2024yah00inc78io90ce043irs456o0mail98io.github.io

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 5 HTTP transactions. The main IP is 2606:50c0:8002::153, located in United States and belongs to FASTLY, US. The main domain is 2024yah00inc78io90ce043irs456o0mail98io.github.io.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on March 15th 2024. Valid for: a year.

This is the only time 2024yah00inc78io90ce043irs456o0mail98io.github.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:50c0:800... 2606:50c0:8002::153	54113 (FASTLY) (FASTLY)
1	2607:f8b0:400... 2607:f8b0:4006:81c::200a	15169 (GOOGLE) (GOOGLE)
2	2001:4998:1c:... 2001:4998:1c:800::1000	14779 (YAHOO) (YAHOO)
1	2600:141b:900... 2600:141b:9000::b833:959b	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
5	4

1 2606:50c0:8002::153 (United States)

ASN54113 (FASTLY, US)

2024yah00inc78io90ce043irs456o0mail98io.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4998:1c:800::1000 (United States)

ASN14779 (YAHOO, US)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:9000::b833:959b (Secaucus, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)

th.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 768	3 KB
1	bing.com th.bing.com — Cisco Umbrella Rank: 152	38 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	870 B
1	github.io 2024yah00inc78io90ce043irs456o0mail98io.github.io	3 KB
5	4

	Domain	Requested by
2	s.yimg.com	2024yah00inc78io90ce043irs456o0mail98io.github.io
1	th.bing.com	2024yah00inc78io90ce043irs456o0mail98io.github.io
1	fonts.googleapis.com	2024yah00inc78io90ce043irs456o0mail98io.github.io
1	2024yah00inc78io90ce043irs456o0mail98io.github.io
5	4

This site contains no links.

Subject Issuer	Validity	Valid
*.github.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-15` - `2025-03-14`	a year	crt.sh
upload.video.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-10-31` - `2024-12-18`	2 months	crt.sh
r.bing.com Microsoft Azure ECC TLS Issuing CA 04	`2024-06-24` - `2025-06-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://2024yah00inc78io90ce043irs456o0mail98io.github.io/login.mail.ya1h00/view092document897oiverify89/ioswin11/
Frame ID: 4C26216660A60C9FF52D3D2F64C6E2B3
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Yahoo Mail | Sign in to Yahoo Mail

Detected technologies

GitHub Pages (CDN) Expand

Overall confidence: 100%
Detected patterns

^https?://[^/]+\.github\.io

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

45 kB
Transfer

55 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
2024yah00inc78io90ce043irs456o0mail98io.github.io/login.mail.ya1h00/view092document897oiverify89/ioswin11/ 9 KB
3 KB 101ms
32ms Document
text/html 2606:50c0:8002::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://2024yah00inc78io90ce043irs456o0mail98io.github.io/login.mail.ya1h00/view092document897oiverify89/ioswin11/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8002::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

d6901482516f09651a4ccc448766f78f99ff61f9a0bba2565dcd4501da379aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 406
cache-control: max-age=600
content-encoding: gzip
content-length: 2239
content-type: text/html; charset=utf-8
date: Mon, 02 Dec 2024 16:13:33 GMT
etag: W/"674dcfbe-2330"
expires: Mon, 02 Dec 2024 16:05:21 GMT
last-modified: Mon, 02 Dec 2024 15:18:22 GMT
permissions-policy: interest-cohort=()
server: GitHub.com
strict-transport-security: max-age=31556952
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-fastly-request-id: bac55448783adc87717d6bfbe17bbb8e2e7c36c7
x-github-request-id: AB46:3709FC:71724F:7A7731:674DD869
x-proxy-cache: MISS
x-served-by: cache-mia-kmia1760031-MIA
x-timer: S1733156013.351067,VS0,VE1

GET
H2 200 css2
fonts.googleapis.com/ 6 KB
870 B 224ms
85ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:wght@300;400;500;600;700;800;900&display=swap

Requested by

Host: 2024yah00inc78io90ce043irs456o0mail98io.github.io
URL: https://2024yah00inc78io90ce043irs456o0mail98io.github.io/login.mail.ya1h00/view092document897oiverify89/ioswin11/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ad70b1fd0bcb66d0483b6875835c2108cb06f69a5214d06dd78e7209e24086e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer: https://2024yah00inc78io90ce043irs456o0mail98io.github.io/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, max-age=86400
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 02 Dec 2024 16:13:33 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 02 Dec 2024 16:13:33 GMT
x-xss-protection: 0
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png
s.yimg.com/rz/p/ 1 KB
2 KB 295ms
64ms Image
image/png 2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage_2x.png

Requested by

Host: 2024yah00inc78io90ce043irs456o0mail98io.github.io
URL: https://2024yah00inc78io90ce043irs456o0mail98io.github.io/login.mail.ya1h00/view092document897oiverify89/ioswin11/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer: https://2024yah00inc78io90ce043irs456o0mail98io.github.io/

Response headers

etag: "cd166981c96c6d0f4b5a7d798c25878e"
age: 40489
expires: Tue, 03 Dec 2024 00:00:00 GMT
date: Mon, 02 Dec 2024 04:58:45 GMT
last-modified: Sun, 01 Dec 2024 21:30:34 GMT
vary: Origin
content-type: image/png
x-amz-id-2: EYwBjuqPV1Ndgsw/9cofi3/BGcQ82JOv4sRLPPz/YCaH8HY8lJ+esLZ/gOsM7AkPK5dPxrKWKoM=
strict-transport-security: max-age=31536000
cache-control: public,max-age=86400
ats-carp-promotion: 1, 1
referrer-policy: no-referrer-when-downgrade
x-amz-request-id: 6Z69MCMHNQZC5Q3E
accept-ranges: bytes
content-length: 1346
server: ATS
x-amz-server-side-encryption: AES256

GET
H2 200 OIP.JB3F70EKQ9BOW84q5vk8RQAAAA
th.bing.com/th/id/ 38 KB
38 KB 269ms
106ms Image
image/jpeg 2600:141b:9000::b833:959b
AKAMAI-ASN1 Akama...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://th.bing.com/th/id/OIP.JB3F70EKQ9BOW84q5vk8RQAAAA?rs=1&pid=ImgDetMain
Requested by: Host: 2024yah00inc78io90ce043irs456o0mail98io.github.io
URL: https://2024yah00inc78io90ce043irs456o0mail98io.github.io/login.mail.ya1h00/view092document897oiverify89/ioswin11/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:9000::b833:959b Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 451252a264158b29eab90b7c66a376d82844a948998dcddabad301307ed5a063

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer: https://2024yah00inc78io90ce043irs456o0mail98io.github.io/

Response headers

nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
timing-allow-origin: *
cache-control: public, max-age=1209558
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
access-control-allow-methods: GET, POST, OPTIONS
x-check-cacheable: YES
access-control-allow-origin: *
x-cache: TCP_MISS from a184-51-149-151.deploy.akamaitechnologies.com (AkamaiGHost/11.7.1-5d2a058efeda81c5505a169a6e16c38e) (-)
content-length: 38849
alt-svc: h3=":443"; ma=93600
date: Mon, 02 Dec 2024 16:13:33 GMT
akamai-grn: 0.979533b8.1733156013.26571e32
content-type: image/jpeg
access-control-allow-headers: *

GET
H2 200 yahoo-favicon-img-v0.0.2.ico
s.yimg.com/wm/mbr/images/ 1 KB
2 KB 65ms
64ms Other
image/vnd.microsoft.icon 2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wm/mbr/images/yahoo-favicon-img-v0.0.2.ico

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:1c:800::1000 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer: https://2024yah00inc78io90ce043irs456o0mail98io.github.io/

Response headers

etag: "b6814ae5582d7953821acbd76e977bb4"
age: 328410
date: Thu, 28 Nov 2024 21:00:04 GMT
last-modified: Wed, 11 Sep 2019 18:01:04 GMT
vary: Origin
content-type: image/vnd.microsoft.icon
x-amz-id-2: UxA5/L64hUQ7xmbLOGg2BuXX8fb/G7g6jfVwKxaomo0VhZZMHr+bEPs3MT4TVQV40o0qCyUI2h8=
strict-transport-security: max-age=31536000
cache-control: public,max-age=315360000
ats-carp-promotion: 1, 1
referrer-policy: no-referrer-when-downgrade
x-amz-request-id: MH3YPTD7CMBCBXVV
accept-ranges: bytes
content-length: 1406
server: ATS
x-amz-server-side-encryption: AES256

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://2024yah00inc78io90ce043irs456o0mail98io.github.io/login.mail.ya1h00/view092document897oiverify89/ioswin11/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556952

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2024yah00inc78io90ce043irs456o0mail98io.github.io
fonts.googleapis.com
s.yimg.com
th.bing.com
2001:4998:1c:800::1000
2600:141b:9000::b833:959b
2606:50c0:8002::153
2607:f8b0:4006:81c::200a
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338
451252a264158b29eab90b7c66a376d82844a948998dcddabad301307ed5a063
4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3
ad70b1fd0bcb66d0483b6875835c2108cb06f69a5214d06dd78e7209e24086e7
d6901482516f09651a4ccc448766f78f99ff61f9a0bba2565dcd4501da379aed

2024yah00inc78io90ce043irs456o0mail98io.github.io Open in urlscan Pro 2606:50c0:8002::153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

45 kBTransfer

55 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

2024yah00inc78io90ce043irs456o0mail98io.github.io Open in urlscan Pro
2606:50c0:8002::153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

45 kB
Transfer

55 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!