www.adorcasitas.com - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main IP is 185.42.104.95, located in Spain and belongs to CDMON sistemes@cdmon.com, ES. The main domain is www.adorcasitas.com.
TLS certificate: Issued by R3 on February 17th 2024. Valid for: 3 months.

This is the only time www.adorcasitas.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Emirates (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	204.154.174.31 204.154.174.31	174 (COGENT-174) (COGENT-174)
1 5	185.42.104.95 185.42.104.95	197712 (CDMON sis...) (CDMON sistemes@cdmon.com)
1	96.7.74.34 96.7.74.34	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	3

1 204.154.174.31 (Canada) 1 redirects

ASN174 (COGENT-174, US)

app.cyberimpact.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.42.104.95 (Spain) 1 redirects

ASN197712 (CDMON sistemes@cdmon.com, ES)
PTR: vxhco-29.srv.cat

www.adorcasitas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.7.74.34 (Ashburn, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a96-7-74-34.deploy.static.akamaitechnologies.com

c.ekstatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	adorcasitas.com 1 redirects www.adorcasitas.com	85 KB
1	ekstatic.net c.ekstatic.net — Cisco Umbrella Rank: 104701	70 KB
1	cyberimpact.com 1 redirects app.cyberimpact.com — Cisco Umbrella Rank: 495007	910 B
5	3

	Domain	Requested by
5	www.adorcasitas.com	1 redirects www.adorcasitas.com
1	c.ekstatic.net	www.adorcasitas.com
1	app.cyberimpact.com	1 redirects
5	3

This site contains no links.

Subject Issuer	Validity	Valid
*.adorcasitas.com R3	`2024-02-17` - `2024-05-17`	3 months	crt.sh
ekstatic.net DigiCert TLS RSA SHA256 2020 CA1	`2023-11-20` - `2024-11-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.adorcasitas.com/flyemirates/
Frame ID: DBE9D5F072F2EB02F3B56FA692AAAD20
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login to Emirates | Emirates Canada

Page URL History Show full URLs

https://app.cyberimpact.com/click-tracking?ct=RCoSk7laNCy9LOeZnvyXkmr85CT5lyrzF0yWnZ3ms_w7_umLkjFTWy_gSS... HTTP 302
https://www.adorcasitas.com/flyemirates HTTP 301
https://www.adorcasitas.com/flyemirates/ Page URL

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

155 kB
Transfer

162 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://app.cyberimpact.com/click-tracking?ct=RCoSk7laNCy9LOeZnvyXkmr85CT5lyrzF0yWnZ3ms_w7_umLkjFTWy_gSShgLm0lGGiRS-iDSDVKSGRCByb3PCDp80JOGm4DQPqMdbohQPw~ HTTP 302
https://www.adorcasitas.com/flyemirates HTTP 301
https://www.adorcasitas.com/flyemirates/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.adorcasitas.com/flyemirates/
Redirect Chain

https://app.cyberimpact.com/click-tracking?ct=RCoSk7laNCy9LOeZnvyXkmr85CT5lyrzF0yWnZ3ms_w7_umLkjFTWy_gSShgLm0lGGiRS-iDSDVKSGRCByb3PCDp80JOGm4DQPqMdbohQPw~
https://www.adorcasitas.com/flyemirates
https://www.adorcasitas.com/flyemirates/

4 KB
2 KB

1826ms
1825ms

Document
text/html

185.42.104.95
CDMON sistemes@cd...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adorcasitas.com/flyemirates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.42.104.95 , Spain, ASN197712 (CDMON sistemes@cdmon.com, ES),
Reverse DNS: vxhco-29.srv.cat
Software: Apache /
Resource Hash: 17d62de4faabd2d8dc368b2690de8e3a64bcff9d7772efd0f6f6ad2e18cc58a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 1793
content-type: text/html; charset=UTF-8
date: Sun, 18 Feb 2024 14:59:16 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache
vary: Accept-Encoding

Redirect headers

content-length: 248
content-type: text/html; charset=iso-8859-1
date: Sun, 18 Feb 2024 14:59:15 GMT
location: https://www.adorcasitas.com/flyemirates/
server: Apache

GET
H2 200 ecss.css
www.adorcasitas.com/flyemirates/ecss/ 7 KB
2 KB 317ms
316ms Stylesheet
text/css 185.42.104.95
CDMON sistemes@cd...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.adorcasitas.com/flyemirates/ecss/ecss.css
Requested by: Host: www.adorcasitas.com
URL: https://www.adorcasitas.com/flyemirates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.42.104.95 , Spain, ASN197712 (CDMON sistemes@cdmon.com, ES),
Reverse DNS: vxhco-29.srv.cat
Software: Apache /
Resource Hash: fc3ad9e215b8a567f28176f00f7e91cd43c7ce1d6b45e9fc76f582bfa15a00f3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.adorcasitas.com/flyemirates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Sun, 18 Feb 2024 14:59:18 GMT
content-encoding: gzip
last-modified: Thu, 07 Sep 2023 10:40:42 GMT
server: Apache
etag: "1c2d-604c27ddbfe80-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 2154

