yahoo-inquiry.com Open in urlscan Pro
125.227.143.133 Malicious Activity! Public Scan

URL:
http://yahoo-inquiry.com/
Submission: On January 26 via manual (January 26th 2019, 9:05:42 am UTC) from JP

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 125.227.143.133, located in Taipei, Taiwan and belongs to HINET Data Communication Business Group, TW. The main domain is yahoo-inquiry.com.

This is the only time yahoo-inquiry.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo Japan (Online)

Domain & IP information

	IP Address	AS Autonomous System
7	125.227.143.133 125.227.143.133	3462 (HINET Dat...) (HINET Data Communication Business Group)
5	182.22.31.252 182.22.31.252	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
1	183.79.248.252 183.79.248.252	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
1	183.79.253.234 183.79.253.234	24572 (YAHOO-JP-...) (YAHOO-JP-AS-AP Yahoo Japan)
1	182.22.24.252 182.22.24.252	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
15	5

7 125.227.143.133 (Taipei, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 125-227-143-133.HINET-IP.hinet.net

yahoo-inquiry.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 182.22.31.252 (Tokyo, Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 183.79.248.252 (Akasaka, Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

yeas.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 183.79.253.234 (Akasaka, Japan)

ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP)

logql.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.22.24.252 (Tokyo, Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

b8.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	yahoo-inquiry.com yahoo-inquiry.com	102 KB
5	yimg.jp s.yimg.jp	155 KB
3	yahoo.co.jp yeas.yahoo.co.jp logql.yahoo.co.jp b8.yahoo.co.jp	2 KB
15	3

	Domain	Requested by
7	yahoo-inquiry.com	yahoo-inquiry.com
5	s.yimg.jp	yahoo-inquiry.com
1	b8.yahoo.co.jp
1	logql.yahoo.co.jp	yahoo-inquiry.com
1	yeas.yahoo.co.jp	yahoo-inquiry.com
15	5

This site contains no links.

Subject Issuer	Validity	Valid
*.yahoo.co.jp Cybertrust Japan Public CA G3	`2019-01-18` - `2020-02-17`	a year	crt.sh
logql.yahoo.co.jp Cybertrust Japan Public CA G3	`2018-08-27` - `2019-08-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://yahoo-inquiry.com/
Frame ID: 342A48FBCD963262813E6A34FB5B2537
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

YUI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^YAHOO$/i

Page Statistics

15
Requests

47 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

5
IPs

2
Countries

260 kB
Transfer

346 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
yahoo-inquiry.com/ 25 KB
25 KB 1563ms
1095ms Document
text/html 125.227.143.133
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-inquiry.com/
Protocol: HTTP/1.1
Server: 125.227.143.133 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-133.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: ed9410cd11d62f8f373abf4e087c73a6347922d938e9a0db4acc2a1e1d242ac1

Request headers

Host: yahoo-inquiry.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: text/html
Last-Modified: Fri, 15 Sep 2017 01:14:34 GMT
Accept-Ranges: bytes
ETag: "0b990fdbf2dd31:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 26 Jan 2019 09:05:17 GMT
Content-Length: 25565

GET
H/1.1 200
OK login-min.css
yahoo-inquiry.com/res/ 38 KB
38 KB 343ms
342ms Stylesheet
text/css 125.227.143.133
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-inquiry.com/res/login-min.css
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: HTTP/1.1
Server: 125.227.143.133 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-133.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 58e691f9228f2c52a07e135f0c0b3cae7c1b7f0626d378b617ea4f3cc0113dd6

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-inquiry.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://yahoo-inquiry.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 26 Jan 2019 09:05:18 GMT
Last-Modified: Tue, 12 Sep 2017 07:22:40 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "0a09bea972bd31:0"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 38461

GET
H2 200 yj_r_34_2x.png
s.yimg.jp/c/logo/f/2.0/ 3 KB
4 KB 1014ms
253ms Image
image/png 182.22.31.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/c/logo/f/2.0/yj_r_34_2x.png
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.31.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b

Request headers

Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 26 Jan 2019 09:00:09 GMT
via: http/1.1 edge1158.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1119.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
last-modified: Tue, 03 Dec 2013 01:24:30 GMT
server: ATS
age: 315
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public
accept-ranges: bytes
content-type: image/png
content-length: 3304
expires: Sat, 26 Jan 2019 09:10:09 GMT

