saffron-distributor.com Open in urlscan Pro
49.12.128.156  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response saffron-distributor.com/	64 KB 22 KB	357ms 14ms	Document text/html	49.12.128.156 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 49.12.128.156 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.156-128-12-49.clients.mizbanidc.net Software / PHP/8.1.4 Resource Hash 5aad2ac56b26538b373db9d3069e1cc9486d03ff284ba99e10b6d72c5ed2ede2 Request headers Upgrade-Insecure-Requests 1 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) accept-language de-DE,de;q=0.9 Response headers alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000 content-encoding br content-length 22717 content-type text/html; charset=UTF-8 date Tue, 19 Apr 2022 10:53:57 GMT vary Accept-Encoding x-powered-by PHP/8.1.4
GET H2	200	yahoo-main.css s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/	480 KB 105 KB	626ms 28ms	Stylesheet text/css	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash f0c07b51ee40e2cc36ed4ff055772272b0b443fbb94dbe93c3875ef779b264a4 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://saffron-distributor.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Sat, 02 Apr 2022 08:09:14 GMT content-encoding gzip x-content-type-options nosniff age 1478685 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding x-amz-request-id MA2CABHMRBEY3FG5 x-amz-id-2 bajrllh14RQprNNNT09gRVYxH2vKIADDxjfXT0nQs/ADFSjJgAQ8u5lItCMCloaw9mdtqkCYHOo= referrer-policy no-referrer-when-downgrade last-modified Wed, 17 Nov 2021 19:10:41 GMT server ATS etag "9ff01699e7fa24e51dc90bc962ae63d6-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 content-type text/css x-xss-protection 1; mode=block cache-control public,max-age=31536000 accept-ranges bytes
GET H2	200	boot.js Show response s.yimg.com/rq/darla/	7 KB 4 KB	622ms 25ms	Script application/javascript	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/boot.js Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 4530d183f6b42ae95bc7b2dafab9f38d1901b5c0e7f58253e35ec8e4215bacea Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://saffron-distributor.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers ats-carp-promotion 1 date Mon, 18 Apr 2022 15:33:36 GMT content-encoding gzip x-content-type-options nosniff age 69623 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding content-length 3608 x-amz-id-2 oNOcBCrdvrmLzHXGP3uQqJbAkJQBlc/N2VFQKg0QOJfs+t4bJ40y7depGB28u+eiaZOQOYMpkgs= referrer-policy no-referrer-when-downgrade last-modified Thu, 24 Mar 2022 18:57:52 GMT server ATS etag "93d8df54e24138f615918242db0c49a3-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id WEY7JEPJNY8Y6BJ6 x-xss-protection 1; mode=block cache-control public,max-age=86400 accept-ranges bytes content-type application/javascript; charset=utf-8
GET H2	200	g-r-min.js Show response s.yimg.com/rq/darla/4-10-0/js/	204 KB 86 KB	627ms 29ms	Script application/javascript	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/4-10-0/js/g-r-min.js Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 8dda7afe007db4691616af1ed05fafef5e070babc820100b856bc1ffa89dfd4d Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://saffron-distributor.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Thu, 31 Mar 2022 20:55:27 GMT content-encoding gzip x-content-type-options nosniff age 1605513 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding x-amz-request-id HG2E50KZJFR14QVV x-amz-id-2 KXXDajxkxX1Jl4OI2mOLRGRoo1KNsffETQQ5i5s/9NWj4+MQpgsmV0Ncr/SgG7YaWs0fag8IwVk= referrer-policy no-referrer-when-downgrade last-modified Thu, 11 Nov 2021 15:57:22 GMT server ATS etag "4748f58f9bd0675f676d12b5cd34b954-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 content-type application/javascript; charset=utf-8 x-xss-protection 1; mode=block cache-control public,max-age=31536000 accept-ranges bytes
