ssl.help-add.com
Open in
urlscan Pro
160.153.128.33
Malicious Activity!
Public Scan
Effective URL: http://ssl.help-add.com/verification/MCA92812D76M6D1854B4/index.php?country.x=-&lang.x=en
Submission: On May 07 via manual from IN
Summary
This is the only time ssl.help-add.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Airbnb (Hospitality)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.118.35 167.89.118.35 | 11377 (SENDGRID) (SENDGRID) | |
1 2 | 160.153.128.33 160.153.128.33 | 21501 (GODADDY-AMS) (GODADDY-AMS) | |
11 | 2.18.232.67 2.18.232.67 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 2a00:1450:400... 2a00:1450:4001:809::200e | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:400c:c08::9b | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:815::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:814::2003 | 15169 (GOOGLE) (GOOGLE) | |
15 | 5 |
ASN11377 (SENDGRID, US)
PTR: o16789118x35.outbound-mail.sendgrid.net
u2880300.ct.sendgrid.net |
ASN21501 (GODADDY-AMS, DE)
PTR: ip-160-153-128-33.ip.secureserver.net
ssl.help-add.com |
ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-67.deploy.static.akamaitechnologies.com
a0.muscache.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
muscache.com
a0.muscache.com |
528 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
2 |
help-add.com
1 redirects
ssl.help-add.com |
11 KB |
1 |
google.de
www.google.de |
109 B |
1 |
google.com
1 redirects
www.google.com |
179 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net |
163 B |
1 |
sendgrid.net
1 redirects
u2880300.ct.sendgrid.net |
227 B |
15 | 7 |
Domain | Requested by | |
---|---|---|
11 | a0.muscache.com |
ssl.help-add.com
|
2 | www.google-analytics.com |
ssl.help-add.com
|
2 | ssl.help-add.com | 1 redirects |
1 | www.google.de |
ssl.help-add.com
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
1 | u2880300.ct.sendgrid.net | 1 redirects |
15 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.airbnb.com DigiCert SHA2 Extended Validation Server CA |
2018-05-31 - 2020-06-04 |
2 years | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-04-07 - 2020-06-30 |
3 months | crt.sh |
www.google.de GTS CA 1O1 |
2020-04-07 - 2020-06-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://ssl.help-add.com/verification/MCA92812D76M6D1854B4/index.php?country.x=-&lang.x=en
Frame ID: BFB813B0379FFBA8572C608CBA343A60
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://u2880300.ct.sendgrid.net/ls/click?upn=sNnibqma3tlME50VxF3S9-2B1tL3jMh9gz430I6kADEgDn1N0CsOLbyzOwzc0Y2...
HTTP 302
http://ssl.help-add.com/ HTTP 302
http://ssl.help-add.com/verification/MCA92812D76M6D1854B4/index.php?country.x=-&lang.x=en Page URL
Detected technologies
Ruby (Programming Languages) ExpandDetected patterns
- meta csrf-param /^authenticity_token$/i
Ruby on Rails (Web Frameworks) Expand
Detected patterns
- meta csrf-param /^authenticity_token$/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- html /googletagmanager\.com\/ns\.html[^>]+><\/iframe>/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://u2880300.ct.sendgrid.net/ls/click?upn=sNnibqma3tlME50VxF3S9-2B1tL3jMh9gz430I6kADEgDn1N0CsOLbyzOwzc0Y2qN5sNtV_UtOE5nT3mEkT3-2Fcw419AkQPLG3iOOBbxB4MT720pHcOn3x0xGNhw5iKUHGSnxl-2B-2F-2BWSXpNLhkI0InmmKiUKsqn8OOgBGY-2FPxSCRb9skmuQTJbIh41fTtIAhNeXo-2Fd-2F1MBD1Av-2FF5QJamheS-2F8tSk2iLOQyRP8Dh5wRZXWbFPuMb6Oj0Yl-2BXC3xJ0yMfCCa4ihp1qNCgRl55edn8sZIbyQGZwEBzmrQebLwytgBQ6Bjg-3D
HTTP 302
http://ssl.help-add.com/ HTTP 302
http://ssl.help-add.com/verification/MCA92812D76M6D1854B4/index.php?country.x=-&lang.x=en Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 15- https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2725447-1&cid=919066595.1588809827&jid=276304337&gjid=1360235407&_gid=1889052604.1588809827&_u=IGBAiEABB~&z=1768200527 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2725447-1&cid=919066595.1588809827&jid=276304337&_v=j81&z=1768200527 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2725447-1&cid=919066595.1588809827&jid=276304337&_v=j81&z=1768200527&slf_rd=1&random=3722045425