GET
H/1.1 200
OK ico_info.png
yahoo-inquiry.com/res/ 164 B
410 B 661ms
338ms Image
image/png 125.227.143.133
HINET Data Commun...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://yahoo-inquiry.com/res/ico_info.png
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: HTTP/1.1
Server: 125.227.143.133 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-133.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 1f19d9b979d33abc721fa7241518f28f936301003f539d71706b11de3fd053fb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-inquiry.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://yahoo-inquiry.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 26 Jan 2019 09:05:18 GMT
Last-Modified: Tue, 12 Sep 2017 07:22:58 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "03556f5972bd31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 164

GET
H/1.1 200
OK rapidjp-1.0.0.js Show response
yahoo-inquiry.com/res/ 51 KB
19 KB 321ms
320ms Script
application/x-javascript 125.227.143.133
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-inquiry.com/res/rapidjp-1.0.0.js
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: HTTP/1.1
Server: 125.227.143.133 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-133.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 8fc22298b6c758c2a601cedae1718b0c01463af2e7b13859a85cb6bcdca2720a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-inquiry.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://yahoo-inquiry.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 26 Jan 2019 09:05:18 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Sep 2017 07:23:20 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "024732982bd31:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 19090

GET
H/1.1 200
OK mics-min.js Show response
yahoo-inquiry.com/res/ 23 KB
7 KB 331ms
308ms Script
application/x-javascript 125.227.143.133
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-inquiry.com/res/mics-min.js
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: HTTP/1.1
Server: 125.227.143.133 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-133.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 453e9fcbf918c3cefb3c440c2aab2fe2c9bc750350346b9fd1185eb3ecefbcaf

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-inquiry.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://yahoo-inquiry.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 26 Jan 2019 09:05:18 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Sep 2017 07:23:24 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "07ed54982bd31:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 6569

GET
H/1.1 200
OK login-min.js Show response
yahoo-inquiry.com/res/ 52 KB
12 KB 642ms
320ms Script
application/x-javascript 125.227.143.133
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-inquiry.com/res/login-min.js
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: HTTP/1.1
Server: 125.227.143.133 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-133.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: f8bd0e21e0b2202a81584373013e13a29e0d48492ce516aa0f4b48f2d6c7788b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-inquiry.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://yahoo-inquiry.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 26 Jan 2019 09:05:20 GMT
Content-Encoding: gzip
Last-Modified: Wed, 23 Jan 2019 13:11:04 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "06414181db3d41:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 11494

GET
H/1.1 200
OK yjbfp.js Show response
yahoo-inquiry.com/res/ 4 KB
2 KB 758ms
302ms Script
application/x-javascript 125.227.143.133
HINET Data Commun...

General

Check archive.org

Show headers Download Go to

Full URL: http://yahoo-inquiry.com/res/yjbfp.js
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: HTTP/1.1
Server: 125.227.143.133 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 125-227-143-133.HINET-IP.hinet.net
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 8571293a7cd686e1eda501350e8c7e2b2175eb7ca67b0bf58a72a90fa5ad75ee

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yahoo-inquiry.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://yahoo-inquiry.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 26 Jan 2019 09:05:20 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Sep 2017 07:23:34 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "05fcba982bd31:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Length: 1411

GET
H2 200 a Show response
yeas.yahoo.co.jp/ 40 B
724 B 1319ms
287ms Script
text/javascript 183.79.248.252
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to

Full URL

https://yeas.yahoo.co.jp/a?f=2079962931&l=LIP&p=jp_common&domain=login.yahoo.co.jp&c=r&jcode=u&rnd=1548493525404

Requested by

Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

183.79.248.252 Akasaka, Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),

Reverse DNS

Software

ATS /

Resource Hash

41430257b5bf4f1c478be93f52b27de6d56d0d5c42d7a45dad9c3e7b08e26bbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sat, 26 Jan 2019 09:05:26 GMT
via: http/1.1 edge2168.img.djm.yahoo.co.jp (ApacheTrafficServer [c sSf ])
x-content-type-options: nosniff
server: ATS
age: 0
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: private
content-type: text/javascript
content-length: 40
x-xss-protection: 1; mode=block

