![](/screenshots/90cfba48-514d-44ea-a27f-121eae610687.png)
www.airfrance-billetfly.com
Open in
urlscan Pro
52.216.64.18
Malicious Activity!
Public Scan
Effective URL: http://www.airfrance-billetfly.com/
Submission: On February 08 via api from DE
Summary
This is the only time www.airfrance-billetfly.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Crypto (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 209.141.38.71 209.141.38.71 | 53667 (PONYNET) (PONYNET - FranTech Solutions) | |
1 | 52.216.64.18 52.216.64.18 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
1 7 | 151.101.120.193 151.101.120.193 | 54113 (FASTLY) (FASTLY - Fastly) | |
11 | 2606:4700:30:... 2606:4700:30::681c:3f5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:824::2014 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:815::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 67.202.94.93 67.202.94.93 | 32748 (STEADFAST) (STEADFAST - Steadfast) | |
1 | 185.225.208.133 185.225.208.133 | 13213 (UK2NET-AS) (UK2NET-AS) | |
22 | 7 |
ASN53667 (PONYNET - FranTech Solutions, US)
PTR: parking.namesilo.com
airfrance-billetfly.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-website-us-east-1.amazonaws.com
www.airfrance-billetfly.com |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
randomuser.me |
ASN32748 (STEADFAST - Steadfast, US)
PTR: amung.us
whos.amung.us |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
randomuser.me
randomuser.me |
71 KB |
7 |
imgur.com
1 redirects
i.imgur.com |
154 KB |
2 |
amung.us
1 redirects
whos.amung.us widgets.amung.us |
2 KB |
2 |
airfrance-billetfly.com
1 redirects
airfrance-billetfly.com www.airfrance-billetfly.com |
23 KB |
1 |
googleapis.com
ajax.googleapis.com |
33 KB |
1 |
appspot.com
geoapi123.appspot.com |
419 B |
1 |
jquery.com
code.jquery.com |
29 KB |
22 | 7 |
Domain | Requested by | |
---|---|---|
11 | randomuser.me |
www.airfrance-billetfly.com
|
7 | i.imgur.com |
1 redirects
www.airfrance-billetfly.com
|
1 | widgets.amung.us |
www.airfrance-billetfly.com
|
1 | whos.amung.us | 1 redirects |
1 | ajax.googleapis.com |
www.airfrance-billetfly.com
|
1 | geoapi123.appspot.com |
www.airfrance-billetfly.com
|
1 | code.jquery.com |
www.airfrance-billetfly.com
|
1 | www.airfrance-billetfly.com | |
1 | airfrance-billetfly.com | 1 redirects |
22 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.imgur.com DigiCert SHA2 Secure Server CA |
2018-12-14 - 2020-02-12 |
a year | crt.sh |
sni39465.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-01-30 - 2019-08-08 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.airfrance-billetfly.com/
Frame ID: C8D3F1FA410C71CD32236821BBC93BEC
Requests: 22 HTTP requests in this frame
Screenshot
![](/screenshots/90cfba48-514d-44ea-a27f-121eae610687.png)
Page URL History Show full URLs
-
http://airfrance-billetfly.com/
HTTP 301
http://www.airfrance-billetfly.com/ Page URL
Detected technologies
Detected patterns
- headers server /AmazonS3/i
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://airfrance-billetfly.com/
HTTP 301
http://www.airfrance-billetfly.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- http://i.imgur.com/cpxkri0.jpg HTTP 302
- http://i.imgur.com/removed.png
- http://whos.amung.us/widget/fraance123z HTTP 307
- http://widgets.amung.us/classic/00/30.png
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
www.airfrance-billetfly.com/ Redirect Chain
|
22 KB 22 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.5.1.min.js
code.jquery.com/ |
83 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ZXC4ZHv.png
i.imgur.com/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xcAdbtq.gif
i.imgur.com/ |
5 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gPa3LUt.png
i.imgur.com/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iRIQJWB.png
i.imgur.com/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
UConVQT.gif
i.imgur.com/ |
125 KB 125 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
removed.png
i.imgur.com/ Redirect Chain
|
503 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
54.jpg
randomuser.me/api/portraits/men/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
32.jpg
randomuser.me/api/portraits/men/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
24.jpg
randomuser.me/api/portraits/men/ |
18 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
21.jpg
randomuser.me/api/portraits/women/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
73.jpg
randomuser.me/api/portraits/women/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.jpg
randomuser.me/api/portraits/men/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
99.jpg
randomuser.me/api/portraits/men/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
53.jpg
randomuser.me/api/portraits/women/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
46.jpg
randomuser.me/api/portraits/women/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
89.jpg
randomuser.me/api/portraits/women/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
61.jpg
randomuser.me/api/portraits/women/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
geoapi123.appspot.com/ |
392 B 419 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.11.1/ |
94 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
30.png
widgets.amung.us/classic/00/ Redirect Chain
|
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Crypto (Crypto Exchange)24 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| randomString function| get_random_number number| x object| links number| randno string| link function| geoip_country_code function| geoip_country_name function| geoip_city function| geoip_region function| geoip_region_name function| geoip_latitude function| geoip_longitude function| geoip_postal_code function| geoip_area_code function| geoip_metro_code function| date function| addCom function| FBcom0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
airfrance-billetfly.com
ajax.googleapis.com
code.jquery.com
geoapi123.appspot.com
i.imgur.com
randomuser.me
whos.amung.us
widgets.amung.us
www.airfrance-billetfly.com
151.101.120.193
185.225.208.133
205.185.208.52
209.141.38.71
2606:4700:30::681c:3f5
2a00:1450:4001:815::200a
2a00:1450:4001:824::2014
52.216.64.18
67.202.94.93
10469f9db9fde47955252e427fb379745f8d2acda13299c4600b7967e0c3c78b
11d956f8b1bf14c55157948c614aab760383cc7685163ed43e25609c7c050266
1b1b97636201c5dd3af564e0a805905b26f51f081eac54da1b4df5f3273ff20f
43984d6d0b65d9047f8887d924a0432678c06b0b8804375023e24778674ff320
4aecd2756ae2ed682f204b0f81ca0f478d5a870f3dfa771e8cb30b567715fcfd
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
68655f7dc0aa218890a2b17016db6d22ca4f47caf71c9b3e6de07233c3a735c3
716cfb40836039a4e9e34d89320b6398ba7871ea7882e32b7397029586f6dda7
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
88445d944fdf0bc52a4f79ddf5cffde16e42eec01bdd3e32ab6234cef44411b3
8d0417f0910586650f889adf5f72fb8ad336f07247cbfd9da9dd6db02546dd00
98966f452650ad89257a9164c2d3899e4247d475f6812e1d2b10af2872595e53
9b5936f4006146e4e1e9025b474c02863c0b5614132ad40db4b925a10e8bfbb9
a2556b2854ed0e49c55be6d4bff69db14ecd05890939c701a1e98c45787af1b1
a38c7997fe17f718915694f3e76ab9d0119d861886ac9869ee27b2428652b86e
a634d4f02fe5b77804943c1d74b8d70e35ffe26454e0e9af9717432a2c72bfde
aa71ceacc335c50de5d72536473637050da921b5439ea9b4fb289b8f76c5720e
d1a3e08d4e37d6ee2b7de1db8df87c1dc7acd8ffb004caaf980917de518a60c9
eaa81a78d6ab29a12b5b86e349f7d77abe19946f0d597e1b5191ad1845c4effd
eb0d14c51d571b63ba1aa4050367d192f71c8e9d5c1aa15cd6de9aacae05b2a1
efdb6ee589c3b1c29cbed18fe546fe8d9e2764f92cfa9a27bcb2d95b4f402e13
f8f2ddc445b6b2318430260bdebb665c9415865827230565aa42f57c9c794baf