audiencehijacking-demo.costa-security.com Open in urlscan Pro
2a02:26f0:f7::5c7b:e152 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://audiencehijacking-demo.costa-security.com/
Submission: On November 04 via automatic, source certstream-suspicious (November 4th 2021, 11:04:11 pm UTC) — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2a02:26f0:f7::5c7b:e152, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is audiencehijacking-demo.costa-security.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on July 15th 2021. Valid for: a year.

This is the only time audiencehijacking-demo.costa-security.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2a02:26f0:f7:... 2a02:26f0:f7::5c7b:e152	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	2a02:26f0:170... 2a02:26f0:1700:11::b856:679a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	3

2 2a02:26f0:f7::5c7b:e152 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

audiencehijacking-demo.costa-security.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:1700:11::b856:679a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p11.techlab-cdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	techlab-cdn.com p11.techlab-cdn.com	64 KB
2	costa-security.com audiencehijacking-demo.costa-security.com	52 KB
8	2

	Domain	Requested by
5	p11.techlab-cdn.com	audiencehijacking-demo.costa-security.com
2	audiencehijacking-demo.costa-security.com	audiencehijacking-demo.costa-security.com
8	2

This site contains no links.

Subject Issuer	Validity	Valid
a248.e.akamai.net DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
go.chameleonx.com DigiCert SHA2 Secure Server CA	`2020-12-24` - `2022-01-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://audiencehijacking-demo.costa-security.com/
Frame ID: A109B1C76435BD6787713CD33DA83EEC
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

