employee.skybirdtravel.com Open in urlscan Pro
217.24.59.77 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://employee.skybirdtravel.com/
Effective URL:
https://employee.skybirdtravel.com/sbtt/public/login2.html
Submission: On August 16 via automatic, source certstream-suspicious (August 16th 2022, 9:41:38 pm UTC) — Scanned from DE

Summary HTTP 10 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 217.24.59.77, located in Rodental, Germany and belongs to SUEC-DACOR-AS, DE. The main domain is employee.skybirdtravel.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 6th 2021. Valid for: a year.

This is the only time employee.skybirdtravel.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 5	217.24.59.77 217.24.59.77		28876 (SUEC-DACO...) (SUEC-DACOR-AS)
10	2

5 217.24.59.77 (Rodental, Germany) 1 redirects

ASN28876 (SUEC-DACOR-AS, DE)
PTR: 217.24.59.77.suec-dacor-codab.de

employee.skybirdtravel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	skybirdtravel.com 1 redirects employee.skybirdtravel.com	115 KB
10	1

	Domain	Requested by
5	employee.skybirdtravel.com	1 redirects employee.skybirdtravel.com
10	1

This site contains links to these domains. Also see Links.

Domain
www.skybirdtravel.com
www.skybirdtravel.ca

Subject Issuer	Validity	Valid
*.skybirdtravel.com Go Daddy Secure Certificate Authority - G2	`2021-09-06` - `2022-10-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://employee.skybirdtravel.com/sbtt/public/login2.html
Frame ID: FB9BC721B4F5798BBBA3A8C22F2A1177
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Employee | Sky Bird Travel and Tours - USA

Page URL History Show full URLs

https://employee.skybirdtravel.com/ HTTP 302
https://employee.skybirdtravel.com/sbtt/public/login2.html Page URL

Page Statistics

10
Requests

40 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

115 kB
Transfer

113 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://www.skybirdtravel.com/sbtt/public/home.html
Title: usa

Search URL Search Domain Scan URL

URL: http://www.skybirdtravel.ca/sbtt/public/home.html
Title: canada

Search URL Search Domain Scan URL

URL: http://www.skybirdtravel.com/sbtt/public/tac.html
Title: Terms and Conditions

Search URL Search Domain Scan URL

URL: http://www.skybirdtravel.com/sbtt/public/privacy.html
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://employee.skybirdtravel.com/ HTTP 302
https://employee.skybirdtravel.com/sbtt/public/login2.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login2.html Show response employee.skybirdtravel.com/sbtt/public/ Redirect Chain https://employee.skybirdtravel.com/ https://employee.skybirdtravel.com/sbtt/public/login2.html	10 KB 10 KB	35ms 35ms	Document text/html	217.24.59.77 SUEC-DACOR-AS
General Check archive.org Show headers Download Go to Full URL https://employee.skybirdtravel.com/sbtt/public/login2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.24.59.77 Rodental, Germany, ASN28876 (SUEC-DACOR-AS, DE), Reverse DNS 217.24.59.77.suec-dacor-codab.de Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / PHP/5.4.16 Resource Hash `4d3c505a6ee7d9bf1fb5f7ac7beebbce335e77c900d30f1a63eef84a020ae7f5` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Type text/html; charset=UTF-8 Date Tue, 16 Aug 2022 21:41:34 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Transfer-Encoding chunked X-Powered-By PHP/5.4.16 Redirect headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length 0 Content-Type text/html; charset=UTF-8 Date Tue, 16 Aug 2022 21:41:34 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Location sbtt/public/login2.html Pragma no-cache Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 X-Powered-By PHP/5.4.16
GET H/1.1	200 OK	sky_bird_logo.png employee.skybirdtravel.com/sbtt/content_site_new/images/	22 KB 22 KB	43ms 43ms	Image image/png	217.24.59.77 SUEC-DACOR-AS
General Check archive.org Show headers Download Go to Show image Full URL https://employee.skybirdtravel.com/sbtt/content_site_new/images/sky_bird_logo.png Requested by Host: employee.skybirdtravel.com URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.24.59.77 Rodental, Germany, ASN28876 (SUEC-DACOR-AS, DE), Reverse DNS 217.24.59.77.suec-dacor-codab.de Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `eba32891711d0701eaca1beb977ee8c62098b0dc6b043fae4a5df6b14ad72ca6` Request headers accept-language de-DE,de;q=0.9 Referer https://employee.skybirdtravel.com/sbtt/public/login2.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Date Tue, 16 Aug 2022 21:41:34 GMT Last-Modified Wed, 20 Mar 2013 01:53:38 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Accept-Ranges bytes ETag "56bf-4d8517d996c80" Content-Length 22207 Content-Type image/png
GET H/1.1	200 OK	BTN_quote.png employee.skybirdtravel.com/sbtt/content_site_new/images/	56 KB 56 KB	59ms 38ms	Image image/png	217.24.59.77 SUEC-DACOR-AS
General Check archive.org Show headers Download Go to Show image Full URL https://employee.skybirdtravel.com/sbtt/content_site_new/images/BTN_quote.png Requested by Host: employee.skybirdtravel.com URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.24.59.77 Rodental, Germany, ASN28876 (SUEC-DACOR-AS, DE), Reverse DNS 217.24.59.77.suec-dacor-codab.de Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `10c258bfad5ecfe9d5bb157f0216162abfd520fcf6dc1ba0df11c8d1748c8432` Request headers accept-language de-DE,de;q=0.9 Referer https://employee.skybirdtravel.com/sbtt/public/login2.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Date Tue, 16 Aug 2022 21:41:34 GMT Last-Modified Wed, 20 Mar 2013 01:53:38 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Accept-Ranges bytes ETag "de18-4d8517d996c80" Content-Length 56856 Content-Type image/png
GET H/1.1	200 OK	start.png employee.skybirdtravel.com/sbtt/content_site_new/images/	27 KB 27 KB	51ms 31ms	Image image/png	217.24.59.77 SUEC-DACOR-AS
General Check archive.org Show headers Download Go to Show image Full URL https://employee.skybirdtravel.com/sbtt/content_site_new/images/start.png Requested by Host: employee.skybirdtravel.com URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 217.24.59.77 Rodental, Germany, ASN28876 (SUEC-DACOR-AS, DE), Reverse DNS 217.24.59.77.suec-dacor-codab.de Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash `aab074bc99711c242c6b9efacf5ebe2f1d9047036c8c6d5eca98aa20573b91e9` Request headers accept-language de-DE,de;q=0.9 Referer https://employee.skybirdtravel.com/sbtt/public/login2.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Date Tue, 16 Aug 2022 21:41:34 GMT Last-Modified Wed, 20 Mar 2013 01:53:38 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Accept-Ranges bytes ETag "6aa3-4d8517d996c80" Content-Length 27299 Content-Type image/png
GET		jquery.js employee.skybirdtravel.com/sbtt/content_site/jquery/	0 0

