 GMT
x-amz-meta-created-date: Tue, 03 Oct 2017 06:22:51 GMT
age: 1777972
x-amz-server-side-encryption: AES256
x-amz-meta-x-ysws-mbst-vtime: 1507011771480561
strict-transport-security: max-age=15552000
x-amz-request-id: ZJSA1WHMGPNPXKA4
x-amz-id-2: BoF0HrYqi5txywECuKFzjd7SzbP8/5BmR3y/neDwTyK+jmgAGY0u5bsHYo+FVoH9ia8qEYFIqig=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 19 Apr 2018 17:33:29 GMT
server: ATS
etag: "af9fdad7698452697b016850fff96423"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin
content-type: font/woff2
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000,public
content-length: 29040
x-amz-meta-x-ysws-access: public
x-amz-meta-mbst-etag: "YM:1:95620d49-21c2-4044-b803-58b70c8e419700055a9e854fb9f1"
x-content-type-options: nosniff
expires: Sat, 05 Sep 2026 00:00:00 GMT

GET
H2 200 checkbox-checked.svg
s.yimg.com/wm/mbr/images/ 1 KB
913 B 14ms
14ms Image
image/svg+xml 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/wm/mbr/images/checkbox-checked.svg

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

11b4310df6e27428e7cf86f316abdc10148ac5cf3c8bbbd5b85c88b9f6290c59

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

ats-carp-promotion: 1
date: Thu, 31 Mar 2022 16:39:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1620894
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 659
x-amz-id-2: w+ODo9dJETiaIE/rVgu0+ZNJCnazXePcMgcjzf/VnIqesia/CPCxeoQK833rR0y5z6T9NRY7h/w=
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 24 Apr 2020 17:13:52 GMT
server: ATS
etag: "ac8c4fbeda6efad9549cb41b992a8b3a-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: P36JCHMAF65RK08D
x-xss-protection: 1; mode=block
cache-control: public,max-age=315360000
accept-ranges: bytes
content-type: image/svg+xml

GET
H2 200 Yahoo_Sans-Medium.woff2
s.yimg.com/cv/ae/sports/fonts/2017/ 29 KB
29 KB 33ms
30ms Font
font/woff2 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Medium.woff2

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

d5312dacbe6f248c6c4b60251d7acf77bc3bc891cd9b880dead36d9babb288c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css
Origin: https://saffron-distributor.com
accept-language: de-DE,de;q=0.9
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

ats-carp-promotion: 1
date: Sun, 17 Apr 2022 08:45:58 GMT
x-amz-meta-created-date: Tue, 03 Oct 2017 06:22:52 GMT
age: 180479
x-amz-server-side-encryption: AES256
x-amz-meta-x-ysws-mbst-vtime: 1507011772247755
strict-transport-security: max-age=15552000
x-amz-request-id: QNY4B4FVZCXA5WGP
x-amz-id-2: OFlQ3Hy7GPczpy8GWnGTidamfD0kyUTjKMAsIzRhbic8Me4pWODGI6Bd6f6yl66VReXLhxDfHSw=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 19 Apr 2018 16:25:50 GMT
server: ATS
etag: "7c7c02dcee2bf1c2528db6092d4ad1fa"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin
content-type: font/woff2
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: max-age=31536000,public
content-length: 29228
x-amz-meta-x-ysws-access: public
x-amz-meta-mbst-etag: "YM:1:1bb49599-26ac-442e-b6b8-f4e40f067ea500055a9e855b6ecb"
x-content-type-options: nosniff
expires: Sat, 05 Sep 2026 00:00:00 GMT

POST
H2 204 yql Show response
3p-udc.yahoo.com/v2/public/ 0
701 B 282ms
33ms XHR
text/plain 2a00:1288:110:c204::b000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to

Full URL

https://3p-udc.yahoo.com/v2/public/yql?yhlVer=2&yhlClient=rapid&yhlS=794200018&yhlCT=2&yhlBTMS=1650365635825&yhlClientVer=3.53.30&yhlRnd=EDEkv1rFUDuvt5GK&yhlCompressed=0

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/ss/rapid-3.53.30.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:110:c204::b000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://saffron-distributor.com/
accept-language: de-DE,de;q=0.9
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 19 Apr 2022 10:53:55 GMT
server: ATS
age: 1
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin
p3p: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
access-control-allow-origin: https://saffron-distributor.com
cache-control: no-store, no-cache, private, max-age=0
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
strict-transport-security: max-age=31536000
expires: -1

GET
H2 403 client.php
fc.yahoo.com/sdarla/php/ 0
0 63ms
52ms Script
text/html 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL: https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794200018&ref=https%3A%2F%2Flogin.yahoo.com%2F&sa=geminifed%253D1%2520y-bucket%253Dmbr-sonicmail-mtls%252Cmbr-fido-1fa-login%252Cmbr-rcscore-threshold%252Cmbr-qr-comet-sdk
Requested by: Host: s.yimg.com
URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://saffron-distributor.com/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo (Online)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.saffron-distributor.com/	1970-01-20 11:11:41	Name: rxx Value: 24yepc3xhnz.2pdqhjvq&v=1
			.yahoo.com/	1970-01-20 11:12:03	Name: A3 Value: d=AQABBMSUXmICEEgcp51iqtjODEWvO-OXGc8FEgEBAQHmX2JoYgAAAAAA_eMAAA&S=AQAAAkNrG8olaf3GPRNpIR6azKA

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794200018&ref=https%3A%2F%2Flogin.yahoo.com%2F&sa=geminifed%253D1%2520y-bucket%253Dmbr-sonicmail-mtls%252Cmbr-fido-1fa-login%252Cmbr-rcscore-threshold%252Cmbr-qr-comet-sdk Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3p-udc.yahoo.com
fc.yahoo.com
s.yimg.com
saffron-distributor.com
2a00:1288:110:c204::b000
2a00:1288:80:807::1
49.12.128.156
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338
11b4310df6e27428e7cf86f316abdc10148ac5cf3c8bbbd5b85c88b9f6290c59
4f47ef8ff3dad2a78360ab207cf35ff2905622511c0426109f6e225052cf5637
7bc917ebee12bcd521ae88840228032579459c25a3ccf8953d8a2dbe5e085be9
8753bd16e941a2f55b24dd9ea5e9b76b88792d4d04e95cffa5619fb6e7ee29b1
b8989e0be6a0c3a8a407d8b69b7884eb5ebf401b7eee8b8b98c5eeec3ba497fa
be513eff4f40bee8a93bc7ef4b28a0db4125644511ab51856491a1111a58a569
d5312dacbe6f248c6c4b60251d7acf77bc3bc891cd9b880dead36d9babb288c4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f0c07b51ee40e2cc36ed4ff055772272b0b443fbb94dbe93c3875ef779b264a4
fc0e2df417e7959509df87df6b4de2eb1479c8718bc2d8ab0bc70d3753c68560

saffron-distributor.com Open in urlscan Pro 49.12.128.156 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

12 Requests

100 %HTTPS

67 %IPv6

3 Domains

4 Subdomains

3 IPs

2 Countries

272 kBTransfer

837 kBSize

2 Cookies

4 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

saffron-distributor.com Open in urlscan Pro
49.12.128.156 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

272 kB
Transfer

837 kB
Size

2
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!