urlscan.io logo urlscan.io
SecurityTrails logo

v6d7u3b2.apps.lair.io Open in urlscan Pro
13.93.208.196  Public Scan

Go To Rescan Add Verdict Report
URL: https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
Submission: On October 12 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 7 domains to perform 7 HTTP transactions. The main IP is 13.93.208.196, located in San Jose, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US. The main domain is v6d7u3b2.apps.lair.io.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 12th 2018. Valid for: 3 months.
This is the only time v6d7u3b2.apps.lair.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 13.93.208.196 8075 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2.18.233.89 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 151.101.2.110 54113 (FASTLY)
1 162.247.242.18 23467 (NEWRELIC-...)
7 7
1    13.93.208.196 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
v6d7u3b2.apps.lair.io
1    2a00:1450:4001:814::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
1    2a00:1450:4001:814::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2.18.233.89 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-89.deploy.static.akamaitechnologies.com
bbcc1ce3fd17f5494858-8c1097c0a7933fee65eeb2e7c6f97ab3.ssl.cf2.rackcdn.com
1    2a00:1450:4001:814::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
1    151.101.2.110 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com
1    162.247.242.18 (United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-6.nr-data.net
bam.nr-data.net
Domain Requested by
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com v6d7u3b2.apps.lair.io
1 fonts.gstatic.com v6d7u3b2.apps.lair.io
1 bbcc1ce3fd17f5494858-8c1097c0a7933fee65eeb2e7c6f97ab3.ssl.cf2.rackcdn.com v6d7u3b2.apps.lair.io
1 www.google-analytics.com v6d7u3b2.apps.lair.io
1 fonts.googleapis.com v6d7u3b2.apps.lair.io
1 v6d7u3b2.apps.lair.io
7 7

This site contains links to these domains. Also see Links.

Domain
www.sourcelair.com
Subject Issuer Validity Valid
v6d7u3b2.apps.lair.io
Let's Encrypt Authority X3		 2018-10-12 -
2019-01-10		 3 months crt.sh
*.googleapis.com
Google Internet Authority G3		 2018-09-25 -
2018-12-18		 3 months crt.sh
*.google-analytics.com
Google Internet Authority G3		 2018-09-25 -
2018-12-18		 3 months crt.sh
*.ssl.cf2.rackcdn.com
DigiCert SHA2 Secure Server CA		 2018-03-19 -
2019-03-19		 a year crt.sh
*.google.com
Google Internet Authority G3		 2018-09-25 -
2018-12-18		 3 months crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2018-10-03 -
2019-04-14		 6 months crt.sh
*.nr-data.net
GeoTrust RSA CA 2018		 2018-01-11 -
2020-03-17		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
Frame ID: 6904E88A4D3F9D0A4F302019731CB485
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /openresty(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • env /^NREUM/i

Page Statistics

7
Requests

100 %
HTTPS

43 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

92 kB
Transfer

135 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/ 		7 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.93.208.196 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
openresty/1.13.6.1 /
Resource Hash
9f8165206c1850826399a77b4a268af5c3a8e7dc1ec02e9cd81b6d4db4c66fc9
Security Headers
Name Value
X-Frame-Options ALLOW-FROM HTTPS://WWW.SOURCELAIR.COM

Request headers

Host
v6d7u3b2.apps.lair.io
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
openresty/1.13.6.1
Date
Fri, 12 Oct 2018 17:06:55 GMT
Content-Type
text/html; charset=utf-8
Content-Length
7344
Connection
keep-alive
Keep-Alive
timeout=30
SourceLair-App-Status
Not found
SourceLair-Middleware
true
X-Frame-Options
ALLOW-FROM HTTPS://WWW.SOURCELAIR.COM
css
fonts.googleapis.com/ 		5 KB
790 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600
Requested by
Host: v6d7u3b2.apps.lair.io
URL: https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
73ed4957753f475d502c2ee4e56fc072150f9b323be22652c868ef7cb82a926c
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
last-modified
Fri, 12 Oct 2018 17:06:55 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Fri, 12 Oct 2018 17:06:55 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
x-xss-protection
1; mode=block
expires
Fri, 12 Oct 2018 17:06:55 GMT
analytics.js
www.google-analytics.com/ 		42 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: v6d7u3b2.apps.lair.io
URL: https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:814::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
316fe2ef7b6caac81936e79571e2e0b742200f1c5b0e02d6bdeeb375eb419026
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 01 Oct 2018 17:56:18 GMT
server
Golfe2
age
2256
date
Fri, 12 Oct 2018 16:29:19 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
17285
expires
Fri, 12 Oct 2018 18:29:19 GMT
logo-256.png
bbcc1ce3fd17f5494858-8c1097c0a7933fee65eeb2e7c6f97ab3.ssl.cf2.rackcdn.com/ 		44 KB
45 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bbcc1ce3fd17f5494858-8c1097c0a7933fee65eeb2e7c6f97ab3.ssl.cf2.rackcdn.com/logo-256.png
Requested by
Host: v6d7u3b2.apps.lair.io
URL: https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.233.89 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-233-89.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f66ea06bc7c871ecf210200b02a5c7ce1248b53db8ac782cca665112948c351f

