member.qff-online.live Open in urlscan Pro
8.211.0.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/3lFk5Kj
Effective URL:
https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/
Submission: On October 13 via manual (October 13th 2020, 10:21:44 pm UTC) from NZ

Summary HTTP 19 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 19 HTTP transactions. The main IP is 8.211.0.55, located in Singapore, Singapore and belongs to CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN. The main domain is member.qff-online.live.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 13th 2020. Valid for: 3 months.

This is the only time member.qff-online.live was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Qantas (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
1 1	67.199.248.11 67.199.248.11		396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
1	212.22.77.3 212.22.77.3		202933 (CLOUDSOLU...) (CLOUDSOLUTIONS)
2 20	8.211.0.55 8.211.0.55		45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.)
19	2

1 67.199.248.11 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.22.77.3 (Moscow, Russian Federation)

ASN202933 (CLOUDSOLUTIONS, RU)
PTR: orascom-trading.info

go.flydir.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 8.211.0.55 (Singapore, Singapore) 2 redirects

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)

member.qff-online.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	qff-online.live 2 redirects member.qff-online.live	630 KB
1	flydir.live go.flydir.live	351 B
1	bit.ly 1 redirects bit.ly	258 B
19	3

	Domain	Requested by
20	member.qff-online.live	2 redirects member.qff-online.live
1	go.flydir.live
1	bit.ly	1 redirects
19	3

This site contains no links.

Subject Issuer	Validity	Valid
go.flydir.live Let's Encrypt Authority X3	`2020-10-12` - `2021-01-10`	3 months	crt.sh
member.qff-online.live Let's Encrypt Authority X3	`2020-10-13` - `2021-01-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/
Frame ID: 48E02E14B7BEA8CD2F4FBA66415DC048
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://bit.ly/3lFk5Kj HTTP 301
https://go.flydir.live/RfBnnlADjjnr Page URL
https://member.qff-online.live/ Page URL
https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7 HTTP 301
https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/ HTTP 302
https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/ Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<div class="[^"]*parbase/i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<div class="[^"]*parbase/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

19
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

630 kB
Transfer

626 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3lFk5Kj HTTP 301
https://go.flydir.live/RfBnnlADjjnr Page URL
https://member.qff-online.live/ Page URL
https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7 HTTP 301
https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/ HTTP 302
https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://bit.ly/3lFk5Kj HTTP 301
https://go.flydir.live/RfBnnlADjjnr

19 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	404 Not Found	RfBnnlADjjnr Show response go.flydir.live/ Redirect Chain https://bit.ly/3lFk5Kj https://go.flydir.live/RfBnnlADjjnr	71 B 351 B	226ms 72ms	Document text/html	212.22.77.3 CLOUDSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://go.flydir.live/RfBnnlADjjnr Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 212.22.77.3 Moscow, Russian Federation, ASN202933 (CLOUDSOLUTIONS, RU), Reverse DNS orascom-trading.info Software nginx / Resource Hash `ee169de1b4ea1ea927868a08114fd79737999602461a61e996e0eb08c12ced90` Request headers Host go.flydir.live Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx Date Tue, 13 Oct 2020 22:21:26 GMT Content-Type text/html; charset=UTF-8 Content-Length 71 Connection keep-alive Keep-Alive timeout=60 Last-Modified Tue, 13 Oct 2020 21:25:41 GMT ETag "47-5b1940e950555" Accept-Ranges bytes Redirect headers status 301 server nginx date Tue, 13 Oct 2020 22:21:25 GMT content-type text/html; charset=utf-8 content-length 122 cache-control private, max-age=90 content-security-policy referrer always; location https://go.flydir.live/RfBnnlADjjnr referrer-policy unsafe-url set-cookie _bit=k9dmlp-ab8d9753642ff8b574-00u; Domain=bit.ly; Expires=Sun, 11 Apr 2021 22:21:25 GMT via 1.1 google alt-svc clear
GET H/1.1	200 OK	Cookie set / Show response member.qff-online.live/	728 B 957 B	1425ms 1006ms	Document text/html	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / PHP/7.2.19 Resource Hash `b2d4690383555ce7eafa00b76921f0f32b1a81f8d6f2be58d0b16dbaa327eb5a` Request headers Host member.qff-online.live Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://go.flydir.live/RfBnnlADjjnr Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://go.flydir.live/RfBnnlADjjnr Response headers Server nginx/1.16.0 Date Tue, 13 Oct 2020 22:21:27 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive X-Powered-By PHP/7.2.19 Set-Cookie real=OK
GET H/1.1	200 OK	Primary Request / Show response member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/ Redirect Chain https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7? https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/ https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/?	27 KB 27 KB	209ms 208ms	Document text/html	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Requested by Host: member.qff-online.live URL: https://member.qff-online.live/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / PHP/7.2.19 Resource Hash `196c74d417fb4c9a59d76885b51c4ef57056b518dc0048719de1a0291f0d5ef0` Request headers Host member.qff-online.live Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://member.qff-online.live/ Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie real=OK; bid=96bdbff1ec2b98db53974403e8372fa7 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://member.qff-online.live/ Response headers Server nginx/1.16.0 Date Tue, 13 Oct 2020 22:21:28 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive X-Powered-By PHP/7.2.19 Redirect headers Server nginx/1.16.0 Date Tue, 13 Oct 2020 22:21:28 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive X-Powered-By PHP/7.2.19 Set-Cookie bid=96bdbff1ec2b98db53974403e8372fa7; expires=Thu, 12-Nov-2020 22:21:28 GMT; Max-Age=2592000; path=/ location login/?
GET H/1.1	200 OK	jquery.min.js Show response member.qff-online.live/bower_components/jquery/dist/	85 KB 85 KB	220ms 99ms	Script application/javascript	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/bower_components/jquery/dist/jquery.min.js Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:35:22 GMT Server nginx/1.16.0 ETag "5e3ce90a-15283" Content-Type application/javascript; charset=utf-8 Connection keep-alive Accept-Ranges bytes Content-Length 86659
GET H/1.1	200 OK	ua-parser.min.js Show response member.qff-online.live/bower_components/ua-parser-js/dist/	17 KB 17 KB	191ms 49ms	Script application/javascript	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/bower_components/ua-parser-js/dist/ua-parser.min.js Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:36:16 GMT Server nginx/1.16.0 ETag "5e3ce940-4298" Content-Type application/javascript; charset=utf-8 Connection keep-alive Accept-Ranges bytes Content-Length 17048
GET H/1.1	200 OK	font-awesome.min.css member.qff-online.live/bower_components/font-awesome/css/	30 KB 31 KB	68ms 66ms	Stylesheet text/css	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/bower_components/font-awesome/css/font-awesome.min.css Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:33:34 GMT Server nginx/1.16.0 ETag "5e3ce89e-7918" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 31000
GET H/1.1	200 OK	core_form.js Show response member.qff-online.live/core/form/	16 KB 16 KB	226ms 52ms	Script application/javascript	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/core/form/core_form.js Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `4ba0ad592a9744187492773b01f431117d77c17c540fbb5d151c2f14315d5885` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Sat, 18 Jul 2020 06:41:52 GMT Server nginx/1.16.0 ETag "5f1299b0-3f45" Content-Type application/javascript; charset=utf-8 Connection keep-alive Accept-Ranges bytes Content-Length 16197
GET H/1.1	200 OK	core_form.css member.qff-online.live/core/form/	3 KB 3 KB	112ms 45ms	Stylesheet text/css	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/core/form/core_form.css Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `ee708a81cb6b68b46bac363796cbd4e4e4b0d956c4ffbca6d05560b14e7e0027` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:24:18 GMT Server nginx/1.16.0 ETag "5e3ce672-a68" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 2664
GET H/1.1	200 OK	css.css member.qff-online.live/login/form/	199 B 435 B	108ms 41ms	Stylesheet text/css	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/login/form/css.css Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `71ed6d386b107b71653613a86944ad8f04fad6bceae9e761a21d5e60f956d226` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:18:06 GMT Server nginx/1.16.0 ETag "5e3ce4fe-c7" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 199
GET H/1.1	200 OK	main.min.2a59980d09662444d23feab128b9acfa.css member.qff-online.live/login/	186 KB 186 KB	131ms 56ms	Stylesheet text/css	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/login/main.min.2a59980d09662444d23feab128b9acfa.css Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `c836377b3f878bb339f820600c13435c8e88490e176bedf5af928c927b229353` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:07:22 GMT Server nginx/1.16.0 ETag "5e3ce27a-2e7d3" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 190419
GET H/1.1	200 OK	login.bundle.css member.qff-online.live/login/	114 B 350 B	140ms 32ms	Stylesheet text/css	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/login/login.bundle.css Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `acfecce6970a2ec8db6bbf3a51bcec7b2936d8930b0b7c84a079a315adb7b6c3` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:07:10 GMT Server nginx/1.16.0 ETag "5e3ce26e-72" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 114
GET H/1.1	200 OK	index.css member.qff-online.live/login/	50 KB 51 KB	160ms 47ms	Stylesheet text/css	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/login/index.css Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `75eee9dcf5bf3366fe5d7fcdf218a61f808d8ec2449983e74ed6ddc204fdda15` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:07:04 GMT Server nginx/1.16.0 ETag "5e3ce268-c92a" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 51498
GET H/1.1	200 OK	main-noncritical.min.7813760a0650572c476ec4027d786bfe.css member.qff-online.live/login/	65 KB 66 KB	194ms 81ms	Stylesheet text/css	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/login/main-noncritical.min.7813760a0650572c476ec4027d786bfe.css Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `564c11a6d2b5f6d64dbfcb00ef27a880cade69487f964361ceffb213f27436e5` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:07:14 GMT Server nginx/1.16.0 ETag "5e3ce272-10523" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 66851
GET H/1.1	200 OK	optanon.css member.qff-online.live/login/	20 KB 20 KB	200ms 85ms	Stylesheet text/css	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/login/optanon.css Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `39a2cf5d04df079c795ff8fbd5331af0ad118a3726ac317e3f1e8bcedc0071f3` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:07:32 GMT Server nginx/1.16.0 ETag "5e3ce284-4ee4" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 20196
GET H/1.1	200 OK	QANTAS-Centenary-24px.svg member.qff-online.live/login/	13 KB 13 KB	63ms 62ms	Image image/svg+xml	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://member.qff-online.live/login/QANTAS-Centenary-24px.svg Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `8ee72b870f333d99caf97671efaa921f9b64a772dc43898c360ef7e3d3c0c588` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:07:34 GMT Server nginx/1.16.0 ETag "5e3ce286-3274" Content-Type image/svg+xml Connection keep-alive Accept-Ranges bytes Content-Length 12916
GET H/1.1	200 OK	form.js Show response member.qff-online.live/login/form/	5 KB 5 KB	76ms 76ms	Script application/javascript	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/login/form/form.js?v=5f862868ee44f Requested by Host: member.qff-online.live URL: https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `b9f0ea6e2df50e3e9177759ff4421e7550d4e9eed508d0b69eed34b8ecc79bb0` Request headers Referer https://member.qff-online.live/frequent-flyer/96bdbff1ec2b98db53974403e8372fa7/login/? User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 02 Oct 2020 19:41:54 GMT Server nginx/1.16.0 ETag "5f778282-1490" Content-Type application/javascript; charset=utf-8 Connection keep-alive Accept-Ranges bytes Content-Length 5264
GET H/1.1	200 OK	spritesheet-9632fb7044385395ce89846b873ea4e3.png member.qff-online.live/login/	12 KB 12 KB	68ms 67ms	Image image/png	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://member.qff-online.live/login/spritesheet-9632fb7044385395ce89846b873ea4e3.png Requested by Host: member.qff-online.live URL: https://member.qff-online.live/login/main.min.2a59980d09662444d23feab128b9acfa.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `1e5c057c32de71d29c585b09b0562497b93c5f12c88214e79c81d2c2c8e6c398` Request headers Referer https://member.qff-online.live/login/main.min.2a59980d09662444d23feab128b9acfa.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:07:40 GMT Server nginx/1.16.0 ETag "5e3ce28c-3032" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 12338
GET H/1.1	200 OK	315CA1_3_0.woff2 member.qff-online.live/login/	48 KB 48 KB	71ms 71ms	Font font/woff2	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/login/315CA1_3_0.woff2 Requested by Host: member.qff-online.live URL: https://member.qff-online.live/login/main.min.2a59980d09662444d23feab128b9acfa.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `b2b64e5d45e5f4911d34343f60b7d15ba57d7ce1e4cc5dd69ac424bb79d84455` Request headers Origin https://member.qff-online.live Referer https://member.qff-online.live/login/main.min.2a59980d09662444d23feab128b9acfa.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:06:40 GMT Server nginx/1.16.0 ETag "5e3ce250-c10d" Content-Type font/woff2 Connection keep-alive Accept-Ranges bytes Content-Length 49421
GET H/1.1	200 OK	315CA1_1_0.woff2 member.qff-online.live/login/	49 KB 49 KB	75ms 75ms	Font font/woff2	8.211.0.55 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://member.qff-online.live/login/315CA1_1_0.woff2 Requested by Host: member.qff-online.live URL: https://member.qff-online.live/login/main.min.2a59980d09662444d23feab128b9acfa.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 8.211.0.55 Singapore, Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN), Reverse DNS Software nginx/1.16.0 / Resource Hash `b964d246defe2ccf6dd3a0d3887ac9d09325a866b94bd57732219406654698a2` Request headers Origin https://member.qff-online.live Referer https://member.qff-online.live/login/main.min.2a59980d09662444d23feab128b9acfa.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 13 Oct 2020 22:21:29 GMT Last-Modified Fri, 07 Feb 2020 04:06:24 GMT Server nginx/1.16.0 ETag "5e3ce240-c2c8" Content-Type font/woff2 Connection keep-alive Accept-Ranges bytes Content-Length 49864

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Qantas (Transportation)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery function| UAParser function| ask_def_proxy function| next__ function| preFinish__ function| finish__ function| set_event function| def_plugin_data_receiver function| deep_json_parse object| cookies function| advanced_string_validation function| sin_luhn function| cc_luhn function| dob_luhn function| exp_with_day_luhn function| exp_luhn function| qasame__ function| valid_a function| valid_q function| EN function| send1 string| bid object| php_js object| loader_ string| el

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			member.qff-online.live/	1970-01-19 13:53:39	Name: bid Value: 96bdbff1ec2b98db53974403e8372fa7
			member.qff-online.live/	1969-12-31 23:59:59	Name: real Value: OK

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
go.flydir.live
member.qff-online.live
212.22.77.3
67.199.248.11
8.211.0.55
0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896
196c74d417fb4c9a59d76885b51c4ef57056b518dc0048719de1a0291f0d5ef0
1e5c057c32de71d29c585b09b0562497b93c5f12c88214e79c81d2c2c8e6c398
39a2cf5d04df079c795ff8fbd5331af0ad118a3726ac317e3f1e8bcedc0071f3
4ba0ad592a9744187492773b01f431117d77c17c540fbb5d151c2f14315d5885
564c11a6d2b5f6d64dbfcb00ef27a880cade69487f964361ceffb213f27436e5
71ed6d386b107b71653613a86944ad8f04fad6bceae9e761a21d5e60f956d226
75eee9dcf5bf3366fe5d7fcdf218a61f808d8ec2449983e74ed6ddc204fdda15
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8ee72b870f333d99caf97671efaa921f9b64a772dc43898c360ef7e3d3c0c588
acfecce6970a2ec8db6bbf3a51bcec7b2936d8930b0b7c84a079a315adb7b6c3
b2b64e5d45e5f4911d34343f60b7d15ba57d7ce1e4cc5dd69ac424bb79d84455
b2d4690383555ce7eafa00b76921f0f32b1a81f8d6f2be58d0b16dbaa327eb5a
b964d246defe2ccf6dd3a0d3887ac9d09325a866b94bd57732219406654698a2
b9f0ea6e2df50e3e9177759ff4421e7550d4e9eed508d0b69eed34b8ecc79bb0
c836377b3f878bb339f820600c13435c8e88490e176bedf5af928c927b229353
ee169de1b4ea1ea927868a08114fd79737999602461a61e996e0eb08c12ced90
ee708a81cb6b68b46bac363796cbd4e4e4b0d956c4ffbca6d05560b14e7e0027