AH demo

Page Statistics

8
Requests

63 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

117 kB
Transfer

292 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response audiencehijacking-demo.costa-security.com/	388 B 974 B	371ms 97ms	Document text/html	2a02:26f0:f7::5c7b:e152 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://audiencehijacking-demo.costa-security.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2a02:26f0:f7::5c7b:e152 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash `df035f19429c0e212b61b8d702b4a2848b2ac895ab7a6b601449a9954c144b6c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html last-modified Thu, 04 Nov 2021 22:55:12 GMT etag "618464d0-ea" x-robots-tag noindex, nofollow, nosnippet, noarchive accept-ranges bytes vary Accept-Encoding content-encoding gzip expires Thu, 04 Nov 2021 23:04:07 GMT cache-control max-age=0, no-cache, no-store pragma no-cache date Thu, 04 Nov 2021 23:04:07 GMT content-length 262
GET H2	200	b0e3ff15b67eedc9d31406184598f4499b30011913fe4 Show response audiencehijacking-demo.costa-security.com/resources/	142 KB 51 KB	342ms 342ms	Script application/javascript	2a02:26f0:f7::5c7b:e152 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://audiencehijacking-demo.costa-security.com/resources/b0e3ff15b67eedc9d31406184598f4499b30011913fe4 Requested by Host: audiencehijacking-demo.costa-security.com URL: https://audiencehijacking-demo.costa-security.com/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2a02:26f0:f7::5c7b:e152 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash `aaa58617b585a9268fc17c700edb2d79361bf8f67d3cd3209165924e5f2cb872` Request headers Accept-Language de-DE,de;q=0.9 Referer https://audiencehijacking-demo.costa-security.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 04 Nov 2021 23:04:07 GMT content-encoding gzip last-modified Thu, 04 Nov 2021 22:12:12 GMT content-md5 +e+3jZThikWCvuRpns1PWA== etag "0x8D99FE02700DBD5" vary Accept-Encoding access-control-allow-methods GET, POST, HEAD content-type application/javascript access-control-allow-origin * access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding cache-control max-age=300 accept-ranges bytes timing-allow-origin * expires Thu, 04 Nov 2021 23:09:07 GMT
GET H2	200	65319_1825232221.js Show response p11.techlab-cdn.com/e/	56 KB 19 KB	89ms 22ms	Fetch application/javascript	2a02:26f0:1700:11::b856:679a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p11.techlab-cdn.com/e/65319_1825232221.js Requested by Host: audiencehijacking-demo.costa-security.com URL: https://audiencehijacking-demo.costa-security.com/resources/b0e3ff15b67eedc9d31406184598f4499b30011913fe4 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:11::b856:679a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash `e0916afbe5f8291168214915bcea9bc411678257222ea7c7ea0d075fc9eb8c4b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://audiencehijacking-demo.costa-security.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 04 Nov 2021 23:04:07 GMT content-encoding gzip last-modified Mon, 29 Mar 2021 14:50:47 GMT content-md5 8uL8P6st2u5Ul6/yMgHEBA== etag "0x8D8F2C209B74786" vary Accept-Encoding access-control-allow-methods GET, POST, HEAD content-type application/javascript access-control-allow-origin * access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding cache-control max-age=600 accept-ranges bytes timing-allow-origin * content-length 18645 expires Thu, 04 Nov 2021 23:14:07 GMT
GET H2	200	65257_1825232190.js Show response p11.techlab-cdn.com/e/	14 KB 6 KB	101ms 34ms	Fetch application/javascript	2a02:26f0:1700:11::b856:679a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p11.techlab-cdn.com/e/65257_1825232190.js Requested by Host: audiencehijacking-demo.costa-security.com URL: https://audiencehijacking-demo.costa-security.com/resources/b0e3ff15b67eedc9d31406184598f4499b30011913fe4 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:11::b856:679a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash `72667f8da6f63197e092832b2028a562ecfd78a599848ed873d3bd24dd3a7725` Request headers Accept-Language de-DE,de;q=0.9 Referer https://audiencehijacking-demo.costa-security.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 04 Nov 2021 23:04:07 GMT content-encoding gzip last-modified Wed, 31 Mar 2021 11:07:05 GMT content-md5 Dz6kDlqcMQZmScOUVuRDHA== etag "0x8D8F4351E4CC3B3" vary Accept-Encoding access-control-allow-methods GET, POST, HEAD content-type application/javascript access-control-allow-origin * access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding cache-control max-age=600 accept-ranges bytes timing-allow-origin * content-length 5946 expires Thu, 04 Nov 2021 23:14:07 GMT
GET H2	200	64885_1825232283.js Show response p11.techlab-cdn.com/e/	4 KB 2 KB	101ms 35ms	Fetch application/javascript	2a02:26f0:1700:11::b856:679a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p11.techlab-cdn.com/e/64885_1825232283.js Requested by Host: audiencehijacking-demo.costa-security.com URL: https://audiencehijacking-demo.costa-security.com/resources/b0e3ff15b67eedc9d31406184598f4499b30011913fe4 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:11::b856:679a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash `2281bceeaf3c81dc26731248960c8d210a0d461a02759c39b7a7b6c5ee1e06a0` Request headers Accept-Language de-DE,de;q=0.9 Referer https://audiencehijacking-demo.costa-security.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 04 Nov 2021 23:04:07 GMT content-encoding gzip last-modified Tue, 02 Feb 2021 20:14:20 GMT content-md5 kYjINenfgD1AmqSEyGQZvA== etag "0x8D8C7B7200E6A28" vary Accept-Encoding access-control-allow-methods GET, POST, HEAD content-type application/javascript access-control-allow-origin * access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding cache-control max-age=600 accept-ranges bytes timing-allow-origin * content-length 1872 expires Thu, 04 Nov 2021 23:14:07 GMT
GET H2	200	65226_1825232221.js Show response p11.techlab-cdn.com/e/	69 KB 32 KB	102ms 35ms	Fetch application/javascript	2a02:26f0:1700:11::b856:679a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p11.techlab-cdn.com/e/65226_1825232221.js Requested by Host: audiencehijacking-demo.costa-security.com URL: https://audiencehijacking-demo.costa-security.com/resources/b0e3ff15b67eedc9d31406184598f4499b30011913fe4 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:11::b856:679a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash `f15d0efbde8255667f5a72b6d15514a07af8ed26fc0123dbecd7a57b8571f5f6` Request headers Accept-Language de-DE,de;q=0.9 Referer https://audiencehijacking-demo.costa-security.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 04 Nov 2021 23:04:07 GMT content-encoding gzip last-modified Tue, 22 Jun 2021 09:56:19 GMT content-md5 SXxgqgysjhD+doh01gfTBg== etag "0x8D93563FBF1CA03" vary Accept-Encoding access-control-allow-methods GET, POST, HEAD content-type application/javascript access-control-allow-origin * access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding cache-control max-age=600 accept-ranges bytes timing-allow-origin * content-length 32564 expires Thu, 04 Nov 2021 23:14:07 GMT
GET H2	200	64854_747628186.js Show response p11.techlab-cdn.com/e/	8 KB 4 KB	112ms 46ms	Fetch application/javascript	2a02:26f0:1700:11::b856:679a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p11.techlab-cdn.com/e/64854_747628186.js Requested by Host: audiencehijacking-demo.costa-security.com URL: https://audiencehijacking-demo.costa-security.com/resources/b0e3ff15b67eedc9d31406184598f4499b30011913fe4 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:11::b856:679a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash `7e79bb95e51e4f2c127656ad5327f1c87141ac7d0c61de2e5195cfb28daabf2e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://audiencehijacking-demo.costa-security.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Thu, 04 Nov 2021 23:04:07 GMT content-encoding gzip last-modified Tue, 31 Aug 2021 00:17:09 GMT content-md5 ihO5IHG2chGysGWrt93urQ== etag "0x8D96C14ABFDA2C6" vary Accept-Encoding access-control-allow-methods GET, POST, HEAD content-type application/javascript access-control-allow-origin * access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding cache-control max-age=600 accept-ranges bytes timing-allow-origin * content-length 3907 expires Thu, 04 Nov 2021 23:14:07 GMT
GET		style.css audiencehijacking-demo.costa-security.com/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: audiencehijacking-demo.costa-security.com
URL: http://audiencehijacking-demo.costa-security.com/style.css

