URL: https://www.airbnb.az/manifest.json
Submission: On January 07 via api from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 2.18.234.85, located in Ascension Island and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is www.airbnb.az.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on October 11th 2019. Valid for: 2 years.
This is the only time www.airbnb.az was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2.18.234.85 16625 (AKAMAI-AS)
1 1
Apex Domain
Subdomains
Transfer
1 airbnb.az
www.airbnb.az
5 KB
1 1
Domain Requested by
1 www.airbnb.az
1 1

This site contains no links.

Subject Issuer Validity Valid
www.airbnb.at
DigiCert SHA2 Secure Server CA
2019-10-11 -
2021-10-15
2 years crt.sh

This page contains 1 frames:

Primary Page: https://www.airbnb.az/manifest.json
Frame ID: BE1FA1F9CD048228A9452593B791003C
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

5 kB
Transfer

1 kB
Size

7
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request manifest.json
www.airbnb.az/
1 KB
5 KB
Document
General
Full URL
https://www.airbnb.az/manifest.json
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2.18.234.85 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-85.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d699e70e8fcccd5f3db4a284dc71152b7da1b4dea58cb9978367a344c9e61171
Security Headers
Name Value
Content-Security-Policy default-src 'self' https: blob:; child-src * blob:; connect-src 'self' https: wss: *.amap.com *.inspectlet.com; font-src 'self' data: *.muscache.com fonts.gstatic.com use.typekit.net; img-src 'self' https: data: *.inspectlet.com; media-src 'self' https:; script-src 'self' 'unsafe-eval' a0.muscache.com cdn.siftscience.com ss.musthird.com t1.musthird.com bat.bing.com connect.facebook.net www.google-analytics.com www.googleadservices.com tpc.googlesyndication.com www.googletagmanager.com a.cdn.intentmedia.net maps.googleapis.com ajax.googleapis.com *.g.doubleclick.net www.google.com www.gstatic.com smartlock.google.com accounts.google.com app.link cdn.branch.io api.branch.io bam.nr-data.net js-agent.newrelic.com sslwidget.criteo.com static.criteo.net dis.criteo.com widget.us.criteo.com *.gbc.criteo.net ethn.io s.yimg.jp api.geetest.com cdn.ampproject.org storage.googleapis.com/workbox-cdn/ tagmanager.google.com pay.google.com songbird.cardinalcommerce.com/ blob: webapi.amap.com restapi.amap.com *.inspectlet.com 'nonce-74a1abe54fd9a0e2b057eae32e8be8'; style-src 'self' https: 'unsafe-inline'; report-uri /tracking/csp?action=show&controller=web_app_manifest&report_only=false&req_uuid=fc6899a6-ce95-4f41-8a17-6f1a9255adcb&version=7697260a2630b6c8b134e4c02489f8e59a51b48b
Strict-Transport-Security max-age=10886400; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.airbnb.az
:scheme
https
:path
/manifest.json
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
server
nginx
content-type
application/manifest+json; charset=utf-8
x-frame-options
SAMEORIGIN
cache-control
no-store, max-age=0, private, must-revalidate
etag
"ef062c21d538c299f86cf12cb6af9bda"
referrer-policy
same-origin
x-ua-compatible
IE=Edge,chrome=1
server-timing
total;dur=130
content-security-policy
