berkatdiesel.com Open in urlscan Pro
103.9.170.53  Malicious Activity! Public Scan

5 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request aol2.html Show response berkatdiesel.com/aol/	120 KB 40 KB	937ms 591ms	Document text/html	103.9.170.53 SYNERGYWHOLESALE-...
General Check archive.org Show headers Download Go to Full URL http://berkatdiesel.com/aol/aol2.html Protocol HTTP/1.1 Server 103.9.170.53 , Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU), Reverse DNS c1s3-2e-syd.hosting-services.net.au Software LiteSpeed / Resource Hash 80fddc1e4dfff219b064c73b3904ecd7a124ae6cfb27f825cf701142d23de9df Request headers Host berkatdiesel.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Connection close Content-Type text/html Last-Modified Wed, 28 Nov 2018 16:36:12 GMT Accept-Ranges bytes Content-Encoding gzip Vary Accept-Encoding Content-Length 40445 Date Tue, 15 Oct 2019 00:11:22 GMT Server LiteSpeed
GET H2	200	boot.js Show response s.yimg.com/rq/darla/	7 KB 4 KB	15ms 15ms	Script application/javascript	2a00:1288:f03d:1fa::4000 Oath Holdings Inc.
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/boot.js Requested by Host: berkatdiesel.com URL: http://berkatdiesel.com/aol/aol2.html Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US), Reverse DNS Software ATS / Resource Hash da5d7fa73420d743dcfea24827dcf70e4d2e49a71323e2f062fd2546a31fa11d Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer http://berkatdiesel.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers ats-carp-promotion 1 date Mon, 14 Oct 2019 09:45:55 GMT content-encoding gzip x-content-type-options nosniff age 51930 x-amz-server-side-encryption AES256 status 200 vary Origin, Accept-Encoding content-length 3609 x-amz-id-2 FUux4JU8wYGZfop/jMsYtHZsx8O/Xx0/vILI3oM976ALgQ78BDeDecLlROwaJdvSndrcT6Mfahc= referrer-policy no-referrer-when-downgrade last-modified Mon, 30 Sep 2019 20:30:02 GMT server ATS etag "59ac66e41a5a087279f9712b8ce1a867-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 x-amz-request-id 80A49CF852B0C448 x-xss-protection 1; mode=block cache-control public,max-age=86400 accept-ranges bytes content-type application/javascript; charset=utf-8
GET H2	200	g-r-min.js Show response s.yimg.com/rq/darla/3-4-3/js/	203 KB 86 KB	27ms 27ms	Script application/x-javascript	2a00:1288:f03d:1fa::4000 Oath Holdings Inc.
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/3-4-3/js/g-r-min.js Requested by Host: berkatdiesel.com URL: http://berkatdiesel.com/aol/aol2.html Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US), Reverse DNS Software ATS / Resource Hash bdc64936a41377b3f86d44398cf2b929d94dcc99a001b48ce51a9baf83de3815 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer http://berkatdiesel.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Wed, 21 Aug 2019 22:52:15 GMT content-encoding gzip x-content-type-options nosniff age 4670350 x-amz-server-side-encryption AES256 status 200 vary Origin, Accept-Encoding x-amz-request-id 6F877DEE2E518A43 x-amz-id-2 W0fd9xQEu9H7ULaJ3Va4Pmpj7iaNi4uaUXofjGISOgJVQjNLW5oW4gvJkuwzPXvFKbZirodxSp0= referrer-policy no-referrer-when-downgrade last-modified Wed, 01 Aug 2018 20:02:08 GMT server ATS etag "4e03a875fb9b799a2b0884a7dee64d14-df" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 content-type application/x-javascript; charset=utf-8 x-xss-protection 1; mode=block cache-control public,max-age=31536000 accept-ranges bytes
GET H2	200	aol-logo-black-v.0.0.2.png s.yimg.com/wm/assets/images/ns/	16 KB 16 KB	16ms 15ms	Image image/png	2a00:1288:f03d:1fa::4000 Oath Holdings Inc.
