sraviation.com Open in urlscan Pro
64.71.34.16 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://disq.us/?url=http%3A%2F%2Fdemosite.harbertv.com&key=Pw9buIVY-BNK5DOd9_VnCA
Effective URL:
http://sraviation.com//webstats/quarterly/
Submission: On December 06 via manual (December 6th 2019, 4:55:02 pm UTC) from US

Summary HTTP 8 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 8 HTTP transactions. The main IP is 64.71.34.16, located in United States and belongs to AFFINITY-FTL - Affinity Internet, Inc, US. The main domain is sraviation.com.

This is the only time sraviation.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: LinkedIn (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	151.101.64.64 151.101.64.64	54113 (FASTLY) (FASTLY - Fastly)
1 1	72.18.212.50 72.18.212.50	22658 (EARTHNET) (EARTHNET - Earthnet)
3	64.71.34.16 64.71.34.16	3064 (AFFINITY-FTL) (AFFINITY-FTL - Affinity Internet)
4	2606:2800:233... 2606:2800:233:1a99:2aa:1474:167d:2694	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
8	3

1 151.101.64.64 (United States)

ASN54113 (FASTLY - Fastly, US)

disq.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.18.212.50 (United States) 1 redirects

ASN22658 (EARTHNET - Earthnet, Inc., US)
PTR: plesk.earthnet.net

demosite.harbertv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 64.71.34.16 (United States)

ASN3064 (AFFINITY-FTL - Affinity Internet, Inc, US)

sraviation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:233:1a99:2aa:1474:167d:2694 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

static.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	licdn.com static.licdn.com	139 KB
3	sraviation.com sraviation.com	7 KB
1	harbertv.com 1 redirects demosite.harbertv.com	261 B
1	disq.us disq.us	511 B
8	4

	Domain	Requested by
4	static.licdn.com	sraviation.com
3	sraviation.com	disq.us static.licdn.com
1	demosite.harbertv.com	1 redirects
1	disq.us
8	4

This site contains links to these domains. Also see Links.

Domain
linkedin.com

Subject Issuer	Validity	Valid
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2021-10-14`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://sraviation.com//webstats/quarterly/
Frame ID: DD604F49F0118C90605958F9A833220B
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://disq.us/?url=http%3A%2F%2Fdemosite.harbertv.com&key=Pw9buIVY-BNK5DOd9_VnCA Page URL
http://demosite.harbertv.com/ HTTP 302
http://sraviation.com//webstats/quarterly/ Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

8
Requests

50 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

147 kB
Transfer

496 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://linkedin.com/help/linkedin/answer/34593?lang=en&trk=d_checkpoint_lg_consumerLogin_ft_community_guidelines
Title: Community Guidelines

Search URL Search Domain Scan URL

URL: https://linkedin.com/help/linkedin?trk=d_checkpoint_lg_consumerLogin_ft_send_feedback&lang=en
Title: Send Feedback

