Report - oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param

Report Overview

Visited public
2025-05-18 07:47:38
Tags
URL
oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid
Finishing URL
consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
IP / ASN
23.109.170.226
#7979 SERVERS-COM
Title
Yahoo er et varemerke fra Yahoo-familien.

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
consent.yahoo.com	31016	1995-01-18	2019-02-20	2025-05-15	3.3 kB	95 kB	54.170.226.6
oo.militbuckish.shop	unknown	unknown	2025-05-11	2025-05-11	1.6 kB	15 kB	23.109.170.226
udc.yahoo.com	2454	1995-01-18	2017-01-30	2025-05-15	689 B	594 B	188.125.72.139
csp.yahoo.com	8923	1995-01-18	2015-01-04	2025-05-15	480 B	208 B	188.125.72.139
guce.yahoo.com	2064	1995-01-18	2018-03-16	2025-05-15	618 B	92 kB	52.215.140.68
s.yimg.com	375	1997-05-14	2012-05-20	2025-05-14	3.7 kB	476 kB	87.248.119.251
segarkojiri.top	unknown	2025-04-22	2025-04-23	2025-05-15	1.1 kB	1.1 kB	212.117.186.252
www.yahoo.com	1299	1995-01-18	2012-05-20	2025-05-16	520 B	93 kB	87.248.119.251
mixiblefarmout.top	unknown	2025-04-19	2025-05-09	2025-05-17	3.7 kB	4.5 kB	172.255.99.92

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-05-18 07:47:16	medium	212.117.186.252	Client IP	ET INFO Observed ZeroSSL Certificate for Suspicious TLD (.top)
2025-05-18 07:47:16	low	212.117.186.252	Client IP	ET INFO Observed ZeroSSL SSL/TLS Certificate
2025-05-18 07:47:16	medium	212.117.186.252	Client IP	ET INFO Observed ZeroSSL Certificate for Suspicious TLD (.top)
2025-05-18 07:47:16	low	212.117.186.252	Client IP	ET INFO Observed ZeroSSL SSL/TLS Certificate
2025-05-18 07:47:16	medium	172.255.99.92	Client IP	ET INFO Observed ZeroSSL Certificate for Suspicious TLD (.top)
2025-05-18 07:47:16	low	172.255.99.92	Client IP	ET INFO Observed ZeroSSL SSL/TLS Certificate

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-05-18	medium	militbuckish.shop	Sinkholed
2025-05-18	medium	segarkojiri.top	Sinkholed
2025-05-18	medium	militbuckish.shop	Sinkholed
2025-05-18	medium	mixiblefarmout.top	Sinkholed
2025-05-18	medium	mixiblefarmout.top	Sinkholed
2025-05-18	medium	segarkojiri.top	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	s.yimg.com/oa/build/js/site-28051ae4.js	ScriptElement	96 kB	2025-03-25	2025-05-27
Pretty URL s.yimg.com/oa/build/js/site-28051ae4.js IP 87.248.119.251 ASN #203220 Yahoo-UK Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2025-03-25 21:02 Last Seen2025-05-27 19:08 Times Seen208 Hash 32bc72a1b4b7a68aeea196f9fc302a8a 28051ae4932429f08b047a2c7633e937c608a8d7 46fc594091278ec41f55b6ba62463f5b8c745d68a82b1158ec9d9e4152226892 Loading...

	oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid	ScriptElement	12 kB	2025-05-18	2025-05-18
Pretty URL oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid IP 23.109.170.226 ASN #7979 SERVERS-COM Introduced by scriptElement Embedded in HTML true Observations First Seen2025-05-18 07:47 Last Seen2025-05-18 07:47 Times Seen1 Hash 2782ee0cef9486eec6887cb0094a38e5 ca3ae760d60a52cd3222b3d719a2710b4d38da86 2465d9277a6d11696d61d3d7f9ea5e7820fe3503e193255e74ed0e970d0462f3 Loading...

	s.yimg.com/ss/rapid-3.53.30.js	ScriptElement	50 kB	2023-03-07	2025-05-27
Pretty URL s.yimg.com/ss/rapid-3.53.30.js IP 87.248.119.251 ASN #203220 Yahoo-UK Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-27 19:08 Times Seen2848 Hash 665798d28ecf9be7cbc434e75267920d 55864f76f012bb11a354c6bacdcc7769a5ec6fa2 7bc917ebee12bcd521ae88840228032579459c25a3ccf8953d8a2dbe5e085be9 Loading...

	consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8	ScriptElement	140 B	2024-03-02	2025-05-27
Pretty URL consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8 IP 54.170.226.6 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-02 20:37 Last Seen2025-05-27 19:08 Times Seen268 Hash cb35f66e60f5a88b6ad45db24cfd4a1e 0d89c03ff758fffdbd48297c905430f46e05640d 39aa0748ee518e97e5a33e72328fcf31efae53dc5eef2e84115861328634ca82 Loading...

	consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8	ScriptElement	700 B	2025-03-25	2025-05-27
Pretty URL consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8 IP 54.170.226.6 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2025-03-25 22:58 Last Seen2025-05-27 19:08 Times Seen182 Hash ce8910148f681d52b05edc8fc744b5d5 172f26f8900a4e3bde1252ab00d2c8826ad2996f a1e6aeac162d2dcfc603b227c9327dc0da9df968837f8b18cba20bcc11c6e543 Loading...

HTTP Transactions (23)

URL IP Response Size

consent.yahoo.com/beacon?tag=TCF2&step=Layer1-View&brandDomain=www.yahoo.com&brandBid=&userType=nonreg&sdk=false&tos=nb-NO&country=NO&x=&sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8

54.170.226.6

204 No Content

0 B

URL GET
consent.yahoo.com/beacon?tag=TCF2&step=Layer1-View&brandDomain=www.yahoo.com&brandBid=&userType=nonreg&sdk=false&tos=nb-NO&country=NO&x=&sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
IP
54.170.226.6:443
ASN
#16509 AMAZON-02

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subjectconsent.oath.com
Fingerprint57:50:C9:8A:EB:3E:A4:9C:1E:1F:87:FA:3C:F3:45:37:D4:D6:AB:A2
ValidityTue, 04 Feb 2025 00:00:00 GMT - Wed, 30 Jul 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /beacon?tag=TCF2&step=Layer1-View&brandDomain=www.yahoo.com&brandBid=&userType=nonreg&sdk=false&tos=nb-NO&country=NO&x=&sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8 HTTP/1.1
Host: consent.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
DNT: 1
Connection: keep-alive
Cookie: GUCS=AUDKJodF
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 204 No Content
Server: guce
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Sun, 18 May 2025 07:47:18 GMT

oo.militbuckish.shop/favicon.ico

23.109.170.226

200 OK

1.4 kB

URL GET
oo.militbuckish.shop/favicon.ico
IP
23.109.170.226:443
ASN
#7979 SERVERS-COM

Requested by
https://oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid
Certificate
IssuerLet's Encrypt
Subjectoo.militbuckish.shop
Fingerprint4D:CD:72:C9:6D:82:48:8A:59:01:D5:F2:DE:4B:41:1A:2B:C8:F0:63
ValidityWed, 19 Mar 2025 11:09:58 GMT - Tue, 17 Jun 2025 11:09:57 GMT

File type
MS Windows icon resource - 1 icon, 16x16
Size
1.4 kB (1406 bytes)
Hash
011201ab56695ce86ea2f190bce2670b
bb8fad6accf293e619360935047c23f00da3c769
a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: oo.militbuckish.shop
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid
Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 18 May 2025 07:47:16 GMT
Content-Type: application/octet-stream
Content-Length: 1406
Last-Modified: Fri, 16 May 2025 14:00:10 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "682744ea-57e"
Expires: Mon, 19 May 2025 07:47:16 GMT
Cache-Control: max-age=86400
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Accept-Ranges: bytes

guce.yahoo.com/consent?brandType=nonEu&gcrumb=QMomh0U&done=https%3A%2F%2Fwww.yahoo.com%2F

52.215.140.68

302 Found

92 kB

URL User Request GET
guce.yahoo.com/consent?brandType=nonEu&gcrumb=QMomh0U&done=https%3A%2F%2Fwww.yahoo.com%2F
IP
52.215.140.68:443
ASN
#16509 AMAZON-02

Certificate
IssuerDigiCert Inc
Subjectguce.oath.com
Fingerprint91:86:B9:21:05:5A:48:89:FC:68:9F:6A:05:E4:25:F7:24:08:8D:B7
ValidityTue, 04 Feb 2025 00:00:00 GMT - Wed, 30 Jul 2025 23:59:59 GMT

File type

Size
92 kB (92192 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /consent?brandType=nonEu&gcrumb=QMomh0U&done=https%3A%2F%2Fwww.yahoo.com%2F HTTP/1.1
Host: guce.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mixiblefarmout.top/
DNT: 1
Connection: keep-alive
Cookie: GUCS=AUDKJodF
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Connection: keep-alive
Server: guce
Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Content-Length: 0
Date: Sun, 18 May 2025 07:47:17 GMT

s.yimg.com/oa/build/images/en-GB-home_f0badd867efa6720.jpeg

87.248.119.251

200 OK

79 kB

URL GET
s.yimg.com/oa/build/images/en-GB-home_f0badd867efa6720.jpeg
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
Fingerprint79:34:29:BB:52:D4:B5:31:EF:69:EE:69:89:CD:9D:DA:20:A0:D6:E4
ValidityMon, 12 May 2025 00:00:00 GMT - Wed, 02 Jul 2025 23:59:59 GMT

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1920x1546, components 3
Size
79 kB (79439 bytes)
Hash
9c394eca0dfc6cbf2420b6c3c07d4970
378092debaa0e79af573265a7d0ce2db3ed38a3b
c2b819e2ae41bd6a05129d0b6c38941240576b2236386789ffad3656b186ef29

HTTP Headers

GET /oa/build/images/en-GB-home_f0badd867efa6720.jpeg HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://s.yimg.com/oa/build/css/site-ltr-fcbc12bf.css
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: UEoXaP7FwMmD29IGtalwivbU7+T2X7Cn8xZUFTE1qU75CX07wxJmUvwWYQoi1/zrh0f+wxNR3b4VEgVnrMVuJxoqw21aJ/PlC4XU53bJtks=
x-amz-request-id: VS6J3HZQGERYNSAA
date: Mon, 21 Apr 2025 09:44:21 GMT
last-modified: Sat, 19 Apr 2025 02:24:06 GMT
etag: "9c394eca0dfc6cbf2420b6c3c07d4970"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000; immutable
accept-ranges: bytes
content-type: image/jpeg
content-length: 79439
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 2325779
strict-transport-security: max-age=31536000
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage.png

87.248.119.251

200 OK

760 B

URL GET
s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage.png
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
Fingerprint79:34:29:BB:52:D4:B5:31:EF:69:EE:69:89:CD:9D:DA:20:A0:D6:E4
ValidityMon, 12 May 2025 00:00:00 GMT - Wed, 02 Jul 2025 23:59:59 GMT

File type
PNG image data, 120 x 36, 8-bit colormap, non-interlaced
Size
760 B (760 bytes)
Hash
7e72897bf7bdaecf5fec47f028de6aac
a6d4f7b2b57a751941cc56e3cffbfde4de633576
8a781f94157287ada91708b4baf12712cedf808ce49c58c194fc9873f4fa7a30

