embassy-hotels.ro Open in urlscan Pro
185.92.194.170 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://embassy-hotels.ro/.well-known/ayauN/
Submission: On December 27 via manual (December 27th 2022, 9:59:03 pm UTC) from PH — Scanned from DE

Summary HTTP 14 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 5 domains to perform 14 HTTP transactions. The main IP is 185.92.194.170, located in Romania and belongs to H88_WEB_HOSTING_DC-CLJ, RO. The main domain is embassy-hotels.ro.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 4th 2022. Valid for: 3 months.

This is the only time embassy-hotels.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Qantas (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
4	185.92.194.170 185.92.194.170	44043 (H88_WEB_H...) (H88_WEB_HOSTING_DC-CLJ)
1	3.212.217.228 3.212.217.228	14618 (AMAZON-AES) (AMAZON-AES)
1	96.16.146.7 96.16.146.7	16625 (AKAMAI-AS) (AKAMAI-AS)
7	69.192.160.75 69.192.160.75	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:400d:80c::200a	15169 (GOOGLE) (GOOGLE)
14	6

4 185.92.194.170 (Romania)

ASN44043 (H88_WEB_HOSTING_DC-CLJ, RO)
PTR: 170-194-static.mxserver.ro

embassy-hotels.ro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.212.217.228 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-217-228.compute-1.amazonaws.com

qantas.resultspage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.16.146.7 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-146-7.deploy.static.akamaitechnologies.com

cdn.qantasloyalty.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 69.192.160.75 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-75.deploy.static.akamaitechnologies.com

www.qantas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80c::200a (Ireland)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	qantas.com www.qantas.com — Cisco Umbrella Rank: 37595	135 KB
4	embassy-hotels.ro embassy-hotels.ro	224 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 520	33 KB
1	qantasloyalty.com cdn.qantasloyalty.com — Cisco Umbrella Rank: 224823	557 B
1	resultspage.com qantas.resultspage.com — Cisco Umbrella Rank: 277227	1 KB
14	5

	Domain	Requested by
7	www.qantas.com	embassy-hotels.ro
4	embassy-hotels.ro	embassy-hotels.ro
1	ajax.googleapis.com	embassy-hotels.ro
1	cdn.qantasloyalty.com	embassy-hotels.ro
1	qantas.resultspage.com	embassy-hotels.ro
14	5

This site contains links to these domains. Also see Links.

Domain
www.qantas.com
travelinsider.qantas.com.au
help.qantas.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
instagram.com
www.jetstar.com

Subject Issuer	Validity	Valid
embassy-hotels.ro cPanel, Inc. Certification Authority	`2022-12-04` - `2023-03-04`	3 months	crt.sh
*.resultspage.com Starfield Secure Certificate Authority - G2	`2022-05-23` - `2023-05-21`	a year	crt.sh
qantasloyalty.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-26` - `2023-03-01`	4 months	crt.sh
qantas.com GeoTrust RSA CA 2018	`2022-09-20` - `2023-06-28`	9 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://embassy-hotels.ro/.well-known/ayauN/
Frame ID: 38BBCFBE7C55A9C5E9ED2A01411F4D95
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

error iconCheckbox

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/designs/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

394 kB
Transfer

1148 kB
Size

0
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://www.qantas.com/travel/airlines/viewing/global/en
Title: Upgrade my browser

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en.html

Search URL Search Domain Scan URL

URL: https://www.qantas.com/au/en/qantas-experience/network-and-partner-airlines/oneworld.html
Title: Oneworld

Search URL Search Domain Scan URL

URL: https://www.qantas.com/travelinsider/en.html
Title: Travel Insider

Search URL Search Domain Scan URL

URL: https://www.qantas.com/directconnect/affinity
Title: Where can I go?

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/travel-guides/australia.html?int_cam=us:en:travel-guides-au:nav:en:flights

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/flight-deals/flights-to-australia.html/au
Title: Flights to Australia

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/flight-deals/flights-to-new-zealand.html/nz
Title: Flights to New Zealand

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/flight-deals.html
Title: Flights to Japan

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/flight-deals/flights-to-singapore.html/sin
Title: Flights to Singapore

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/flight-deals/flights-to-vanuatu.html/nou
Title: Flights to New Caledonia

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/flight-deals/international/flights-to-australia.html/economy/all/lowest?int_cam=us:en:flight-deals-au:nav:en:flights

Search URL Search Domain Scan URL

URL: http://travelinsider.qantas.com.au/qantas-magazine
Title: Qantas magazineOpens external site