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://disq.us/?url=http%3A%2F%2Fdemosite.harbertv.com&key=Pw9buIVY-BNK5DOd9_VnCA Page URL
http://demosite.harbertv.com/ HTTP 302
http://sraviation.com//webstats/quarterly/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response disq.us/	247 B 511 B	151ms 133ms	Document text/html	151.101.64.64 Fastly
General Check archive.org Show headers Download Go to Full URL http://disq.us/?url=http%3A%2F%2Fdemosite.harbertv.com&key=Pw9buIVY-BNK5DOd9_VnCA Protocol HTTP/1.1 Server 151.101.64.64 , United States, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software nginx / Resource Hash `9f88a302db0952284e77f90bb2602dda44d6b9c08d9af056ea221ac8c546a5b1` Request headers Host disq.us Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server nginx Content-Type text/html Expires Fri, 06 Dec 2019 17:54:43 GMT Cache-Control max-age=3600 Content-Encoding gzip X-Backend shortener Disqus-Cachetype TTL Disqus-NoCache 1 Content-Length 182 Date Fri, 06 Dec 2019 16:54:43 GMT Age 0 Connection keep-alive Vary Accept-Encoding
GET H/1.1	200 OK	Primary Request / Show response sraviation.com//webstats/quarterly/ Redirect Chain http://demosite.harbertv.com/ http://sraviation.com//webstats/quarterly/	22 KB 7 KB	581ms 341ms	Document text/html	64.71.34.16 Affinity Internet
General Check archive.org Show headers Download Go to Full URL http://sraviation.com//webstats/quarterly/ Requested by Host: disq.us URL: http://disq.us/?url=http%3A%2F%2Fdemosite.harbertv.com&key=Pw9buIVY-BNK5DOd9_VnCA Protocol HTTP/1.1 Server 64.71.34.16 , United States, ASN3064 (AFFINITY-FTL - Affinity Internet, Inc, US), Reverse DNS Software Apache / PHP/5.6.40-1+hw2 Resource Hash `6a5f1e799e912d5e7c4c12bb7955deaf8374b64f2429b3ab4c2c055c057c901a` Request headers Host sraviation.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Referer http://disq.us/?url=http%3A%2F%2Fdemosite.harbertv.com&key=Pw9buIVY-BNK5DOd9_VnCA Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://disq.us/?url=http%3A%2F%2Fdemosite.harbertv.com&key=Pw9buIVY-BNK5DOd9_VnCA Response headers Date Fri, 06 Dec 2019 16:54:44 GMT Server Apache X-Powered-By PHP/5.6.40-1+hw2 Vary Accept-Encoding Content-Encoding gzip Content-Length 6465 Keep-Alive timeout=5, max=256 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Redirect headers Server nginx Date Fri, 06 Dec 2019 16:55:22 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection keep-alive X-Powered-By PHP/7.0.33 PleskLin Location http://sraviation.com//webstats/quarterly/
GET H/1.1	200 OK	31mqu6a6sydhthsyjzi3v5coe Show response static.licdn.com/sc/h/br/	70 KB 20 KB	531ms 512ms	Script text/javascript	2606:2800:233:1a99:2aa:1474:167d:2694 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://static.licdn.com/sc/h/br/31mqu6a6sydhthsyjzi3v5coe Requested by Host: sraviation.com URL: http://sraviation.com//webstats/quarterly/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1a99:2aa:1474:167d:2694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software Play / Resource Hash `1cfe4c996a730d4001d94dc792f36503e3d055aa129a1fbbb9f739180fa4a19e` Request headers Referer http://sraviation.com//webstats/quarterly/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers X-LI-Proto http/1.1 Date Wed, 30 Oct 2019 19:16:28 GMT Content-Encoding br X-CDN-CLIENT-IP-VERSION IPV6 X-cdn ECST X-LI-Static-Content 1 X-Cache MISS X-CDN-Proto HTTP1 X-Li-Pop prod-eda6 Content-Length 19607 X-LI-UUID eUzt1n7W3RXgkkmSfCsAAA== X-FS-UUID b91ac2c7c182d2158066a038b42a0000 Last-Modified Mon, 05 Nov 2012 04:00:51 GMT Server Play Content-Type text/javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto Cache-Control max-age=31536000, immutable Timing-Allow-Origin * X-Li-Fabric prod-ltx1 Expires Thu, 29 Oct 2020 19:16:28 GMT
GET H/1.1	200 OK	64qgwz5qqroaggxqxu6370jvs Show response static.licdn.com/sc/h/br/	185 KB 84 KB	28ms 9ms	Script text/javascript	2606:2800:233:1a99:2aa:1474:167d:2694 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://static.licdn.com/sc/h/br/64qgwz5qqroaggxqxu6370jvs Requested by Host: sraviation.com URL: http://sraviation.com//webstats/quarterly/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1a99:2aa:1474:167d:2694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (frc/8EA2) / Resource Hash `5439c1a615806b62849178f075c081bd09a195233477f3b324a1531c4bf20a4a` Request headers Referer http://sraviation.com//webstats/quarterly/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers X-LI-Proto http/1.1 Date Fri, 06 Dec 2019 16:54:44 GMT Content-Encoding br X-CDN-CLIENT-IP-VERSION IPV6 X-CDN ECST X-LI-Static-Content 1 X-Cache HIT X-CDN-Proto HTTP1 X-Li-Pop prod-eda6 Content-Length 85215 X-LI-UUID mbv2PmJA0hVQCdMgDSsAAA== X-FS-UUID 5bdaba67ac2dcc1500e2cbd2962b0000 Last-Modified Mon, 05 Nov 2012 04:00:51 GMT Server ECAcc (frc/8EA2) Vary Accept-Encoding Content-Type text/javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto Cache-Control max-age=31536000, immutable Accept-Ranges bytes Timing-Allow-Origin * X-Li-Fabric prod-lor1 Expires Fri, 09 Oct 2020 04:09:48 GMT