HTTP Headers

GET /rz/p/yahoo_frontpage_en-US_s_f_p_bestfit_frontpage.png HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: EdmnPsI0OQ5j2MfN5DGaMsvBZevgoQ76MKdy0OOoPhmo0eY08qtmJZOBpY8UVoCP8M0mWhzrjSvZAfHejbuMGE5iJcRXiBln
x-amz-request-id: E8PEW9M0JK4QNXZ5
date: Sat, 17 May 2025 10:17:19 GMT
last-modified: Fri, 16 May 2025 21:31:54 GMT
etag: "7e72897bf7bdaecf5fec47f028de6aac"
x-amz-server-side-encryption: AES256
cache-control: public,max-age=86400
expires: Sat, 17 May 2025 23:00:00 GMT
accept-ranges: bytes
content-type: image/png
content-length: 760
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 77400
strict-transport-security: max-age=31536000
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

consent.yahoo.com/beacon?tag=TCF2&step=Layer1-View&brandDomain=www.yahoo.com&brandBid=&userType=nonreg&sdk=false&tos=nb-NO&country=NO&x=&sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8

54.170.226.6

204 No Content

0 B

URL GET
consent.yahoo.com/beacon?tag=TCF2&step=Layer1-View&brandDomain=www.yahoo.com&brandBid=&userType=nonreg&sdk=false&tos=nb-NO&country=NO&x=&sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
IP
54.170.226.6:443
ASN
#16509 AMAZON-02

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subjectconsent.oath.com
Fingerprint57:50:C9:8A:EB:3E:A4:9C:1E:1F:87:FA:3C:F3:45:37:D4:D6:AB:A2
ValidityTue, 04 Feb 2025 00:00:00 GMT - Wed, 30 Jul 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /beacon?tag=TCF2&step=Layer1-View&brandDomain=www.yahoo.com&brandBid=&userType=nonreg&sdk=false&tos=nb-NO&country=NO&x=&sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8 HTTP/1.1
Host: consent.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
DNT: 1
Connection: keep-alive
Cookie: GUCS=AUDKJodF
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 204 No Content
Server: guce
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Sun, 18 May 2025 07:47:18 GMT

s.yimg.com/oa/build/images/favicons/yahoo.png

87.248.119.251

200 OK

1.4 kB

URL GET
s.yimg.com/oa/build/images/favicons/yahoo.png
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
Fingerprint79:34:29:BB:52:D4:B5:31:EF:69:EE:69:89:CD:9D:DA:20:A0:D6:E4
ValidityMon, 12 May 2025 00:00:00 GMT - Wed, 02 Jul 2025 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 8 bits/pixel
Size
1.4 kB (1406 bytes)
Hash
b6814ae5582d7953821acbd76e977bb4
75a33fc706c2c6ba233e76c17337e466949f403c
4a491acd00880c407a2b749619003716c87e9c25ac344e5934c13e8f9aa0e8b3

HTTP Headers

GET /oa/build/images/favicons/yahoo.png HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: S97PUAvVWHqzIfdUxejfa9zMDs+sM400l0NQGA+yWQypr//lpgusSFZtLkrvlJp7Byuqn78yLsI=
x-amz-request-id: Y932JNVWCYNRV5Y5
date: Thu, 24 Apr 2025 19:31:18 GMT
last-modified: Tue, 22 Apr 2025 16:37:41 GMT
etag: "b6814ae5582d7953821acbd76e977bb4"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000; immutable
accept-ranges: bytes
content-type: image/png
content-length: 1406
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 2031361
strict-transport-security: max-age=31536000
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

segarkojiri.top/cuid/?f=https%3A%2F%2Foo.militbuckish.shop

212.117.186.252

200 OK

0 B

URL OPTIONS
segarkojiri.top/cuid/?f=https%3A%2F%2Foo.militbuckish.shop
IP
212.117.186.252:443
ASN
#7979 SERVERS-COM

Requested by
https://oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid
Certificate
IssuerZeroSSL
Subjectsegarkojiri.top
FingerprintB1:D1:99:D4:6E:8F:E8:95:E2:D6:F3:32:5C:83:EB:8C:7C:23:2A:D7
ValidityTue, 22 Apr 2025 00:00:00 GMT - Mon, 21 Jul 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

OPTIONS /cuid/?f=https%3A%2F%2Foo.militbuckish.shop HTTP/1.1
Host: segarkojiri.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://oo.militbuckish.shop/
Origin: https://oo.militbuckish.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 18 May 2025 07:47:16 GMT
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://oo.militbuckish.shop
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

www.yahoo.com/

87.248.119.251

307 Temporary Redirect

92 kB

URL User Request GET
www.yahoo.com/
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
Fingerprint79:34:29:BB:52:D4:B5:31:EF:69:EE:69:89:CD:9D:DA:20:A0:D6:E4
ValidityMon, 12 May 2025 00:00:00 GMT - Wed, 02 Jul 2025 23:59:59 GMT

File type

Size
92 kB (92192 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: www.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mixiblefarmout.top/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 307 Temporary Redirect
date: Sun, 18 May 2025 07:47:16 GMT
strict-transport-security: max-age=31536000
server: ATS
cache-control: no-store
content-type: text/html; charset=utf-8
content-language: en
location: https://guce.yahoo.com/consent?brandType=nonEu&gcrumb=QMomh0U&done=https%3A%2F%2Fwww.yahoo.com%2F
set-cookie: GUCS=AUDKJodF; Max-Age=1800; Domain=.yahoo.com; Path=/; Secure
content-security-policy: frame-ancestors 'self' https://*.builtbygirls.com https://*.rivals.com https://*.engadget.com https://*.intheknow.com https://*.autoblog.com https://*.techcrunch.com https://*.yahoo.com https://*.aol.com https://*.huffingtonpost.com https://*.oath.com https://*.search.yahoo.com https://*.pnr.ouryahoo.com https://pnr.ouryahoo.com https://*.search.aol.com https://*.search.huffpost.com https://*.onesearch.com https://*.verizonmedia.com https://*.publishing.oath.com https://cdn.taboola.com https://ads.taboola.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=news&region=US&lang=en-US&device=desktop&yrid=6o9nr8tivmg0j&partner=;
content-length: 0
X-Firefox-Spdy: h2

consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8

54.170.226.6

200 OK

92 kB

URL User Request GET
consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
IP
54.170.226.6:443
ASN
#16509 AMAZON-02