GET H2	200	yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png s.yimg.com/rz/p/	1 KB 2 KB	23ms 23ms	Image image/png	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Show image Full URL https://s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://saffron-distributor.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers ats-carp-promotion 1 date Mon, 18 Apr 2022 14:13:04 GMT x-content-type-options nosniff age 74455 x-amz-server-side-encryption AES256 vary Origin content-length 1346 x-amz-id-2 dnkHj6aDYfvxwbjNoBDauiFOu1nk12OzTc00zaBggND8XZ8TNqiXf46FcY+HCQpEh2Ksf30R0oA= referrer-policy no-referrer-when-downgrade last-modified Sun, 17 Apr 2022 21:30:57 GMT server ATS etag "cd166981c96c6d0f4b5a7d798c25878e" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id M34KC24JR892BP8V x-xss-protection 1; mode=block cache-control public,max-age=86400 accept-ranges bytes content-type image/png expires Mon, 18 Apr 2022 23:00:00 GMT
GET H2	200	yahoo_frontpage_en-US_s_f_w_bestfit_frontpage_2x.png s.yimg.com/rz/p/	1 KB 2 KB	24ms 24ms	Image image/png	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Show image Full URL https://s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_w_bestfit_frontpage_2x.png Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 4f47ef8ff3dad2a78360ab207cf35ff2905622511c0426109f6e225052cf5637 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://saffron-distributor.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 19 Apr 2022 10:27:01 GMT x-content-type-options nosniff age 1618 x-amz-server-side-encryption AES256 vary Origin content-length 1391 x-amz-id-2 RnyJjBsnX/aPdb3jgYClN0lpZM3lYfEoS8AUlI8mB6YxPP71/1IoYXIwPZucAXyx82ttXkuY2V8= referrer-policy no-referrer-when-downgrade last-modified Mon, 18 Apr 2022 21:31:43 GMT server ATS etag "dd31f56b9e4dff40eb87447c3dc55b84" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id X4NRN9293MY1JHEM x-xss-protection 1; mode=block cache-control public,max-age=86400 accept-ranges bytes content-type image/png expires Tue, 19 Apr 2022 23:00:00 GMT
GET H2	200	rapid-3.53.30.js Show response s.yimg.com/ss/	49 KB 18 KB	21ms 21ms	Script application/javascript	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/ss/rapid-3.53.30.js Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 7bc917ebee12bcd521ae88840228032579459c25a3ccf8953d8a2dbe5e085be9 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://saffron-distributor.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 19 Apr 2022 10:46:16 GMT content-encoding gzip x-content-type-options nosniff age 463 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding content-length 17971 x-amz-id-2 YsUNs5bxVFfGOW3q6QeFiDDCDHAa1qSGQULSGicdDuiuAS1Gg2QvBfX3RZK+lh4lUCsD4yNNZGA= referrer-policy no-referrer-when-downgrade last-modified Tue, 29 Jun 2021 01:45:07 GMT server ATS etag "665798d28ecf9be7cbc434e75267920d-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id W6Q4NBTCP024X2T9 x-xss-protection 1; mode=block cache-control max-age=31536000, immutable x-amz-version-id .Bcg25AHAdRCkTvv5tMdNmGVEjznZ_m3 accept-ranges bytes content-type application/javascript
GET H2	200	bundle.js Show response s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/	180 KB 49 KB	23ms 23ms	Script application/javascript	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/bundle.js Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 8753bd16e941a2f55b24dd9ea5e9b76b88792d4d04e95cffa5619fb6e7ee29b1 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://saffron-distributor.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Thu, 31 Mar 2022 23:32:42 GMT content-encoding gzip x-content-type-options nosniff age 1596077 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding x-amz-request-id 1HC4GG9SEM9WGGNG x-amz-id-2 vSuqrT4PiGJ0nEr5eLayZ9btHSvcvFY5az7p9LrBHE5F3cJQfG9VUVfz5+FTEzuZpZryFmJ6hdI= referrer-policy no-referrer-when-downgrade last-modified Wed, 17 Nov 2021 19:10:41 GMT server ATS etag "6e3023f1f8ba48f4b6c9f6b17fed5f0e-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 content-type application/javascript x-xss-protection 1; mode=block cache-control public,max-age=31536000 accept-ranges bytes