GET		jquery.droppy.js employee.skybirdtravel.com/sbtt/content_site/jquery/jquery.droppy/	0 0

GET		jquery.ui.all.js employee.skybirdtravel.com/sbtt/content_site/jquery/ui/	0 0

GET		jquery.ui.all.css employee.skybirdtravel.com/sbtt/content_site/jquery/themes/flick/	0 0

GET		layout.css employee.skybirdtravel.com/sbtt/content_site_new/css/	0 0

GET		internal.css employee.skybirdtravel.com/sbtt/content_site_new/css/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: employee.skybirdtravel.com
URL: http://employee.skybirdtravel.com/sbtt/content_site/jquery/jquery.js

Domain: employee.skybirdtravel.com
URL: http://employee.skybirdtravel.com/sbtt/content_site/jquery/jquery.droppy/jquery.droppy.js

Domain: employee.skybirdtravel.com
URL: http://employee.skybirdtravel.com/sbtt/content_site/jquery/ui/jquery.ui.all.js

Domain: employee.skybirdtravel.com
URL: http://employee.skybirdtravel.com/sbtt/content_site/jquery/themes/flick/jquery.ui.all.css

Domain: employee.skybirdtravel.com
URL: http://employee.skybirdtravel.com/sbtt/content_site_new/css/layout.css

Domain: employee.skybirdtravel.com
URL: http://employee.skybirdtravel.com/sbtt/content_site_new/css/internal.css

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			employee.skybirdtravel.com/	1969-12-31 23:59:59	Name: sbttnet Value: o6rrpqd9a59fel2akbd0m6nv67

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure element 'http://employee.skybirdtravel.com/sbtt/content_site_new/images/sky_bird_logo.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure element 'http://employee.skybirdtravel.com/sbtt/content_site_new/images/BTN_quote.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure element 'http://employee.skybirdtravel.com/sbtt/content_site_new/images/start.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure script 'http://employee.skybirdtravel.com/sbtt/content_site/jquery/jquery.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure script 'http://employee.skybirdtravel.com/sbtt/content_site/jquery/jquery.droppy/jquery.droppy.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure script 'http://employee.skybirdtravel.com/sbtt/content_site/jquery/ui/jquery.ui.all.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html(Line 24) Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://employee.skybirdtravel.com/sbtt/content_site/jquery/themes/flick/jquery.ui.all.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html(Line 27) Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://employee.skybirdtravel.com/sbtt/content_site_new/css/layout.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html(Line 33) Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure stylesheet 'http://employee.skybirdtravel.com/sbtt/content_site_new/css/internal.css'. This request has been blocked; the content must be served over HTTPS.
security	warning	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html(Line 168) Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://employee.skybirdtravel.com/sbtt/secure/home.php'. This endpoint should be made available over a secure connection.
security	warning	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html(Line 171) Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure element 'http://employee.skybirdtravel.com/sbtt/content_site_new/images/sky_bird_logo.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure element 'http://employee.skybirdtravel.com/sbtt/content_site_new/images/BTN_quote.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://employee.skybirdtravel.com/sbtt/public/login2.html Message: Mixed Content: The page at 'https://employee.skybirdtravel.com/sbtt/public/login2.html' was loaded over HTTPS, but requested an insecure element 'http://employee.skybirdtravel.com/sbtt/content_site_new/images/start.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

employee.skybirdtravel.com
employee.skybirdtravel.com
217.24.59.77
10c258bfad5ecfe9d5bb157f0216162abfd520fcf6dc1ba0df11c8d1748c8432
4d3c505a6ee7d9bf1fb5f7ac7beebbce335e77c900d30f1a63eef84a020ae7f5
aab074bc99711c242c6b9efacf5ebe2f1d9047036c8c6d5eca98aa20573b91e9
eba32891711d0701eaca1beb977ee8c62098b0dc6b043fae4a5df6b14ad72ca6

employee.skybirdtravel.com Open in urlscan Pro 217.24.59.77 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

40 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

115 kBTransfer

113 kBSize

1 Cookies

4 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

1 Cookies

13 Console Messages

Indicators

employee.skybirdtravel.com Open in urlscan Pro
217.24.59.77 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

40 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

115 kB
Transfer

113 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions