onyc.ga Open in urlscan Pro
2606:4700:3036::681c:1733  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request Aol.php Show response onyc.ga/AOL/aol/	209 KB 45 KB	636ms 617ms	Document text/html	2606:4700:3036::681c:1733 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://onyc.ga/AOL/aol/Aol.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::681c:1733 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c88d1df04b23cb22dca3a4a72edf3ca08123c3368b8a917c2f2dfa86c983b7e Request headers :method GET :authority onyc.ga :scheme https :path /AOL/aol/Aol.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Thu, 20 Feb 2020 00:11:43 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d80cf670cf9317f9e6e3c54e1c2f795841582157503; expires=Sat, 21-Mar-20 00:11:43 GMT; path=/; domain=.onyc.ga; HttpOnly; SameSite=Lax cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 567c43cbbf46d6f9-FRA content-encoding br
GET H2	200	boot.js Show response s.yimg.com/rq/darla/	7 KB 4 KB	54ms 20ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/boot.js Requested by Host: onyc.ga URL: https://onyc.ga/AOL/aol/Aol.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash beda8529987050b39a783175fffb8a7e7aea1049f14487da7eb388c2ddb2183e Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://onyc.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Wed, 19 Feb 2020 02:00:07 GMT content-encoding gzip x-content-type-options nosniff age 79898 x-amz-server-side-encryption AES256 status 200 strict-transport-security max-age=15552000 content-length 3607 x-amz-id-2 LFFCmTLHr4yf1yJZ/DLn3HPZTNPwTYtG5h1OVoNscKA3dggxSztximeaJt4eDmQnBwosjHDwl3A= referrer-policy no-referrer-when-downgrade last-modified Mon, 10 Feb 2020 19:43:58 GMT server ATS etag "1513b5e9f161dff9f13681a03d20e481-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin, Accept-Encoding x-amz-request-id 21CAA472E79CEFB4 x-xss-protection 1; mode=block cache-control public,max-age=86400 accept-ranges bytes content-type application/javascript; charset=utf-8
GET H2	200	g-r-min.js Show response s.yimg.com/rq/darla/3-23-1/js/	205 KB 87 KB	54ms 20ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/3-23-1/js/g-r-min.js Requested by Host: onyc.ga URL: https://onyc.ga/AOL/aol/Aol.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash ef11018fe5dfd76d08ed24df491abf9165272c10713566df95485236d60daff6 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://onyc.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers ats-carp-promotion 1 date Wed, 22 Jan 2020 12:00:02 GMT content-encoding gzip x-content-type-options nosniff age 2463103 x-amz-server-side-encryption AES256 status 200 strict-transport-security max-age=15552000 content-length 88691 x-amz-id-2 hUL7b6gOhgUq7DvF9V2TU2FUFpqli7+GhC83ykzqb/UAQri3MyDhOUy/3WzJ4exUcVdd2HpYz/8= referrer-policy no-referrer-when-downgrade last-modified Tue, 21 Jan 2020 19:44:45 GMT server ATS etag "6fd0e23f0e202218983dcb8fa142786f-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin, Accept-Encoding x-amz-request-id ACC6489392A12352 x-xss-protection 1; mode=block cache-control public,max-age=31536000 accept-ranges bytes content-type application/javascript; charset=utf-8
GET H2	200	aol-logo-black-v.0.0.2.png s.yimg.com/wm/assets/images/ns/	16 KB 16 KB	94ms 60ms	Image image/png	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Show image Full URL https://s.yimg.com/wm/assets/images/ns/aol-logo-black-v.0.0.2.png Requested by Host: onyc.ga URL: https://onyc.ga/AOL/aol/Aol.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://onyc.