Certificate
IssuerDigiCert Inc
Subjectconsent.oath.com
Fingerprint57:50:C9:8A:EB:3E:A4:9C:1E:1F:87:FA:3C:F3:45:37:D4:D6:AB:A2
ValidityTue, 04 Feb 2025 00:00:00 GMT - Wed, 30 Jul 2025 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (37625)
Size
92 kB (92192 bytes)
Hash
20bd34b15de74640ffee5cfd58788e0d
01f78ccc066018e2abd1484d9d21cd69af662f01
2011acbb7e6a4f6a63f69d06d095627b99320bcdf13b15dbeb2ac9535827f5d2

HTTP Headers

GET /v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8 HTTP/1.1
Host: consent.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://mixiblefarmout.top/
DNT: 1
Connection: keep-alive
Cookie: GUCS=AUDKJodF
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Encoding: gzip
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Content-Security-Policy-Report-Only: default-src 'none'; block-all-mixed-content; connect-src 'self'; frame-ancestors 'none'; img-src 'self' https://s.yimg.com; media-src 'none'; script-src 'self' 'nonce-tze5Z/PDudKjBCo9rZ+DksQNgDDW9BzQ' https://s.yimg.com; style-src 'self' 'nonce-tze5Z/PDudKjBCo9rZ+DksQNgDDW9BzQ' https://s.yimg.com; font-src 'self'; object-src 'none'; frame-src 'none'; report-uri https://csp.yahoo.com/beacon/csp?src=guce
Server: guce
X-XSS-Protection: 1; mode=block
Pragma: no-cache
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Date: Sun, 18 May 2025 07:47:17 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Content-Type: text/html;charset=UTF-8
Content-Length: 14615

s.yimg.com/oa/build/css/site-ltr-fcbc12bf.css

87.248.119.251

200 OK

239 kB

URL GET
s.yimg.com/oa/build/css/site-ltr-fcbc12bf.css
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
Fingerprint79:34:29:BB:52:D4:B5:31:EF:69:EE:69:89:CD:9D:DA:20:A0:D6:E4
ValidityMon, 12 May 2025 00:00:00 GMT - Wed, 02 Jul 2025 23:59:59 GMT

File type
ASCII text
Size
239 kB (238658 bytes)
Hash
05296cb1adf8cd0c27b9d7fa693f6838
fcbc12bf695cdb618625119e46a9d3abf55bc490
d92f28f16ef4904afb66cd19da7086b8014bfa504d1b876a57bdfd1ec63e1ace

HTTP Headers

GET /oa/build/css/site-ltr-fcbc12bf.css HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: CVxG+wjAKsutEbXCeN6MUtLIvQ2RHN1JXtCOJVoZyVWqwQiBrI216brzhV1vN9+cjQjERdfumbQcZ2ogQvgUW1KFEvYOrpmr0ctH4sP7xOQ=
x-amz-request-id: R5MV5W3PNXX59NMR
date: Tue, 13 May 2025 14:10:07 GMT
last-modified: Tue, 13 May 2025 14:00:35 GMT
etag: "719e9b778784d31c295ea2081c36d99a"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000; immutable
content-encoding: gzip
accept-ranges: bytes
content-type: text/css
content-length: 37669
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 409032
strict-transport-security: max-age=31536000
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

udc.yahoo.com/v2/public/yql?yhlVer=2&yhlClient=rapid&yhlS=1197812781&yhlCT=2&yhlBTMS=1747554438250&yhlClientVer=3.53.30&yhlRnd=cWg3sKtKCjCZ7zdP&yhlCompressed=0

188.125.72.139

204 No Content

0 B

URL POST
udc.yahoo.com/v2/public/yql?yhlVer=2&yhlClient=rapid&yhlS=1197812781&yhlCT=2&yhlBTMS=1747554438250&yhlClientVer=3.53.30&yhlRnd=cWg3sKtKCjCZ7zdP&yhlCompressed=0
IP
188.125.72.139:443
ASN
#34010 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subjectyahoo.com
Fingerprint6C:23:14:EA:B1:DF:98:60:2A:CF:08:82:7B:57:A5:93:E6:7B:D1:5E
ValidityTue, 06 May 2025 00:00:00 GMT - Wed, 29 Oct 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /v2/public/yql?yhlVer=2&yhlClient=rapid&yhlS=1197812781&yhlCT=2&yhlBTMS=1747554438250&yhlClientVer=3.53.30&yhlRnd=cWg3sKtKCjCZ7zdP&yhlCompressed=0 HTTP/1.1
Host: udc.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 1357
Origin: https://consent.yahoo.com
DNT: 1
Connection: keep-alive
Cookie: GUCS=AUDKJodF
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
access-control-allow-origin: https://consent.yahoo.com
vary: Origin
access-control-allow-credentials: true
cache-control: no-store, no-cache, private, max-age=0
p3p: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
pragma: no-cache
expires: -1
x-envoy-upstream-service-time: 1
date: Sun, 18 May 2025 07:47:18 GMT
server: ATS
age: 0
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2

consent.yahoo.com/beacon?tag=TCF2&step=Layer1-View-Js&brandDomain=www.yahoo.com&brandBid=&userType=nonreg&sdk=false&tos=nb-NO&country=NO&x=&sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8

54.170.226.6

204 No Content

0 B

URL POST
consent.yahoo.com/beacon?tag=TCF2&step=Layer1-View-Js&brandDomain=www.yahoo.com&brandBid=&userType=nonreg&sdk=false&tos=nb-NO&country=NO&x=&sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
IP
54.170.226.6:443
ASN
#16509 AMAZON-02

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subjectconsent.oath.com
Fingerprint57:50:C9:8A:EB:3E:A4:9C:1E:1F:87:FA:3C:F3:45:37:D4:D6:AB:A2
ValidityTue, 04 Feb 2025 00:00:00 GMT - Wed, 30 Jul 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /beacon?tag=TCF2&step=Layer1-View-Js&brandDomain=www.yahoo.com&brandBid=&userType=nonreg&sdk=false&tos=nb-NO&country=NO&x=&sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8 HTTP/1.1
Host: consent.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Origin: https://consent.yahoo.com
DNT: 1
Connection: keep-alive
Cookie: GUCS=AUDKJodF
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Content-Length: 0