GET H2	403	client.php fc.yahoo.com/sdarla/php/	0 0	89ms 61ms	Script text/html	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794200019&ref=https%3A%2F%2Flogin.yahoo.com%2Faccount%2Fchallenge%2Fpassword&sa=geminifed%253D1%2520y-bucket%253Dmbr-sonicmail-mtls%252Cmbr-fido-1fa-login%252Cmbr-rcscore-threshold%252Cmbr-qr-comet-sdk Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://saffron-distributor.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers
GET		g-r-min.js l.yimg.com/rq/darla/4-10-1/js/	0 0
GET H2	200	r-sf.html Show response s.yimg.com/rq/darla/4-10-0/html/ Frame 447E	2 KB 1001 B	24ms 24ms	Document text/html	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/4-10-0/html/r-sf.html Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 856189d481ed2d854451c028fac29309629eed3301211fe4fe582058f13a3f92 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://saffron-distributor.com/ Upgrade-Insecure-Requests 1 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes age 53581 cache-control public,max-age=31536000 content-encoding gzip content-type text/html; charset=utf-8 date Mon, 18 Apr 2022 20:00:59 GMT etag "630dfb686b2205755bab511d73ed42dd-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" last-modified Thu, 11 Nov 2021 15:57:21 GMT referrer-policy no-referrer-when-downgrade server ATS strict-transport-security max-age=15552000 vary Origin, Accept-Encoding x-amz-id-2 jDKveb7ZFhasLqhfrDlgegvGnjaHZ+7BOoGLkWU++SlJjjaGT5+4NCh7dp9ILyM6bKpFKl0WgJk= x-amz-request-id 1VFJKKAK37DPBZCF x-amz-server-side-encryption AES256 x-content-type-options nosniff x-xss-protection 1; mode=block
GET H2	200	Yahoo_Sans-Regular.woff2 s.yimg.com/cv/ae/sports/fonts/2017/	28 KB 29 KB	67ms 25ms	Font font/woff2	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Regular.woff2 Requested by Host: s.yimg.com URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash fc0e2df417e7959509df87df6b4de2eb1479c8718bc2d8ab0bc70d3753c68560 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Origin https://saffron-distributor.com accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers ats-carp-promotion 1 date Tue, 19 Apr 2022 06:37:08 GMT x-amz-meta-created-date Tue, 03 Oct 2017 06:22:51 GMT age 15412 x-amz-server-side-encryption AES256 x-amz-meta-x-ysws-mbst-vtime 1507011771545398 strict-transport-security max-age=15552000 x-amz-request-id 1SEG002RYTJH4SPK x-amz-id-2 nU4xTeD6He2+quQhk6GWdma6ECC4qEr1hU6R2c773Qk9oQEvtIdqkSzxhlv9Xfmuh5zlGKX2za4= accept-ranges bytes referrer-policy no-referrer-when-downgrade last-modified Thu, 19 Apr 2018 19:06:41 GMT server ATS etag "a99b283070afc519f4816e4300c515d2" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin content-type font/woff2 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=31536000,public content-length 28860 x-amz-meta-x-ysws-access public x-amz-meta-mbst-etag "YM:1:cb5e4811-e042-455c-b2b2-f984d5f70e0200055a9e8550b736" x-content-type-options nosniff expires Sat, 05 Sep 2026 00:00:00 GMT
GET H2	200	hide-v0.0.1.svg s.yimg.com/wm/mbr/images/	860 KB 646 KB	21ms 21ms	Image image/svg+xml	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Show image Full URL https://s.yimg.com/wm/mbr/images/hide-v0.0.1.svg Requested by Host: s.yimg.com URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 119acd68e288f17e86722a67e341ec74f7f6a377ec8e15b3914245f57caf6fbf Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers ats-carp-promotion 1 date Mon, 28 Mar 2022 06:45:21 GMT content-encoding gzip x-content-type-options nosniff age 1915719 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding content-length 660584 x-amz-id-2 GYWhwioLcYHwPrT6Zv94GYyOmStPW/zy+J0TQElJdYY76Y936BzjFNyzPYjSrW3Gw8NKtQSKZ60= referrer-policy no-referrer-when-downgrade last-modified Tue, 16 Jul 2019 23:13:44 GMT server ATS etag "6bd15a1456d985027ba5ca91528e4b1e-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id JV7V5YN5CDBC4GV3 x-xss-protection 1; mode=block cache-control public,max-age=315360000 accept-ranges bytes content-type image/svg+xml
