di2-live.appspot.com Open in urlscan Pro
2a00:1450:4001:825::2014 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://di2-live.appspot.com/client/www/index.html#/?_k=hrpu46
Effective URL:
http://di2-live.appspot.com/client/www/index.html
Submission: On August 20 via manual (August 20th 2019, 8:05:58 pm UTC) from US

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 21 HTTP transactions. The main IP is 2a00:1450:4001:825::2014, located in Frankfurt am Main, Germany and belongs to GOOGLE - Google LLC, US. The main domain is di2-live.appspot.com.

This is the only time di2-live.appspot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: American Express (Financial)

Domain & IP information

	IP Address	AS Autonomous System
3 7	2a00:1450:400... 2a00:1450:4001:825::2014	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2606:4700::68... 2606:4700::6813:c597	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5	23.38.48.128 23.38.48.128	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	12.105.185.175 12.105.185.175	6307 (AMERICAN-...) (AMERICAN-EXPRESS - American Express Company)
1	148.173.96.163 148.173.96.163	6307 (AMERICAN-...) (AMERICAN-EXPRESS - American Express Company)
21	6

7 2a00:1450:4001:825::2014 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE - Google LLC, US)

di2-live.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6813:c597 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.38.48.128 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-48-128.deploy.static.akamaitechnologies.com

www.aexp-static.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 12.105.185.175 (United States)

ASN6307 (AMERICAN-EXPRESS - American Express Company, US)
PTR: qicm.americanexpress.com

qicm.americanexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 148.173.96.163 (United States)

ASN6307 (AMERICAN-EXPRESS - American Express Company, US)
PTR: ipc2travel.americanexpress.com

travel.americanexpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	appspot.com 3 redirects di2-live.appspot.com	483 KB
5	aexp-static.com www.aexp-static.com icm.aexp-static.com Failed	25 KB
4	cloudflare.com cdnjs.cloudflare.com	199 KB
2	americanexpress.com qicm.americanexpress.com travel.americanexpress.com	46 KB
0	myamextravel.com Failed digital2.myamextravel.com Failed
0	ensighten.com Failed nexus.ensighten.com Failed
21	6

	Domain	Requested by
7	di2-live.appspot.com	3 redirects di2-live.appspot.com
5	www.aexp-static.com	di2-live.appspot.com
4	cdnjs.cloudflare.com	di2-live.appspot.com
1	travel.americanexpress.com	di2-live.appspot.com
1	qicm.americanexpress.com	di2-live.appspot.com
0	digital2.myamextravel.com Failed	di2-live.appspot.com
0	icm.aexp-static.com Failed	di2-live.appspot.com
0	nexus.ensighten.com Failed	di2-live.appspot.com
21	8

This site contains no links.

Subject Issuer	Validity	Valid
*.appspot.com Google Internet Authority G3	`2019-07-29` - `2019-10-21`	3 months	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-10` - `2020-02-16`	6 months	crt.sh
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2018-08-08` - `2020-07-23`	2 years	crt.sh
qicm.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2018-01-05` - `2020-01-10`	2 years	crt.sh
travel.americanexpress.com DigiCert SHA2 Extended Validation Server CA	`2018-04-02` - `2020-04-06`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://di2-live.appspot.com/client/www/index.html
Frame ID: 3C382D69AF966B4D9A0113C73CB8D640
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

21
Requests

67 %
HTTPS

40 %
IPv6

6
Domains

8
Subdomains

6
IPs

3
Countries

752 kB
Transfer

2440 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://di2-live.appspot.com/client/www/fonts/font-awesome.min.css HTTP 302
https://di2-live.appspot.com/client/www/fonts/font-awesome.min.css

Request Chain 1

http://di2-live.appspot.com/client/www/theme-static.css HTTP 302
https://di2-live.appspot.com/client/www/theme-static.css

Request Chain 18

http://di2-live.appspot.com/client/www/main.16f39276d23b5da919e2.js HTTP 302
https://di2-live.appspot.com/client/www/main.16f39276d23b5da919e2.js

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.html Show response
di2-live.appspot.com/client/www/ 71 KB
14 KB 266ms
236ms Document
text/html 2a00:1450:4001:825::2014
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://di2-live.appspot.com/client/www/index.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:825::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

643e1482d40c2528ea2b39403ea1a99bee06374a8273c7ea5ab332314cfc9deb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: di2-live.appspot.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: text/html; charset=utf-8
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubdomains
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0
X-XSS-Protection: 1; mode=block
Content-Encoding: gzip
X-Cloud-Trace-Context: e012cec8b59dee1c5d1c2260bcc49f03
Vary: Accept-Encoding
Date: Tue, 20 Aug 2019 20:05:21 GMT
Server: Google Frontend
Content-Length: 13759

GET
H2

200

font-awesome.min.css
di2-live.appspot.com/client/www/fonts/
Redirect Chain

http://di2-live.appspot.com/client/www/fonts/font-awesome.min.css
https://di2-live.appspot.com/client/www/fonts/font-awesome.min.css

30 KB
8 KB

745ms
725ms

Stylesheet
text/css

2a00:1450:4001:825::2014
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://di2-live.appspot.com/client/www/fonts/font-awesome.min.css
Requested by: Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:825::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 20 Aug 2019 20:05:21 GMT
content-encoding: gzip
server: Google Frontend
etag: "4elCLg"
content-type: text/css
status: 200
x-cloud-trace-context: ea55984e4954023957161173d32dbdbb
cache-control: public, max-age=600
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
expires: Tue, 20 Aug 2019 20:15:21 GMT

Redirect headers

Location: https://di2-live.appspot.com/client/www/fonts/font-awesome.min.css
X-Cloud-Trace-Context: e012cec8b59dee1c5d1c2260bcc49f03
Server: Google Frontend
Date: Tue, 20 Aug 2019 20:05:21 GMT
Content-Length: 0
Content-Type: text/html

GET
H2

200

theme-static.css
di2-live.appspot.com/client/www/
Redirect Chain

http://di2-live.appspot.com/client/www/theme-static.css
https://di2-live.appspot.com/client/www/theme-static.css

435 B
418 B

704ms
703ms

Stylesheet
text/css

2a00:1450:4001:825::2014
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://di2-live.appspot.com/client/www/theme-static.css
Requested by: Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:825::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 6bd20ad0d2edd7a284a0cdededb2cc0336bf7fc2e0a06c28e49b370721d25c1c

Request headers

Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 20 Aug 2019 20:05:22 GMT
content-encoding: gzip
server: Google Frontend
etag: "4elCLg"
content-type: text/css
status: 200
x-cloud-trace-context: 3af4ce586d5699623bdbf29d32ee501b
cache-control: public, max-age=600
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
expires: Tue, 20 Aug 2019 20:15:22 GMT

Redirect headers

Location: https://di2-live.appspot.com/client/www/theme-static.css
X-Cloud-Trace-Context: cdb808588c37e3700764792f50647d5c
Server: Google Frontend
Date: Tue, 20 Aug 2019 20:05:21 GMT
Content-Length: 0
Content-Type: text/html

GET
H2 200 react.js Show response
cdnjs.cloudflare.com/ajax/libs/react/15.4.2/ 125 KB
28 KB 31ms
17ms Script
application/javascript 2606:4700::6813:c597
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/react/15.4.2/react.js

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

887271ada97774a796b8803efbaa9f681fc639b73fc7fe2028daae4ab495b360

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 20 Aug 2019 20:05:21 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 10965302
status: 200
served-in-seconds: 0.004
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:25:28 GMT
server: cloudflare
etag: W/"5afd4a88-1f2ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5096fb47abb9d709-FRA
expires: Sun, 09 Aug 2020 20:05:21 GMT

GET
H2 200 react-dom.js Show response
cdnjs.cloudflare.com/ajax/libs/react/15.4.2/ 606 KB
126 KB 35ms
21ms Script
application/javascript 2606:4700::6813:c597
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/react/15.4.2/react-dom.js

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e05bdc91756f087849131a429efd807380487711579c0f71cd63a0c3c29c2299