HTTP/1.1 204 No Content
Server: guce
Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Sun, 18 May 2025 07:47:18 GMT

oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid

23.109.170.226

200 OK

12 kB

URL User Request GET
oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid
IP
23.109.170.226:443
ASN
#7979 SERVERS-COM

Certificate
IssuerLet's Encrypt
Subjectoo.militbuckish.shop
Fingerprint4D:CD:72:C9:6D:82:48:8A:59:01:D5:F2:DE:4B:41:1A:2B:C8:F0:63
ValidityWed, 19 Mar 2025 11:09:58 GMT - Tue, 17 Jun 2025 11:09:57 GMT

File type
HTML document, ASCII text, with very long lines (11839)
Size
12 kB (12102 bytes)
Hash
c0e02cdd97a4fe8c5309e388896e5f26
4b90126e698fdb0131cd91a5f14c551f219ab626
117ca871752a4b04d83016be85467899116804690f9ed765079fb7e7b2a5515a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid HTTP/1.1
Host: oo.militbuckish.shop
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 18 May 2025 07:47:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Set-Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; expires=Mon, 19-May-2025 07:47:15 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Mon, 19-May-2025 07:47:15 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

mixiblefarmout.top/iVGXkvdHOCnstSDfviUjSKiUda/78053/?md=eyJ0dmMiOjAsImEiOjU2MTEsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL29vLm1pbGl0YnVja2lzaC5zaG9wL2lzSUxtRDBhVmNMZ2JkNnovam5vSlI%2FcGFyYW1fNT1kMGtwMGpsbDcxcmM3M2V1ZmtuZyZwYXJhbV80PXpvbmVpZCIsImgiOjUzODAsImwiOiJlbi1VUyIsInQiOjAsInoiOjk4MDksImsiOjQsInUiOiI2N2YxOWI0MzkyMjQzNTAxYTFhYmM4IiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6InJwamt2ZTF0eTdhNm80aSIsIm8iOnRydWUsIm0iOjE3NDc1NTQ0MzY0ODgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6Ik1lc2EiLCJ2ciI6Imxsdm1waXBlIiwiYWMiOjAsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6MTIwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=YSthRSldFKtPRruknMf3cQMm6zmujFf2OXOPcsqtlpY&param_3=dcpa_orig_111440&param_4=zoneid&param_5=d0kp0jll71rc73eufkng

172.255.99.92

200 OK

1.0 kB

URL User Request GET
mixiblefarmout.top/iVGXkvdHOCnstSDfviUjSKiUda/78053/?md=eyJ0dmMiOjAsImEiOjU2MTEsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL29vLm1pbGl0YnVja2lzaC5zaG9wL2lzSUxtRDBhVmNMZ2JkNnovam5vSlI%2FcGFyYW1fNT1kMGtwMGpsbDcxcmM3M2V1ZmtuZyZwYXJhbV80PXpvbmVpZCIsImgiOjUzODAsImwiOiJlbi1VUyIsInQiOjAsInoiOjk4MDksImsiOjQsInUiOiI2N2YxOWI0MzkyMjQzNTAxYTFhYmM4IiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6InJwamt2ZTF0eTdhNm80aSIsIm8iOnRydWUsIm0iOjE3NDc1NTQ0MzY0ODgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6Ik1lc2EiLCJ2ciI6Imxsdm1waXBlIiwiYWMiOjAsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6MTIwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=YSthRSldFKtPRruknMf3cQMm6zmujFf2OXOPcsqtlpY&param_3=dcpa_orig_111440&param_4=zoneid&param_5=d0kp0jll71rc73eufkng
IP
172.255.99.92:443
ASN
#7979 SERVERS-COM

Certificate
IssuerZeroSSL
Subjectmixiblefarmout.top
Fingerprint63:03:B8:D8:88:F3:35:B5:AC:A5:72:C4:FC:E3:F7:2B:E2:95:D2:AB
ValiditySat, 19 Apr 2025 00:00:00 GMT - Fri, 18 Jul 2025 23:59:59 GMT

File type
HTML document, ASCII text
Size
1.0 kB (1020 bytes)
Hash
f544a625fe71efa4c02b0202cb9d9e77
5f1ee53a0ce7d9ab48e462d0ed62c008d471db02
5692621abe9c122279081ffdb07f87342e905a73fbf4d1d86f05040f40d979f6

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /iVGXkvdHOCnstSDfviUjSKiUda/78053/?md=eyJ0dmMiOjAsImEiOjU2MTEsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL29vLm1pbGl0YnVja2lzaC5zaG9wL2lzSUxtRDBhVmNMZ2JkNnovam5vSlI%2FcGFyYW1fNT1kMGtwMGpsbDcxcmM3M2V1ZmtuZyZwYXJhbV80PXpvbmVpZCIsImgiOjUzODAsImwiOiJlbi1VUyIsInQiOjAsInoiOjk4MDksImsiOjQsInUiOiI2N2YxOWI0MzkyMjQzNTAxYTFhYmM4IiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6InJwamt2ZTF0eTdhNm80aSIsIm8iOnRydWUsIm0iOjE3NDc1NTQ0MzY0ODgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6Ik1lc2EiLCJ2ciI6Imxsdm1waXBlIiwiYWMiOjAsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6MTIwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=YSthRSldFKtPRruknMf3cQMm6zmujFf2OXOPcsqtlpY&param_3=dcpa_orig_111440&param_4=zoneid&param_5=d0kp0jll71rc73eufkng HTTP/1.1
Host: mixiblefarmout.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://oo.militbuckish.shop/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 18 May 2025 07:47:16 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Set-Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; expires=Mon, 19-May-2025 07:47:16 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; expires=Mon, 19-May-2025 07:47:16 GMT; Max-Age=86400; path=/; secure; SameSite=None
cvn1=CwaAAAAAAhQBCgAP4Q4GAQM%3D; expires=Thu, 17-Jul-2025 07:47:16 GMT; Max-Age=5184000; path=/; secure; SameSite=None
GL_BC=eJxjYGBgEmEU5EyKNzQwMTAzNRFh5MrQnNDCxggAK14EIg%3D%3D; expires=Mon, 19-May-2025 07:47:16 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_CA_78053=eJxjYGBgEmHkYuB9XyzCJMiYzMYoyFjClaE5oQUAKMUEWA%3D%3D; expires=Mon, 19-May-2025 07:47:16 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_OC=eJxjYGBgEmEUZM2PNzY1FWHkytCc0MLGCAAcygNk; expires=Mon, 19-May-2025 07:47:16 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