GET H/1.1	200 OK	39q1xngfynmqegl2ijphoun57 Show response static.licdn.com/sc/h/br/	63 KB 17 KB	526ms 507ms	Script text/javascript	2606:2800:233:1a99:2aa:1474:167d:2694 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://static.licdn.com/sc/h/br/39q1xngfynmqegl2ijphoun57 Requested by Host: sraviation.com URL: http://sraviation.com//webstats/quarterly/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1a99:2aa:1474:167d:2694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software Play / Resource Hash `7a911a2da379cea15d972eceae5a13918db397ae2110e20349d7323c60b1e446` Request headers Referer http://sraviation.com//webstats/quarterly/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers X-LI-Proto http/1.1 Date Wed, 09 Oct 2019 02:13:38 GMT Content-Encoding br X-CDN-CLIENT-IP-VERSION IPV6 X-cdn ECST X-LI-Static-Content 1 X-Cache MISS X-CDN-Proto HTTP1 X-Li-Pop prod-eda6 Content-Length 16606 X-LI-UUID LqUR137W3RUANyL1PisAAA== X-FS-UUID 3c60fe06c1d8cb15a08f3d925c2b0000 Last-Modified Mon, 05 Nov 2012 04:00:51 GMT Server Play Content-Type text/javascript Access-Control-Allow-Origin * Access-Control-Expose-Headers X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto Cache-Control max-age=31536000, immutable Timing-Allow-Origin * X-Li-Fabric prod-ltx1 Expires Thu, 08 Oct 2020 02:13:38 GMT
GET H/1.1	200 OK	%2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Forganic%2Fdesktop_en_US.css static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.647/f/	156 KB 18 KB	814ms 796ms	Stylesheet text/css	2606:2800:233:1a99:2aa:1474:167d:2694 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://static.licdn.com/sc/p/com.linkedin.checkpoint%3Acheckpoint-static-content%2B2.0.647/f/%2Fcheckpoint-frontend%2Fstylesheets%2Flogin%2Forganic%2Fdesktop_en_US.css Requested by Host: sraviation.com URL: http://sraviation.com//webstats/quarterly/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1a99:2aa:1474:167d:2694 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software Play / Resource Hash `203eaa07150030c25a469cc308b564930ece1e9268fc2cdd21de491036810b51` Request headers Referer http://sraviation.com//webstats/quarterly/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers X-LI-Proto http/1.1 Date Fri, 06 Dec 2019 16:54:45 GMT Content-Encoding gzip X-CDN-CLIENT-IP-VERSION IPV6 X-cdn ECST X-FS-TXN-ID 2ae3f310e910 X-Cache MISS X-CDN-Proto HTTP1 X-LI-Static-Content 1 X-Li-Pop prod-eda6 Content-Length 18214 X-LI-UUID y/kx137W3RXQc6nGOCsAAA== X-FS-UUID cbf931d77ed6dd15d073a9c6382b0000 Last-Modified Mon, 05 Nov 2012 04:00:51 GMT Server Play Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Access-Control-Expose-Headers X-CDN, X-CDN-CLIENT-IP-VERSION, X-CDN-Proto Cache-Control max-age=31536000, immutable Timing-Allow-Origin * X-Li-Fabric prod-ltx1 Expires Sat, 05 Dec 2020 16:54:45 GMT
POST H/1.1	200 OK	track Show response sraviation.com/li/	2 B 221 B	272ms 272ms	XHR text/html	64.71.34.16 Affinity Internet
General Check archive.org Show headers Download Go to Full URL http://sraviation.com/li/track Requested by Host: static.licdn.com URL: https://static.licdn.com/sc/h/br/39q1xngfynmqegl2ijphoun57 Protocol HTTP/1.1 Server 64.71.34.16 , United States, ASN3064 (AFFINITY-FTL - Affinity Internet, Inc, US), Reverse DNS Software Apache / PHP/5.6.40-1+hw2 Resource Hash `7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6` Request headers Csrf-Token Origin http://sraviation.com Referer http://sraviation.com//webstats/quarterly/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-type application/json Response headers Date Fri, 06 Dec 2019 16:54:45 GMT Server Apache Connection Keep-Alive X-Powered-By PHP/5.6.40-1+hw2 Content-Length 2 Keep-Alive timeout=5, max=255 Content-Type text/html; charset=UTF-8
POST H/1.1	200 OK	track Show response sraviation.com/li/	2 B 221 B	249ms 249ms	XHR text/html	64.71.34.16 Affinity Internet
General Check archive.org Show headers Download Go to Full URL http://sraviation.com/li/track Requested by Host: static.licdn.com URL: https://static.licdn.com/sc/h/br/39q1xngfynmqegl2ijphoun57 Protocol HTTP/1.1 Server 64.71.34.16 , United States, ASN3064 (AFFINITY-FTL - Affinity Internet, Inc, US), Reverse DNS Software Apache / PHP/5.6.40-1+hw2 Resource Hash `7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6` Request headers Referer http://sraviation.com//webstats/quarterly/ Origin http://sraviation.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 content-type application/json Response headers Date Fri, 06 Dec 2019 16:54:45 GMT Server Apache Connection Keep-Alive X-Powered-By PHP/5.6.40-1+hw2 Content-Length 2 Keep-Alive timeout=5, max=254 Content-Type text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: LinkedIn (Social Network)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

demosite.harbertv.com
disq.us
sraviation.com
static.licdn.com
151.101.64.64
2606:2800:233:1a99:2aa:1474:167d:2694
64.71.34.16
72.18.212.50
1cfe4c996a730d4001d94dc792f36503e3d055aa129a1fbbb9f739180fa4a19e
203eaa07150030c25a469cc308b564930ece1e9268fc2cdd21de491036810b51
5439c1a615806b62849178f075c081bd09a195233477f3b324a1531c4bf20a4a
6a5f1e799e912d5e7c4c12bb7955deaf8374b64f2429b3ab4c2c055c057c901a
7a911a2da379cea15d972eceae5a13918db397ae2110e20349d7323c60b1e446
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
9f88a302db0952284e77f90bb2602dda44d6b9c08d9af056ea221ac8c546a5b1

sraviation.com Open in urlscan Pro 64.71.34.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

50 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

1 Countries

147 kBTransfer

496 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

sraviation.com Open in urlscan Pro
64.71.34.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

50 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

147 kB
Transfer

496 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!