GET H2	200	Yahoo_Sans-Semibold.woff2 s.yimg.com/cv/ae/sports/fonts/2017/	28 KB 29 KB	118ms 81ms	Font font/woff2	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Semibold.woff2 Requested by Host: s.yimg.com URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash b8989e0be6a0c3a8a407d8b69b7884eb5ebf401b7eee8b8b98c5eeec3ba497fa Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Origin https://saffron-distributor.com accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers ats-carp-promotion 1 date Tue, 29 Mar 2022 05:11:35 GMT x-amz-meta-created-date Tue, 03 Oct 2017 06:22:51 GMT age 1834944 x-amz-server-side-encryption AES256 x-amz-meta-x-ysws-mbst-vtime 1507011771480561 strict-transport-security max-age=15552000 x-amz-request-id 03YS6Z2456F32YTM x-amz-id-2 /IsbyIUtqFQI5IsyUXzKIma6+nwFmx46tdjJCCg3XLG+rrdE68qxrLbBqc5erRDJictdsLKg3Yc= accept-ranges bytes referrer-policy no-referrer-when-downgrade last-modified Thu, 19 Apr 2018 17:33:29 GMT server ATS etag "af9fdad7698452697b016850fff96423" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin content-type font/woff2 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=31536000,public content-length 29040 x-amz-meta-x-ysws-access public x-amz-meta-mbst-etag "YM:1:95620d49-21c2-4044-b803-58b70c8e419700055a9e854fb9f1" x-content-type-options nosniff expires Sat, 05 Sep 2026 00:00:00 GMT
GET H2	200	Yahoo_Sans-Medium.woff2 s.yimg.com/cv/ae/sports/fonts/2017/	29 KB 29 KB	82ms 45ms	Font font/woff2	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-Medium.woff2 Requested by Host: s.yimg.com URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash d5312dacbe6f248c6c4b60251d7acf77bc3bc891cd9b880dead36d9babb288c4 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Origin https://saffron-distributor.com accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers ats-carp-promotion 1 date Wed, 23 Mar 2022 08:56:33 GMT x-amz-meta-created-date Tue, 03 Oct 2017 06:22:52 GMT age 2339846 x-amz-server-side-encryption AES256 x-amz-meta-x-ysws-mbst-vtime 1507011772247755 strict-transport-security max-age=15552000 x-amz-request-id WEG496F03RTNQSZ8 x-amz-id-2 VyjPwQATbbrbl9rh1hqqTTShxVlzWzxPkWUQfashJrinuCBbuCyzE77Nq6g+7Fo63fvB2nhLyyA= accept-ranges bytes referrer-policy no-referrer-when-downgrade last-modified Thu, 19 Apr 2018 16:25:50 GMT server ATS etag "7c7c02dcee2bf1c2528db6092d4ad1fa" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin content-type font/woff2 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=31536000,public content-length 29228 x-amz-meta-x-ysws-access public x-amz-meta-mbst-etag "YM:1:1bb49599-26ac-442e-b6b8-f4e40f067ea500055a9e855b6ecb" x-content-type-options nosniff expires Sat, 05 Sep 2026 00:00:00 GMT
GET H2	200	Yahoo_Sans-ExtraBold.woff2 s.yimg.com/cv/ae/sports/fonts/2017/	28 KB 28 KB	86ms 64ms	Font font/woff2	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/cv/ae/sports/fonts/2017/Yahoo_Sans-ExtraBold.woff2 Requested by Host: s.yimg.com URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash e3b229d1d0e49226f929a219c007a701c2c2646ef75c215e427a28e36466ab1b Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/yahoo-main.css Origin https://saffron-distributor.com accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers ats-carp-promotion 1 date Wed, 30 Mar 2022 09:09:42 GMT x-amz-meta-created-date Tue, 03 Oct 2017 06:22:51 GMT age 1734257 x-amz-server-side-encryption AES256 x-amz-meta-x-ysws-mbst-vtime 1507011771924800 strict-transport-security max-age=15552000 x-amz-request-id MV08R52RM6H9W5VB x-amz-id-2 f6HZ/7fqSDwtLO60/SUJ7VbIerDLJ+u9fTfijGPF12oVtq+N+1SR4RNBlSsldWRYhL0m9/Q8jfM= accept-ranges bytes referrer-policy no-referrer-when-downgrade last-modified Thu, 19 Apr 2018 19:01:13 GMT server ATS etag "632a74de7778e84fd6e92f2f6c49f1c3" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin content-type font/woff2 access-control-allow-origin * x-xss-protection 1; mode=block cache-control max-age=31536000,public content-length 28808 x-amz-meta-x-ysws-access public x-amz-meta-mbst-etag "YM:1:1ccdd2c4-6102-4773-912a-83dcdcf0e3cd00055a9e85568140" x-content-type-options nosniff expires Sat, 05 Sep 2026 00:00:00 GMT
