srilankachess.lk Open in urlscan Pro
2606:4700:3034::6818:7945 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://srilankachess.lk/NEW/Yahoo/login.php
Submission: On May 27 via automatic, source openphish (May 27th 2020, 12:32:47 pm UTC)

Summary HTTP 12 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3034::6818:7945, located in United States and belongs to CLOUDFLARENET, US. The main domain is srilankachess.lk.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 14th 2020. Valid for: 6 months.

This is the only time srilankachess.lk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo (Online)

Domain & IP information

	IP Address	AS Autonomous System
5	2606:4700:303... 2606:4700:3034::6818:7945	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1288:f03... 2a00:1288:f03d:1fa::4000	10310 (YAHOO-1) (YAHOO-1)
2	152.195.39.165 152.195.39.165	15133 (EDGECAST) (EDGECAST)
3	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
12	5

5 2606:4700:3034::6818:7945 (United States)

ASN13335 (CLOUDFLARENET, US)

srilankachess.lk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:f03d:1fa::4000 (United Kingdom)

ASN10310 (YAHOO-1, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 152.195.39.165 (United States)

ASN15133 (EDGECAST, US)

tag.sp.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	srilankachess.lk srilankachess.lk	25 KB
3	yahoo.com pr-bh.ybp.yahoo.com	466 B
2	advertising.com tag.sp.advertising.com
2	yimg.com s.yimg.com	817 B
12	4

	Domain	Requested by
5	srilankachess.lk	srilankachess.lk
3	pr-bh.ybp.yahoo.com	srilankachess.lk
2	tag.sp.advertising.com	s.yimg.com
2	s.yimg.com	srilankachess.lk
12	4

This site contains links to these domains. Also see Links.

Domain
www.yahoo.com
help.yahoo.com
login.yahoo.com
policies.oath.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-04-14` - `2020-10-09`	6 months	crt.sh
*.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-19` - `2020-07-03`	a month	crt.sh
tag.sp.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-02` - `2022-05-12`	2 years	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-01-04` - `2020-07-02`	6 months	crt.sh

This page contains 6 frames:

Primary Page: https://srilankachess.lk/NEW/Yahoo/login.php
Frame ID: 121861B99463ACA08DBAF6ADBCB6E691
Requests: 3 HTTP requests in this frame

Frame: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html
Frame ID: AA96A7509BC89862CC0F804062635DBA
Requests: 1 HTTP requests in this frame

Frame: https://s.yimg.com/rq/sbox/bv.js
Frame ID: 112752D7A5D4D8327BE25A65A6C0372B
Requests: 2 HTTP requests in this frame

Frame: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html
Frame ID: E6FF529A833B786899A220637F5A0CAD
Requests: 5 HTTP requests in this frame

Frame: https://tag.sp.advertising.com/bid-apid/bid-apid-idsync.html
Frame ID: 7B302380BB2BA84AC9EA879A6AF3479A
Requests: 1 HTTP requests in this frame

Frame: https://tag.sp.advertising.com/bid-apid/bid-apid-idsync.html
Frame ID: 98D6A4FBBA66F5B699F99EC59DE8EA3B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

12
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

26 kB
Transfer

83 kB
Size

5
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.yahoo.com/
Title:

Search URL Search Domain Scan URL

URL: https://help.yahoo.com/kb/index?locale=en_US&page=product&y=PROD_ACCT
Title: Help

Search URL Search Domain Scan URL

URL: https://login.yahoo.com/forgot?.lang=en-US&done=https%3A%2F%2Fwww.yahoo.com
Title: Trouble signing in?

