air.bnb-extranett.com

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3033::ac43:8b6e, located in United States and belongs to CLOUDFLARENET, US. The main domain is air.bnb-extranett.com.
TLS certificate: Issued by E1 on February 22nd 2024. Valid for: 3 months.

This is the only time air.bnb-extranett.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Airbnb (Hospitality)

Domain & IP information

	IP Address		AS Autonomous System
1 5	2606:4700:303... 2606:4700:3033::ac43:8b6e		13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

5 2606:4700:3033::ac43:8b6e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

air.bnb-extranett.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.bnb-extranett.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	bnb-extranett.com 1 redirects air.bnb-extranett.com api.bnb-extranett.com	1007 KB
4	1

	Domain	Requested by
4	air.bnb-extranett.com	1 redirects air.bnb-extranett.com
1	api.bnb-extranett.com	air.bnb-extranett.com
4	2

This site contains links to these domains. Also see Links.

Domain
www.airbnb.com
investors.airbnb.com
www.airbnb.org
www.facebook.com
twitter.com
instagram.com

Subject Issuer	Validity	Valid
bnb-extranett.com E1	`2024-02-22` - `2024-05-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://air.bnb-extranett.com/
Frame ID: 3EA25AF451EF21B48BCCA6F067240061
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log In / Sign Up - Airbnb

Page URL History Show full URLs

http://air.bnb-extranett.com/ HTTP 301
https://air.bnb-extranett.com/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

1077 kB
Transfer

2788 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.airbnb.com/host/homes
Title: Airbnb your home

Search URL Search Domain Scan URL

URL: https://www.airbnb.com/terms/privacy_policy?source=signup
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.airbnb.com/host/homes?from_footer=1
Title: Airbnb your home

