booking.avialook.aero
Open in
urlscan Pro
37.200.71.162
Public Scan
URL:
https://booking.avialook.aero/
Submission: On May 16 via automatic, source certstream-suspicious — Scanned from DE
Submission: On May 16 via automatic, source certstream-suspicious — Scanned from DE
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 37.200.71.162, located in
Moscow, Russian Federation and
belongs to SELECTEL-MSK, RU.
The main domain is booking.avialook.aero.
TLS certificate: Issued by AlphaSSL CA - SHA256 - G4 on March 24th 2023. Valid for: a year.
This is the only time booking.avialook.aero was scanned on urlscan.io!
TLS certificate: Issued by AlphaSSL CA - SHA256 - G4 on March 24th 2023. Valid for: a year.
This is the only time booking.avialook.aero was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 37.200.71.162 37.200.71.162 | 50340 (SELECTEL-MSK) (SELECTEL-MSK) | |
| 1 | 91.194.3.208 91.194.3.208 | 51520 (RH) (RH) | |
| 9 | 2 |
8
37.200.71.162
(Moscow, Russian Federation)
ASN50340 (SELECTEL-MSK, RU)
PTR: sys.nemo.travel
ASN50340 (SELECTEL-MSK, RU)
PTR: sys.nemo.travel
| booking.avialook.aero | |
| avialook.nemo.travel |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
avialook.aero
booking.avialook.aero avialook.aero |
371 KB |
| 1 |
nemo.travel
avialook.nemo.travel |
86 KB |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | booking.avialook.aero |
booking.avialook.aero
|
| 1 | avialook.nemo.travel |
avialook.aero
|
| 1 | avialook.aero |
booking.avialook.aero
|
| 9 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.nemo.travel AlphaSSL CA - SHA256 - G4 |
2023-03-24 - 2024-04-24 |
a year | crt.sh |
| avialook.aero R3 |
2023-02-23 - 2023-05-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://booking.avialook.aero/
Frame ID: A53B26A39D7084D95E318E7BEA64D052
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Поиск авиабилетовDetected technologies
RequireJS
(JavaScript Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- require.*\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
booking.avialook.aero/ |
7 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-awesome.min.css
booking.avialook.aero/templates/wurst/f2.0/css/font/fontawesome/css/ |
30 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
booking.avialook.aero/templates/wurst/f2.0/css/ |
555 KB 86 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
require.js
booking.avialook.aero/templates/wurst/f2.0/js/lib/requirejs/v.2.1.15/ |
15 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
nemo-search-ru.js
booking.avialook.aero/templates/wurst/dist/ |
863 KB 258 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
booking.avialook.aero/templates/avialook_admin/extfiles/ |
0 121 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nemo.min.css
avialook.aero/assets/front/build/css/ |
43 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
warn_line.gif
booking.avialook.aero/static/images/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
avialook.nemo.travel/templates/wurst/f2.0/css/ |
555 KB 86 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| requirejs function| require function| define function| initAnalytics function| $ function| jQuery function| numeral string| nemoSourceHost3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| booking.avialook.aero/ | Name: PHPSESSID Value: 3a1f982d23af8756c2c17f42fc031266 |
|
| .avialook.aero/ | Name: user_unique_id Value: 5220288f1565686f7e63f1861bb239e9 |
|
| booking.avialook.aero/ | Name: nemo_currency Value: RUB |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
avialook.aero
avialook.nemo.travel
booking.avialook.aero
37.200.71.162
91.194.3.208
3b17d1581eb24ad16921089f0a7cbb29174d07e72da4e9a82b6cebfba52c627d
552a9717eebd927ecac5c572d270e9fd322a2f99dbf5b1203f4f84995edc23e1
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
8f528919fbe5ad23af4089d95124b230969c2d063ab6b67f258c8707e7040b62
9b462879c4c763deb5520abc0882ea4fdf39ef76ae44922b3cb170410c3c1d38
adea132a1d1a148c5313a315d4389300981c48df4e3dcd42577e7f30be7d3ab9
d5783e88093f2b0e799ed040726f421bc8907476a3dfd8334a56f7ec9137a48d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855