greenappletravel.ae - urlscan.io

Summary

This website contacted 6 IPs in 5 countries across 5 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3031::6815:2ed4, located in United States and belongs to CLOUDFLARENET, US. The main domain is greenappletravel.ae.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 15th 2020. Valid for: a year.

This is the only time greenappletravel.ae was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	163.172.102.219 163.172.102.219	12876 (Online SAS) (Online SAS)
1 2	2606:4700:303... 2606:4700:3031::6815:2ed4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80e::2004	15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
1 1	74.3.136.66 74.3.136.66	6327 (SHAW) (SHAW)
1	74.3.136.79 74.3.136.79	6327 (SHAW) (SHAW)
1	2a00:1450:400... 2a00:1450:4001:812::2004	15169 (GOOGLE) (GOOGLE)
6	6

1 163.172.102.219 (France)

ASN12876 (Online SAS, FR)
PTR: server.x-des.com

redseaco.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3031::6815:2ed4 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

greenappletravel.ae	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.3.136.66 (Kelowna, Canada) 1 redirects

ASN6327 (SHAW, CA)
PTR: h74-3-136-66.bigpipeinc.com

kelowna.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.3.136.79 (Kelowna, Canada)

ASN6327 (SHAW, CA)
PTR: h74-3-136-79.bigpipeinc.com

www.kelowna.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	kelowna.ca 1 redirects kelowna.ca www.kelowna.ca	443 B
2	google.com www.google.com	3 KB
2	greenappletravel.ae 1 redirects greenappletravel.ae	3 KB
1	jquery.com code.jquery.com	30 KB
1	redseaco.net redseaco.net	566 B
6	5

	Domain	Requested by
2	www.google.com	greenappletravel.ae
2	greenappletravel.ae	1 redirects redseaco.net
1	www.kelowna.ca	greenappletravel.ae
1	kelowna.ca	1 redirects
1	code.jquery.com	greenappletravel.ae
1	redseaco.net
6	6

This site contains no links.

Subject Issuer	Validity	Valid
redseaco.net cPanel, Inc. Certification Authority	`2021-02-08` - `2021-05-09`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-15` - `2021-08-15`	a year	crt.sh
www.google.com GTS CA 1O1	`2021-03-11` - `2021-06-03`	3 months	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
*.kelowna.ca Sectigo RSA Organization Validation Secure Server CA	`2020-01-07` - `2022-04-10`	2 years	crt.sh
*.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://greenappletravel.ae/modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca
Frame ID: 407270DA2D0EB74CFF3F17F0D703847A
Requests: 5 HTTP requests in this frame

Frame: https://www.kelowna.ca/
Frame ID: 5BB6A28AEB47395D29B55D28D6417D23
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://redseaco.net/js.html?email=financeap@kelowna.ca Page URL
https://greenappletravel.ae/modules/index.php?email=financeap@kelowna.ca HTTP 302
https://greenappletravel.ae/modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e4... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

57 %
IPv6

5
Domains

6
Subdomains

6
IPs

5
Countries

35 kB
Transfer

93 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://redseaco.net/js.html?email=financeap@kelowna.ca Page URL
https://greenappletravel.ae/modules/index.php?email=financeap@kelowna.ca HTTP 302
https://greenappletravel.ae/modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://kelowna.ca/ HTTP 301
https://www.kelowna.ca/

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 js.html Show response
redseaco.net/ 584 B
566 B 178ms
61ms Document
text/html 163.172.102.219
Online SAS

General

Check archive.org

Show headers Download Go to

Full URL

https://redseaco.net/js.html?email=financeap@kelowna.ca

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

163.172.102.219 , France, ASN12876 (Online SAS, FR),

Reverse DNS

server.x-des.com

Software

nginx /

Resource Hash

a41016be26d6d45bd9e4cdbf5c6d7952d7bb380c5e9d40a940bab175d9613b94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: redseaco.net
:scheme: https
:path: /js.html?email=financeap@kelowna.ca
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Thu, 25 Mar 2021 13:51:53 GMT
content-type: text/html
vary: Accept-Encoding
last-modified: Wed, 24 Mar 2021 11:23:40 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-upstream-cache-status: EXPIRED
x-server-powered-by: Engintron
content-encoding: gzip

GET
H2

200

Primary Request mail.php Show response
greenappletravel.ae/modules/
Redirect Chain

https://greenappletravel.ae/modules/index.php?email=financeap@kelowna.ca
https://greenappletravel.ae/modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca

6 KB
2 KB

352ms
352ms

Document
text/html

2606:4700:3031::6815:2ed4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://greenappletravel.ae/modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca
Requested by: Host: redseaco.net
URL: https://redseaco.net/js.html?email=financeap@kelowna.ca
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:2ed4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ccf7f030bd6fb15bb5331b5fddb741e31d0142583989c63a04397b1bc22f126

Request headers

:method: GET
:authority: greenappletravel.ae
:scheme: https
:path: /modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://redseaco.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=d69719b5ea63f8a4ffec637bae6e1d29a1616680313; PHPSESSID=pjtjhi68rl3ous5ulf966718o4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://redseaco.net/js.html?email=financeap@kelowna.ca

Response headers

date: Thu, 25 Mar 2021 13:51:54 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
cf-request-id: 090b40fc9d0000dfad78a90000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZvUs6jp%2Ba4Pmt8Z2Ngnq6JWQOnzJz8YnE1G4smxgRnGTXbazCEIlX9nhWJG3%2BKs0EbHAmgLo65XLYD6eVnh1Zjpal2YTPUQ4Uitb3SUBRvmHok5eLhgAL2jXoyvxoq9R"}],"max_age":604800,"group":"cf-nel"}
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
cf-ray: 63589dda9c67dfad-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date: Thu, 25 Mar 2021 13:51:54 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d69719b5ea63f8a4ffec637bae6e1d29a1616680313; expires=Sat, 24-Apr-21 13:51:53 GMT; path=/; domain=.greenappletravel.ae; HttpOnly; SameSite=Lax; Secure PHPSESSID=pjtjhi68rl3ous5ulf966718o4; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
location: mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca
cf-cache-status: DYNAMIC
cf-request-id: 090b40faf00000dfad8bbd1000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bWOMbMqqeeNjy2%2FUDHK3AwHZnMMvCVj4lfUnAsUJ%2BVc8gBsF9N4cOv5OID%2FN%2F%2BLujvCs5KS3R%2FKymNB38DxwJ01exxG29d8OlLMqZRjAIt7h3ab8SzjvVN%2Bi5L%2B2exYL"}],"max_age":604800,"group":"cf-nel"}
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
cf-ray: 63589dd7e94cdfad-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 favicons
www.google.com/s2/ 901 B
1 KB 7ms
7ms Image
image/png 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/s2/favicons?domain=http://kelowna.ca

Requested by

Host: greenappletravel.ae
URL: https://greenappletravel.ae/modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ce3fb814619e50d3b045f300540bcee696a86968b94e1cf6edbde19306e06085

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-NdaOKfWbd6hlbuKu9QmyKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-NdaOKfWbd6hlbuKu9QmyKg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://greenappletravel.ae/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 13:50:00 GMT
x-content-type-options: nosniff
server: ESF
age: 114
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'report-sample' 'nonce-NdaOKfWbd6hlbuKu9QmyKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-NdaOKfWbd6hlbuKu9QmyKg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 901
x-xss-protection: 0
expires: Fri, 26 Mar 2021 13:50:00 GMT

GET
H2 200 jquery-3.2.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 31ms
14ms Script
application/javascript 2001:4de0:ac18::1:a:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.min.js
Requested by: Host: greenappletravel.ae
URL: https://greenappletravel.ae/modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Referer: https://greenappletravel.ae/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 13:51:54 GMT
content-encoding: gzip
last-modified: Mon, 20 Mar 2017 19:01:15 GMT
server: nginx
etag: W/"58d026fb-15283"
vary: Accept-Encoding
x-hw: 1616680314.dop210.fr8.t,1616680314.cds239.fr8.hc,1616680314.cds133.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30125

GET
H/1.1

200
OK

/
www.kelowna.ca/ Frame 5BB6
Redirect Chain

https://kelowna.ca/
https://www.kelowna.ca/

0
0

1069ms
246ms

Document
text/html

74.3.136.79
SHAW

General

Check archive.org

Show headers Download Go to

Full URL

https://www.kelowna.ca/

Requested by

Host: greenappletravel.ae
URL: https://greenappletravel.ae/modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

74.3.136.79 Kelowna, Canada, ASN6327 (SHAW, CA),

Reverse DNS

h74-3-136-79.bigpipeinc.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload
X-Frame-Options	SAMEORIGIN, SAMEORIGIN, SAMEORIGIN

Request headers

Host: www.kelowna.ca
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://greenappletravel.ae/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://greenappletravel.ae/

Response headers

Date: Thu, 25 Mar 2021 13:51:55 GMT
Server: Apache
X-Drupal-Cache: HIT
Content-Language: en
X-Frame-Options: SAMEORIGIN, SAMEORIGIN, SAMEORIGIN
X-UA-Compatible: IE=edge,chrome=1
Link: ,,,,,,<https://www.kelowna.ca/>; rel="canonical",<https://www.kelowna.ca/>; rel="shortlink"
X-Generator: Drupal 7 (https://www.drupal.org)
Cache-Control: public, max-age=0
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Vary: Cookie,Accept-Encoding
Content-Encoding: gzip
Strict-Transport-Security: max-age=31536000; preload
Etag: "1616679980-1"
Last-Modified: Thu, 25 Mar 2021 13:46:20 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8

Redirect headers

Date: Thu, 25 Mar 2021 13:51:54 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Strict-Transport-Security: max-age=31536000; preload
X-Content-Type-Options: nosniff
Location: https://www.kelowna.ca/
Cache-Control: max-age=604800
Expires: Thu, 01 Apr 2021 13:51:54 GMT
Content-Length: 231
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H3-Q050 200 favicons
www.google.com/s2/ 901 B
1 KB 7ms
6ms Image
image/png 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/s2/favicons?domain=http://kelowna.ca/

Requested by

Host: greenappletravel.ae
URL: https://greenappletravel.ae/modules/mail.php?s=autorize&client_id=fbe237aa-6a24-88b7-0685-f11e-180e180e477c&redirect=http%3A%2F%2Fkelowna.ca%2F&id=ZmluYW5jZWFwQGtlbG93bmEuY2E=&subdomain=kelowna.ca

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ce3fb814619e50d3b045f300540bcee696a86968b94e1cf6edbde19306e06085

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-bG+wUfUpIJYHxz6Bvn9CpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-bG+wUfUpIJYHxz6Bvn9CpQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://greenappletravel.ae/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 13:50:00 GMT
x-content-type-options: nosniff
server: ESF
age: 114
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'report-sample' 'nonce-bG+wUfUpIJYHxz6Bvn9CpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-bG+wUfUpIJYHxz6Bvn9CpQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 901
x-xss-protection: 0
expires: Fri, 26 Mar 2021 13:50:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			greenappletravel.ae/	1969-12-31 23:59:59	Name: PHPSESSID Value: pjtjhi68rl3ous5ulf966718o4
			.greenappletravel.ae/	1970-01-19 17:47:52	Name: __cfduid Value: d69719b5ea63f8a4ffec637bae6e1d29a1616680313

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
greenappletravel.ae
kelowna.ca
redseaco.net
www.google.com
www.kelowna.ca
163.172.102.219
2001:4de0:ac18::1:a:2a
2606:4700:3031::6815:2ed4
2a00:1450:4001:80e::2004
2a00:1450:4001:812::2004
74.3.136.66
74.3.136.79
1ccf7f030bd6fb15bb5331b5fddb741e31d0142583989c63a04397b1bc22f126
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
a41016be26d6d45bd9e4cdbf5c6d7952d7bb380c5e9d40a940bab175d9613b94
ce3fb814619e50d3b045f300540bcee696a86968b94e1cf6edbde19306e06085

greenappletravel.ae Open in urlscan Pro 2606:4700:3031::6815:2ed4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

57 %IPv6

5 Domains

6 Subdomains

6 IPs

5 Countries

35 kBTransfer

93 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

greenappletravel.ae Open in urlscan Pro
2606:4700:3031::6815:2ed4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

57 %
IPv6

5
Domains

6
Subdomains

6
IPs

5
Countries

35 kB
Transfer

93 kB
Size

2
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!