activation.na-citiprepaid.com

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main IP is 103.134.152.4, located in Singapore and belongs to CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG. The main domain is activation.na-citiprepaid.com.

This is the only time activation.na-citiprepaid.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	103.134.152.4 103.134.152.4	138608 (CLOUDHOST...) (CLOUDHOST-AS-AP Cloud Host Pte Ltd)
1	2a03:2880:f00... 2a03:2880:f00d:115:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1288:110... 2a00:1288:110:603::1021	34010 (YAHOO-IRD) (YAHOO-IRD)
5	3

1 103.134.152.4 (Singapore)

ASN138608 (CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG)
PTR: sgz11.cloudhost.id

activation.na-citiprepaid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f00d:115:face:b00c:0:3 (Los Angeles, United States)

ASN32934 (FACEBOOK, US)

scontent-lax3-2.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:110:603::1021 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

ecp.yusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	yusercontent.com ecp.yusercontent.com — Cisco Umbrella Rank: 6230	58 KB
1	fbcdn.net scontent-lax3-2.xx.fbcdn.net — Cisco Umbrella Rank: 6697	11 KB
1	na-citiprepaid.com activation.na-citiprepaid.com	2 KB
5	3

	Domain	Requested by
3	ecp.yusercontent.com	activation.na-citiprepaid.com
1	scontent-lax3-2.xx.fbcdn.net	activation.na-citiprepaid.com
1	activation.na-citiprepaid.com
5	3

This site contains links to these domains. Also see Links.

Domain
na-citiprepaid.com
links.royal-caribbean-cruises.mkt5894.com

Subject Issuer	Validity	Valid
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-06-22` - `2022-09-20`	3 months	crt.sh
*.ec.yimg.com DigiCert SHA2 High Assurance Server CA	`2022-07-13` - `2022-10-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://activation.na-citiprepaid.com/
Frame ID: A1AF3B1B38592D84A598C25A5CEEF47D
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

5
Requests

80 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

72 kB
Transfer

76 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://na-citiprepaid.com/login/
Title: https://login.northlane.com/

Search URL Search Domain Scan URL

URL: https://links.royal-caribbean-cruises.mkt5894.com/ctt?ms=MzQwMzU5OTMS1&kn=1&r=NDgzOTI2NTU5NzQxS0&b=0&j=MjEwMzQ2MTk1MQS2&mt=1&rt=0

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
activation.na-citiprepaid.com/ 9 KB
2 KB 1132ms
380ms Document
text/html 103.134.152.4
CLOUDHOST-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: http://activation.na-citiprepaid.com/
Protocol: HTTP/1.1
Server: 103.134.152.4 , Singapore, ASN138608 (CLOUDHOST-AS-AP Cloud Host Pte Ltd, SG),
Reverse DNS: sgz11.cloudhost.id
Software: LiteSpeed /
Resource Hash: ec7809bde6e439c59ec7832f655a611d9d3389faa4aa379ddb27701a04331a33

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
accept-ranges: bytes
content-encoding: gzip
content-length: 2249
content-type: text/html
date: Tue, 13 Sep 2022 02:21:27 GMT
last-modified: Sun, 11 Sep 2022 20:34:09 GMT
server: LiteSpeed
vary: Accept-Encoding

GET
H2 200 306713742_8247637315254113_5927907547459126570_n.jpg
scontent-lax3-2.xx.fbcdn.net/v/t39.30808-6/ 11 KB
11 KB 542ms
178ms Image
image/jpeg 2a03:2880:f00d:115:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-lax3-2.xx.fbcdn.net/v/t39.30808-6/306713742_8247637315254113_5927907547459126570_n.jpg?_nc_cat=111&ccb=1-7&_nc_sid=730e14&_nc_eui2=AeFJA6XzvgVK9n-ZbUefITr9Di-LZhbxudkOL4tmFvG52cBkVCXEWx1z4xVQU6WVMnF_fQtWNgG9IZ7rnCU5Mi4p&_nc_ohc=XTpDeyeZVdwAX-l0FFt&_nc_ht=scontent-lax3-2.xx&oh=00_AT-wq7Jy7K6WZr85gzGVZvPpVePhmaZGJA7XxxC6Sp37ew&oe=6323D9CD
Requested by: Host: activation.na-citiprepaid.com
URL: http://activation.na-citiprepaid.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f00d:115:face:b00c:0:3 Los Angeles, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 4fe8e998c00d1cef0fb550a17297fcb19ecb6c0c7b64f1cd8de1ba91794b7081

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://activation.na-citiprepaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-haystack-needlechecksum: 3036691581
date: Tue, 13 Sep 2022 02:21:28 GMT
x-fb-trip-id: 1425083115
x-storage-error-category: dfs:none;hs_p:200:HS_ESUCCESS
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=2474125145
cache-control: max-age=1209600, no-transform
last-modified: Sun, 11 Sep 2022 15:25:35 GMT
cross-origin-resource-policy: cross-origin
x-needle-checksum: 2474125145
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 11381

GET
H2 200 mail
ecp.yusercontent.com/ 43 B
169 B 1781ms
1648ms Image
image/gif 2a00:1288:110:603::1021
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ecp.yusercontent.com/mail?url=http%3A%2F%2Fwww.creative.rccl.com%2Fe-lite%2FRCI%2F2014%2FMasters%2Femail_temp%2Fhtml%2Fimages%2Fspacer.gif&t=1662915587&ymreqid=233dcc70-d23a-19e3-1cc0-580033013d00&sig=96yPC8KAh9IUI03z66UMyw--~D