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.php
ssl.help-add.com/verification/MCA92812D76M6D1854B4/ Redirect Chain
|
38 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common_o2.1-8d41663e2369a993e9cff5721fe3e5ab.css
a0.muscache.com/airbnb/static/packages/ |
208 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common-1d683b61e4e176146bd02b67fa539f49.css
a0.muscache.com/airbnb/static/packages/ |
290 KB 104 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signinup-054b06337494ba9bc92696dc56d55dcb.css
a0.muscache.com/airbnb/static/ |
491 B 822 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cdn_provider-955038e0686ec92cb7402ca76b957d11.js
a0.muscache.com/airbnb/static/packages/ |
39 B 672 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core.bundle-eef60f1d9f864489a26b.js
a0.muscache.com/airbnb/static/packages/ |
1 MB 229 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signup_login.bundle-18bba9c3db9e4cf5cb93.js
a0.muscache.com/airbnb/static/packages/ |
625 B 886 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
site_footer.bundle-79acdd81c7378a736f30.js
a0.muscache.com/airbnb/static/packages/mystique/site_footer/ |
44 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
44 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
970 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
282 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Circular_Air-Book-f016908d84431f0566776240dc8652fc.woff2
a0.muscache.com/airbnb/static/airbnb-o2/fonts/ |
52 KB 53 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
airglyphs-701f40935e70e54947e28932ff4c09cc.woff
a0.muscache.com/airbnb/static/airbnb-o2/fonts/ |
46 KB 47 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
text-field-icons-72d5ec863b1ef7c22391015ec8af5906.png
a0.muscache.com/airbnb/static/signinup/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Circular_Air-Bold-c6b068854263ae24ccc36a2b944d7017.woff2
a0.muscache.com/airbnb/static/airbnb-o2/fonts/ |
56 KB 56 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/ |
35 B 99 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 109 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Airbnb (Hospitality)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate number| sherlock_firstbyte string| GoogleAnalyticsObject function| ga string| WWW_CDN_PROVIDER string| MUSCACHE_CDN_PROVIDER function| webpackJsonp object| google_tag_data object| gaplugins object| gaGlobal object| gaData4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.help-add.com/ | Name: _gat Value: 1 |
|
.help-add.com/ | Name: _gid Value: GA1.2.1889052604.1588809827 |
|
.help-add.com/ | Name: _ga Value: GA1.2.919066595.1588809827 |
|
ssl.help-add.com/ | Name: PHPSESSID Value: 495fc2000e01f50b83286200c9f0e741 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a0.muscache.com
ssl.help-add.com
stats.g.doubleclick.net
u2880300.ct.sendgrid.net
www.google-analytics.com
www.google.com
www.google.de
160.153.128.33
167.89.118.35
2.18.232.67
2a00:1450:4001:809::200e
2a00:1450:4001:814::2003
2a00:1450:4001:815::2004
2a00:1450:400c:c08::9b
0e3d9ab5a30dec0b91a6402a8aa2249dd0dc0dc0ce64db2efc46954e1d24a88a
2a6c4050d884faeda02b94ae2d14b5575336afe228efb7425a94a95186db7b22
5044429ff04937d3479ad32b5d9bca8a391e341f2fb44f873a7e690ec29d3faf
5436e0d46c4bdbb188cb2cb5f98e9453f7edec161c16185c71844ccd0c39e5f8
55248d62295e67c532e6c416035df0aa72ee7fccb036417eb9096acbce3d908e
6f749afca5240fb6bb7420e807ce9494c556649bbd7fffc4fa55ea2fc73cf703
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
93fa04524dd4d53e5a06985f8bc7b60f294b221d4cf4acdb2eff8004377ea6b8
a8aa80553b033481759a0bae4dd0d1875fcebbd18199518989f851d099ea806b
a9a09d90e8e4e2d156371a9a5dc01c9b74ff26c256a09515926524f4189c3751
aca6a0a68b8b35d0a59eca7cb7208f897a9eaafd3a3da4d2362649a9e7a3becf
b411e8881ea5ee22a68a773acd1663eb636b0a0839e95ac621d2dc91f6399aa2
bd9ed6b4d5601be14ff1b008d3423bb68960a29fed4df9018a6e416065779ef0
e514ec60916679980b58e69e3ef3b1a913ef639d73684f4705104abcabe98d46
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fd49a19bd76311e3c99ea977a2cd21e02a44b69819b580a9c239a1a5cf873f07