mixiblefarmout.top/favicon.ico

172.255.99.92

200 OK

1.4 kB

URL GET
mixiblefarmout.top/favicon.ico
IP
172.255.99.92:443
ASN
#7979 SERVERS-COM

Requested by
https://mixiblefarmout.top/iVGXkvdHOCnstSDfviUjSKiUda/78053/?md=eyJ0dmMiOjAsImEiOjU2MTEsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL29vLm1pbGl0YnVja2lzaC5zaG9wL2lzSUxtRDBhVmNMZ2JkNnovam5vSlI%2FcGFyYW1fNT1kMGtwMGpsbDcxcmM3M2V1ZmtuZyZwYXJhbV80PXpvbmVpZCIsImgiOjUzODAsImwiOiJlbi1VUyIsInQiOjAsInoiOjk4MDksImsiOjQsInUiOiI2N2YxOWI0MzkyMjQzNTAxYTFhYmM4IiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6InJwamt2ZTF0eTdhNm80aSIsIm8iOnRydWUsIm0iOjE3NDc1NTQ0MzY0ODgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6Ik1lc2EiLCJ2ciI6Imxsdm1waXBlIiwiYWMiOjAsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6MTIwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=YSthRSldFKtPRruknMf3cQMm6zmujFf2OXOPcsqtlpY&param_3=dcpa_orig_111440&param_4=zoneid&param_5=d0kp0jll71rc73eufkng
Certificate
IssuerZeroSSL
Subjectmixiblefarmout.top
Fingerprint63:03:B8:D8:88:F3:35:B5:AC:A5:72:C4:FC:E3:F7:2B:E2:95:D2:AB
ValiditySat, 19 Apr 2025 00:00:00 GMT - Fri, 18 Jul 2025 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 16x16
Size
1.4 kB (1406 bytes)
Hash
011201ab56695ce86ea2f190bce2670b
bb8fad6accf293e619360935047c23f00da3c769
a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: mixiblefarmout.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mixiblefarmout.top/iVGXkvdHOCnstSDfviUjSKiUda/78053/?md=eyJ0dmMiOjAsImEiOjU2MTEsInMiOiIxMjgweDEwMjQiLCJiIjoiMTI4MHgxMDI0IiwiciI6IiIsInEiOiJodHRwczovL29vLm1pbGl0YnVja2lzaC5zaG9wL2lzSUxtRDBhVmNMZ2JkNnovam5vSlI%2FcGFyYW1fNT1kMGtwMGpsbDcxcmM3M2V1ZmtuZyZwYXJhbV80PXpvbmVpZCIsImgiOjUzODAsImwiOiJlbi1VUyIsInQiOjAsInoiOjk4MDksImsiOjQsInUiOiI2N2YxOWI0MzkyMjQzNTAxYTFhYmM4IiwiZiI6ZmFsc2UsIndoIjoibm90IGluIGlmcmFtZSIsImloIjoiMTI4MHgxMDI0IiwiZSI6InJwamt2ZTF0eTdhNm80aSIsIm8iOnRydWUsIm0iOjE3NDc1NTQ0MzY0ODgsInciOiIlN0IlMjJ0aXRsZSUyMiUzQSUyMiUyMiUyQyUyMmtleXdvcmRzJTIyJTNBJTVCJTVEJTJDJTIydG9wd29yZHMlMjIlM0ElNUIlMjJhZHZlcnRpc2VyJTNBMSUyMiU1RCU3RCIsInRzIjowLCJwciI6MSwiaGMiOjQ4LCJibCI6LTEsImJjIjozLCJ2diI6Ik1lc2EiLCJ2ciI6Imxsdm1waXBlIiwiYWMiOjAsImN0IjoidW5rbm93biIsImNldCI6InVua25vd24iLCJjZGxtIjotMSwiY2RsIjotMSwiY3J0dCI6LTEsInRtcyI6MTIwLCJjZSI6dHJ1ZSwiY2QiOjI0LCJvciI6ImxhbmRzY2FwZS1wcmltYXJ5IiwiZnMiOm51bGwsImZzbyI6bnVsbH0&pdc=YSthRSldFKtPRruknMf3cQMm6zmujFf2OXOPcsqtlpY&param_3=dcpa_orig_111440&param_4=zoneid&param_5=d0kp0jll71rc73eufkng
Cookie: GL_UI4=eJw9zV1OhDAcBHC%2B2dUFnYQDeASKlPDqi1fwkRT6B%2BtCuykV9PYSE32bTH6T8TwvKB7gb8kZ4afgeGKsbdqaV21ZD62o%2Br5tGl72vC1ZxceR46zWzol%2BJhfhtC7Cus5tES4TabJq6AYjKcPjof6aqza7jhD3VmiZIV4OMWdIe2v2lWwRItJiIaSvytJovg4hPoxFyJ7rIyt9ZL9EYNYizO%2BQviktj2V%2BQcDKPE883N9m4UZjl07JxEc8WSEJ%2FgtOg3A0GfuNVNJ6deYGmFl2%2F%2F73ONxZiUTSpgZCbNw72R%2B3Z03l; GL_GI10=eJwVyM0KgkAUhuE5hxiIJPjIC%2FAKTMsWbrNl6MIrMIsYGObIzNjP3WeLd%2FG8SilOE7CZkNRlXhd5dcjLUwV6gtsOPDroVvx7%2BII8uDiCvcOmC1ayRmYXlz9i9TfIYHu25pP1YudoxAXw0roZbvaxv%2FRX0KQJHEUzONxTBXrp3Q9e7R3S; cvn1=CwaAAAAAAhQBCgAP4Q4GAQM%3D; GL_BC=eJxjYGBgEmEU5EyKNzQwMTAzNRFh5MrQnNDCxggAK14EIg%3D%3D; GL_CA_78053=eJxjYGBgEmHkYuB9XyzCJMiYzMYoyFjClaE5oQUAKMUEWA%3D%3D; GL_OC=eJxjYGBgEmEUZM2PNzY1FWHkytCc0MLGCAAcygNk
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 18 May 2025 07:47:16 GMT
Content-Type: application/octet-stream
Content-Length: 1406
Last-Modified: Fri, 16 May 2025 14:00:11 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "682744eb-57e"
Expires: Mon, 19 May 2025 07:47:16 GMT
Cache-Control: max-age=86400
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
Accept-Ranges: bytes

