flynautuae.com Open in urlscan Pro
209.97.151.202 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://flynautuae.com/cgi-bum/
Submission: On May 19 via automatic, source links-suspicious (May 19th 2023, 2:22:56 am UTC) — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 209.97.151.202, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is flynautuae.com.
TLS certificate: Issued by R3 on April 2nd 2023. Valid for: 3 months.

This is the only time flynautuae.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco de la Provincia de Buenos Aires (Banking)

Domain & IP information

	IP Address	AS Autonomous System
7	209.97.151.202 209.97.151.202	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (STACKPATH...) (STACKPATH-CDN)
8	2

7 209.97.151.202 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: host.flynautstudio.com

flynautuae.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	flynautuae.com flynautuae.com	350 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 696	29 KB
8	2

	Domain	Requested by
7	flynautuae.com	flynautuae.com
1	code.jquery.com	flynautuae.com
8	2

This site contains no links.

Subject Issuer	Validity	Valid
*.flynautuae.com R3	`2023-04-02` - `2023-07-01`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://flynautuae.com/cgi-bum/
Frame ID: 77524151677F5B8C2EDF83B679BF0049
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

379 kB
Transfer

432 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response flynautuae.com/cgi-bum/	5 KB 6 KB	604ms 94ms	Document text/html	209.97.151.202 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://flynautuae.com/cgi-bum/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.97.151.202 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS host.flynautstudio.com Software Apache / Resource Hash `4d9a466c59576a9c2e97da21f3308e2962898b603d342a6a9f676e568b3a9c66` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 5513 Content-Type text/html Date Fri, 19 May 2023 02:22:50 GMT Keep-Alive timeout=5, max=100 Last-Modified Thu, 18 May 2023 15:46:54 GMT Server Apache
GET H2	200	jquery-2.2.3.min.js Show response code.jquery.com/	84 KB 29 KB	52ms 11ms	Script application/javascript	2001:4de0:ac18::1:a:2a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-2.2.3.min.js Requested by Host: flynautuae.com URL: https://flynautuae.com/cgi-bum/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash `6b6de0d4db7876d1183a3edb47ebd3bbbf93f153f5de1ba6645049348628109a` Request headers Referer https://flynautuae.com/ Origin https://flynautuae.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Fri, 19 May 2023 02:22:51 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-14e9b" vary Accept-Encoding x-hw 1684462971.dop236.fr8.t,1684462971.cds161.fr8.hn,1684462971.cds275.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 29881
GET H/1.1	200 OK	l.jpg flynautuae.com/cgi-bum/	6 KB 6 KB	232ms 232ms	Image image/jpeg	209.97.151.202 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://flynautuae.com/cgi-bum/l.jpg Requested by Host: flynautuae.com URL: https://flynautuae.com/cgi-bum/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.97.151.202 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS host.flynautstudio.com Software Apache / Resource Hash `810068a933b0983e4253afc6093010ddbb90e0cc6b6c9449b83599f16d074f26` Request headers accept-language de-DE,de;q=0.9 Referer https://flynautuae.com/cgi-bum/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Fri, 19 May 2023 02:22:51 GMT Last-Modified Sun, 26 Mar 2023 16:27:04 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 6276
GET H/1.1	404 Not Found	ttl.svg flynautuae.com/cgi-bum/	315 B 315 B	266ms 93ms	Image text/html	209.97.151.202 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://flynautuae.com/cgi-bum/ttl.svg Requested by Host: flynautuae.com URL: https://flynautuae.com/cgi-bum/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.97.151.202 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS host.flynautstudio.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers accept-language de-DE,de;q=0.9 Referer https://flynautuae.com/cgi-bum/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Fri, 19 May 2023 02:22:51 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	h.png flynautuae.com/cgi-bum/	90 KB 90 KB	319ms 90ms	Image image/png	209.97.151.202 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://flynautuae.com/cgi-bum/h.png Requested by Host: flynautuae.com URL: https://flynautuae.com/cgi-bum/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.97.151.202 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS host.flynautstudio.com Software Apache / Resource Hash `4d0fb94aaedb6482baac8b4a6b2004381c4cecb03ad373ad0cad341dd84a04cd` Request headers accept-language de-DE,de;q=0.9 Referer https://flynautuae.com/cgi-bum/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Fri, 19 May 2023 02:22:51 GMT Last-Modified Sun, 26 Mar 2023 16:27:18 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 91916
GET H/1.1	404 Not Found	tp1.svg flynautuae.com/cgi-bum/	315 B 315 B	328ms 93ms	Image text/html	209.97.151.202 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://flynautuae.com/cgi-bum/tp1.svg Requested by Host: flynautuae.com URL: https://flynautuae.com/cgi-bum/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.97.151.202 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS host.flynautstudio.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers accept-language de-DE,de;q=0.9 Referer https://flynautuae.com/cgi-bum/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Fri, 19 May 2023 02:22:51 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	b.jpg flynautuae.com/cgi-bum/	206 KB 206 KB	396ms 90ms	Image image/jpeg	209.97.151.202 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://flynautuae.com/cgi-bum/b.jpg Requested by Host: flynautuae.com URL: https://flynautuae.com/cgi-bum/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.97.151.202 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS host.flynautstudio.com Software Apache / Resource Hash `189e4d24e01e7572498302b0fe8e6c3bdd0a824584e0330cb3cc0027f5a097d2` Request headers accept-language de-DE,de;q=0.9 Referer https://flynautuae.com/cgi-bum/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Fri, 19 May 2023 02:22:51 GMT Last-Modified Sun, 26 Mar 2023 16:27:58 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 210689
GET H/1.1	200 OK	1.svg flynautuae.com/cgi-bum/	41 KB 41 KB	404ms 93ms	Image image/svg+xml	209.97.151.202 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://flynautuae.com/cgi-bum/1.svg Requested by Host: flynautuae.com URL: https://flynautuae.com/cgi-bum/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 209.97.151.202 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS host.flynautstudio.com Software Apache / Resource Hash `7c689249e64fb3beda6c099e3d9bb7a56f8d62b0e832c410522a892f0b9883e5` Request headers accept-language de-DE,de;q=0.9 Referer https://flynautuae.com/cgi-bum/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers Date Fri, 19 May 2023 02:22:51 GMT Last-Modified Sun, 26 Mar 2023 18:05:06 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 41657

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco de la Provincia de Buenos Aires (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery function| xbndtl

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://flynautuae.com/cgi-bum/ttl.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://flynautuae.com/cgi-bum/tp1.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
flynautuae.com
2001:4de0:ac18::1:a:2a
209.97.151.202
189e4d24e01e7572498302b0fe8e6c3bdd0a824584e0330cb3cc0027f5a097d2
4d0fb94aaedb6482baac8b4a6b2004381c4cecb03ad373ad0cad341dd84a04cd
4d9a466c59576a9c2e97da21f3308e2962898b603d342a6a9f676e568b3a9c66
6b6de0d4db7876d1183a3edb47ebd3bbbf93f153f5de1ba6645049348628109a
7c689249e64fb3beda6c099e3d9bb7a56f8d62b0e832c410522a892f0b9883e5
810068a933b0983e4253afc6093010ddbb90e0cc6b6c9449b83599f16d074f26
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

flynautuae.com Open in urlscan Pro 209.97.151.202 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

379 kBTransfer

432 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

flynautuae.com Open in urlscan Pro
209.97.151.202 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

379 kB
Transfer

432 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!