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.costa-security.com/	1970-01-19 22:27:54	Name: ak_bmsc Value: 864A0229E614C2E9702125227562DEA4~000000000000000000000000000000~YAAQTuF7XEicPux8AQAAwPYx7Q2+7DSpEPgfdngzmFQhbkb92wqYXEBXtJEYG+p+/3La/CffG8KspD0wOU5QmD28d7/eWO+gXQn/gTMkFVTyBa0GgwZBrDrJ1VG5znPWuPsQswlcNaFKXe/bDZPneC70dsUR1Q4m4aUMkwzjfoBiX96B0RBkxxaP5paVvjpwrZakpYd5fqMJQ4/l4CVIi1kLxMCems6twEczUH8ZLvX29cE5UAbkKb5Z0Gac8webhk2Ti0bxctmLzYnFeoRoCCC8rWUHZsWVWmOon1ENPLpnqOSu+5THO0e8aV1ILnOLd/pOf73Uy6UTKG1XZWzTrbBsONhlCFZkIFegeY+TdPvT4qQzxTseznTxEZWmnMURLil5FFmHvdmbSxTYpiPE5K+TY6aBfIlj3g==
audiencehijacking-demo.costa-security.com/	1969-12-31 23:59:59	Name: akacd_RWASP-default-phased-release Value: 3813519846~rv=61~id=8f1bfee15ddc73f3b1d99e399626ebb9
audiencehijacking-demo.costa-security.com/	1969-12-31 23:59:59	Name: PIM-SESSION-ID Value: j9p9RFaoQajF4Wkj

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://audiencehijacking-demo.costa-security.com/(Line 4) Message: Mixed Content: The page at 'https://audiencehijacking-demo.costa-security.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://audiencehijacking-demo.costa-security.com/style.css'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

audiencehijacking-demo.costa-security.com
p11.techlab-cdn.com
audiencehijacking-demo.costa-security.com
2a02:26f0:1700:11::b856:679a
2a02:26f0:f7::5c7b:e152
2281bceeaf3c81dc26731248960c8d210a0d461a02759c39b7a7b6c5ee1e06a0
72667f8da6f63197e092832b2028a562ecfd78a599848ed873d3bd24dd3a7725
7e79bb95e51e4f2c127656ad5327f1c87141ac7d0c61de2e5195cfb28daabf2e
aaa58617b585a9268fc17c700edb2d79361bf8f67d3cd3209165924e5f2cb872
df035f19429c0e212b61b8d702b4a2848b2ac895ab7a6b601449a9954c144b6c
e0916afbe5f8291168214915bcea9bc411678257222ea7c7ea0d075fc9eb8c4b
f15d0efbde8255667f5a72b6d15514a07af8ed26fc0123dbecd7a57b8571f5f6

audiencehijacking-demo.costa-security.com Open in urlscan Pro 2a02:26f0:f7::5c7b:e152 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

63 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

117 kBTransfer

292 kBSize

3 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

3 Cookies

1 Console Messages

Indicators

audiencehijacking-demo.costa-security.com Open in urlscan Pro
2a02:26f0:f7::5c7b:e152 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

63 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

117 kB
Transfer

292 kB
Size

3
Cookies

8 HTTP transactions
0 data transactions