POST H2	204	yql Show response 3p-udc.yahoo.com/v2/public/	0 701 B	383ms 42ms	XHR text/plain	2a00:1288:110:c204::b000 YAHOO-IRD
General Check archive.org Show headers Download Go to Full URL https://3p-udc.yahoo.com/v2/public/yql?yhlVer=2&yhlClient=rapid&yhlS=794200019&yhlCT=2&yhlBTMS=1650365637919&yhlClientVer=3.53.30&yhlRnd=wsSydkzwUZXuKAxZ&yhlCompressed=0 Requested by Host: s.yimg.com URL: https://s.yimg.com/ss/rapid-3.53.30.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:110:c204::b000 , United Kingdom, ASN34010 (YAHOO-IRD, GB), Reverse DNS Software ATS / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://saffron-distributor.com/ accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Tue, 19 Apr 2022 10:53:58 GMT server ATS age 0 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin p3p policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" access-control-allow-origin https://saffron-distributor.com cache-control no-store, no-cache, private, max-age=0 access-control-allow-credentials true x-envoy-upstream-service-time 1 strict-transport-security max-age=31536000 expires -1
GET H2	200	sfext-min.js Show response s.yimg.com/rq/darla/4-10-0/js/ Frame 447E	63 KB 27 KB	22ms 22ms	Script application/javascript	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/4-10-0/js/sfext-min.js Requested by Host: s.yimg.com URL: https://s.yimg.com/rq/darla/4-10-0/html/r-sf.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash eb2783e0f4ae428363f7e36fc4ecb4057dbae329d858efee6775ba60f254a81d Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://s.yimg.com/rq/darla/4-10-0/html/r-sf.html User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 22 Mar 2022 11:27:35 GMT content-encoding gzip x-content-type-options nosniff age 2417186 x-amz-server-side-encryption AES256 vary Origin, Accept-Encoding x-amz-request-id 3J4HSB44YDA0MEHY x-amz-id-2 uyVvKF+yRaT8H01DIiVCk9R4AK4E2Ar+NS8KBwSBzlRb9xyhMQAumesQXjIiZVtyPVvqfZiFy4A= referrer-policy no-referrer-when-downgrade last-modified Thu, 11 Nov 2021 15:57:23 GMT server ATS etag "a84b48cbebd5379f03b1e428526ec262-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 content-type application/javascript; charset=utf-8 x-xss-protection 1; mode=block cache-control public,max-age=31536000 accept-ranges bytes
GET H2	200	r-csc.html Show response s.yimg.com/rq/darla/4-10-0/html/ Frame F270	2 KB 1 KB	27ms 27ms	Document text/html	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/4-10-0/html/r-csc.html Requested by Host: saffron-distributor.com URL: https://saffron-distributor.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software ATS / Resource Hash 3f1fdef4f502d2db072df997a1b83e977c3e257521551a9e4de98b1c28fa8a39 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://saffron-distributor.com/ Upgrade-Insecure-Requests 1 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes age 1479548 cache-control public,max-age=31536000 content-encoding gzip content-length 1160 content-type text/html; charset=utf-8 date Sat, 02 Apr 2022 07:54:52 GMT etag "1ff9b6e511ccd76562520a75bae161d2-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" last-modified Thu, 11 Nov 2021 15:57:21 GMT referrer-policy no-referrer-when-downgrade server ATS strict-transport-security max-age=15552000 vary Origin, Accept-Encoding x-amz-id-2 IhKjMsMFnWIkoGvvFpsX9DycrLBfmVgopuEi5LBFszDQK7erSfI8OyJ+i632Hx8RlpAESPmq5UM= x-amz-request-id FPEMP6HSZX7XZ5CD x-amz-server-side-encryption AES256 x-content-type-options nosniff x-xss-protection 1; mode=block