GET
H2 200 or.svg
www.adorcasitas.com/flyemirates/efiles/ 768 B
860 B 204ms
204ms Image
image/svg+xml 185.42.104.95
CDMON sistemes@cd...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adorcasitas.com/flyemirates/efiles/or.svg
Requested by: Host: www.adorcasitas.com
URL: https://www.adorcasitas.com/flyemirates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.42.104.95 , Spain, ASN197712 (CDMON sistemes@cdmon.com, ES),
Reverse DNS: vxhco-29.srv.cat
Software: Apache /
Resource Hash: f4753a2e3b7ff295dd2181b679fbfd1cbb36f9a6be875fc4a4e5aa41bc1d6ae8

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.adorcasitas.com/flyemirates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Sun, 18 Feb 2024 14:59:18 GMT
last-modified: Thu, 07 Sep 2023 00:12:56 GMT
server: Apache
accept-ranges: bytes
etag: "300-604b9b8ca7200"
content-length: 768
content-type: image/svg+xml

GET
H2 200 fpc.PNG
www.adorcasitas.com/flyemirates/efiles/ 79 KB
80 KB 204ms
203ms Image
image/png 185.42.104.95
CDMON sistemes@cd...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.adorcasitas.com/flyemirates/efiles/fpc.PNG
Requested by: Host: www.adorcasitas.com
URL: https://www.adorcasitas.com/flyemirates/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.42.104.95 , Spain, ASN197712 (CDMON sistemes@cdmon.com, ES),
Reverse DNS: vxhco-29.srv.cat
Software: Apache /
Resource Hash: 8d3677b388a082e7d8ba69c6caf0919af32edb891bfe7e47f737ec23d25ab336

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.adorcasitas.com/flyemirates/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Sun, 18 Feb 2024 14:59:18 GMT
last-modified: Wed, 06 Sep 2023 23:34:08 GMT
server: Apache
accept-ranges: bytes
etag: "13d56-604b92e07fc00"
content-length: 81238
content-type: image/png

GET
DATA 200
OK truncated
/ 802 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7254863d0534eeff30cd26edc17ed0c7f2019653f99c4b187df75377c9ca517

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 emirates-bold-v3.woff2
c.ekstatic.net/shared/fonts/emirates/ 70 KB
70 KB 497ms
169ms Font
font/woff2 96.7.74.34
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c.ekstatic.net/shared/fonts/emirates/emirates-bold-v3.woff2

Requested by

Host: www.adorcasitas.com
URL: https://www.adorcasitas.com/flyemirates/ecss/ecss.css

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

96.7.74.34 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a96-7-74-34.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

d248c3da063ad6809ea77cba7a45e7773a143983c5b0e7c09d9b8725f635988f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://www.adorcasitas.com/
Origin: https://www.adorcasitas.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date: Sun, 18 Feb 2024 14:59:19 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
last-modified: Sun, 15 Nov 2020 09:16:32 GMT
etag: "4240d8feaa51e249410011489a23e492:1605431792.574995"
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=15552000
accept-ranges: bytes
alt-svc: h3=":443"; ma=3600
content-length: 71512
x-ek-source: NS

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Emirates (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.cyberimpact.com/	1969-12-31 23:59:59	Name: csrf_token Value: cee78b4e7e800bac6d8bfc1aa8e34352
app.cyberimpact.com/	1970-01-20 18:31:15	Name: cisession Value: t9uf8sbcc1bsdmh2vntbga3kngdpch32
www.adorcasitas.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0q4o11m9loua7q0cqmr2kn7pdsodpjni

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.adorcasitas.com/flyemirates/(Line 4) Message: The key "" is not recognized and ignored.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.cyberimpact.com
c.ekstatic.net
www.adorcasitas.com
185.42.104.95
204.154.174.31
96.7.74.34
17d62de4faabd2d8dc368b2690de8e3a64bcff9d7772efd0f6f6ad2e18cc58a4
8d3677b388a082e7d8ba69c6caf0919af32edb891bfe7e47f737ec23d25ab336
d248c3da063ad6809ea77cba7a45e7773a143983c5b0e7c09d9b8725f635988f
f4753a2e3b7ff295dd2181b679fbfd1cbb36f9a6be875fc4a4e5aa41bc1d6ae8
f7254863d0534eeff30cd26edc17ed0c7f2019653f99c4b187df75377c9ca517
fc3ad9e215b8a567f28176f00f7e91cd43c7ce1d6b45e9fc76f582bfa15a00f3

www.adorcasitas.com Open in urlscan Pro 185.42.104.95 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

155 kBTransfer

162 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

3 Cookies

1 Console Messages

Indicators

www.adorcasitas.com Open in urlscan Pro
185.42.104.95 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

155 kB
Transfer

162 kB
Size

3
Cookies

5 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!