GET
H2 200 h8qhkudl3cnqd9ii35oc-a.jpg
s.yimg.jp/bdv/prem/knqkkf3xsup0sxxrlct1/ttf_sry9xdivutrce0e8/m_fhm2ucijbyqquaejrf/ 146 KB
147 KB 255ms
254ms Image
image/jpeg 182.22.31.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/bdv/prem/knqkkf3xsup0sxxrlct1/ttf_sry9xdivutrce0e8/m_fhm2ucijbyqquaejrf/h8qhkudl3cnqd9ii35oc-a.jpg
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.31.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: fa5913fa6e206db2bcd1683e4ba42983f5d300660e037feeb827fd5baf57168e

Request headers

Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Wed, 23 Jan 2019 03:10:43 GMT
via: http/1.1 edge1107.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1119.img.bbt.yahoo.co.jp (ApacheTrafficServer [cMsSf ])
last-modified: Wed, 06 Sep 2017 03:24:01 GMT
server: ATS
age: 280482
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 149831
expires: Wed, 30 Jan 2019 03:10:43 GMT

GET
H2 200 theme_btn.png
s.yimg.jp/images/login/pc/img/login/1.0.0/ 591 B
1 KB 253ms
252ms Image
image/png 182.22.31.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/images/login/pc/img/login/1.0.0/theme_btn.png
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.31.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 642d234f2cee13b77a639f9b80df4c70c3c5bf3a73f6e99fda73c489ec618137

Request headers

Referer: http://yahoo-inquiry.com/res/login-min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 26 Jan 2019 09:00:07 GMT
via: http/1.1 edge1138.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1119.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
last-modified: Fri, 07 Mar 2014 04:16:36 GMT
server: ATS
age: 318
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public
accept-ranges: bytes
content-type: image/png
content-length: 591
expires: Sat, 26 Jan 2019 09:07:13 GMT

GET
H2 200 btn_clear.png
s.yimg.jp/images/login/sp/img/theme/1.2.1/ 740 B
1 KB 1012ms
1011ms Image
image/png 182.22.31.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.yimg.jp/images/login/sp/img/theme/1.2.1/btn_clear.png
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.31.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 2c2852bce600f225fb5fab38313e5f9c6019b8d46c3bcd756e4a608bb27a4e58

Request headers

Referer: http://yahoo-inquiry.com/res/login-min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 26 Jan 2019 08:57:09 GMT
via: http/1.1 edge1127.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1119.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
last-modified: Tue, 23 Apr 2013 08:18:36 GMT
server: ATS
age: 496
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public
accept-ranges: bytes
content-type: image/png
content-length: 740
expires: Sat, 26 Jan 2019 09:07:00 GMT

GET
H2 200 lib2obf_b8.js Show response
s.yimg.jp/bdv/yahoo/javascript/csc/20060824/ 2 KB
2 KB 253ms
252ms Script
application/javascript 182.22.31.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/bdv/yahoo/javascript/csc/20060824/lib2obf_b8.js
Requested by: Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 182.22.31.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: 990a245fe622fc5c6f73b0154585a8c14cc07ad4cbdb7a9b2114458fba12dc37

Request headers

Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Sat, 26 Jan 2019 09:01:25 GMT
content-encoding: gzip
last-modified: Tue, 12 Jun 2007 10:31:37 GMT
server: ATS
age: 241
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
cache-control: public
accept-ranges: bytes
content-type: application/javascript
content-length: 945
via: http/1.1 edge1158.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1119.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
expires: Sat, 26 Jan 2019 09:10:47 GMT

POST
H2 200 yql Show response
logql.yahoo.co.jp/v1/public/ 301 B
1 KB 1286ms
273ms XHR
text/plain 183.79.253.234
YAHOO-JP-AS-AP Ya...

General

Check archive.org

Show headers Download Go to

Full URL

https://logql.yahoo.co.jp/v1/public/yql?yhlVer=2&yhlClient=rapid&yhlS=2079962931&yhlCT=2&yhlBTMS=1548493526751&yhlClientVer=3.25.1&yhlRnd=4W6wYo9SjCXkqte8jrd92c4f&yhlCompressed=0

Requested by

Host: yahoo-inquiry.com
URL: http://yahoo-inquiry.com/res/rapidjp-1.0.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

183.79.253.234 Akasaka, Japan, ASN24572 (YAHOO-JP-AS-AP Yahoo Japan, JP),

Reverse DNS

Software

ATS /

Resource Hash

9658e7517b872ccacebec897c04b534a159a2e9bad9e55bc0c645fafb0987ab4

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Referer: http://yahoo-inquiry.com/
Origin: http://yahoo-inquiry.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Sat, 26 Jan 2019 09:05:27 GMT
x-content-type-options: nosniff
x-yql-host: logql5216.data.ogk.yahoo.co.jp
age: 0
p3p: policyref="https://privacy.yahoo.co.jp/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
status: 200
pragma: no-cache
server: ATS
strict-transport-security: max-age=0
access-control-allow-methods: POST, OPTIONS
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://yahoo-inquiry.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
expires: Wed, 01 Mar 1995 00:00:00 GMT

GET
H/1.1 200
OK b
b8.yahoo.co.jp/ 43 B
680 B 980ms
263ms Image
image/gif 182.22.24.252
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://b8.yahoo.co.jp/b?P=USemADEyNy6VwbzGWbeoLwG3MjE5LgAAAADfApjA&T=15kf808p3%2fX%3d1505209390%2fE%3d2079962931%2fR%3djp_c_s_ad%2fK%3d5%2fV%3d1.1%2fW%3dJ%2fY%3djp%2fF%3d2314146438%2fH%3dc2VjdXJlPXRydWUgc2VjdXJlPVwidFwiIGFkY3Zlcj02LjguMQ--%2fS%3d1%2fJ%3d59B7AC2E&Q=0&O=0.02434868250319666

Protocol

HTTP/1.1

Server

182.22.24.252 Tokyo, Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

ATS /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://yahoo-inquiry.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 26 Jan 2019 09:05:27 GMT
Via: http/1.1 edge1352.img.bbt.yahoo.co.jp (ApacheTrafficServer [c sSf ])
X-Content-Type-Options: nosniff
Server: ATS
Age: 0
X-Frame-Options: SAMEORIGIN
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: no-cache, no-store, private, no-cache=Set-Cookie, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo Japan (Online)

43 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: http://yahoo-inquiry.com/res/rapidjp-1.0.0.js(Line 2) Message: RAPID WARNING: Specified module not in DOM: noticeBox

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b8.yahoo.co.jp
logql.yahoo.co.jp
s.yimg.jp
yahoo-inquiry.com
yeas.yahoo.co.jp
125.227.143.133
182.22.24.252
182.22.31.252
183.79.248.252
183.79.253.234
1f19d9b979d33abc721fa7241518f28f936301003f539d71706b11de3fd053fb
2c2852bce600f225fb5fab38313e5f9c6019b8d46c3bcd756e4a608bb27a4e58
41430257b5bf4f1c478be93f52b27de6d56d0d5c42d7a45dad9c3e7b08e26bbc
453e9fcbf918c3cefb3c440c2aab2fe2c9bc750350346b9fd1185eb3ecefbcaf
479928aeb69a62ed0fad13d232a754ce1d1f24787fcafd684b73ba1db32ffb5b
58e691f9228f2c52a07e135f0c0b3cae7c1b7f0626d378b617ea4f3cc0113dd6
642d234f2cee13b77a639f9b80df4c70c3c5bf3a73f6e99fda73c489ec618137
8571293a7cd686e1eda501350e8c7e2b2175eb7ca67b0bf58a72a90fa5ad75ee
8fc22298b6c758c2a601cedae1718b0c01463af2e7b13859a85cb6bcdca2720a
9658e7517b872ccacebec897c04b534a159a2e9bad9e55bc0c645fafb0987ab4
990a245fe622fc5c6f73b0154585a8c14cc07ad4cbdb7a9b2114458fba12dc37
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
ed9410cd11d62f8f373abf4e087c73a6347922d938e9a0db4acc2a1e1d242ac1
f8bd0e21e0b2202a81584373013e13a29e0d48492ce516aa0f4b48f2d6c7788b
fa5913fa6e206db2bcd1683e4ba42983f5d300660e037feeb827fd5baf57168e

yahoo-inquiry.com Open in urlscan Pro 125.227.143.133 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

47 %HTTPS

0 %IPv6

3 Domains

5 Subdomains

5 IPs

2 Countries

260 kBTransfer

346 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

43 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

yahoo-inquiry.com Open in urlscan Pro
125.227.143.133 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

47 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

5
IPs

2
Countries

260 kB
Transfer

346 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!