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/book-a-trip/flights/qantas-explorer.html?int_cam=us:en:qantas-explorer:nav:en:flights

Search URL Search Domain Scan URL

URL: http://www.qantas.com/travel/airlines/flight-deals/us/en
Title: Flights to Australia

Search URL Search Domain Scan URL

URL: https://www.qantas.com/detect-site/coronavirus.html
Title: COVID-19 information

Search URL Search Domain Scan URL

URL: https://www.qantas.com/detect-site/manage-booking.html
Title: Manage booking

Search URL Search Domain Scan URL

URL: https://www.qantas.com/travel/airlines/baggage/global/en
Title: baggage allowances

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/qantas-experience/australian-domestic-flight-network.html?int_cam=us:en:mega-nav:domestic-network:en:flights

Search URL Search Domain Scan URL

URL: https://help.qantas.com/support/s/
Title: Help Opens external site

Search URL Search Domain Scan URL

URL: https://www.qantas.com/au/en/frequent-flyer/discover-and-join/terms-and-conditions.html
Title: Terms and Conditions

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/travel-info/baggage/allowance-and-fees.html
Title: Baggage & Optional Service Fees

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/support/customer-service-plan.html
Title: Customer Service Plan

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/qantas-group.html
Title: Qantas Group

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/about-us/news-room.html
Title: News Room

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/about-us/qantas-careers.html
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/about-us/our-company/our-airline-partners/oneworld.html
Title: oneworld

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/about-us.html
Title: More about Qantas

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/100-years-of-the-spirit-of-australia.html
Title: Qantas Centenary

Search URL Search Domain Scan URL

URL: https://www.qantas.com/content/dam/qantas/pdfs/about-us/corporate-governance/modern-slavery-and-human-trafficking-statement.pdf
Title: Modern Slavery Act Statement

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Qantas/
Title: 1.4m+ likesOpens external site in a new window

Search URL Search Domain Scan URL

URL: https://twitter.com/Qantas
Title: 483k+ followersOpens external site in a new window

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/company/qantas
Title: 287k+ followersOpens external site in a new window

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/Qantas
Title: 93k+ subscribersOpens external site in a new window

Search URL Search Domain Scan URL

URL: http://instagram.com/Qantas
Title: 933k+ followersOpens external site in a new window

Search URL Search Domain Scan URL

URL: https://www.jetstar.com/
Title: JetstarOpens external site in a new window

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/support/essential-accessibility.html
Title: eSSENTIAL AccessibilityTM

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/support/privacy-and-security.html
Title: Privacy & Security

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/support/terms-of-use.html
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/book-a-trip/flights/conditions-of-carriage.html
Title: Conditions of Carriage

Search URL Search Domain Scan URL

URL: https://www.qantas.com/us/en/book-a-trip/flights/fare-types.html
Title: Fare types

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
embassy-hotels.ro/.well-known/ayauN/ 542 KB
99 KB 260ms
110ms Document
text/html 185.92.194.170
H88_WEB_HOSTING_D...

General

Check archive.org

Show headers Download Go to

Full URL: https://embassy-hotels.ro/.well-known/ayauN/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.92.194.170 , Romania, ASN44043 (H88_WEB_HOSTING_DC-CLJ, RO),
Reverse DNS: 170-194-static.mxserver.ro
Software: LiteSpeed /
Resource Hash: 7eb785bebf4d089bb85dd4af0ef23ee744a321e62f4e7ef1c4257cd25cd7ce3b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 27 Dec 2022 21:58:58 GMT
server: LiteSpeed
vary: Accept-Encoding

GET
H2 200 main.css
embassy-hotels.ro/.well-known/ayauN/ 210 KB
27 KB 77ms
76ms Stylesheet
text/css 185.92.194.170
H88_WEB_HOSTING_D...

General

Check archive.org

Show headers Download Go to

Full URL: https://embassy-hotels.ro/.well-known/ayauN/main.css
Requested by: Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.92.194.170 , Romania, ASN44043 (H88_WEB_HOSTING_DC-CLJ, RO),
Reverse DNS: 170-194-static.mxserver.ro
Software: LiteSpeed /
Resource Hash: e33bf0e24ad4a7482d68c48aa84a576e57bd3d8cdd3256de1e72f3b08bff4fed

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/.well-known/ayauN/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 21:58:58 GMT
content-encoding: br
last-modified: Sun, 06 Nov 2022 16:58:22 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 27931
expires: Tue, 03 Jan 2023 21:58:58 GMT

GET
H2 200 sli-rac.css
qantas.resultspage.com/autocomplete/ 4 KB
1 KB 385ms
114ms Stylesheet
text/css 3.212.217.228
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://qantas.resultspage.com/autocomplete/sli-rac.css
Requested by: Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.212.217.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-217-228.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 763a86d3b22b56dc063a25ec601d018d501c38aed49034fde8e2d3351f614f81

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 21:58:59 GMT
content-encoding: gzip
last-modified: Wed, 01 Jun 2022 06:41:39 GMT
server: Apache
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=432000
accept-ranges: bytes
content-length: 1063
expires: Sun, 01 Jan 2023 21:58:59 GMT

GET
H2 200 login.bundle.css
cdn.qantasloyalty.com/assets/widgets/login/v2/ 114 B
557 B 144ms
39ms Stylesheet
text/css 96.16.146.7
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.qantasloyalty.com/assets/widgets/login/v2/login.bundle.css

Requested by

Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.16.146.7 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-146-7.deploy.static.akamaitechnologies.com

Software

AmazonS3 /

Resource Hash

acfecce6970a2ec8db6bbf3a51bcec7b2936d8930b0b7c84a079a315adb7b6c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 21:58:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubdomains;
x-amz-request-id: VY1HWA63VDQHQH8N
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 111
x-amz-id-2: lrLnTlTpkj25oEkhp8moRKxlaaaWRFOsRQt+2e/2dS69Hhez4kzknfrrln0Kq9aRDjmMyXCj/vA=
x-xss-protection: 1; mode=block
last-modified: Thu, 28 Jul 2022 00:02:56 GMT
server: AmazonS3
etag: "19c524b09b676f62aceedac324b217b9"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=300
accept-ranges: bytes
expires: Tue, 27 Dec 2022 22:03:58 GMT

GET
H2 200 main-noncritical.min.39f8b7e771e1f7442c41e2b0eb8c5459.css
www.qantas.com/etc/designs/qcom/site/ 73 KB
10 KB 612ms
507ms Stylesheet
text/css 69.192.160.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.qantas.com/etc/designs/qcom/site/main-noncritical.min.39f8b7e771e1f7442c41e2b0eb8c5459.css

Requested by

Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

69.192.160.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a69-192-160-75.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

32ee1f32e2511ee7c44d19ac28c9813e7bfe22f88f6193d9b0fdee004ab1f575

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 344, 347, 288
date: Tue, 27 Dec 2022 21:58:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
x-edgeconnect-midmile-rtt: 0, 186, 21
content-length: 9374
x-xss-protection: 1; mode=block
last-modified: Tue, 06 Dec 2022 04:00:06 GMT
server: nginx
etag: "1244d-5ef20d6e3a380-gzip"
x-frame-options: SAMEORIGIN, SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=86400
accept-ranges: bytes
expires: Wed, 28 Dec 2022 21:58:59 GMT

GET
H2 200 qantas-masterbrand-logo-40px.svg
www.qantas.com/content/dam/qantas/logos/ 10 KB
3 KB 215ms
112ms Image
image/svg+xml 69.192.160.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.qantas.com/content/dam/qantas/logos/qantas-masterbrand-logo-40px.svg

Requested by

Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

69.192.160.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a69-192-160-75.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

abe83c8f1046deaa45805df9f097a32140095ea26d267b9761fc062c618513a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 288
date: Tue, 27 Dec 2022 21:58:59 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
x-edgeconnect-midmile-rtt: 0
content-length: 2759
x-xss-protection: 1; mode=block
last-modified: Tue, 06 Dec 2022 00:38:57 GMT
server: nginx
etag: "296a-5ef1e077c7944-gzip"
x-frame-options: SAMEORIGIN, SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=86400
accept-ranges: bytes
expires: Wed, 28 Dec 2022 21:58:59 GMT

GET
H2 200 escape-au.jpg
www.qantas.com/images/imb/img/190x440/ 39 KB
39 KB 224ms
121ms Image
image/jpeg 69.192.160.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.qantas.com/images/imb/img/190x440/escape-au.jpg

Requested by

Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

69.192.160.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a69-192-160-75.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

919f33e94bb4833d42df0eb8c637ec44270a37e2ac2ccbadeb5cb152d43a7eaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 21:58:59 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Dec 2022 19:22:30 GMT
server: Akamai Image Manager
etag: W/"2b4d6-5eead79812c07"
content-type: image/jpeg
cache-control: private, no-transform, max-age=86400
content-length: 39690
expires: Wed, 28 Dec 2022 21:58:59 GMT

GET
H2 200 Australia-flight-deals-190x135.jpg
www.qantas.com/images/imb/img/ 13 KB
13 KB 224ms
121ms Image
image/webp 69.192.160.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.qantas.com/images/imb/img/Australia-flight-deals-190x135.jpg

Requested by

Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

69.192.160.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a69-192-160-75.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

4e3fd3dafb08962cea8a9dabb8fe9589a7f963b1681dec376e92be7a4c7c009f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 134
date: Tue, 27 Dec 2022 21:58:59 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 04 Dec 2022 22:53:08 GMT
x-serial: 846
server: Akamai Image Manager
x-check-cacheable: YES
x-edgeconnect-midmile-rtt: 23
etag: W/"d5ca-5ee90eb8daabd"
content-type: image/webp
cache-control: private, no-transform, max-age=86400
content-length: 13004
expires: Wed, 28 Dec 2022 21:58:59 GMT

GET
H2 200 qantas-explorer.jpg
www.qantas.com/images/imb/img/190x440/ 40 KB
40 KB 226ms
123ms Image
image/jpeg 69.192.160.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.qantas.com/images/imb/img/190x440/qantas-explorer.jpg

Requested by

Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

69.192.160.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a69-192-160-75.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

ca0a6f20703633710b9a3c359c806e5023ea01774d70347df97f384bc2406325

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 155, 155, 155
date: Tue, 27 Dec 2022 21:58:59 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 16 Dec 2022 19:22:31 GMT
x-serial: 1404
server: Akamai Image Manager
x-check-cacheable: YES
x-edgeconnect-midmile-rtt: 23, 23, 35
etag: W/"2c260-5ee90eb8f19ee"
content-type: image/jpeg
cache-control: private, no-transform, max-age=86400
content-length: 40507
expires: Wed, 28 Dec 2022 21:58:59 GMT

GET
H2 200 australian-domestic-network-190x440.jpg
www.qantas.com/images/imb/img/190x440/ 17 KB
18 KB 208ms
113ms Image
image/webp 69.192.160.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.qantas.com/images/imb/img/190x440/australian-domestic-network-190x440.jpg

Requested by

Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

69.192.160.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a69-192-160-75.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

48800ae8a0e7fc928d7acaa7830f9a746caa250031be363b85c1329831b0eada

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 1047
date: Tue, 27 Dec 2022 21:58:59 GMT
strict-transport-security: max-age=31536000
last-modified: Sun, 04 Dec 2022 22:55:57 GMT
x-serial: 262
server: Akamai Image Manager
x-check-cacheable: YES
x-edgeconnect-midmile-rtt: 34
etag: "b2c2-5eed4c0354170"
content-type: image/webp
cache-control: private, no-transform, max-age=86400
content-length: 17718
expires: Wed, 28 Dec 2022 21:58:59 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ 90 KB
33 KB 131ms
37ms Script
text/javascript 2a00:1450:400d:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 04:21:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63429
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33018
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Dec 2023 04:21:50 GMT

GET
H2 200 spritesheet-9632fb7044385395ce89846b873ea4e3.png
www.qantas.com/etc/designs/qantas/global/img/ 12 KB
12 KB 43ms
42ms Image
image/webp 69.192.160.75
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.qantas.com/etc/designs/qantas/global/img/spritesheet-9632fb7044385395ce89846b873ea4e3.png

Requested by

Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/main.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

69.192.160.75 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a69-192-160-75.deploy.static.akamaitechnologies.com

Software

Akamai Image Manager /

Resource Hash

7f98d1f53ea0be02728304816c55187a55cc16f4ac6a015b3ec60946e1d51c15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://embassy-hotels.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 930
date: Tue, 27 Dec 2022 21:58:59 GMT
strict-transport-security: max-age=31536000
last-modified: Wed, 09 Nov 2022 00:45:19 GMT
x-serial: 434
server: Akamai Image Manager
x-check-cacheable: YES
x-edgeconnect-midmile-rtt: 34
etag: "64de-5ec0ba34fa47c"
content-type: image/webp
cache-control: private, no-transform, max-age=86400
content-length: 12318
expires: Wed, 28 Dec 2022 21:58:59 GMT

GET
H2 200 315CA1_3_0.woff2
embassy-hotels.ro/.well-known/ayauN/ 48 KB
48 KB 46ms
46ms Font
font/woff2 185.92.194.170
H88_WEB_HOSTING_D...

General

Check archive.org

Show headers Download Go to

Full URL: https://embassy-hotels.ro/.well-known/ayauN/315CA1_3_0.woff2
Requested by: Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.92.194.170 , Romania, ASN44043 (H88_WEB_HOSTING_DC-CLJ, RO),
Reverse DNS: 170-194-static.mxserver.ro
Software: LiteSpeed /
Resource Hash: b2b64e5d45e5f4911d34343f60b7d15ba57d7ce1e4cc5dd69ac424bb79d84455

Request headers

Referer: https://embassy-hotels.ro/.well-known/ayauN/main.css
Origin: https://embassy-hotels.ro
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 21:58:59 GMT
last-modified: Sun, 06 Nov 2022 01:09:34 GMT
server: LiteSpeed
content-type: font/woff2
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 49421
expires: Tue, 03 Jan 2023 21:58:59 GMT

GET
DATA 200
OK truncated
/ 736 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 445b7df4c1fa8a4f1847e39edc7476fb8bec4c9e7aa3c4127ce4e61a300f6e00

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 315CA1_1_0.woff2
embassy-hotels.ro/.well-known/ayauN/ 49 KB
49 KB 66ms
66ms Font
font/woff2 185.92.194.170
H88_WEB_HOSTING_D...

General

Check archive.org

Show headers Download Go to

Full URL: https://embassy-hotels.ro/.well-known/ayauN/315CA1_1_0.woff2
Requested by: Host: embassy-hotels.ro
URL: https://embassy-hotels.ro/.well-known/ayauN/main.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.92.194.170 , Romania, ASN44043 (H88_WEB_HOSTING_DC-CLJ, RO),
Reverse DNS: 170-194-static.mxserver.ro
Software: LiteSpeed /
Resource Hash: b964d246defe2ccf6dd3a0d3887ac9d09325a866b94bd57732219406654698a2

Request headers

Referer: https://embassy-hotels.ro/.well-known/ayauN/main.css
Origin: https://embassy-hotels.ro
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Tue, 27 Dec 2022 21:58:59 GMT
last-modified: Sun, 06 Nov 2022 01:10:02 GMT
server: LiteSpeed
content-type: font/woff2
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 49864
expires: Tue, 03 Jan 2023 21:58:59 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Qantas (Transportation)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.qantasloyalty.com
embassy-hotels.ro
qantas.resultspage.com
www.qantas.com
185.92.194.170
2a00:1450:400d:80c::200a
3.212.217.228
69.192.160.75
96.16.146.7
32ee1f32e2511ee7c44d19ac28c9813e7bfe22f88f6193d9b0fdee004ab1f575
445b7df4c1fa8a4f1847e39edc7476fb8bec4c9e7aa3c4127ce4e61a300f6e00
48800ae8a0e7fc928d7acaa7830f9a746caa250031be363b85c1329831b0eada
4e3fd3dafb08962cea8a9dabb8fe9589a7f963b1681dec376e92be7a4c7c009f
763a86d3b22b56dc063a25ec601d018d501c38aed49034fde8e2d3351f614f81
7eb785bebf4d089bb85dd4af0ef23ee744a321e62f4e7ef1c4257cd25cd7ce3b
7f98d1f53ea0be02728304816c55187a55cc16f4ac6a015b3ec60946e1d51c15
919f33e94bb4833d42df0eb8c637ec44270a37e2ac2ccbadeb5cb152d43a7eaf
abe83c8f1046deaa45805df9f097a32140095ea26d267b9761fc062c618513a1
acfecce6970a2ec8db6bbf3a51bcec7b2936d8930b0b7c84a079a315adb7b6c3
b2b64e5d45e5f4911d34343f60b7d15ba57d7ce1e4cc5dd69ac424bb79d84455
b964d246defe2ccf6dd3a0d3887ac9d09325a866b94bd57732219406654698a2
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
ca0a6f20703633710b9a3c359c806e5023ea01774d70347df97f384bc2406325
e33bf0e24ad4a7482d68c48aa84a576e57bd3d8cdd3256de1e72f3b08bff4fed

embassy-hotels.ro Open in urlscan Pro 185.92.194.170 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

20 %IPv6

5 Domains

5 Subdomains

6 IPs

4 Countries

394 kBTransfer

1148 kBSize

0 Cookies

41 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

0 Cookies

Indicators

embassy-hotels.ro Open in urlscan Pro
185.92.194.170 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

394 kB
Transfer

1148 kB
Size

0
Cookies

14 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!