General Check archive.org Show headers Download Go to Show image Full URL https://s.yimg.com/wm/assets/images/ns/aol-logo-black-v.0.0.2.png Requested by Host: berkatdiesel.com URL: http://berkatdiesel.com/aol/aol2.html Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US), Reverse DNS Software ATS / Resource Hash f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690 Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer http://berkatdiesel.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers ats-carp-promotion 1 date Tue, 17 Sep 2019 15:41:52 GMT x-amz-meta-created-date Thu, 16 Nov 2017 19:59:27 GMT age 2363372 x-amz-server-side-encryption AES256 status 200 vary Origin x-amz-request-id 14C65D9277BBF054 x-amz-id-2 9DXetRj1s8X0U6mZAbps1QBKJO+RRAGBrsNh1TUmYBNoZrNyzs1Va4kbbq/ATlmE0gMYnbfUSaM= x-amz-meta-x-ysws-mbst-vtime 1510862367682930 referrer-policy no-referrer-when-downgrade last-modified Fri, 04 May 2018 01:23:57 GMT server ATS etag "f9e0f24b60732cd95150a37fb003b871" expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 content-type image/png x-xss-protection 1; mode=block cache-control max-age=31536000; public accept-ranges bytes content-length 16340 x-amz-meta-x-ysws-access public x-amz-meta-mbst-etag "YM:1:3570f846-88d6-4c90-bd91-179d937c363c00055e1f0ebaf172" x-content-type-options nosniff expires Sat, 04 May 2019 01:23:56 GMT
GET H/1.1	200 OK	g-r-min.js Show response l.yimg.com/rq/darla/3-19-0/js/	204 KB 86 KB	26ms 13ms	Script application/javascript	2a00:1288:f03d:1fa::2000 Oath Holdings Inc.
General Check archive.org Show headers Download Go to Full URL http://l.yimg.com/rq/darla/3-19-0/js/g-r-min.js Requested by Host: s.yimg.com URL: https://s.yimg.com/rq/darla/boot.js Protocol HTTP/1.1 Server 2a00:1288:f03d:1fa::2000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US), Reverse DNS Software ATS / Resource Hash 8fd49a02e3eb1b4341676f8714283af44541769ac55e6270a951049f3aa11288 Request headers Referer http://berkatdiesel.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 08 Oct 2019 08:07:48 GMT Content-Encoding gzip Age 576216 x-amz-server-side-encryption AES256 Connection keep-alive Content-Length 87946 x-amz-id-2 jUW8vriBX/eK0Ps7fkkV6ZzsyVoMkOq+EeaXY7fIr65/yq6oUiEmgxKmwvwCwDILhpvPRwG00Ic= Referrer-Policy no-referrer-when-downgrade Last-Modified Mon, 30 Sep 2019 20:30:05 GMT Server ATS ETag "7761632daa64c47f00ad1ad65483dae7-df" Vary Origin, Accept-Encoding x-amz-request-id 3DA6A4E857B952C8 Cache-Control public,max-age=31536000 Accept-Ranges bytes Content-Type application/javascript; charset=utf-8
GET DATA	200 OK	truncated /	181 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3439c6811bb7e4afdef051434b36bf650eb42915ca52df41624f598cd3dbb3c7 Request headers Referer http://berkatdiesel.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	478 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a8f5c5ea6f77446204eaceba741604eb56ea17fe0282ba98fa4d97673e2b1de7 Request headers Referer http://berkatdiesel.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 94ce309471555238fde53af4bd8b3a23f4402ebed4b975e0788b565126b156af Request headers Referer http://berkatdiesel.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	782 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cb07120b6de3fef86b33ef7acdef185f558485c5da3a317c945393cce3689cb0 Request headers Referer http://berkatdiesel.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET H2	200	client.php Show response fc.yahoo.com/sdarla/php/	10 KB 5 KB	224ms 190ms	Script text/javascript	2a00:1288:f03d:1fa::4000 Oath Holdings Inc.
General Check archive.org Show headers Download Go to Full URL https://fc.yahoo.com/sdarla/php/client.php?l=RICH{dest:tgtRICH;asz:flex}&f=150003036&ref=https%3A%2F%2Flogin.aol.com%2F%3Fsrc%3Dfp-us%26redirect_uri%3Dhttps%253A%252F%252Fwww.aol.com%252Fcallback%26intl%3Dus%26lang%3Den-us Requested by Host: berkatdiesel.com URL: http://berkatdiesel.com/aol/aol2.html Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US), Reverse DNS Software ATS / Resource Hash 1136abd4d629fa11eccc2ec877f6ec96998e13ce45a01d73117df13c08022ecd Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer http://berkatdiesel.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 15 Oct 2019 00:11:23 GMT content-encoding gzip x-content-type-options nosniff age 3 x-dns-prefetch-control off p3p policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" status 200 vary Accept-Encoding content-length 4537 x-xss-protection 1; mode=block referrer-policy no-referrer-when-downgrade server ATS expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" strict-transport-security max-age=15552000 content-type text/javascript;charset=UTF-8 cache-control private,no-cache,no-store x-robots-tag noindex, noarchive, nosnippet, nofollow
GET H2	200	r-csc.html s.yimg.com/rq/darla/3-4-3/html/ Frame A396	0 0	16ms 16ms	Document text/html	2a00:1288:f03d:1fa::4000 Oath Holdings Inc.
General Check archive.org Show headers Download Go to Full URL https://s.yimg.com/rq/darla/3-4-3/html/r-csc.html Requested by Host: berkatdiesel.com URL: http://berkatdiesel.com/aol/aol2.html Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2a00:1288:f03d:1fa::4000 , United Kingdom, ASN10310 (YAHOO-1 - Oath Holdings Inc., US), Reverse DNS Software ATS / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15552000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority s.yimg.com :scheme https :path /rq/darla/3-4-3/html/r-csc.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode nested-navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site referer http://berkatdiesel.com/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer http://berkatdiesel.com/ Response headers status 200 x-amz-id-2 UNzjGgeSK9nX2E8XdPZgCDAVsxcy1PJtvC2bxZiFZmvj7Z1w1FtGft2erojZ5SJVWMzPzgGdhrc= x-amz-request-id 7F88C83656F5823A date Fri, 04 Oct 2019 07:30:43 GMT last-modified Wed, 01 Aug 2018 20:02:07 GMT etag "1450e69fc39d02269ab6b4563d2978a1-df" x-amz-server-side-encryption AES256 cache-control public,max-age=31536000 accept-ranges bytes content-type text/html; charset=utf-8 server ATS referrer-policy no-referrer-when-downgrade vary Origin, Accept-Encoding age 924043 content-encoding gzip content-length 1143 strict-transport-security max-age=15552000 expect-ct max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" x-xss-protection 1; mode=block x-content-type-options nosniff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AOL (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate number| pageStartTime object| DARLA object| $sf undefined| $yac boolean| sf_auto_2-15-9-2019 undefined| Y object| _Y function| setheadertext function| get object| I13N_config object| COUNTRY_CODES_MAP object| mbrConfig object| darlaConfig string| bucket string| currentURL undefined| comscoreBeaconUrl

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://l.yimg.com/rq/darla/3-19-0/js/g-r-min.js(Line 3) Message: DARLA notice: 425
console-api	log	URL: http://l.yimg.com/rq/darla/3-19-0/js/g-r-min.js(Line 3) Message: DARLA notice: 426

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

berkatdiesel.com
fc.yahoo.com
l.yimg.com
s.yimg.com
103.9.170.53
2a00:1288:f03d:1fa::2000
2a00:1288:f03d:1fa::4000
1136abd4d629fa11eccc2ec877f6ec96998e13ce45a01d73117df13c08022ecd
3439c6811bb7e4afdef051434b36bf650eb42915ca52df41624f598cd3dbb3c7
80fddc1e4dfff219b064c73b3904ecd7a124ae6cfb27f825cf701142d23de9df
8fd49a02e3eb1b4341676f8714283af44541769ac55e6270a951049f3aa11288
94ce309471555238fde53af4bd8b3a23f4402ebed4b975e0788b565126b156af
a8f5c5ea6f77446204eaceba741604eb56ea17fe0282ba98fa4d97673e2b1de7
bdc64936a41377b3f86d44398cf2b929d94dcc99a001b48ce51a9baf83de3815
cb07120b6de3fef86b33ef7acdef185f558485c5da3a317c945393cce3689cb0
da5d7fa73420d743dcfea24827dcf70e4d2e49a71323e2f062fd2546a31fa11d
f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690