Search URL Search Domain Scan URL

URL: https://investors.airbnb.com/
Title: Investors

Search URL Search Domain Scan URL

URL: https://www.airbnb.org/?locale=en
Title: Airbnb.org emergency stays

Search URL Search Domain Scan URL

URL: https://www.facebook.com/airbnb

Search URL Search Domain Scan URL

URL: https://twitter.com/airbnb

Search URL Search Domain Scan URL

URL: https://instagram.com/airbnb

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://air.bnb-extranett.com/ HTTP 301
https://air.bnb-extranett.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response air.bnb-extranett.com/ Redirect Chain http://air.bnb-extranett.com/ https://air.bnb-extranett.com/	509 B 749 B	341ms 258ms	Document text/html	2606:4700:3033::ac43:8b6e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://air.bnb-extranett.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:8b6e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fa329b20f5462eede0091d87550d339956689c9087110146b4651d9108e2b2bc` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 85aa9559dc0c4368-EWR content-encoding br content-type text/html date Sat, 24 Feb 2024 20:50:53 GMT last-modified Sat, 24 Feb 2024 20:35:10 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LanA9Q0NDJtiTz6dq3iAcUnTuNKPr3oS9mfTK%2Bq2ktp0TnssFmUE7uo%2FqY7AhA94zi8Vf3LA7ghB2IQVX0LOwzD8UEgQRbQG4BISOk57y8n5bACxWqlriI19ALRgXnXf8h9p%2FvvCDIpiRBs7oknyQIE8HVQ%3D"}],"group":"cf-nel","max_age":604800} server cloudflare Redirect headers CF-RAY 85aa9558fb5c0f98-EWR Cache-Control max-age=3600 Connection keep-alive Date Sat, 24 Feb 2024 20:50:52 GMT Expires Sat, 24 Feb 2024 21:50:52 GMT Location https://air.bnb-extranett.com/ NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XMGdCx7oVE23Htp7RcP5ojJ0jZ1v05Vx8k3nFfUXuOgteLoCrFIFPGzeLRRq%2BGNBdWBDW6kDJfkNcMYipgodn5CQDdsyB4IPU4othskDoz1oNGQO0PfQEaJvBc%2FwIQDEjH4rgQqMtegSXnbh9S%2FClW7gWfc%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding alt-svc h3=":443"; ma=86400
GET H2	200	style.css air.bnb-extranett.com/	2 MB 893 KB	71ms 70ms	Stylesheet text/css	2606:4700:3033::ac43:8b6e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://air.bnb-extranett.com/style.css Requested by Host: air.bnb-extranett.com URL: https://air.bnb-extranett.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:8b6e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9a824319b735485232494e36e4d2fca1ca96901dc46034bb8f89840a60aa9777` Request headers accept-language en-US,en;q=0.9 Referer https://air.bnb-extranett.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:50:53 GMT content-encoding br cf-cache-status HIT last-modified Thu, 22 Feb 2024 19:01:43 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 454 etag W/"65d79a17-216ce5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F2OZVxflQCXpcRd6PhA9p6yGEjn0CaehaOweKSuudrqdo4MhqLcmNB37Aq75ABQ7aO%2B7BVcatZ1VOKco7iJnb066JP%2B4Y4GDMCisXI354UGcS0l7gxk7p5DDdhUKg6NLJU6Q1wE2XIF6nEOLJTI5eZZ9Kkw%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 85aa955b7dd64368-EWR alt-svc h3=":443"; ma=86400
GET H2	200	main.b8c26c90.js Show response air.bnb-extranett.com/static/js/	578 KB 112 KB	339ms 338ms	Script application/javascript	2606:4700:3033::ac43:8b6e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://air.bnb-extranett.com/static/js/main.b8c26c90.js Requested by Host: air.bnb-extranett.com URL: https://air.bnb-extranett.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:8b6e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `df5f42b1691beb0985969d2ee6079f088b287464c0be625ea49990655af97ea8` Request headers accept-language en-US,en;q=0.9 Referer https://air.bnb-extranett.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:50:53 GMT content-encoding br cf-cache-status HIT last-modified Sat, 24 Feb 2024 20:35:10 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 454 etag W/"65da52fe-90841" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7%2FGI0qRenr8UQyl2Iv0XUbzAnjoDVXsw888sePoHOzJL5jKzuziitAzz3Vy%2FFlSBGqMU776ZgvN21nR6mJ3TSeYTXY5xK4%2BHAZXg46trPgQy%2BLQAg5fcyNN%2Fy6xF3DcpsNKNqfivVlhBSo7EoBb4qD1O6AE%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=14400 cf-ray 85aa955b7dd84368-EWR alt-svc h3=":443"; ma=86400
GET DATA	200 OK	truncated /	24 KB 24 KB		Font binary/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b06428a4009f63f0edb5c8cf89ffb84ea978a2b559cc4c14c8e7a0e130ceefc4` Request headers Referer Origin https://air.bnb-extranett.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type binary/octet-stream
GET DATA	200 OK	truncated /	23 KB 23 KB		Font binary/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b848d7113c5d21f463bd7b248115b78ae386d1628459bfcdb154f82f083bfc97` Request headers Referer Origin https://air.bnb-extranett.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type binary/octet-stream
GET DATA	200 OK	truncated /	24 KB 24 KB		Font binary/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b11f01105c8b416bc49025877708638fc1955dc31d2a3fa7904d4e0b0f4ac4b4` Request headers Referer Origin https://air.bnb-extranett.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers Content-Type binary/octet-stream
GET H2	200	info Show response api.bnb-extranett.com/ws/	77 B 542 B	168ms 155ms	XHR application/json	2606:4700:3033::ac43:8b6e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.bnb-extranett.com/ws/info?t=1708807854169 Requested by Host: air.bnb-extranett.com URL: https://air.bnb-extranett.com/static/js/main.b8c26c90.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:8b6e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `662f69fe7f6dc5ddb7a7e83aa3ac731e97b65817742fee50051b88b89f8d655b` Request headers accept-language en-US,en;q=0.9 Referer https://air.bnb-extranett.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36 Response headers date Sat, 24 Feb 2024 20:50:54 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Origin, Access-Control-Request-Method, Access-Control-Request-Headers report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bli8RdxzjtSrSbawqW3zcjipYpGZlklSlZhR0ZIdwhkmAhRb9Y2A0YqQAfdL6WNIq8rzAumaFEen6g8%2FTjHbYd%2FWi10pev2fzQ7y60IbCM%2BJ3ioDqSGc7jpZSXFQ9CS9OhqO1HNRUwGVzIqNHn0zQ67ZnVg%3D"}],"group":"cf-nel","max_age":604800} content-type application/json;charset=UTF-8 access-control-allow-origin https://air.bnb-extranett.com cache-control no-store, no-cache, must-revalidate, max-age=0 access-control-allow-credentials true cf-ray 85aa9560bc384368-EWR alt-svc h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Airbnb (Hospitality)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| __reactRouterVersion

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

air.bnb-extranett.com
api.bnb-extranett.com
2606:4700:3033::ac43:8b6e
662f69fe7f6dc5ddb7a7e83aa3ac731e97b65817742fee50051b88b89f8d655b
9a824319b735485232494e36e4d2fca1ca96901dc46034bb8f89840a60aa9777
b06428a4009f63f0edb5c8cf89ffb84ea978a2b559cc4c14c8e7a0e130ceefc4
b11f01105c8b416bc49025877708638fc1955dc31d2a3fa7904d4e0b0f4ac4b4
b848d7113c5d21f463bd7b248115b78ae386d1628459bfcdb154f82f083bfc97
df5f42b1691beb0985969d2ee6079f088b287464c0be625ea49990655af97ea8
fa329b20f5462eede0091d87550d339956689c9087110146b4651d9108e2b2bc

air.bnb-extranett.com Open in urlscan Pro 2606:4700:3033::ac43:8b6e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

100 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

1077 kBTransfer

2788 kBSize

0 Cookies

8 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

air.bnb-extranett.com Open in urlscan Pro
2606:4700:3033::ac43:8b6e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

1077 kB
Transfer

2788 kB
Size

0
Cookies

4 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!