Request headers

Referer
https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 12 Oct 2018 17:06:55 GMT
Last-Modified
Mon, 02 Feb 2015 12:31:19 GMT
X-Trans-Id
tx58bd7126a9404309ae4c7-005bb30082ord1
ETag
a46167de54e408946e17b34ad5067c05
Content-Type
image/png
X-Timestamp
1422880278.25208
Cache-Control
public, max-age=75446
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
45486
Expires
Sat, 13 Oct 2018 14:04:21 GMT
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/sourcesanspro/v11/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
Requested by
Host: v6d7u3b2.apps.lair.io
URL: https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:814::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
547ea67155dac1c27efb550426c4848b7364357ed040fd531719c4797e356a1d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600
Origin
https://v6d7u3b2.apps.lair.io

Response headers

date
Tue, 02 Oct 2018 10:29:25 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 18:25:48 GMT
server
sffe
age
887850
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
12960
x-xss-protection
1; mode=block
expires
Wed, 02 Oct 2019 10:29:25 GMT
nr-1071.min.js
js-agent.newrelic.com/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1071.min.js
Requested by
Host: v6d7u3b2.apps.lair.io
URL: https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
56097e8b7ceb27db42a5e102af6d11dfdcaee13d8716477a8e242b4957d7a280

Request headers

Referer
https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 12 Oct 2018 17:06:55 GMT
content-encoding
gzip
x-amz-request-id
481FE111768851BD
x-cache
HIT
status
200
content-length
9086
x-amz-id-2
0YRbL+xndniUNryTFyPMh7blhTKIHFgax7VZOYNB0faQOHdTX/PT1kK81w0HdqDzPFNiC/1Ey3g=
x-served-by
cache-fra19150-FRA
last-modified
Wed, 28 Feb 2018 23:33:31 GMT
server
AmazonS3
x-timer
S1539364016.593289,VS0,VE0
etag
"a1a545c95f313a230157b47dca555c25"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3826
6d0dd89354
bam.nr-data.net/1/ 		57 B
261 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/6d0dd89354?a=6158901,6158902,6158903&v=1071.385e752&to=Y11WNhAHD0pZAkAMCVoXchcMBRVQVw8bEgNWFkILBxESA08IWAEFVUpQPRQPBE4%3D&rst=275&ref=https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e%3D/signin/&ap=28&be=201&fe=262&dc=217&perf=%7B%22timing%22:%7B%22of%22:1539364015330,%22n%22:0,%22f%22:0,%22dn%22:0,%22dne%22:0,%22c%22:0,%22ce%22:0,%22rq%22:1,%22rp%22:195,%22rpe%22:196,%22dl%22:197,%22di%22:216,%22ds%22:216,%22de%22:217,%22dc%22:261,%22l%22:261,%22le%22:262%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1071.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.18 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS
bam-6.nr-data.net
Software
/
Resource Hash
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Referer
https://v6d7u3b2.apps.lair.io/reason/invalidcred/.RIENBOO_V0/.onlinesummery/2mwy2e=/signin/?country.x=US&locale.xmessage-id:
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Expires
Thu, 01 Jan 1970 00:00:00 GMT
Content-Length
57
Content-Type
text/javascript;charset=ISO-8859-1

Verdicts & Comments Add Verdict or Comment

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NREUM object| newrelic function| __nr_require string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| sa object| gaGlobal

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options ALLOW-FROM HTTPS://WWW.SOURCELAIR.COM