Search URL Search Domain Scan URL

URL: https://login.yahoo.com/account/create?src=fpctx&intl=us&lang=en-US&done=https%3A%2F%2Fwww.yahoo.com&specId=yidReg
Title: Sign up

Search URL Search Domain Scan URL

URL: https://policies.oath.com/us/en/oath/terms/otos/index.html
Title: Terms

Search URL Search Domain Scan URL

URL: https://policies.oath.com/us/en/oath/privacy/index.html
Title: Privacy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login.php Show response
srilankachess.lk/NEW/Yahoo/ 74 KB
19 KB 82ms
38ms Document
text/html 2606:4700:3034::6818:7945
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://srilankachess.lk/NEW/Yahoo/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6818:7945 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e432d6067e96556e6864e860659810a3c74fa55ebd595bca6c3f9971cfc20b2

Request headers

:method: GET
:authority: srilankachess.lk
:scheme: https
:path: /NEW/Yahoo/login.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Wed, 27 May 2020 12:32:29 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=da39ee5f868e2e47b189659ffdb3ed91c1590582749; expires=Fri, 26-Jun-20 12:32:29 GMT; path=/; domain=.srilankachess.lk; HttpOnly; SameSite=Lax; Secure PHPSESSID=2072f01a376da0f2d9127431eaf813ec; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
cf-request-id: 02f7b7c27500001776e6326200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 599fc24a5c911776-FRA
content-encoding: br

GET
H2 200 yahoo_en-US_f_p_bestfit_2x.png
srilankachess.lk/NEW/Yahoo/Yahoo_files/ 3 KB
3 KB 41ms
34ms Image
image/png 2606:4700:3034::6818:7945
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/yahoo_en-US_f_p_bestfit_2x.png
Requested by: Host: srilankachess.lk
URL: https://srilankachess.lk/NEW/Yahoo/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6818:7945 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19b644434cfa9f5d12e1e90a3c2d062aacf27da9ecbe8393df77383ab3c00208

Request headers

Referer: https://srilankachess.lk/NEW/Yahoo/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 27 May 2020 12:32:29 GMT
cf-cache-status: HIT
age: 22573
status: 200
content-length: 3066
cf-request-id: 02f7b7c2b600001776e632c200000001
last-modified: Mon, 16 Jul 2018 13:08:07 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 599fc24abdca1776-FRA
expires: Wed, 03 Jun 2020 06:16:15 GMT

GET
H2 200 r-csc.html Show response
srilankachess.lk/NEW/Yahoo/Yahoo_files/ Frame AA96 4 KB
2 KB 44ms
32ms Document
text/html 2606:4700:3034::6818:7945
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html
Requested by: Host: srilankachess.lk
URL: https://srilankachess.lk/NEW/Yahoo/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6818:7945 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53155875eafdf69b0ddc46758dd41c9ecb636caf63d8cbe203780d30569ea8ab

Request headers

:method: GET
:authority: srilankachess.lk
:scheme: https
:path: /NEW/Yahoo/Yahoo_files/r-csc.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://srilankachess.lk/NEW/Yahoo/login.php
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=da39ee5f868e2e47b189659ffdb3ed91c1590582749; PHPSESSID=2072f01a376da0f2d9127431eaf813ec
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://srilankachess.lk/NEW/Yahoo/login.php

Response headers

status: 200
date: Wed, 27 May 2020 12:32:29 GMT
content-type: text/html
last-modified: Mon, 16 Jul 2018 13:08:07 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
cf-request-id: 02f7b7c2c500001776e632e200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 599fc24ade0b1776-FRA
content-encoding: br

GET
DATA 200
OK truncated
/ 650 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1a540d6790659adf104de6f73b3be7526e1729da358976fa63f366e2ca01c58d

Request headers

Referer: https://srilankachess.lk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bv.js Show response
s.yimg.com/rq/sbox/ Frame 1127 357 B
508 B 27ms
27ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/sbox/bv.js

Requested by

Host: srilankachess.lk
URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

303bbc0d2be952f516322124d7c57675f80b4cfc62d476a5819ca54f95124a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 27 May 2020 12:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 891
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 257
x-amz-id-2: AIr0hvNEwBfk1w29J0Q4JU1sDtRx75WrrAcR5gaggyGUNfxm8bsWELKvQ+2uSXnG0KJ5mY1QxnQ=
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 20 Jul 2018 21:04:26 GMT
server: ATS
etag: "87ea17b7d8be94b4b9cb35670f009dd6-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 67CE1564E8F63A53
x-xss-protection: 1; mode=block
cache-control: public,max-age=1800
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 saved_resource.html Show response
srilankachess.lk/NEW/Yahoo/Yahoo_files/ Frame E6FF 316 B
257 B 38ms
38ms Document
text/html 2606:4700:3034::6818:7945
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html
Requested by: Host: srilankachess.lk
URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6818:7945 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b70edecdcf01189f7919af03591432b8d97ed6eb9a339224b4dc2e3998930a8

Request headers

:method: GET
:authority: srilankachess.lk
:scheme: https
:path: /NEW/Yahoo/Yahoo_files/saved_resource.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=da39ee5f868e2e47b189659ffdb3ed91c1590582749; PHPSESSID=2072f01a376da0f2d9127431eaf813ec
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html

Response headers

status: 200
date: Wed, 27 May 2020 12:32:30 GMT
content-type: text/html
last-modified: Mon, 16 Jul 2018 13:08:07 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
cf-request-id: 02f7b7c42000001776e634b200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 599fc24d0ca41776-FRA
content-encoding: br

GET
H2 200 bid-apid-idsync.html
tag.sp.advertising.com/bid-apid/ Frame 7B30 0
0 155ms
28ms Document
text/html 152.195.39.165
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.sp.advertising.com/bid-apid/bid-apid-idsync.html
Requested by: Host: s.yimg.com
URL: https://s.yimg.com/rq/sbox/bv.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.39.165 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41D8) /
Resource Hash

Request headers

:method: GET
:authority: tag.sp.advertising.com
:scheme: https
:path: /bid-apid/bid-apid-idsync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html

Response headers

status: 200
content-encoding: gzip
age: 81
content-type: text/html
date: Wed, 27 May 2020 12:32:30 GMT
etag: "f3441e2c340de93b6af4903c3c078bb8+gzip"
last-modified: Tue, 03 Dec 2019 21:01:22 GMT
server: ECS (fcn/41D8)
vary: Accept-Encoding
x-amz-id-2: G6c9umJH9rHESzmD37IVVvDjQ+jqkHfRrWD8Bin20Ph0vtx3MxUbd1FIdXrVgAno1RUmSqgUSwc=
x-amz-request-id: 44CAF1472E10A184
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 124

GET
H2 200 fac-sync
pr-bh.ybp.yahoo.com/ Frame 1127 43 B
82 B 983ms
46ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/fac-sync?cb=0.6925024348335054

Requested by

Host: srilankachess.lk
URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 27 May 2020 12:32:31 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
access-control-allow-origin: *
content-length: 43
x-content-type-options: nosniff

GET
H2 200 bv.js.t%C3%A9l%C3%A9chargement Show response
srilankachess.lk/NEW/Yahoo/Yahoo_files/ Frame E6FF 212 B
335 B 43ms
39ms Script
application/octet-stream 2606:4700:3034::6818:7945
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/bv.js.t%C3%A9l%C3%A9chargement
Requested by: Host: srilankachess.lk
URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6818:7945 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c294510ca02ff479678448c40892508512ec7511aa3d51926aa1805530b87e7

Request headers

Referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 27 May 2020 12:32:30 GMT
cf-cache-status: DYNAMIC
last-modified: Mon, 16 Jul 2018 13:08:06 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/octet-stream
status: 200
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
cf-ray: 599fc24d6dc81776-FRA
content-length: 212
cf-request-id: 02f7b7c45d00001776e6351200000001

GET
H2 200 fac-sync
pr-bh.ybp.yahoo.com/ Frame E6FF 43 B
302 B 862ms
45ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/fac-sync?cb=0.2593111214372794

Requested by

Host: srilankachess.lk
URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 27 May 2020 12:32:31 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
access-control-allow-origin: *
content-length: 43
x-content-type-options: nosniff

GET
H2 200 bv.js Show response
s.yimg.com/rq/sbox/ Frame E6FF 357 B
309 B 20ms
20ms Script
application/javascript 2a00:1288:f03d:1fa::4000
YAHOO-1