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 20 Aug 2019 20:05:21 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 10963691
status: 200
served-in-seconds: 0.004
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:25:28 GMT
server: cloudflare
etag: W/"5afd4a88-97788"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5096fb47abc0d709-FRA
expires: Sun, 09 Aug 2020 20:05:21 GMT

GET
H2 200 moment.min.js Show response
cdnjs.cloudflare.com/ajax/libs/moment.js/2.17.1/ 60 KB
21 KB 30ms
16ms Script
application/javascript 2606:4700::6813:c597
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.17.1/moment.min.js

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1a7ecc510a27a3c2d4c537d1034599cc9813b9ae7651d9b521fae4e78db5ce40

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 20 Aug 2019 20:05:21 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 10965453
status: 200
served-in-seconds: 0.002
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:23:06 GMT
server: cloudflare
etag: W/"5afd49fa-ef85"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5096fb47abc1d709-FRA
expires: Sun, 09 Aug 2020 20:05:21 GMT

GET
H2 200 lodash.min.js Show response
cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.4/ 70 KB
24 KB 36ms
23ms Script
application/javascript 2606:4700::6813:c597
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.4/lodash.min.js

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c597 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

f04e9051c160d4a4e7a4453c4c51a1a53187c397c9a81f6f0a6b373a10182eac

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 20 Aug 2019 20:05:21 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 8358267
status: 200
served-in-seconds: 0.001
timing-allow-origin: *
last-modified: Thu, 17 May 2018 09:21:07 GMT
server: cloudflare
etag: W/"5afd4983-116fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5096fb47abc3d709-FRA
expires: Sun, 09 Aug 2020 20:05:21 GMT

GET Bootstrap.js
nexus.ensighten.com/amex/amexhead/ 0
0

GET
H2 200 inav_travel.css
www.aexp-static.com/nav/ngn/css/ 77 KB
11 KB 16889ms
73ms Stylesheet
text/css 23.38.48.128
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.aexp-static.com/nav/ngn/css/inav_travel.css?v=0411_18

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.38.48.128 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-38-48-128.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

cb9a7c8627e4d24e495ab7ad314e2c8e714658876cf6b0a7fa84a5509c09a1da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
content-encoding: gzip
last-modified: Tue, 09 Oct 2018 19:01:33 GMT
server: IBM_HTTP_Server
status: 200
date: Tue, 20 Aug 2019 20:05:38 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
timing-allow-origin: *
content-length: 11506

GET
H2 200 nav-amex-logo-2x_new.png
www.aexp-static.com/nav/ngn/img/ 7 KB
7 KB 16905ms
89ms Image
image/png 23.38.48.128
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/nav-amex-logo-2x_new.png

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.38.48.128 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-38-48-128.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

3fbd43ede227a209945da7b3a1dad7383fc25f610d127ce39a0f578570ddd3c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Mon, 09 Apr 2018 02:47:17 GMT
server: IBM_HTTP_Server
date: Tue, 20 Aug 2019 20:05:38 GMT
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 7133

GET
H2 200 logo_bluebox-55x54.svg
www.aexp-static.com/nav/ngn/img/ 9 KB
3 KB 16923ms
107ms Image
image/svg+xml 23.38.48.128
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/logo_bluebox-55x54.svg

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.38.48.128 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-38-48-128.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

9bedfbcc3e602d182e232daca408a303b96620908e515e31743c2b431d416d74

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
content-encoding: gzip
last-modified: Tue, 10 Apr 2018 19:15:17 GMT
server: IBM_HTTP_Server
status: 200
date: Tue, 20 Aug 2019 20:05:38 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=29030400
accept-ranges: bytes
timing-allow-origin: *
content-length: 3267

GET
H2 200 clear.gif
www.aexp-static.com/nav/ngn/img/ 43 B
214 B 15524ms
118ms Image
image/gif 23.38.48.128
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/clear.gif

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.38.48.128 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-38-48-128.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:23:00 GMT
server: IBM_HTTP_Server
date: Tue, 20 Aug 2019 20:05:38 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 43