default-src 'self' https: blob:; child-src * blob:; connect-src 'self' https: wss: *.amap.com *.inspectlet.com; font-src 'self' data: *.muscache.com fonts.gstatic.com use.typekit.net; img-src 'self' https: data: *.inspectlet.com; media-src 'self' https:; script-src 'self' 'unsafe-eval' a0.muscache.com cdn.siftscience.com ss.musthird.com t1.musthird.com bat.bing.com connect.facebook.net www.google-analytics.com www.googleadservices.com tpc.googlesyndication.com www.googletagmanager.com a.cdn.intentmedia.net maps.googleapis.com ajax.googleapis.com *.g.doubleclick.net www.google.com www.gstatic.com smartlock.google.com accounts.google.com app.link cdn.branch.io api.branch.io bam.nr-data.net js-agent.newrelic.com sslwidget.criteo.com static.criteo.net dis.criteo.com widget.us.criteo.com *.gbc.criteo.net ethn.io s.yimg.jp api.geetest.com cdn.ampproject.org storage.googleapis.com/workbox-cdn/ tagmanager.google.com pay.google.com songbird.cardinalcommerce.com/ blob: webapi.amap.com restapi.amap.com *.inspectlet.com 'nonce-74a1abe54fd9a0e2b057eae32e8be8'; style-src 'self' https: 'unsafe-inline'; report-uri /tracking/csp?action=show&controller=web_app_manifest&report_only=false&req_uuid=fc6899a6-ce95-4f41-8a17-6f1a9255adcb&version=7697260a2630b6c8b134e4c02489f8e59a51b48b
content-security-policy-report-only
default-src blob: *; child-src blob: *; connect-src blob: *; font-src 'self' data: *.muscache.com fonts.gstatic.com use.typekit.net; img-src 'self' https: data: *.inspectlet.com; script-src 'self' 'unsafe-eval' webpack.localhost.airbnb.com jira.airbnb.biz *.g.doubleclick.net cdn.siftscience.com ss.musthird.com t1.musthird.com bat.bing.com connect.facebook.net www.google-analytics.com www.googleadservices.com tpc.googlesyndication.com www.googletagmanager.com maps.googleapis.com ajax.googleapis.com app.link cdn.branch.io api.branch.io bam.nr-data.net js-agent.newrelic.com sslwidget.criteo.com static.criteo.net dis.criteo.com widget.us.criteo.com ethn.io blob: webapi.amap.com restapi.amap.com *.inspectlet.com cdn.ampproject.org/v0.js cdn.ampproject.org/v0/ a.alipayobjects.com gw.alipayobjects.com static.t.agrant.cn t.agrantsem.com ditu.google.com *.muscache.cn *.muscache.com ss.musthird.cn www.google.com www.gstatic.com b92.yahoo.co.jp mc.yandex.ru wcs.naver.net static.matterport.com a.cdn.intentmedia.net s.yimg.jp icm.aexp-static.com checkout.americanexpress.com www.paypalobjects.com smartlock.google.com accounts.google.com tagmanager.google.com; style-src * blob: 'unsafe-inline'; report-uri /tracking/csp?action=show&controller=web_app_manifest&report_only=true&req_uuid=fc6899a6-ce95-4f41-8a17-6f1a9255adcb&version=7697260a2630b6c8b134e4c02489f8e59a51b48b
x-content-type-options
nosniff
x-xss-protection
1; mode=block
x-envoy-upstream-service-time
137
strict-transport-security
max-age=10886400; includeSubdomains
content-length
1514
date
Tue, 07 Jan 2020 02:02:21 GMT
set-cookie
bev=1578362541_MWYzYzgxMmQ5MzUz; domain=.airbnb.az; path=/; expires=Thu, 06-Jan-2022 02:02:21 GMT; secure _csrf_token=V4%24.airbnb.az%246y-FyI8lG6s%24mtY4PlwR3yVgxOvNl1WtN0oZQK04_EZ42d-fPFd6zv0%3D; domain=.airbnb.az; path=/; secure jitney_client_session_id=e19c934b-72a2-4f89-b9b4-12a1bbc491ac; domain=.airbnb.az; path=/; expires=Wed, 08-Jan-2020 02:02:21 GMT; secure jitney_client_session_created_at=1578362541; domain=.airbnb.az; path=/; expires=Wed, 08-Jan-2020 02:02:21 GMT; secure jitney_client_session_updated_at=1578362541; domain=.airbnb.az; path=/; expires=Wed, 08-Jan-2020 02:02:21 GMT; secure _user_attributes=%7B%22curr%22%3A%22USD%22%2C%22guest_exchange%22%3A1.0%2C%22device_profiling_session_id%22%3A%221578362541--b03473feee66e272a32434b5%22%2C%22giftcard_profiling_session_id%22%3A%221578362541--bee0700354619e95865289cd%22%2C%22reservation_profiling_session_id%22%3A%221578362541--4844b5bb06b34ffaa675f524%22%7D; domain=.airbnb.az; path=/; expires=Fri, 07-Jan-2022 02:02:21 GMT; secure flags=0; domain=.airbnb.az; path=/; secure bev=1578362541_MWYzYzgxMmQ5MzUz; expires=Thu, 06-Jan-2022 02:02:21 GMT; path=/; domain=.airbnb.az; secure
x-erf-bev-bev-is-generated
1
x-erf-bev-bev
1578362541_MWYzYzgxMmQ5MzUz

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

7 Cookies

Domain/Path Name / Value
.airbnb.az/ Name: flags
Value: 0
.airbnb.az/ Name: jitney_client_session_updated_at
Value: 1578362541
.airbnb.az/ Name: _csrf_token
Value: V4%24.airbnb.az%246y-FyI8lG6s%24mtY4PlwR3yVgxOvNl1WtN0oZQK04_EZ42d-fPFd6zv0%3D
.airbnb.az/ Name: jitney_client_session_created_at
Value: 1578362541
.airbnb.az/ Name: jitney_client_session_id
Value: e19c934b-72a2-4f89-b9b4-12a1bbc491ac
.airbnb.az/ Name: _user_attributes
Value: %7B%22curr%22%3A%22USD%22%2C%22guest_exchange%22%3A1.0%2C%22device_profiling_session_id%22%3A%221578362541--b03473feee66e272a32434b5%22%2C%22giftcard_profiling_session_id%22%3A%221578362541--bee0700354619e95865289cd%22%2C%22reservation_profiling_session_id%22%3A%221578362541--4844b5bb06b34ffaa675f524%22%7D
.airbnb.az/ Name: bev
Value: 1578362541_MWYzYzgxMmQ5MzUz

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self' https: blob:; child-src * blob:; connect-src 'self' https: wss: *.amap.com *.inspectlet.com; font-src 'self' data: *.muscache.com fonts.gstatic.com use.typekit.net; img-src 'self' https: data: *.inspectlet.com; media-src 'self' https:; script-src 'self' 'unsafe-eval' a0.muscache.com cdn.siftscience.com ss.musthird.com t1.musthird.com bat.bing.com connect.facebook.net www.google-analytics.com www.googleadservices.com tpc.googlesyndication.com www.googletagmanager.com a.cdn.intentmedia.net maps.googleapis.com ajax.googleapis.com *.g.doubleclick.net www.google.com www.gstatic.com smartlock.google.com accounts.google.com app.link cdn.branch.io api.branch.io bam.nr-data.net js-agent.newrelic.com sslwidget.criteo.com static.criteo.net dis.criteo.com widget.us.criteo.com *.gbc.criteo.net ethn.io s.yimg.jp api.geetest.com cdn.ampproject.org storage.googleapis.com/workbox-cdn/ tagmanager.google.com pay.google.com songbird.cardinalcommerce.com/ blob: webapi.amap.com restapi.amap.com *.inspectlet.com 'nonce-74a1abe54fd9a0e2b057eae32e8be8'; style-src 'self' https: 'unsafe-inline'; report-uri /tracking/csp?action=show&controller=web_app_manifest&report_only=false&req_uuid=fc6899a6-ce95-4f41-8a17-6f1a9255adcb&version=7697260a2630b6c8b134e4c02489f8e59a51b48b
Strict-Transport-Security max-age=10886400; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.airbnb.az
2.18.234.85
d699e70e8fcccd5f3db4a284dc71152b7da1b4dea58cb9978367a344c9e61171