s.yimg.com/oa/build/js/site-28051ae4.js

87.248.119.251

200 OK

96 kB

URL GET
s.yimg.com/oa/build/js/site-28051ae4.js
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
Fingerprint79:34:29:BB:52:D4:B5:31:EF:69:EE:69:89:CD:9D:DA:20:A0:D6:E4
ValidityMon, 12 May 2025 00:00:00 GMT - Wed, 02 Jul 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (497)
Size
96 kB (96511 bytes)
Hash
32bc72a1b4b7a68aeea196f9fc302a8a
28051ae4932429f08b047a2c7633e937c608a8d7
46fc594091278ec41f55b6ba62463f5b8c745d68a82b1158ec9d9e4152226892

HTTP Headers

GET /oa/build/js/site-28051ae4.js HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: oauF7WcRWZMZApiHvTzBoMwPbgfBUIZB4lpGuhvAP0LJQcPKjQsmJ0ywTDfaDaogyR+olHzpcew=
x-amz-request-id: P6WKCQMG8W74V6JS
date: Sun, 20 Apr 2025 02:37:16 GMT
last-modified: Sat, 19 Apr 2025 02:24:06 GMT
etag: "a70f3f11e7644e6bd57785220f352865"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000; immutable
content-encoding: gzip
accept-ranges: bytes
content-type: application/javascript
content-length: 17843
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 2437804
strict-transport-security: max-age=31536000
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

s.yimg.com/ss/rapid-3.53.30.js

87.248.119.251

200 OK

50 kB

URL GET
s.yimg.com/ss/rapid-3.53.30.js
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
Fingerprint79:34:29:BB:52:D4:B5:31:EF:69:EE:69:89:CD:9D:DA:20:A0:D6:E4
ValidityMon, 12 May 2025 00:00:00 GMT - Wed, 02 Jul 2025 23:59:59 GMT

File type
data
Size
50 kB (50266 bytes)
Hash
665798d28ecf9be7cbc434e75267920d
55864f76f012bb11a354c6bacdcc7769a5ec6fa2
7bc917ebee12bcd521ae88840228032579459c25a3ccf8953d8a2dbe5e085be9

HTTP Headers

GET /ss/rapid-3.53.30.js HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: pkkuqbD7blS87KPeDuoodiqpCEHUMu+dw40gE8PtRROiFB4/7tZ7LwqiROf/eKtKVwgLeEPbVvk=
x-amz-request-id: QCCF9AW30C5WQSR6
date: Tue, 22 Apr 2025 13:28:28 GMT
last-modified: Tue, 29 Jun 2021 01:45:07 GMT
etag: "665798d28ecf9be7cbc434e75267920d-df"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000, immutable
x-amz-version-id: .Bcg25AHAdRCkTvv5tMdNmGVEjznZ_m3
accept-ranges: bytes
content-type: application/javascript
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin, Accept-Encoding
age: 2225931
content-encoding: gzip
content-length: 17971
strict-transport-security: max-age=31536000
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

s.yimg.com/oa/build/images/help-circle-solid-black_f68609a66d5b78e7.svg

87.248.119.251

200 OK

2.7 kB

URL GET
s.yimg.com/oa/build/images/help-circle-solid-black_f68609a66d5b78e7.svg
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
Fingerprint79:34:29:BB:52:D4:B5:31:EF:69:EE:69:89:CD:9D:DA:20:A0:D6:E4
ValidityMon, 12 May 2025 00:00:00 GMT - Wed, 02 Jul 2025 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
2.7 kB (2715 bytes)
Hash
5fec39e72a4ed58c02f47c08dcf0ee9b
fb77c65f3087b8cf25cdcda7c76fb22e2d698d2d
9284f7fb38c8d02a4bd0e156987de0ececfb3b7aab4a0a004591fc784f1d01b5

HTTP Headers

GET /oa/build/images/help-circle-solid-black_f68609a66d5b78e7.svg HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://s.yimg.com/oa/build/css/site-ltr-fcbc12bf.css
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: sKap8dkndoglTpSscqmX4+lrB5cU2pNpsvke9EITQqPjr2aFjd1Is7em6p56ncrEi8Nz32G5HFN5C7+Qu/dXmt7XxZSh42mC4JLQ/HZ43XA=
x-amz-request-id: 2RF19F9YG1NRTPYZ
date: Thu, 24 Apr 2025 18:45:44 GMT
last-modified: Tue, 22 Apr 2025 16:37:40 GMT
etag: "db8ae5c3af867c288f5acd55550ff4c9"
x-amz-server-side-encryption: AES256
cache-control: max-age=31536000; immutable
content-encoding: gzip
accept-ranges: bytes
content-type: image/svg+xml
content-length: 1312
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin
age: 2034095
strict-transport-security: max-age=31536000
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