Requested by

Host: activation.na-citiprepaid.com
URL: http://activation.na-citiprepaid.com/

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1288:110:603::1021 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://activation.na-citiprepaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 13 Sep 2022 02:21:29 GMT
x-content-type-options: nosniff
age: 0
content-disposition: attachment
content-length: 43
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 15 Sep 2009 20:45:11 GMT
server: ATS
x-frame-options: DENY
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=0
content-type: image/gif
cache-control: max-age=3600
public-key-pins-report-only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
accept-ranges: bytes
expires: Tue, 13 Sep 2022 03:21:29 GMT

GET
H2 200 mail
ecp.yusercontent.com/ 4 KB
5 KB 244ms
127ms Image
image/png 2a00:1288:110:603::1021
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ecp.yusercontent.com/mail?url=http%3A%2F%2Fcontentz.mkt5894.com%2Fra%2F2022%2F2950%2F01%2F34035993%2FGreg-Purdy-Signaturev1-01.png&t=1662915587&ymreqid=233dcc70-d23a-19e3-1cc0-580033013d00&sig=Ro28wYp2BMkxoqXxc7n9Sw--~D

Requested by

Host: activation.na-citiprepaid.com
URL: http://activation.na-citiprepaid.com/

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1288:110:603::1021 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0545bd83711e509220862ffa14db701e7c58af8e3485cb3d9c298ecaed9a315c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://activation.na-citiprepaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 13 Sep 2022 02:21:28 GMT
x-content-type-options: nosniff
age: 0
x-cache: Hit from cloudfront
content-disposition: attachment
content-length: 4500
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 10 Jan 2022 09:53:25 GMT
server: ATS
x-frame-options: DENY
etag: "1194-5d5374ecf5be0"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=0
content-type: image/png
public-key-pins-report-only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-amz-cf-pop: DUB2-C1
accept-ranges: bytes
x-amz-cf-id: WHaEBg61ovjxQcqnoV66DLJMKDPhg15oHubFmsvLrvXM-h5SWGQS1w==

GET
H2 200 mail
ecp.yusercontent.com/ 52 KB
52 KB 405ms
288ms Image
image/png 2a00:1288:110:603::1021
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ecp.yusercontent.com/mail?url=http%3A%2F%2Fcontentz.mkt5894.com%2Fra%2F2022%2F2950%2F01%2F34035993%2Ffooter-royal%2520way2-012.png&t=1662915587&ymreqid=233dcc70-d23a-19e3-1cc0-580033013d00&sig=fNXkRD5AeVEKzo1JWQluJA--~D

Requested by

Host: activation.na-citiprepaid.com
URL: http://activation.na-citiprepaid.com/

Protocol

H2

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1288:110:603::1021 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

015dba4aa0426b88ffcd598f9e0418adc18daa42dae7644a2460a6090ce78961

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://activation.na-citiprepaid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 13 Sep 2022 02:21:28 GMT
x-content-type-options: nosniff
age: 0
x-cache: RefreshHit from cloudfront
content-disposition: attachment
content-length: 53354
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 10 Jan 2022 09:53:25 GMT
server: ATS
x-frame-options: DENY
etag: "d06a-5d5374ecf11aa"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=0
content-type: image/png
public-key-pins-report-only: max-age=2592000; pin-sha256="2fRAUXyxl4A1/XHrKNBmc8bTkzA7y4FB/GLJuNAzCqY="; pin-sha256="I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o="; pin-sha256="Wd8xe/qfTwq3ylFNd3IpaqLHZbh2ZNCLluVzmeNkcpw="; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="i7WTqTvh0OioIruIfFR4kMPnBqrS2rdiVPl/s2uC/CY="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; pin-sha256="uUwZgwDOxcBXrQcntwu+kYFpkiVkOaezL0WYEZ3anJc="; pin-sha256="dolnbtzEBnELx/9lOEQ22e6OZO/QNb6VSSX2XHA3E7A="; includeSubdomains; report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-hpkp-report-only"
x-amz-cf-pop: DUB2-C1
accept-ranges: bytes
x-amz-cf-id: 9zKx4Kr8EraawL03MHdg0dR98E2wEaB9dI2K17M5UELL1R5H83bq7Q==

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

activation.na-citiprepaid.com
ecp.yusercontent.com
scontent-lax3-2.xx.fbcdn.net
103.134.152.4
2a00:1288:110:603::1021
2a03:2880:f00d:115:face:b00c:0:3
015dba4aa0426b88ffcd598f9e0418adc18daa42dae7644a2460a6090ce78961
0545bd83711e509220862ffa14db701e7c58af8e3485cb3d9c298ecaed9a315c
4fe8e998c00d1cef0fb550a17297fcb19ecb6c0c7b64f1cd8de1ba91794b7081
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
ec7809bde6e439c59ec7832f655a611d9d3389faa4aa379ddb27701a04331a33

activation.na-citiprepaid.com Open in urlscan Pro 103.134.152.4 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

5 Requests

80 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

72 kBTransfer

76 kBSize

0 Cookies

2 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

0 Cookies

Indicators

activation.na-citiprepaid.com Open in urlscan Pro
103.134.152.4 Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

72 kB
Transfer

76 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions