air.bnb-extranett.com

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3031::6815:878, located in United States and belongs to CLOUDFLARENET, US. The main domain is air.bnb-extranett.com.
TLS certificate: Issued by E1 on February 22nd 2024. Valid for: 3 months.

This is the only time air.bnb-extranett.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Airbnb (Hospitality)

Domain & IP information

	IP Address		AS Autonomous System
4	2606:4700:303... 2606:4700:3031::6815:878		13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

4 2606:4700:3031::6815:878 (United States)

ASN13335 (CLOUDFLARENET, US)

air.bnb-extranett.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.bnb-extranett.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	bnb-extranett.com air.bnb-extranett.com api.bnb-extranett.com	1007 KB
4	1

	Domain	Requested by
3	air.bnb-extranett.com	air.bnb-extranett.com
1	api.bnb-extranett.com	air.bnb-extranett.com
4	2

This site contains links to these domains. Also see Links.

Domain
www.airbnb.com
investors.airbnb.com
www.airbnb.org
www.facebook.com
twitter.com
instagram.com

Subject Issuer	Validity	Valid
bnb-extranett.com E1	`2024-02-22` - `2024-05-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://air.bnb-extranett.com/login
Frame ID: 6801CB24FB11F498A6C2B73A9435BD78
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log In / Sign Up - Airbnb

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

1077 kB
Transfer

2788 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.airbnb.com/host/homes
Title: Airbnb your home

Search URL Search Domain Scan URL

URL: https://www.airbnb.com/terms/privacy_policy?source=signup
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.airbnb.com/host/homes?from_footer=1
Title: Airbnb your home

Search URL Search Domain Scan URL

URL: https://investors.airbnb.com/
Title: Investors

Search URL Search Domain Scan URL

URL: https://www.airbnb.org/?locale=en
Title: Airbnb.org emergency stays

Search URL Search Domain Scan URL

URL: https://www.facebook.com/airbnb

Search URL Search Domain Scan URL

URL: https://twitter.com/airbnb

Search URL Search Domain Scan URL

URL: https://instagram.com/airbnb

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login Show response air.bnb-extranett.com/	509 B 753 B	411ms 327ms	Document text/html	2606:4700:3031::6815:878 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://air.bnb-extranett.com/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:878 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fa329b20f5462eede0091d87550d339956689c9087110146b4651d9108e2b2bc` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 85aa980c4c2eda73-MIA content-encoding br content-type text/html date Sat, 24 Feb 2024 20:52:43 GMT last-modified Sat, 24 Feb 2024 20:35:10 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KVVpc4cW8UEUIAI1b5XiULUmRnXnbvP%2BohjDk%2BERtHX9IH2vGBqgB1RBMJvF5g%2BStCHr4WVQpqMU3pJycoKlxyw6CAfnabqjKp2m2uHyxil78uYGV3gULGfLhsFKDkPIXnkZZaDo3i%2BOg4GJWq8Jhk98tBw%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	style.css air.bnb-extranett.com/	2 MB 893 KB	59ms 52ms	Stylesheet text/css	2606:4700:3031::6815:878 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://air.bnb-extranett.com/style.css Requested by Host: air.bnb-extranett.com URL: https://air.bnb-extranett.com/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:878 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9a824319b735485232494e36e4d2fca1ca96901dc46034bb8f89840a60aa9777` Request headers accept-language en-US,en;q=0.9 Referer https://air.bnb-extranett.com/login User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:52:43 GMT content-encoding br cf-cache-status HIT last-modified Thu, 22 Feb 2024 19:01:43 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1156 etag W/"65d79a17-216ce5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P3rEy53MNgkl42TPvUOXiswHKlVzgJDBS%2FutoDm1x%2FDRsvkfmdzwFCGidJeVTWy0S364FprWYILogh8URv4Eu3EM4CTOA%2BYF2SYM3COrUZ4ZpwYmUs7XVTSzGf9OViN6Y1tUxrfDPAFYgQjlpYkrm8I7wa8%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 85aa980e6f84da73-MIA alt-svc h3=":443"; ma=86400
GET H2	200	main.b8c26c90.js Show response air.bnb-extranett.com/static/js/	578 KB 112 KB	995ms 993ms	Script application/javascript	2606:4700:3031::6815:878 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://air.bnb-extranett.com/static/js/main.b8c26c90.js Requested by Host: air.bnb-extranett.com URL: https://air.bnb-extranett.com/login Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:878 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `df5f42b1691beb0985969d2ee6079f088b287464c0be625ea49990655af97ea8` Request headers accept-language en-US,en;q=0.9 Referer https://air.bnb-extranett.com/login User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:52:44 GMT content-encoding br cf-cache-status MISS last-modified Sat, 24 Feb 2024 20:35:10 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"65da52fe-90841" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oY8DuluOaj3J8eEoaRbo1EP3I8lal5nTX7Lc796eFnHdjdF3d55urw8AcvZcftBK8wQp1BpPvfR%2FFpxdAOqS0UGrInmPAS4Be68Fgmqre%2BipMRb40nODxdPgNGtDYbZ5UdBEgO8IbRZyPfuXYJ8YtT%2BEekU%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 85aa980e6f88da73-MIA alt-svc h3=":443"; ma=86400
GET DATA	200 OK	truncated /	24 KB 24 KB		Font binary/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b06428a4009f63f0edb5c8cf89ffb84ea978a2b559cc4c14c8e7a0e130ceefc4` Request headers Referer Origin https://air.bnb-extranett.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type binary/octet-stream
GET DATA	200 OK	truncated /	23 KB 23 KB		Font binary/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b848d7113c5d21f463bd7b248115b78ae386d1628459bfcdb154f82f083bfc97` Request headers Referer Origin https://air.bnb-extranett.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type binary/octet-stream
GET DATA	200 OK	truncated /	24 KB 24 KB		Font binary/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b11f01105c8b416bc49025877708638fc1955dc31d2a3fa7904d4e0b0f4ac4b4` Request headers Referer Origin https://air.bnb-extranett.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type binary/octet-stream
GET H2	200	info Show response api.bnb-extranett.com/ws/	77 B 544 B	328ms 322ms	XHR application/json	2606:4700:3031::6815:878 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.bnb-extranett.com/ws/info?t=1708807965090 Requested by Host: air.bnb-extranett.com URL: https://air.bnb-extranett.com/static/js/main.b8c26c90.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:878 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5c25533f7f8c0a0d1ab53c5d5632f7014d264cf24e523929a89b4f463cacaa2a` Request headers accept-language en-US,en;q=0.9 Referer https://air.bnb-extranett.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:52:45 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6yQlMIhj3Kzg0JQyDAlJf%2B8kuIrEQUUdF4ocOS%2FP5Ie8udOKcpQ3YXAgEmqRQC0LsFQuEdwJ%2BSIJOnqgK9gSGk3qfOI3MH%2B1bCbev9WbNbAeqcxrLtgU0gDlAkXByvWs4Ye6YxjeUkaK%2BUymgJNUDpQjm6k%3D"}],"group":"cf-nel","max_age":604800} content-type application/json;charset=UTF-8 access-control-allow-origin https://air.bnb-extranett.com cache-control no-store, no-cache, must-revalidate, max-age=0 access-control-allow-credentials true cf-ray 85aa9815fb33da73-MIA alt-svc h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Airbnb (Hospitality)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| __reactRouterVersion

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

air.bnb-extranett.com
api.bnb-extranett.com
2606:4700:3031::6815:878
5c25533f7f8c0a0d1ab53c5d5632f7014d264cf24e523929a89b4f463cacaa2a
9a824319b735485232494e36e4d2fca1ca96901dc46034bb8f89840a60aa9777
b06428a4009f63f0edb5c8cf89ffb84ea978a2b559cc4c14c8e7a0e130ceefc4
b11f01105c8b416bc49025877708638fc1955dc31d2a3fa7904d4e0b0f4ac4b4
b848d7113c5d21f463bd7b248115b78ae386d1628459bfcdb154f82f083bfc97
df5f42b1691beb0985969d2ee6079f088b287464c0be625ea49990655af97ea8
fa329b20f5462eede0091d87550d339956689c9087110146b4651d9108e2b2bc

air.bnb-extranett.com Open in urlscan Pro 2606:4700:3031::6815:878 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

4 Requests

100 %HTTPS

100 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

1077 kBTransfer

2788 kBSize

0 Cookies

8 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

air.bnb-extranett.com Open in urlscan Pro
2606:4700:3031::6815:878 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

1077 kB
Transfer

2788 kB
Size

0
Cookies

4 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!