csp.yahoo.com/beacon/csp?src=guce

188.125.72.139

204 No Content

0 B

URL POST
csp.yahoo.com/beacon/csp?src=guce
IP
188.125.72.139:443
ASN
#34010 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subjectyahoo.com
Fingerprint6C:23:14:EA:B1:DF:98:60:2A:CF:08:82:7B:57:A5:93:E6:7B:D1:5E
ValidityTue, 06 May 2025 00:00:00 GMT - Wed, 29 Oct 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /beacon/csp?src=guce HTTP/1.1
Host: csp.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/csp-report
Content-Length: 993
Origin: https://consent.yahoo.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: report
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 204 No Content
date: Sun, 18 May 2025 07:47:18 GMT
strict-transport-security: max-age=31536000
server: ATS
cache-control: no-store, no-cache, private, max-age=0
expires: -1
X-Firefox-Spdy: h2

segarkojiri.top/cuid/?f=https%3A%2F%2Foo.militbuckish.shop

212.117.186.252

200 OK

32 B

URL POST
segarkojiri.top/cuid/?f=https%3A%2F%2Foo.militbuckish.shop
IP
212.117.186.252:443
ASN
#7979 SERVERS-COM

Requested by
https://oo.militbuckish.shop/isILmD0aVcLgbd6z/jnoJR?param_5=d0kp0jll71rc73eufkng&param_4=zoneid
Certificate
IssuerZeroSSL
Subjectsegarkojiri.top
FingerprintB1:D1:99:D4:6E:8F:E8:95:E2:D6:F3:32:5C:83:EB:8C:7C:23:2A:D7
ValidityTue, 22 Apr 2025 00:00:00 GMT - Mon, 21 Jul 2025 23:59:59 GMT

File type
JSON text data
Size
32 B (32 bytes)
Hash
70e83b588274e6fbbc5b85faf7d9b6b7
b17a2941481f91bcf95c64784066001c52280b25
db6af3bb3ceb6477fb12022792993fd49a28e818bb60375eafcf59508efb2675

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /cuid/?f=https%3A%2F%2Foo.militbuckish.shop HTTP/1.1
Host: segarkojiri.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://oo.militbuckish.shop/
Content-Type: application/json
Content-Length: 10
Origin: https://oo.militbuckish.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Sun, 18 May 2025 07:47:16 GMT
Content-Type: application/json
Content-Length: 32
Connection: keep-alive
Keep-Alive: timeout=20
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://oo.militbuckish.shop
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: a97fa794a0f9=67f19b4392243501a1abc8; expires=Sun, 29 Sep 2052 07:34:48 GMT; domain=segarkojiri.top; path=/; secure; SameSite=None
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_w_bestfit_frontpage.png

87.248.119.251

200 OK

810 B

URL GET
s.yimg.com/rz/p/yahoo_frontpage_en-US_s_f_w_bestfit_frontpage.png
IP
87.248.119.251:443
ASN
#203220 Yahoo-UK Limited

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subject*.fantasysports.yahoo.com
Fingerprint79:34:29:BB:52:D4:B5:31:EF:69:EE:69:89:CD:9D:DA:20:A0:D6:E4
ValidityMon, 12 May 2025 00:00:00 GMT - Wed, 02 Jul 2025 23:59:59 GMT

File type
PNG image data, 120 x 36, 8-bit colormap, non-interlaced
Size
810 B (810 bytes)
Hash
119157c5c80d9db38f0da8098a35b53a
6c65f9bdaf6aad4fdde6c1bde1e509a6f056058b
1b119e32e848339740c549d02aa62d5fd21451d5ce468225922faae86555a68d

HTTP Headers

GET /rz/p/yahoo_frontpage_en-US_s_f_w_bestfit_frontpage.png HTTP/1.1
Host: s.yimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: DIx5x4UIQwqzvFv6wsd5j1n+JTY3NByYqvo3j9J1ZsZup93prD1qvXl9o7d3sch0G0alujksiCg=
x-amz-request-id: W0RK8S2MS1GVX8YK
date: Sat, 17 May 2025 09:10:31 GMT
last-modified: Fri, 16 May 2025 21:31:54 GMT
x-amz-server-side-encryption: AES256
cache-control: public,max-age=86400
accept-ranges: bytes
content-type: image/png
content-length: 810
server: ATS
referrer-policy: no-referrer-when-downgrade
vary: Origin
etag: "119157c5c80d9db38f0da8098a35b53a"
expires: Sat, 17 May 2025 23:00:00 GMT
age: 81408
strict-transport-security: max-age=31536000
ats-carp-promotion: 1, 1
X-Firefox-Spdy: h2

consent.yahoo.com/static/images/close.svg

54.170.226.6

200 OK

1.4 kB

URL GET
consent.yahoo.com/static/images/close.svg
IP
54.170.226.6:443
ASN
#16509 AMAZON-02

Requested by
https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
Certificate
IssuerDigiCert Inc
Subjectconsent.oath.com
Fingerprint57:50:C9:8A:EB:3E:A4:9C:1E:1F:87:FA:3C:F3:45:37:D4:D6:AB:A2
ValidityTue, 04 Feb 2025 00:00:00 GMT - Wed, 30 Jul 2025 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
1.4 kB (1402 bytes)
Hash
04fdad3c9b32cf024d3494c6e0b1f691
e7c0aabd33e695415e7a8c7afea4b94dca273f06
8f0baedf119a144b8b4fe597eb02a91fc47d89284aa6cdcc12097cb109598796

HTTP Headers

GET /static/images/close.svg HTTP/1.1
Host: consent.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://consent.yahoo.com/v2/collectConsent?sessionId=3_cc-session_d591fffb-4cf5-46a5-b5f1-dd04199e26e8
DNT: 1
Connection: keep-alive
Cookie: GUCS=AUDKJodF
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Encoding: gzip
Server: guce
Accept-Ranges: bytes
Date: Sun, 18 May 2025 07:47:18 GMT
Connection: keep-alive
Last-Modified: Fri, 16 May 2025 07:14:05 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 703
Content-Type: image/svg+xml

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (23)

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate