air.bnb-extranett.com

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3031::6815:878, located in United States and belongs to CLOUDFLARENET, US. The main domain is air.bnb-extranett.com.
TLS certificate: Issued by E1 on February 22nd 2024. Valid for: 3 months.

This is the only time air.bnb-extranett.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Airbnb (Hospitality)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3033::ac43:8b6e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:303... 2606:4700:3031::6815:878	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

1 2606:4700:3033::ac43:8b6e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

air.bnb-extranett.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3031::6815:878 (United States)

ASN13335 (CLOUDFLARENET, US)

air.bnb-extranett.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.bnb-extranett.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	bnb-extranett.com 1 redirects air.bnb-extranett.com api.bnb-extranett.com	1007 KB
4	1

	Domain	Requested by
4	air.bnb-extranett.com	1 redirects air.bnb-extranett.com
1	api.bnb-extranett.com	air.bnb-extranett.com
4	2

This site contains links to these domains. Also see Links.

Domain
www.airbnb.com
investors.airbnb.com
www.airbnb.org
www.facebook.com
twitter.com
instagram.com

Subject Issuer	Validity	Valid
bnb-extranett.com E1	`2024-02-22` - `2024-05-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://air.bnb-extranett.com/
Frame ID: 236CF06285B87BC3CBDC5EF3B17C5D19
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log In / Sign Up - Airbnb

Page URL History Show full URLs

http://air.bnb-extranett.com/ HTTP 301
https://air.bnb-extranett.com/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

1077 kB
Transfer

2789 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.airbnb.com/host/homes
Title: Airbnb your home

Search URL Search Domain Scan URL

URL: https://www.airbnb.com/terms/privacy_policy?source=signup
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.airbnb.com/host/homes?from_footer=1
Title: Airbnb your home

Search URL Search Domain Scan URL

URL: https://investors.airbnb.com/
Title: Investors

Search URL Search Domain Scan URL

URL: https://www.airbnb.org/?locale=en
Title: Airbnb.org emergency stays

Search URL Search Domain Scan URL

URL: https://www.facebook.com/airbnb

Search URL Search Domain Scan URL

URL: https://twitter.com/airbnb

Search URL Search Domain Scan URL

URL: https://instagram.com/airbnb

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://air.bnb-extranett.com/ HTTP 301
https://air.bnb-extranett.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response air.bnb-extranett.com/ Redirect Chain http://air.bnb-extranett.com/ https://air.bnb-extranett.com/	509 B 745 B	504ms 305ms	Document text/html	2606:4700:3031::6815:878 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://air.bnb-extranett.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:878 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `db4bf25d267558332e0ec4327e06bab616acf36aa322126bb6e032610601fa9b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 85ac25861da88ce9-EWR content-encoding br content-type text/html date Sun, 25 Feb 2024 01:24:04 GMT last-modified Sat, 24 Feb 2024 21:22:38 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UBkUbBfesLiOPpba3agst9TXg9V6qVsz8bhywK5DI%2Frrei0eh9C%2Bp8niU93M7h1J6Fd7iptDUEJRWmW2MP0CAHYAdncirxAniN3cSyAulnIbvWNJsXD4MN451CSUHG1OpJqQlmJA8dR4STiHidQbYqi51nA%3D"}],"group":"cf-nel","max_age":604800} server cloudflare Redirect headers CF-RAY 85ac25846e3c6f5a-CDG Cache-Control max-age=3600 Connection keep-alive Date Sun, 25 Feb 2024 01:24:03 GMT Expires Sun, 25 Feb 2024 02:24:03 GMT Location https://air.bnb-extranett.com/ NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vn%2FGaXuXyMA1I8RAzT08u2XMcHcce09VFE6Xx5137%2BbrxesP%2FsWTan0Nd9gXPpsNeL1K3iEbclz4u6W2WsuG97W%2BReYVK1S1mp14Xi%2Bg4uZVH1ac4ojKyZOjadGO96oy2l07IX%2B03fS8z6gxTBgp5o0yDSU%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400
GET H2	200	style.css air.bnb-extranett.com/	2 MB 893 KB	110ms 109ms	Stylesheet text/css	2606:4700:3031::6815:878 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://air.bnb-extranett.com/style.css Requested by Host: air.bnb-extranett.com URL: https://air.bnb-extranett.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:878 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9a824319b735485232494e36e4d2fca1ca96901dc46034bb8f89840a60aa9777` Request headers accept-language de-DE,de;q=0.9 Referer https://air.bnb-extranett.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sun, 25 Feb 2024 01:24:04 GMT content-encoding br cf-cache-status HIT last-modified Thu, 22 Feb 2024 19:01:43 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 222 etag W/"65d79a17-216ce5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NZEw8%2F5iMKwRh4Bh9AsMPBNvUTatbh%2FgT7M6syEh039%2FAwrBztB218gO85je4SpbvNfu9z92l%2Fw3T%2BIbbEpjQJAr7bCJ%2BEkY%2Fgc3KrBdo9k1f2KHmxxZI7Gev6Ceu57D5Dvc3B8XP6U8wRa8WUf%2Fcm%2BBBGU%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 85ac25880fd58ce9-EWR alt-svc h3=":443"; ma=86400
GET H2	200	main.5b0315a6.js Show response air.bnb-extranett.com/static/js/	578 KB 112 KB	119ms 118ms	Script application/javascript	2606:4700:3031::6815:878 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://air.bnb-extranett.com/static/js/main.5b0315a6.js Requested by Host: air.bnb-extranett.com URL: https://air.bnb-extranett.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:878 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `170c265cbfa7f1782152d19a94eca001de6842490de4db231a9a52b7b633624b` Request headers accept-language de-DE,de;q=0.9 Referer https://air.bnb-extranett.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sun, 25 Feb 2024 01:24:04 GMT content-encoding br cf-cache-status HIT last-modified Sat, 24 Feb 2024 21:22:38 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 222 etag W/"65da5e1e-909e2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=09suG%2F0ISWe6wY5367qxVVKwJVB4rayNy4K960%2BI5awauJV4A7%2B1FX1%2FhDZ%2BCYfo%2FnGqjBOmblmP0g9twdrTTu%2Fqlk78DFc50yRqi0UM7EMzWzoLVi9BF9lB%2Fawb5omlg5petQr6L6r1yO2uDfvAdFzjT54%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 85ac25880fd88ce9-EWR alt-svc h3=":443"; ma=86400
GET DATA	200 OK	truncated /	24 KB 24 KB		Font binary/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b06428a4009f63f0edb5c8cf89ffb84ea978a2b559cc4c14c8e7a0e130ceefc4` Request headers Referer Origin https://air.bnb-extranett.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type binary/octet-stream
GET DATA	200 OK	truncated /	23 KB 23 KB		Font binary/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b848d7113c5d21f463bd7b248115b78ae386d1628459bfcdb154f82f083bfc97` Request headers Referer Origin https://air.bnb-extranett.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type binary/octet-stream
GET DATA	200 OK	truncated /	24 KB 24 KB		Font binary/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b11f01105c8b416bc49025877708638fc1955dc31d2a3fa7904d4e0b0f4ac4b4` Request headers Referer Origin https://air.bnb-extranett.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type binary/octet-stream
GET H2	200	info Show response api.bnb-extranett.com/ws/	79 B 542 B	353ms 309ms	XHR application/json	2606:4700:3031::6815:878 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.bnb-extranett.com/ws/info?t=1708824245096 Requested by Host: air.bnb-extranett.com URL: https://air.bnb-extranett.com/static/js/main.5b0315a6.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:878 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `892e4b64cc2fbfad1e6e29b2c5462a3a419dcd6a49fdb9dcb1b022fe1d2a5fb3` Request headers accept-language de-DE,de;q=0.9 Referer https://air.bnb-extranett.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sun, 25 Feb 2024 01:24:05 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tzm0HpbtPY2IIffLUUefSa4w8IZmasH7CIeMFqOD%2Fgdjtr3JbHGJTNM69vax9Ts2C8OXaYb2qOkEmur%2F6%2BnmrNiRxSELBttusCpSbDjjWBWF18HKuoqUKj2MMfokOdNUsDcxXpfItYvCyGe1kCIKGGs2dMA%3D"}],"group":"cf-nel","max_age":604800} content-type application/json;charset=UTF-8 access-control-allow-origin https://air.bnb-extranett.com cache-control no-store, no-cache, must-revalidate, max-age=0 access-control-allow-credentials true cf-ray 85ac258c6cd98ce9-EWR alt-svc h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Airbnb (Hospitality)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| __reactRouterVersion

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

air.bnb-extranett.com
api.bnb-extranett.com
2606:4700:3031::6815:878
2606:4700:3033::ac43:8b6e
170c265cbfa7f1782152d19a94eca001de6842490de4db231a9a52b7b633624b
892e4b64cc2fbfad1e6e29b2c5462a3a419dcd6a49fdb9dcb1b022fe1d2a5fb3
9a824319b735485232494e36e4d2fca1ca96901dc46034bb8f89840a60aa9777
b06428a4009f63f0edb5c8cf89ffb84ea978a2b559cc4c14c8e7a0e130ceefc4
b11f01105c8b416bc49025877708638fc1955dc31d2a3fa7904d4e0b0f4ac4b4
b848d7113c5d21f463bd7b248115b78ae386d1628459bfcdb154f82f083bfc97
db4bf25d267558332e0ec4327e06bab616acf36aa322126bb6e032610601fa9b

air.bnb-extranett.com Open in urlscan Pro 2606:4700:3031::6815:878 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

100 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

1077 kBTransfer

2789 kBSize

0 Cookies

8 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

air.bnb-extranett.com Open in urlscan Pro
2606:4700:3031::6815:878 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

1077 kB
Transfer

2789 kB
Size

0
Cookies

4 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!