GET H2	403	client.php fc.yahoo.com/sdarla/php/	0 0	59ms 59ms	Script text/html	2a00:1288:80:807::2 YAHOO-DEB
General Check archive.org Show headers Download Go to Full URL https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794200019&ref=https%3A%2F%2Flogin.yahoo.com%2Faccount%2Fchallenge%2Fpassword&sa=geminifed%253D1%2520y-bucket%253Dmbr-sonicmail-mtls%252Cmbr-fido-1fa-login%252Cmbr-rcscore-threshold%252Cmbr-qr-comet-sdk Requested by Host: s.yimg.com URL: https://s.yimg.com/wm/mbr/e4793047891fc8d64cda6a67d8098a18e013cffe/bundle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://saffron-distributor.com/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

l.yimg.com

URL

http://l.yimg.com/rq/darla/4-10-1/js/g-r-min.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo (Online)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails number| pageStartTime object| oldError boolean| isGoodJS object| YUI_config string| COMET_URL object| I13N_config string| mKeyPrefix object| darlaConfig object| challenge object| pwchallenge boolean| isIOSDevice function| mbrSendError object| DARLA object| $sf undefined| $yac boolean| sf_auto_2-19-3-2022 object| _Y object| YAHOO object| rapidInstance object| jsModules boolean| mbrJSLoaded function| checkAssets number| lastApvTime object| DARLA_CONFIG

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.saffron-distributor.com/	1970-01-20 11:11:41	Name: rxx Value: 309dggf34oc.2pdqhli3&v=1
			.yahoo.com/	1970-01-20 11:12:03	Name: A3 Value: d=AQABBMaUXmICEPvUUBdWViVrsF2_rDAXUXcFEgEBAQHmX2JoYgAAAAAA_eMAAA&S=AQAAAiPPGLgD8l2ABfEwlHpw9XE

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://s.yimg.com/rq/darla/boot.js Message: Mixed Content: The page at 'https://saffron-distributor.com/login.php' was loaded over HTTPS, but requested an insecure script 'http://l.yimg.com/rq/darla/4-10-1/js/g-r-min.js'. This request has been blocked; the content must be served over HTTPS.
other	warning	URL: https://saffron-distributor.com/login.php(Line 155) Message: Unrecognized feature: 'vr'.
network	error	URL: https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794200019&ref=https%3A%2F%2Flogin.yahoo.com%2Faccount%2Fchallenge%2Fpassword&sa=geminifed%253D1%2520y-bucket%253Dmbr-sonicmail-mtls%252Cmbr-fido-1fa-login%252Cmbr-rcscore-threshold%252Cmbr-qr-comet-sdk Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794200019&ref=https%3A%2F%2Flogin.yahoo.com%2Faccount%2Fchallenge%2Fpassword&sa=geminifed%253D1%2520y-bucket%253Dmbr-sonicmail-mtls%252Cmbr-fido-1fa-login%252Cmbr-rcscore-threshold%252Cmbr-qr-comet-sdk Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3p-udc.yahoo.com
fc.yahoo.com
l.yimg.com
s.yimg.com
saffron-distributor.com
l.yimg.com
2a00:1288:110:c204::b000
2a00:1288:80:807::2
49.12.128.156
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338
119acd68e288f17e86722a67e341ec74f7f6a377ec8e15b3914245f57caf6fbf
3f1fdef4f502d2db072df997a1b83e977c3e257521551a9e4de98b1c28fa8a39
4530d183f6b42ae95bc7b2dafab9f38d1901b5c0e7f58253e35ec8e4215bacea
4f47ef8ff3dad2a78360ab207cf35ff2905622511c0426109f6e225052cf5637
5aad2ac56b26538b373db9d3069e1cc9486d03ff284ba99e10b6d72c5ed2ede2
7bc917ebee12bcd521ae88840228032579459c25a3ccf8953d8a2dbe5e085be9
856189d481ed2d854451c028fac29309629eed3301211fe4fe582058f13a3f92
8753bd16e941a2f55b24dd9ea5e9b76b88792d4d04e95cffa5619fb6e7ee29b1
8dda7afe007db4691616af1ed05fafef5e070babc820100b856bc1ffa89dfd4d
b8989e0be6a0c3a8a407d8b69b7884eb5ebf401b7eee8b8b98c5eeec3ba497fa
d5312dacbe6f248c6c4b60251d7acf77bc3bc891cd9b880dead36d9babb288c4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b229d1d0e49226f929a219c007a701c2c2646ef75c215e427a28e36466ab1b
eb2783e0f4ae428363f7e36fc4ecb4057dbae329d858efee6775ba60f254a81d
f0c07b51ee40e2cc36ed4ff055772272b0b443fbb94dbe93c3875ef779b264a4
fc0e2df417e7959509df87df6b4de2eb1479c8718bc2d8ab0bc70d3753c68560