qantas.saas.com.au
Open in
urlscan Pro
213.165.242.8
Malicious Activity!
Public Scan
Effective URL: https://qantas.saas.com.au/
Submission: On September 27 via manual from PH — Scanned from AU
Summary
TLS certificate: Issued by R10 on September 26th 2024. Valid for: 3 months.
This is the only time qantas.saas.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Qantas (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 213.165.242.8 213.165.242.8 | 22611 (INMOTION) (INMOTION) | |
3 | 203.134.85.106 203.134.85.106 | 9443 (VOCUS-RET...) (VOCUS-RETAIL-AU Vocus Retail) | |
1 | 151.101.78.2 151.101.78.2 | 54113 (FASTLY) (FASTLY) | |
2 | 203.134.85.136 203.134.85.136 | 9443 (VOCUS-RET...) (VOCUS-RETAIL-AU Vocus Retail) | |
4 | 203.134.85.122 203.134.85.122 | 9443 (VOCUS-RET...) (VOCUS-RETAIL-AU Vocus Retail) | |
13 | 6 |
ASN22611 (INMOTION, US)
PTR: amsngx344.inmotionhosting.com
qantas.saas.com.au |
ASN9443 (VOCUS-RETAIL-AU Vocus Retail, AU)
PTR: 106.85-134-203.akamai.cache.nsw.vocus.network
www.qantas.com |
ASN9443 (VOCUS-RETAIL-AU Vocus Retail, AU)
PTR: 136.85-134-203.akamai.cache.nsw.vocus.network
accounts.qantas.com | |
cdn.qantasloyalty.com |
ASN9443 (VOCUS-RETAIL-AU Vocus Retail, AU)
PTR: 122.85-134-203.akamai.cache.nsw.vocus.network
p11.techlab-cdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
techlab-cdn.com
p11.techlab-cdn.com — Cisco Umbrella Rank: 3930 |
59 KB |
4 |
qantas.com
www.qantas.com — Cisco Umbrella Rank: 173019 accounts.qantas.com — Cisco Umbrella Rank: 389863 |
1 MB |
3 |
saas.com.au
qantas.saas.com.au |
326 KB |
1 |
qantasloyalty.com
cdn.qantasloyalty.com — Cisco Umbrella Rank: 424049 |
143 KB |
1 |
giphy.com
i.giphy.com — Cisco Umbrella Rank: 66619 |
743 KB |
13 | 5 |
Domain | Requested by | |
---|---|---|
4 | p11.techlab-cdn.com |
accounts.qantas.com
|
3 | www.qantas.com |
qantas.saas.com.au
|
3 | qantas.saas.com.au |
qantas.saas.com.au
|
1 | cdn.qantasloyalty.com |
qantas.saas.com.au
|
1 | accounts.qantas.com |
qantas.saas.com.au
|
1 | i.giphy.com |
qantas.saas.com.au
|
13 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.qantas.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
qantas.saas.com.au R10 |
2024-09-26 - 2024-12-25 |
3 months | crt.sh |
qantas.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-11-06 - 2024-11-05 |
a year | crt.sh |
*.giphy.com GlobalSign Atlas R3 DV TLS CA 2024 Q2 |
2024-07-05 - 2025-08-06 |
a year | crt.sh |
qantasloyalty.com DigiCert TLS RSA SHA256 2020 CA1 |
2024-07-15 - 2025-07-15 |
a year | crt.sh |
p11.techlab-cdn.com R11 |
2024-08-15 - 2024-11-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://qantas.saas.com.au/
Frame ID: 0710ADA740DD1D877BB81B0EEFA3EB9C
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Special Gift CouponPage URL History Show full URLs
-
http://qantas.saas.com.au/
HTTP 307
https://qantas.saas.com.au/ Page URL
Detected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- /etc/designs/
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Contacts
Search URL Search Domain Scan URL
Title: Privacy & security
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Viewing tips
Search URL Search Domain Scan URL
Title: Worldwide sites
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://qantas.saas.com.au/
HTTP 307
https://qantas.saas.com.au/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
qantas.saas.com.au/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
NAB_Signature_Creative_2.gif
www.qantas.com/images/per/apex/qlcs-13680/ |
971 KB 972 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PjOjqSdGNqMfuw6dfe.webp
i.giphy.com/ |
743 KB 743 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
QLCS_13021_FS_NAB_Benefits_GIF_Update_Xsell_680x240_01_v2_looped.gif
www.qantas.com/images/per/apex/qlcs-13021/ |
74 KB 74 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4d1f86ddf55e8968a625a55fa0bec98a6a39001124ebac
accounts.qantas.com/static/ |
158 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base.bundle.js
cdn.qantasloyalty.com/assets/widgets/login/v2/ |
261 KB 143 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EzViQ
qantas.saas.com.au/p4f4ZNmS/FJSxjsn/Y0O9neE/4F/aQpYGV9bk9/Qk1QICEi/bno1NX/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
65319_1825202430.js
p11.techlab-cdn.com/e/ |
54 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
65257_1825232097.js
p11.techlab-cdn.com/e/ |
14 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
64885_1825202523.js
p11.techlab-cdn.com/e/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
65226_747628217.js
p11.techlab-cdn.com/e/ |
70 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qantas.svg
www.qantas.com/etc/designs/qantas/global/img/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
13 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
41 KB 41 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
qantas.saas.com.au/ |
323 KB 324 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Qantas (Transportation)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| $$__ts/moc.sat number| ___dm function| ___dto object| core object| __core-js_shared__0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.qantas.com
cdn.qantasloyalty.com
i.giphy.com
p11.techlab-cdn.com
qantas.saas.com.au
www.qantas.com
151.101.78.2
203.134.85.106
203.134.85.122
203.134.85.136
213.165.242.8
06e6ec8a6328eaccfbf38c3906f1a1ce147de2fd02523c119887e860114aac0a
1762a6d546dfc49a32e2e4b2caefb01368b948b0d137b4e03447e18e3119c65a
183a96bc637aef9ae1000306dc273ca2cfbcd1d99aa3db44f08ed4ebfe221696
23b2b0908ec40b622426638ca19b8d0b033c9bfe3c17b4d1e8fc553a9992afcb
422aa4e7ba5ff626a830dbbee358cb5055122a03b5c36b5f7608e1b34999e529
42dc012edef1122cfd8750b585cff8577927ae4ec25b89331d530cdd84ba4292
499ef0571b208660fdce5f17c063603d778366afd021c6b2ad659c1d84fb4679
4e5abd4a0506bb0c5426fddde67167e2f86cdad465d7fb77ce459988d26964ca
583cee76f3a8be0b2a2522ba61497b0c801360ea9fd0493a387320c6237ae65f
74a7a53097f5335e794968f4f7c27d089701fd635c8698c5f5fda7f30356cacb
771e85b11ab3136f09f82de0195aea8049e19bb2b897e6d1f5eed0d7e399ff87
80a45aafae2e2b3cf954d3a479bc5f13fd3b771e84fc106cd393f03defb0a965
842108ddb062ea58108e0910347ae0c78459617818f783dbe7b1a2d0231501af
979d7d446373dfe47191cad21f7ede765f7703b0809bfff9273e0c6b672e2388
dad53807c80675f18ac2294144515d334d3195888509c1d5bd5bef01bf23cbff