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers ats-carp-promotion 1 date Mon, 30 Dec 2019 18:17:23 GMT x-amz-meta-created-date Thu, 16 Nov 2017 19:59:27 GMT age 4427662 x-amz-server-side-encryption AES256 status 200 content-length 16340 strict-transport-security max-age=15552000 x-amz-request-id 50357025A6E8CF8F x-amz-id-2 SVJf+RZGkR4MqZmRn8C28lPPumOqZ1e+utkXXy6WykQWQn6U0jJFhrwX4tGL5CuKibreht8USXY= accept-ranges bytes referrer-policy no-referrer-when-downgrade last-modified Fri, 04 May 2018 01:23:57 GMT server ATS etag "f9e0f24b60732cd95150a37fb003b871" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin content-type image/png x-xss-protection 1; mode=block cache-control max-age=31536000; public x-amz-meta-x-ysws-mbst-vtime 1510862367682930 x-amz-meta-x-ysws-access public x-amz-meta-mbst-etag "YM:1:3570f846-88d6-4c90-bd91-179d937c363c00055e1f0ebaf172" x-content-type-options nosniff expires Sat, 04 May 2019 01:23:56 GMT
GET H2	200	aol-logo-white-v0.0.4.png s.yimg.com/wm/assets/images/ybar/	4 KB 5 KB	95ms 61ms	Image image/png	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Show image Full URL https://s.yimg.com/wm/assets/images/ybar/aol-logo-white-v0.0.4.png Requested by Host: onyc.ga URL: https://onyc.ga/AOL/aol/Aol.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash d0ecaea4f4b91a678f16b572dbe3c9dc7212d1437a97a31f84ae74c167d5a4db Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://onyc.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers ats-carp-promotion 1 date Mon, 12 Aug 2019 18:22:32 GMT x-amz-meta-created-date Wed, 18 Apr 2018 19:01:42 GMT age 16523353 x-amz-server-side-encryption AES256 status 200 content-length 4314 strict-transport-security max-age=15552000 x-amz-request-id C79A2AAAF45E9EB3 x-amz-id-2 4/1hN93wvIzac1mdKLcvW3rFLf6diQ3Yeis/XeY31ieXDOJjQHB156rMgNAvgpAyIDDGLYD8ho8= accept-ranges bytes referrer-policy no-referrer-when-downgrade last-modified Thu, 03 May 2018 20:51:15 GMT server ATS etag "f0d2ba5c63ab03f3b53158f293f651c7" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin content-type image/png x-xss-protection 1; mode=block cache-control public,max-age=31536000 x-amz-meta-x-ysws-mbst-vtime 1524078102670246 x-amz-meta-x-ysws-access public x-amz-meta-mbst-etag "YM:1:d32351c9-ea78-46c0-b7a5-1066118ae37d00056a2415eb6ba6" x-content-type-options nosniff expires Fri, 03 May 2019 20:51:13 GMT
GET H2	200	rapid-3.53.3.js Show response s.yimg.com/wm/mbr/js/	46 KB 17 KB	17ms 16ms	Script application/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/wm/mbr/js/rapid-3.53.3.js Requested by Host: onyc.ga URL: https://onyc.ga/AOL/aol/Aol.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash a8ce16e3e81873ddcc952b5029fdb0d75bd8e7e18df5a8ec098bfb96a9ac9d26 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://onyc.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Tue, 31 Dec 2019 22:46:18 GMT content-encoding gzip x-content-type-options nosniff age 4325127 x-amz-server-side-encryption AES256 status 200 strict-transport-security max-age=15552000 content-length 17047 x-amz-id-2 m1moF+05h9U5DR4T3L92VteGXz1xCv2bFzTqdOZWWhuvFUqRbAFtD9Y2bXJrLgpZ+Co1UxmFTO8= referrer-policy no-referrer-when-downgrade last-modified Thu, 28 Mar 2019 21:32:12 GMT server ATS etag "4bda224130c3ac287f18c9b0d9062205-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Origin, Accept-Encoding x-amz-request-id F924C6CE73CB8D96 x-xss-protection 1; mode=block cache-control public,max-age=315360000 accept-ranges bytes content-type application/javascript
GET H2	200	client.php Show response fc.yahoo.com/sdarla/php/	20 KB 9 KB	201ms 200ms	Script text/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794200033&ref=https%3A%2F%2Flogin.aol.com%2F%3Fsrc%3Dmail%26lang%3Den-US%26language%3Den-US Requested by Host: onyc.ga URL: https://onyc.ga/AOL/aol/Aol.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash 0776cdef7fd56c04876432c00c9ee809268690988c01a1288bedeb7d65d20399 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://onyc.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 20 Feb 2020 00:11:44 GMT content-encoding gzip x-content-type-options nosniff age 0 x-dns-prefetch-control off p3p policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" status 200 strict-transport-security max-age=15552000 content-length 8390 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade server ATS expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding content-type text/javascript;charset=UTF-8 cache-control private,no-cache,no-store x-robots-tag noindex, noarchive, nosnippet, nofollow
GET		g-r-min.js l.yimg.com/rq/darla/3-23-2/js/	0 0
GET DATA	200 OK	truncated /	733 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c25f3a57f7858de738e2f3cd49ae322e7d02d70484cf7b6dde7de302eb033aa8 Request headers Referer https://onyc.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
POST H2	204	yql Show response udc.yahoo.com/v2/public/	0 618 B	130ms 45ms	XHR text/plain	2a00:1288:110:c304::1000 YAHOO-IRD
General Check archive.org Show headers Download Go to Full URL https://udc.yahoo.com/v2/public/yql?yhlVer=2&yhlClient=rapid&yhlS=794200033&yhlCT=2&yhlBTMS=1582157504487&yhlClientVer=3.53.3&yhlRnd=qyZoiTXVBEgLS4aB&yhlCompressed=0 Requested by Host: s.yimg.com URL: https://s.yimg.com/wm/mbr/js/rapid-3.53.3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:110:c304::1000 , United Kingdom, ASN34010 (YAHOO-IRD, GB), Reverse DNS Software ATS / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://onyc.ga/ Origin https://onyc.ga Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Thu, 20 Feb 2020 00:11:44 GMT x-content-type-options nosniff age 0 p3p policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" status 204 x-xss-protection 1; mode=block pragma no-cache referrer-policy strict-origin-when-cross-origin server ATS x-frame-options DENY expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 access-control-allow-origin https://onyc.ga cache-control private, no-cache, no-store, must-revalidate, max-age=0 access-control-allow-credentials true expires Wed, 01 Mar 1995 00:00:00 GMT
POST H2	200	c geo.yahoo.com/	43 B 602 B	148ms 46ms	Other image/gif	2a00:1288:110:c204::b000 YAHOO-IRD
General Check archive.org Show headers Download Go to Full URL https://geo.yahoo.com/c?s=794200033&t=h8LUTA6ZZu5rbogI,0.6301764678979376&_I=&_AO=0&_NOL=0&_R=&_K=3.53.3%05_pl%031%04A_v%033.53.3%04A_cn%03VERSIONED-PROD%04_bt%03rapid%04A_pr%03https%04A_tzoff%031%04A_sid%0384Jy2YOdxjmvUMdo%04_w%03login.aol.com%2F%3Fsrc%3Dmail%26lang%3Den-US%26language%3Den-US%04pt%03utility%04ver%03nodejs%04pct%03sign-in%04pg_name%03aol%20Login%20-%20Landing%20Page%04pstcat%03username-verify%04gm_np%03aol%04p_sec%03login%04p_subsec%03login%04src%03mail%04context%03primary%04_rx%036a892hxfnag.1u1p4kx1%26v%3D1%04_ts%031582157504%04_ms%03488%04A_sr%031600x1200%04A_vr%031600x1200%04A_do%031%04A_ib%031600x1200%04A_ob%031600x1200%04A_srr%031&_C=mKey%03primary_login_launch%04intrctn%03click%04corActn%03click%04sec%03primary_login_launch%04_p%030 Requested by Host: s.yimg.com URL: https://s.yimg.com/wm/mbr/js/rapid-3.53.3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:110:c204::b000 , United Kingdom, ASN34010 (YAHOO-IRD, GB), Reverse DNS Software ATS / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://onyc.ga/ Origin https://onyc.ga Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Thu, 20 Feb 2020 00:11:44 GMT x-content-type-options nosniff server ATS age 0 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-frame-options DENY p3p policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" status 200 cache-control no-cache, no-store, private strict-transport-security max-age=31536000 content-type image/gif content-length 43 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin
GET H2	200	r-csc.html s.yimg.com/rq/darla/3-23-1/html/ Frame 9849	0 0	17ms 17ms	Document text/html	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/3-23-1/html/r-csc.html Requested by Host: onyc.ga URL: https://onyc.ga/AOL/aol/Aol.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority s.yimg.com :scheme https :path /rq/darla/3-23-1/html/r-csc.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://onyc.ga/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://onyc.ga/ Response headers status 200 x-amz-id-2 e5gHo7q7W0PY15D9aqh03uTJ5FU9MM5MIhSFNZUzTxSjhmPebKA2tu9YE1vIPHKB9CacL2FBsxc= x-amz-request-id 1D2E3C9ABB858BDC date Wed, 22 Jan 2020 22:49:30 GMT last-modified Tue, 21 Jan 2020 19:44:44 GMT etag "1ff9b6e511ccd76562520a75bae161d2-df" x-amz-server-side-encryption AES256 cache-control public,max-age=31536000 accept-ranges bytes content-type text/html; charset=utf-8 server ATS referrer-policy no-referrer-when-downgrade vary Origin, Accept-Encoding age 2424136 ats-carp-promotion 1 content-encoding gzip content-length 1160 strict-transport-security max-age=15552000 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-xss-protection 1; mode=block x-content-type-options nosniff
GET H2	200	client.php Show response fc.yahoo.com/sdarla/php/	20 KB 8 KB	205ms 205ms	Script text/javascript	2a00:1288:f03d:1fa::4000 YAHOO-1
General Check archive.org Show headers Download Go to Full URL https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=794200033&ref=https%3A%2F%2Flogin.aol.com%2F%3Fsrc%3Dmail%26lang%3Den-US%26language%3Den-US Requested by Host: onyc.ga URL: https://onyc.ga/AOL/aol/Aol.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1, US), Reverse DNS Software ATS / Resource Hash 0aaaaa9dbc7c16ba8c0ad766cebd277d6e123b632071d604ab8fe45d1d513780 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://onyc.ga/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Thu, 20 Feb 2020 00:11:44 GMT content-encoding gzip x-content-type-options nosniff age 0 x-dns-prefetch-control off p3p policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" status 200 strict-transport-security max-age=15552000 content-length 8398 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade server ATS expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" vary Accept-Encoding content-type text/javascript;charset=UTF-8 cache-control private,no-cache,no-store x-robots-tag noindex, noarchive, nosnippet, nofollow

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

l.yimg.com

URL

http://l.yimg.com/rq/darla/3-23-2/js/g-r-min.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AOL (Online)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate number| pageStartTime object| DARLA object| $sf undefined| $yac boolean| sf_auto_4-20-1-2020 undefined| Y object| _Y object| I13N_config string| mKeyPrefix object| COUNTRY_CODES_MAP object| mbrConfig object| darlaConfig string| bucket string| currentURL string| doneURL boolean| isASDK undefined| comscoreBeaconUrl object| YAHOO object| rapidInstance number| lastApvTime object| DARLA_CONFIG

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.onyc.ga/	1970-01-19 16:14:53	Name: rxx Value: 6a892hxfnag.1u1p4kx1&v=1
			.onyc.ga/	1970-01-19 08:12:29	Name: __cfduid Value: d80cf670cf9317f9e6e3c54e1c2f795841582157503

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fc.yahoo.com
geo.yahoo.com
l.yimg.com
onyc.ga
s.yimg.com
udc.yahoo.com
l.yimg.com
2606:4700:3036::681c:1733
2a00:1288:110:c204::b000
2a00:1288:110:c304::1000
2a00:1288:f03d:1fa::4000
0776cdef7fd56c04876432c00c9ee809268690988c01a1288bedeb7d65d20399
0aaaaa9dbc7c16ba8c0ad766cebd277d6e123b632071d604ab8fe45d1d513780
2c88d1df04b23cb22dca3a4a72edf3ca08123c3368b8a917c2f2dfa86c983b7e
a8ce16e3e81873ddcc952b5029fdb0d75bd8e7e18df5a8ec098bfb96a9ac9d26
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
beda8529987050b39a783175fffb8a7e7aea1049f14487da7eb388c2ddb2183e
c25f3a57f7858de738e2f3cd49ae322e7d02d70484cf7b6dde7de302eb033aa8
d0ecaea4f4b91a678f16b572dbe3c9dc7212d1437a97a31f84ae74c167d5a4db
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef11018fe5dfd76d08ed24df491abf9165272c10713566df95485236d60daff6
f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690