kaiue.nut.cc
Open in
urlscan Pro
159.203.35.139
Malicious Activity!
Public Scan
Submission: On September 18 via api from CA
Summary
This is the only time kaiue.nut.cc was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Yahoo (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 159.203.35.139 159.203.35.139 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
11 | 2a00:1288:80:... 2a00:1288:80:800::7001 | 203220 (YAHOO-DEB) (YAHOO-DEB) | |
1 | 212.82.101.30 212.82.101.30 | 34010 (YAHOO-IRD) (YAHOO-IRD) | |
1 2 | 2.16.186.80 2.16.186.80 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
15 | 4 |
ASN34010 (YAHOO-IRD, GB)
PTR: csc-beapa10.adx.vip.ir2.yahoo.com
csc.beap.bc.yahoo.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-80.deploy.static.akamaitechnologies.com
b.scorecardresearch.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
yimg.com
s.yimg.com |
98 KB |
2 |
scorecardresearch.com
1 redirects
b.scorecardresearch.com |
1 KB |
2 |
nut.cc
kaiue.nut.cc |
121 KB |
1 |
yahoo.com
csc.beap.bc.yahoo.com |
467 B |
15 | 4 |
Domain | Requested by | |
---|---|---|
11 | s.yimg.com |
kaiue.nut.cc
s.yimg.com |
2 | b.scorecardresearch.com |
1 redirects
kaiue.nut.cc
|
2 | kaiue.nut.cc |
kaiue.nut.cc
|
1 | csc.beap.bc.yahoo.com |
kaiue.nut.cc
|
15 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.yahoo.com |
help.yahoo.com |
edit.yahoo.com |
login.yahoo.com |
open.login.yahoo.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.yahoo.com DigiCert SHA2 High Assurance Server CA |
2018-08-20 - 2018-09-28 |
a month | crt.sh |
*.af.beap.bc.yahoo.com DigiCert SHA2 High Assurance Server CA |
2018-08-03 - 2019-02-04 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://kaiue.nut.cc/kkk/besty.html
Frame ID: 5D42E09C62CBA121F53F083A34872415
Requests: 15 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
YUI (JavaScript Libraries) Expand
Detected patterns
- env /^YAHOO$/i
comScore (Analytics) Expand
Detected patterns
- env /^_?COMSCORE$/i
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Title: Yahoo!
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Yahoo!
Search URL Search Domain Scan URL
Title: I can't access my account
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Create New Account
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- http://b.scorecardresearch.com/p?c1=2&c2=7241469&c5=150002527&c7=https%253A%252F%252Flogin.yahoo.com%253A443%252Fconfig%252Flogin%253F.intl%253Dus%2526amp%253B.lang%253Den-US%2526amp%253B.partner%253D%2526amp%253B.last%253D%2526amp%253B.src%253Dym%2526amp%253B.pd%253Dym_ver%25253D0%252526c%25253D%252526ivt%25253D%252526sg%25253D%2526amp%253Bpkg%253D%2526amp%253Bstepid%253D%2526amp%253B.done%253Dhttp%25253a%252F%252Fmail.yahoo.com&ns__t=1537279772879&ns_c=UTF-8 HTTP 302
- http://b.scorecardresearch.com/p2?c1=2&c2=7241469&c5=150002527&c7=https%253A%252F%252Flogin.yahoo.com%253A443%252Fconfig%252Flogin%253F.intl%253Dus%2526amp%253B.lang%253Den-US%2526amp%253B.partner%253D%2526amp%253B.last%253D%2526amp%253B.src%253Dym%2526amp%253B.pd%253Dym_ver%25253D0%252526c%25253D%252526ivt%25253D%252526sg%25253D%2526amp%253Bpkg%253D%2526amp%253Bstepid%253D%2526amp%253B.done%253Dhttp%25253a%252F%252Fmail.yahoo.com&ns__t=1537279772879&ns_c=UTF-8
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
besty.html
kaiue.nut.cc/kkk/ |
120 KB 120 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
yregbase_sec_ui_1_9.css
s.yimg.com/lq/i/reg/css/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
container-min-1.css
s.yimg.com/lq/lib/reg/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
combo
s.yimg.com/zz/ |
15 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
combo
s.yimg.com/zz/ |
36 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
yahoo-login-sprite-1.4.png
s.yimg.com/sf/assets/dl/images/ |
31 B 31 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
login-us-3470.png
s.yimg.com/rz/uh/logo/newpurple/PNGs-optimized/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
uh_sprite_2_16.png
s.yimg.com/dh/ap/ap/default/120503/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
%22
kaiue.nut.cc/%22https://s.yimg.com/lq/i/ww/eyc/p.gif/ |
366 B 366 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
cs_0.2.js
s.yimg.com/lq/lib/3pm/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yi
csc.beap.bc.yahoo.com/ |
43 B 467 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
p2
b.scorecardresearch.com/ Redirect Chain
|
43 B 309 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
yui-min.js
s.yimg.com/lq/lib/yui-ssl/3.4.1/build/yui/ |
66 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
combo
s.yimg.com/lq/ |
104 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
combo
s.yimg.com/zz/ |
16 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Yahoo (Online)25 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| startTime object| loadTime boolean| av object| YAHOO object| yahoo_util_event function| mmCheckTheBox string| fbSigninLnk string| googSigninLnk object| xzq_d function| xzq_p function| xzq_svr function| xzq_sr function| xzq_eh function| xzq_s object| DARLA_CONFIG function| handle_render_timeout function| checkBrowser function| flashCacheReady object| _comscore function| udm_ object| ns_p object| COMSCORE function| loadUHJS function| YUI string| _yuid0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.scorecardresearch.com
csc.beap.bc.yahoo.com
kaiue.nut.cc
s.yimg.com
159.203.35.139
2.16.186.80
212.82.101.30
2a00:1288:80:800::7001
00f7045adf1121ad1d80dfd50ea32d4c34170edfc0b603465e7f0423f3270cc9
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
371b96bff1c634230ba827e16e6b952c768d1cd2c42d7782283028a613399483
496d123fcb819b56dce956f5e326d3e440ab514eb54250c95fce87137e6bda7d
575d6f5b1062e18fb9cd8e249db2587c94052f9fb0f21656150ca4b53a7805c2
8c2112cc388b889bb741fb99b95bbad55ae67f20df33ce02e4ce05604271394c
9f4d029fecc30f08ee5f7e6b12191545714a4e4968b2d2f5027f6db018c8ca14
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
befad4eb70371a019345ed230e386622e2f116d318495ee5091d1eeca9a99356
cbae844abf1afe1dcb40374d76db92eb45cc05056800031360ffdd91c8c51402
cc36af5f7a18dee01a1793701a27e2821414d4a12cd8db2b3d9e9ee483053b0c
d01c81a759db45b4ee10bfb7db313fccb30c3b97165b42e9b9095625aa3855c9
e6b6ed8968cc652fb4ecf8cd6b061083ff67f653ab49b338d2d283e33f872877
ec670e6554f318cbf657c8e530c8d1f485c76885cd610de4e567df6fe983049b
f9b17015b57cec77391306eeda5224b2dce6774f638cdf83b67a402e03d831d2