travelsetu.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 148.72.211.94, located in Singapore, Singapore and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is travelsetu.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on October 4th 2022. Valid for: a year.

This is the only time travelsetu.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address		AS Autonomous System
2 8	148.72.211.94 148.72.211.94		26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
6	1

8 148.72.211.94 (Singapore, Singapore) 2 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 94.211.72.148.host.secureserver.net

travelsetu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	travelsetu.com 2 redirects travelsetu.com	391 KB
6	1

	Domain	Requested by
8	travelsetu.com	2 redirects travelsetu.com
6	1

This site contains links to these domains. Also see Links.

Domain
linkedin.com

Subject Issuer	Validity	Valid
travelsetu.com Go Daddy Secure Certificate Authority - G2	`2022-10-04` - `2023-10-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/
Frame ID: 5107A6DC685AE0ACB9B3F8DC26309F76
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In to LinkedIn

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

390 kB
Transfer

389 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://linkedin.com/help/linkedin/answer/34593?lang=en&trk=d_checkpoint_lg_consumerLogin_ft_community_guidelines
Title: Community Guidelines

Search URL Search Domain Scan URL

URL: https://linkedin.com/help/linkedin?trk=d_checkpoint_lg_consumerLogin_ft_send_feedback&lang=en
Title: Send Feedback

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://travelsetu.com/li/track HTTP 302
https://travelsetu.com/404.html

Request Chain 4

https://travelsetu.com/li/track HTTP 302
https://travelsetu.com/404.html

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/	21 KB 22 KB	840ms 275ms	Document text/html	148.72.211.94 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 148.72.211.94 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS 94.211.72.148.host.secureserver.net Software Apache / Resource Hash `4d723b10b0bb2b3a0fc46edeb5689c8c58f0249a29a9a035fc143705abad1738` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language da-DK,da;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 21900 Content-Type text/html Date Thu, 03 Nov 2022 13:45:51 GMT Keep-Alive timeout=5, max=100 Last-Modified Mon, 03 Jan 2022 00:10:32 GMT Server Apache
GET H/1.1	200 OK	cs.css travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/index_files/	172 KB 172 KB	284ms 283ms	Stylesheet text/css	148.72.211.94 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/index_files/cs.css Requested by Host: travelsetu.com URL: https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 148.72.211.94 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS 94.211.72.148.host.secureserver.net Software Apache / Resource Hash `531a543627cea62526d080bd07e24a512c47b96a37b016cf1f26294a7204e636` Request headers accept-language da-DK,da;q=0.9 Referer https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Thu, 03 Nov 2022 13:45:51 GMT Last-Modified Tue, 14 Jul 2020 04:00:02 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 176161
GET H/1.1	200 OK	37u7kr5kganeq2p3ellcmfd15 Show response travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/index_files/	69 KB 69 KB	538ms 275ms	Script text/plain	148.72.211.94 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/index_files/37u7kr5kganeq2p3ellcmfd15 Requested by Host: travelsetu.com URL: https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 148.72.211.94 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS 94.211.72.148.host.secureserver.net Software Apache / Resource Hash `ab44a935b273bd76aed10b90b4d9e55f1cf1277c71c21c946ad9047587edc547` Request headers accept-language da-DK,da;q=0.9 Referer https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Thu, 03 Nov 2022 13:45:52 GMT Last-Modified Tue, 14 Jul 2020 04:00:02 GMT Server Apache Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 70777
GET H/1.1	200 OK	amr2fg65yx3tpak6s74f9lemr Show response travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/index_files/	55 KB 55 KB	834ms 278ms	Script text/plain	148.72.211.94 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/index_files/amr2fg65yx3tpak6s74f9lemr Requested by Host: travelsetu.com URL: https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 148.72.211.94 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS 94.211.72.148.host.secureserver.net Software Apache / Resource Hash `c22f54b3631979deb8563f1a9108f9d8eb981ee76474c9e4217cbe06004522cf` Request headers accept-language da-DK,da;q=0.9 Referer https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Thu, 03 Nov 2022 13:45:52 GMT Last-Modified Tue, 14 Jul 2020 04:00:02 GMT Server Apache Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 56213
GET H/1.1	200 OK	404.html Show response travelsetu.com/ Redirect Chain https://travelsetu.com/li/track https://travelsetu.com/404.html	36 KB 36 KB	285ms 283ms	XHR text/html	148.72.211.94 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://travelsetu.com/404.html Protocol HTTP/1.1 Server 148.72.211.94 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS 94.211.72.148.host.secureserver.net Software Apache / Resource Hash `5c8cc60f603f256ae3862a7216f4725d8a4834daf939afbb6a6f126a239e9f15` Request headers accept-language da-DK,da;q=0.9 Referer https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Thu, 03 Nov 2022 13:45:53 GMT Last-Modified Wed, 16 Sep 2020 12:02:41 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 36526 Redirect headers location https://travelsetu.com/404.html Date Thu, 03 Nov 2022 13:45:53 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	404.html Show response travelsetu.com/ Redirect Chain https://travelsetu.com/li/track https://travelsetu.com/404.html	36 KB 36 KB	283ms 283ms	XHR text/html	148.72.211.94 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://travelsetu.com/404.html Protocol HTTP/1.1 Server 148.72.211.94 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS 94.211.72.148.host.secureserver.net Software Apache / Resource Hash `5c8cc60f603f256ae3862a7216f4725d8a4834daf939afbb6a6f126a239e9f15` Request headers accept-language da-DK,da;q=0.9 Referer https://travelsetu.com/crm/images/user_image/user3/linkedin/linknewin/LINKEDIN/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Thu, 03 Nov 2022 13:45:53 GMT Last-Modified Wed, 16 Sep 2020 12:02:41 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 36526 Redirect headers location https://travelsetu.com/404.html Date Thu, 03 Nov 2022 13:45:53 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

travelsetu.com
148.72.211.94
4d723b10b0bb2b3a0fc46edeb5689c8c58f0249a29a9a035fc143705abad1738
531a543627cea62526d080bd07e24a512c47b96a37b016cf1f26294a7204e636
5c8cc60f603f256ae3862a7216f4725d8a4834daf939afbb6a6f126a239e9f15
ab44a935b273bd76aed10b90b4d9e55f1cf1277c71c21c946ad9047587edc547
c22f54b3631979deb8563f1a9108f9d8eb981ee76474c9e4217cbe06004522cf

travelsetu.com Open in urlscan Pro 148.72.211.94 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

67 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

390 kBTransfer

389 kBSize

0 Cookies

2 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

Indicators

travelsetu.com Open in urlscan Pro
148.72.211.94 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

390 kB
Transfer

389 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!