GET
H2 200 travel_logo.png
www.aexp-static.com/nav/ngn/img/ 2 KB
3 KB 15489ms
83ms Image
image/png 23.38.48.128
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.aexp-static.com/nav/ngn/img/travel_logo.png

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.38.48.128 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-38-48-128.deploy.static.akamaitechnologies.com

Software

IBM_HTTP_Server /

Resource Hash

f5d577b22ab952c0a8954d3e9b45ed9a8f1aa8ebbeb4873557f49bfac7a38848

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000;

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000;
last-modified: Thu, 02 Mar 2017 09:24:57 GMT
server: IBM_HTTP_Server
date: Tue, 20 Aug 2019 20:05:38 GMT
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=7776000
accept-ranges: bytes
timing-allow-origin: *
content-length: 2476

GET
H/1.1 200
OK subNav-min.css
qicm.americanexpress.com/Internet/travel/cttonline/en_US/subNav/styles/ 10 KB
3 KB 827ms
167ms Stylesheet
text/css 12.105.185.175
American Express ...

General

Check archive.org

Show headers Download Go to

Full URL

https://qicm.americanexpress.com/Internet/travel/cttonline/en_US/subNav/styles/subNav-min.css?qa

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

12.105.185.175 , United States, ASN6307 (AMERICAN-EXPRESS - American Express Company, US),

Reverse DNS

qicm.americanexpress.com

Software

Resource Hash

f505c9314cbdb2beb0491c73a412dde4e52dfabe1873c3217fe803cba671e699

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	'nosniff'
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 20 Aug 2019 20:05:21 GMT
Content-Encoding: gzip
X-Content-Type-Options: 'nosniff'
Last-Modified: Mon, 10 Jun 2019 17:43:10 GMT
ETag: "26f5-58afbb6b58161-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Access-Control-Allow-Origin: *
Connection: close
Strict-Transport-Security: max-age=16070400
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 2761
X-XSS-Protection: 1; mode=block

GET mrModal-min.css
qicm.americanexpress.com/Internet/travel/cttonline/en_US/subNav/styles/ 0
0

GET
H/1.1 200
OK jquery-1.11.2.min.js Show response
travel.americanexpress.com/ctnwt/assets/thirdparty/scripts/jquery/1.11/ 94 KB
42 KB 3753ms
130ms Script
application/x-javascript 148.173.96.163
American Express ...

General

Check archive.org

Show headers Download Go to

Full URL

https://travel.americanexpress.com/ctnwt/assets/thirdparty/scripts/jquery/1.11/jquery-1.11.2.min.js

Requested by

Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_CBC

Server

148.173.96.163 , United States, ASN6307 (AMERICAN-EXPRESS - American Express Company, US),

Reverse DNS

ipc2travel.americanexpress.com

Software

Resource Hash

2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 20 Aug 2019 20:05:26 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 05 Apr 2019 04:12:14 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Type: application/x-javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 42991
Keep-Alive: timeout=15, max=71

GET travel_logo.png
icm.aexp-static.com/Internet/travel/cttonline/en_US/subNav/images/ 0
0

GET dls-logo-line.svg
qicm.americanexpress.com/Internet/travel/cttonline/en_US/subNav/images/ 0
0

GET subNav-min.js
icm.aexp-static.com/Internet/travel/cttonline/en_US/subNav/scripts/ 0
0

GET
H2

200

main.16f39276d23b5da919e2.js Show response
di2-live.appspot.com/client/www/
Redirect Chain

http://di2-live.appspot.com/client/www/main.16f39276d23b5da919e2.js
https://di2-live.appspot.com/client/www/main.16f39276d23b5da919e2.js

1 MB
460 KB

768ms
768ms

Script
application/javascript

2a00:1450:4001:825::2014
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://di2-live.appspot.com/client/www/main.16f39276d23b5da919e2.js
Requested by: Host: di2-live.appspot.com
URL: http://di2-live.appspot.com/client/www/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:825::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: f8b3de218716371d694c54af20c2c9ced759a1824677225880ca759759eb9cd8

Request headers

Referer: http://di2-live.appspot.com/client/www/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 20 Aug 2019 20:05:23 GMT
content-encoding: gzip
server: Google Frontend
etag: "4elCLg"
content-type: application/javascript
status: 200
x-cloud-trace-context: 83c5043c0ea8c05711a753803beaf79f
cache-control: public, max-age=600
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
expires: Tue, 20 Aug 2019 20:15:23 GMT

Redirect headers

Location: https://di2-live.appspot.com/client/www/main.16f39276d23b5da919e2.js
X-Cloud-Trace-Context: cdb808588c37e3700764792f50647d5c
Server: Google Frontend
Date: Tue, 20 Aug 2019 20:05:22 GMT
Content-Length: 0
Content-Type: text/html

GET detail
digital2.myamextravel.com/api/user/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: nexus.ensighten.com
URL: https://nexus.ensighten.com/amex/amexhead/Bootstrap.js

Domain: qicm.americanexpress.com
URL: https://qicm.americanexpress.com/Internet/travel/cttonline/en_US/subNav/styles/mrModal-min.css?qa

Domain: icm.aexp-static.com
URL: https://icm.aexp-static.com/Internet/travel/cttonline/en_US/subNav/images/travel_logo.png

Domain: qicm.americanexpress.com
URL: https://qicm.americanexpress.com/Internet/travel/cttonline/en_US/subNav/images/dls-logo-line.svg

Domain: icm.aexp-static.com
URL: https://icm.aexp-static.com/Internet/travel/cttonline/en_US/subNav/scripts/subNav-min.js?version=6.0

Domain: digital2.myamextravel.com
URL: https://digital2.myamextravel.com/api/user/detail

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: American Express (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://cdnjs.cloudflare.com/ajax/libs/react/15.4.2/react-dom.js(Line 5429) Message: Download the React DevTools for a better development experience: https://fb.me/react-devtools

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
di2-live.appspot.com
digital2.myamextravel.com
icm.aexp-static.com
nexus.ensighten.com
qicm.americanexpress.com
travel.americanexpress.com
www.aexp-static.com
digital2.myamextravel.com
icm.aexp-static.com
nexus.ensighten.com
qicm.americanexpress.com
12.105.185.175
148.173.96.163
23.38.48.128
2606:4700::6813:c597
2a00:1450:4001:825::2014
1a7ecc510a27a3c2d4c537d1034599cc9813b9ae7651d9b521fae4e78db5ce40
2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0
3fbd43ede227a209945da7b3a1dad7383fc25f610d127ce39a0f578570ddd3c6
643e1482d40c2528ea2b39403ea1a99bee06374a8273c7ea5ab332314cfc9deb
6bd20ad0d2edd7a284a0cdededb2cc0336bf7fc2e0a06c28e49b370721d25c1c
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
887271ada97774a796b8803efbaa9f681fc639b73fc7fe2028daae4ab495b360
9bedfbcc3e602d182e232daca408a303b96620908e515e31743c2b431d416d74
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
cb9a7c8627e4d24e495ab7ad314e2c8e714658876cf6b0a7fa84a5509c09a1da
e05bdc91756f087849131a429efd807380487711579c0f71cd63a0c3c29c2299
f04e9051c160d4a4e7a4453c4c51a1a53187c397c9a81f6f0a6b373a10182eac
f505c9314cbdb2beb0491c73a412dde4e52dfabe1873c3217fe803cba671e699
f5d577b22ab952c0a8954d3e9b45ed9a8f1aa8ebbeb4873557f49bfac7a38848
f8b3de218716371d694c54af20c2c9ced759a1824677225880ca759759eb9cd8

di2-live.appspot.com Open in urlscan Pro 2a00:1450:4001:825::2014 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

21 Requests

67 %HTTPS

40 %IPv6

6 Domains

8 Subdomains

6 IPs

3 Countries

752 kBTransfer

2440 kBSize

0 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

di2-live.appspot.com Open in urlscan Pro
2a00:1450:4001:825::2014 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

67 %
HTTPS

40 %
IPv6

6
Domains

8
Subdomains

6
IPs

3
Countries

752 kB
Transfer

2440 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!