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/rq/sbox/bv.js

Requested by

Host: srilankachess.lk
URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

303bbc0d2be952f516322124d7c57675f80b4cfc62d476a5819ca54f95124a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Wed, 27 May 2020 12:17:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 892
x-amz-server-side-encryption: AES256
status: 200
vary: Origin, Accept-Encoding
content-length: 257
x-amz-id-2: AIr0hvNEwBfk1w29J0Q4JU1sDtRx75WrrAcR5gaggyGUNfxm8bsWELKvQ+2uSXnG0KJ5mY1QxnQ=
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 20 Jul 2018 21:04:26 GMT
server: ATS
etag: "87ea17b7d8be94b4b9cb35670f009dd6-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 67CE1564E8F63A53
x-xss-protection: 1; mode=block
cache-control: public,max-age=1800
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 bid-apid-idsync.html
tag.sp.advertising.com/bid-apid/ Frame 98D6 0
0 28ms
23ms Document
text/html 152.195.39.165
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.sp.advertising.com/bid-apid/bid-apid-idsync.html
Requested by: Host: s.yimg.com
URL: https://s.yimg.com/rq/sbox/bv.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.39.165 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41D8) /
Resource Hash

Request headers

:method: GET
:authority: tag.sp.advertising.com
:scheme: https
:path: /bid-apid/bid-apid-idsync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html

Response headers

status: 200
content-encoding: gzip
age: 82
content-type: text/html
date: Wed, 27 May 2020 12:32:31 GMT
etag: "f3441e2c340de93b6af4903c3c078bb8+gzip"
last-modified: Tue, 03 Dec 2019 21:01:22 GMT
server: ECS (fcn/41D8)
vary: Accept-Encoding
x-amz-id-2: G6c9umJH9rHESzmD37IVVvDjQ+jqkHfRrWD8Bin20Ph0vtx3MxUbd1FIdXrVgAno1RUmSqgUSwc=
x-amz-request-id: 44CAF1472E10A184
x-amz-server-side-encryption: AES256
x-cache: HIT
content-length: 124

GET
H2 200 fac-sync
pr-bh.ybp.yahoo.com/ Frame E6FF 43 B
82 B 51ms
46ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/fac-sync?cb=0.7563383766417409

Requested by

Host: srilankachess.lk
URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/saved_resource.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 27 May 2020 12:32:31 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
access-control-allow-origin: *
content-length: 43
x-content-type-options: nosniff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.yahoo.com/	1970-01-19 18:35:40	Name: B Value: cureskhfcsnev&b=3&s=3v
.yahoo.com/	1970-01-19 18:35:40	Name: A3 Value: d=AQABBN9dzl4CED5tY_Auq_ik_NebUaTcbc8&S=AQAAAtGNXOKGwFUHnuzOLf7i0qU
.analytics.yahoo.com/	1970-01-19 18:35:18	Name: IDSYNC Value: 16pp~1rlo
srilankachess.lk/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2072f01a376da0f2d9127431eaf813ec
.srilankachess.lk/	1970-01-19 10:32:54	Name: __cfduid Value: da39ee5f868e2e47b189659ffdb3ed91c1590582749

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://srilankachess.lk/NEW/Yahoo/Yahoo_files/r-csc.html(Line 22) Message: darla csc writer, invalid host (1)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pr-bh.ybp.yahoo.com
s.yimg.com
srilankachess.lk
tag.sp.advertising.com
152.195.39.165
2606:4700:3034::6818:7945
2a00:1288:110:c305::8000
2a00:1288:f03d:1fa::4000
19b644434cfa9f5d12e1e90a3c2d062aacf27da9ecbe8393df77383ab3c00208
1a540d6790659adf104de6f73b3be7526e1729da358976fa63f366e2ca01c58d
303bbc0d2be952f516322124d7c57675f80b4cfc62d476a5819ca54f95124a5c
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
53155875eafdf69b0ddc46758dd41c9ecb636caf63d8cbe203780d30569ea8ab
5c294510ca02ff479678448c40892508512ec7511aa3d51926aa1805530b87e7
5e432d6067e96556e6864e860659810a3c74fa55ebd595bca6c3f9971cfc20b2
6b70edecdcf01189f7919af03591432b8d97ed6eb9a339224b4dc2e3998930a8

srilankachess.lk Open in urlscan Pro 2606:4700:3034::6818:7945 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

26 kBTransfer

83 kBSize

5 Cookies

6 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

5 Cookies

1 Console Messages

Indicators

srilankachess.lk Open in urlscan Pro
2606:4700:3034::6818:7945 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

26 kB
Transfer

83 kB
Size

5
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!