urlscan.io logo urlscan.io
SecurityTrails logo

crimsonwavetl.com Open in urlscan Pro
2606:4700:3031::6815:2ba1  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://crimsonwavetl.com/
Effective URL: https://crimsonwavetl.com/
Submission: On March 06 via manual from NL — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3031::6815:2ba1, located in United States and belongs to CLOUDFLARENET, US. The main domain is crimsonwavetl.com.
TLS certificate: Issued by GTS CA 1P5 on March 5th 2024. Valid for: 3 months.
This is the only time crimsonwavetl.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Airbnb (Hospitality)

Domain & IP information

IP Address AS Autonomous System
1 4 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
4 3
Apex Domain
Subdomains		 Transfer
4 crimsonwavetl.com
crimsonwavetl.com
1007 KB
1 maxtlsconnectivity.com
api.maxtlsconnectivity.com
664 B
4 2
Domain Requested by
4 crimsonwavetl.com 1 redirects crimsonwavetl.com
1 api.maxtlsconnectivity.com crimsonwavetl.com
4 2

This site contains links to these domains. Also see Links.

Domain
www.airbnb.com
investors.airbnb.com
www.airbnb.org
www.facebook.com
twitter.com
instagram.com
Subject Issuer Validity Valid
crimsonwavetl.com
GTS CA 1P5		 2024-03-05 -
2024-06-03		 3 months crt.sh
maxtlsconnectivity.com
GTS CA 1P5		 2024-03-04 -
2024-06-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://crimsonwavetl.com/
Frame ID: 708A7D06889D11AA792C25EFE4E24E0B
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Log In / Sign Up - Airbnb

Page URL History Show full URLs

  1. http://crimsonwavetl.com/ HTTP 301
    https://crimsonwavetl.com/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1078 kB
Transfer

2789 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://crimsonwavetl.com/ HTTP 301
    https://crimsonwavetl.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
crimsonwavetl.com/
Redirect Chain
  • http://crimsonwavetl.com/
  • https://crimsonwavetl.com/
509 B
748 B 		Document
General
Check archive.org
Download Go to
Full URL
https://crimsonwavetl.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2ba1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c75121bd2e512622fa17496474cce783efec83e803a19c23c3062f83d6cd93ca

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86006cbc7ad4656f-AMS
content-encoding
br
content-type
text/html
date
Wed, 06 Mar 2024 06:52:44 GMT
last-modified
Mon, 04 Mar 2024 15:12:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=73HRAHtC7b08KxkpE3owcxW5grC40emd9qKlR007lLKb737ZMqr4kXxU0ePGZRgzBhTeMd7dzEPfgRws0qK3OkGbSIgjmxDW0UY2B%2FThDDUFOuq7UR%2BJvkrNetOc1mJ3x%2BNq6TzySXM7M2NfDhXttg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

CF-RAY
86006cbc0a41b954-AMS
Cache-Control
max-age=3600
Connection
keep-alive
Date
Wed, 06 Mar 2024 06:52:44 GMT
Expires
Wed, 06 Mar 2024 07:52:44 GMT
Location
https://crimsonwavetl.com/
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aRrnjRxsLoydU8SO5HaaZ5Qnw%2BGa%2BCuRAuREwsIukccUQA6ea5Ke1It6EllKmynjPXB2blLBvRKS5UfiyA1rAFoHfvvxHB%2FE3h6YojRBK60ms5cQpL706oXqKpHUvqdMtG1RxYR7pTAC%2BcINSGd4SA%3D%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400
style.css
crimsonwavetl.com/ 		2 MB
893 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://crimsonwavetl.com/style.css
Requested by
Host: crimsonwavetl.com
URL: https://crimsonwavetl.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2ba1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9a824319b735485232494e36e4d2fca1ca96901dc46034bb8f89840a60aa9777

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://crimsonwavetl.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 06:52:45 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 22 Feb 2024 19:01:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65d79a16-216ce5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2BqDyh1P7JIIIgmTJvljrVGOm%2FA2BRVWXX%2B55qBGI%2FxReki8Acj4W2RiZx8GeX80sL2EJIVbADE%2B3kZERWptjZTXu%2FKobw%2B66UefUJQKO68K4Ja4YcvB0LD%2F9OHla94J3TuEqRI54ODKKk7MLBq%2Fpw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
86006cbccb48656f-AMS
alt-svc
h3=":443"; ma=86400
main.749b08cc.js
crimsonwavetl.com/static/js/ 		579 KB
112 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://crimsonwavetl.com/static/js/main.749b08cc.js
Requested by
Host: crimsonwavetl.com
URL: https://crimsonwavetl.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2ba1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6996a719969b56e3ede9d26baf9e34af95fbe5d123f69cb8a028276f1622268f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://crimsonwavetl.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 06:52:45 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 04 Mar 2024 15:12:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"65e5e4e2-90c8e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AwI03ymB7Z3p1JUC1EqTFhNZ8vAQ3aLgesUPvoViRbGSjPeqBEl0UDm6KEyldepnk8DMK9F26oYhSZ1%2F7Mk7bBTrwr8pTwm5YQ7rt1Jo%2FevQaEcCDEXUiNHGL3XjmDYhXjXjwNsjYrs9tkqGIuJieA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
86006cbcdb4b656f-AMS
alt-svc
h3=":443"; ma=86400
truncated
/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b06428a4009f63f0edb5c8cf89ffb84ea978a2b559cc4c14c8e7a0e130ceefc4

Request headers

Referer
Origin
https://crimsonwavetl.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type
binary/octet-stream
truncated
/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b848d7113c5d21f463bd7b248115b78ae386d1628459bfcdb154f82f083bfc97

Request headers

Referer
Origin
https://crimsonwavetl.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type
binary/octet-stream
truncated
/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b11f01105c8b416bc49025877708638fc1955dc31d2a3fa7904d4e0b0f4ac4b4

Request headers

Referer
Origin
https://crimsonwavetl.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type
binary/octet-stream
info
api.maxtlsconnectivity.com/ws/ 		78 B
664 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.maxtlsconnectivity.com/ws/info?t=1709707965261
Requested by
Host: crimsonwavetl.com
URL: https://crimsonwavetl.com/static/js/main.749b08cc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:8ffa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
135af061f61ee283fb162a8eedcd086f63663f28aea65721e8e74b2b8fd6964c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://crimsonwavetl.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Wed, 06 Mar 2024 06:52:45 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UW2nA13kfHQwi4tPzoChhwiy9n1w0yUw4f%2FHoVb4kAK5N9XZd35TPA4riMw7e6LkCk5AVKcrihCoq6eLoGD8yvO6Z2mgyT2gOCyoencVRt8p9AabjJ41mvqzFAMm9vSISETyFhZ5Vn7AAvqs9bztXsVXMDBQgRVfBA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://crimsonwavetl.com
cache-control
no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
cf-ray
86006cc07e106607-AMS
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Airbnb (Hospitality)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| __reactRouterVersion

0 Cookies