krebsonsecurity.com
Open in
urlscan Pro
130.211.45.45
Public Scan
URL:
https://krebsonsecurity.com/2024/11/booking-com-phishers-may-leave-you-with-reservations/
Submission Tags: @nominet_threat_intel rnt-string-1st reference_article_link confidence_medium cluster_35076879 Search All
Submission: On November 05 via api from GB — Scanned from GB
Submission Tags: @nominet_threat_intel rnt-string-1st reference_article_link confidence_medium cluster_35076879 Search All
Submission: On November 05 via api from GB — Scanned from GB
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 31 HTTP transactions.
The main IP is 130.211.45.45, located in
Kansas City, United States and
belongs to GOOGLE-CLOUD-PLATFORM, US.
The main domain is krebsonsecurity.com.
The Cisco Umbrella rank of the primary domain is 129757.
TLS certificate: Issued by WR3 on October 12th 2024. Valid for: 3 months.
This is the only time krebsonsecurity.com was scanned on urlscan.io!
TLS certificate: Issued by WR3 on October 12th 2024. Valid for: 3 months.
This is the only time krebsonsecurity.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 27 | 130.211.45.45 130.211.45.45 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
| 3 | 216.58.206.35 216.58.206.35 | 15169 (GOOGLE) (GOOGLE) | |
| 31 | 3 |
27
130.211.45.45
(Kansas City, United States)
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 45.45.211.130.bc.googleusercontent.com
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 45.45.211.130.bc.googleusercontent.com
| krebsonsecurity.com |
3
216.58.206.35
(United States)
ASN15169 (GOOGLE, US)
PTR: lcfraa-aa-in-f3.1e100.net
ASN15169 (GOOGLE, US)
PTR: lcfraa-aa-in-f3.1e100.net
| fonts.gstatic.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 27 |
krebsonsecurity.com
krebsonsecurity.com — Cisco Umbrella Rank: 129757 |
1 MB |
| 3 |
gstatic.com
fonts.gstatic.com |
56 KB |
| 1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
1 KB |
| 31 | 3 |
| Domain | Requested by | |
|---|---|---|
| 27 | krebsonsecurity.com |
krebsonsecurity.com
|
| 3 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | fonts.googleapis.com |
krebsonsecurity.com
|
| 31 | 3 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| krebsonsecurity.com WR3 |
2024-10-12 - 2025-01-10 |
3 months | crt.sh |
| upload.video.google.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
| *.gstatic.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://krebsonsecurity.com/2024/11/booking-com-phishers-may-leave-you-with-reservations/
Frame ID: F4715567D493F7AD8330FF008EDD3523
Requests: 31 HTTP requests in this frame
Screenshot
Page Title
Booking.com Phishers May Leave You With Reservations – Krebs on SecurityDetected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- /wp-(?:content|includes)/
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery Migrate
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Page Statistics
18 Outgoing links
These are links going to different origins than the main page.
URL: https://sonraisecurity.com/blog/avoiding-no-responsibility-cloud-security-model/?utm_medium=display&utm_source=krebs&utm_campaign=Oct24_cnapp_campaign&utm_content=no-response-desktop-leaderboard
Search URL Search Domain Scan URL
URL: https://cybersecurity-strategy-masters.nyu.edu/
Search URL Search Domain Scan URL
URL: http://twitter.com/briankrebs
Search URL Search Domain Scan URL
URL: https://www.linkedin.com/in/bkrebs/
Search URL Search Domain Scan URL
URL: https://partner.booking.com/en-gb/help/legal-security/security/securing-your-account
Title: requires 2FA
Title: requires 2FA
Search URL Search Domain Scan URL
URL: https://www.booking.com/trust-and-safety/partners.en-gb.html#tns_partners_account_safe
Title: account security advice
Title: account security advice
Search URL Search Domain Scan URL
URL: https://www.secureworks.com/blog/vidar-infostealer-steals-booking-com-credentials-in-fraud-scam
Title: detailed
Title: detailed
Search URL Search Domain Scan URL
URL: https://www.bbc.com/news/articles/c8003dd8jzeo
Title: told the BBC
Title: told the BBC
Search URL Search Domain Scan URL
URL: https://www.domaintools.com/
Title: DomainTools.com
Title: DomainTools.com
Search URL Search Domain Scan URL
URL: https://docs.google.com/spreadsheets/d/1k8c2d2XZLXIG9tFUaU6MGRK-puAKxoCuWuzB8GSqkAM/edit?usp=sharing
Title: here
Title: here
Search URL Search Domain Scan URL
URL: https://www.intel471.com/
Title: Intel 471
Title: Intel 471
Search URL Search Domain Scan URL
URL: https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/
Title: exactly what transpired
Title: exactly what transpired
Search URL Search Domain Scan URL
URL: https://reddit.com/r/Iamverysmart
Title: Bobby Knobbers
Title: Bobby Knobbers
Search URL Search Domain Scan URL
URL: https://www.theguardian.com/money/2023/nov/21/more-bookingcom-customers-come-forward-about-scam-confirmation-emails
Title: https://www.theguardian.com/money/2023/nov/21/more-bookingcom-customers-come-forward-about-scam-confirmation-emails
Title: https://www.theguardian.com/money/2023/nov/21/more-bookingcom-customers-come-forward-about-scam-confirmation-emails
Search URL Search Domain Scan URL
URL: https://www.theguardian.com/australia-news/2024/jan/31/bookingcom-scams-surge-australia-accc
Title: https://www.theguardian.com/australia-news/2024/jan/31/bookingcom-scams-surge-australia-accc
Title: https://www.theguardian.com/australia-news/2024/jan/31/bookingcom-scams-surge-australia-accc
Search URL Search Domain Scan URL
URL: https://www.theguardian.com/business/2023/oct/01/booking-com-hotel-fees-unpaid-millions-technical-issue
Title: https://www.theguardian.com/business/2023/oct/01/booking-com-hotel-fees-unpaid-millions-technical-issue
Title: https://www.theguardian.com/business/2023/oct/01/booking-com-hotel-fees-unpaid-millions-technical-issue
Search URL Search Domain Scan URL
URL: https://www.theguardian.com/business/2023/oct/03/bookingcom-makes-a-fortune-so-why-is-it-leaving-its-bills-to-small-hotels-unpaid
Title: https://www.theguardian.com/business/2023/oct/03/bookingcom-makes-a-fortune-so-why-is-it-leaving-its-bills-to-small-hotels-unpaid
Title: https://www.theguardian.com/business/2023/oct/03/bookingcom-makes-a-fortune-so-why-is-it-leaving-its-bills-to-small-hotels-unpaid
Search URL Search Domain Scan URL
URL: https://infosec.exchange/@briankrebs
Title: Mastodon
Title: Mastodon
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
31 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
krebsonsecurity.com/2024/11/booking-com-phishers-may-leave-you-with-reservations/ |
79 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
colorbox.css
krebsonsecurity.com/wp-content/plugins/jquery-lightbox-for-native-galleries/colorbox/theme1/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.min.css
krebsonsecurity.com/wp-includes/css/dist/block-library/ |
95 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
classic-themes.min.css
krebsonsecurity.com/wp-includes/css/ |
291 B 271 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
styles.css
krebsonsecurity.com/wp-content/plugins/contact-form-7/includes/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
krebsonsecurity.com/wp-content/themes/kos-mar2021/ |
50 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
custom.css
krebsonsecurity.com/wp-content/themes/kos-mar2021/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
font-awesome.min.css
krebsonsecurity.com/wp-content/themes/kos-mar2021/fonts/ |
28 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
krebsonsecurity.com/wp-includes/js/jquery/ |
88 KB 30 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-migrate.min.js
krebsonsecurity.com/wp-includes/js/jquery/ |
13 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.colorbox-min.js
krebsonsecurity.com/wp-content/plugins/jquery-lightbox-for-native-galleries/colorbox/ |
9 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jspullquotes-core.css
krebsonsecurity.com/wp-content/plugins/jspullquotes/resources/ |
1 KB 569 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jspullquotes-default.css
krebsonsecurity.com/wp-content/plugins/jspullquotes/resources/ |
690 B 443 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jspullquotes.js
krebsonsecurity.com/wp-content/plugins/jspullquotes/resources/ |
6 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
9.png
krebsonsecurity.com/b-sonrai/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
16.png
krebsonsecurity.com/b-nyu/ |
278 KB 278 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
kos-27-03-2021.jpg
krebsonsecurity.com/wp-content/uploads/2021/03/ |
82 KB 82 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
wp-emoji-release.min.js
krebsonsecurity.com/wp-includes/js/ |
18 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
bookingcomphish.png
krebsonsecurity.com/wp-content/uploads/2024/11/ |
186 KB 186 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
17.png
krebsonsecurity.com/b-nyu/ |
167 KB 167 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
comment-reply.min.js
krebsonsecurity.com/wp-includes/js/ |
3 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
slicknav.js
krebsonsecurity.com/wp-content/themes/kos-mar2021/js/ |
17 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
akismet-frontend.js
krebsonsecurity.com/wp-content/plugins/akismet/_inc/ |
11 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ |
18 KB 18 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v32/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
fontawesome-webfont.woff2
krebsonsecurity.com/wp-content/themes/kos-mar2021/fonts/ |
70 KB 70 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ |
18 KB 18 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
bookingdotcomphishingsite-768x470.png
krebsonsecurity.com/wp-content/uploads/2024/11/ |
92 KB 92 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
computered-580x389.png
krebsonsecurity.com/wp-content/uploads/2017/06/ |
262 KB 262 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
favicon.ico
krebsonsecurity.com/ |
318 B 337 B |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _wpemojiSettings function| jQuery object| pullquote function| pullQuoteOpts object| arrOptions object| addComment object| twemoji object| wp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
krebsonsecurity.com
130.211.45.45
216.58.206.35
2a00:1450:4001:802::200a
1405863ed52d1ca5470d58d5291fe3c0bd4d074695f3cb13df28f849c64cfcc6
2c54169774031a3d5a8f8dde4ca21ea6c03663ff49fe4fe71bec3a908a7c5a4a
36c0d84358f7ed972ad8193537a327f2f1520e47167c8f5d0905842ef87b46c7
42f59a090a3dfb961c03b318230607e2750f330d868f80bc1cce78c55a9c7977
47d217e2b7354090c7bcdc5fa1984e8174d3556c04f421483a15bbd63a4129fe
4b95d820d3824b514c16e2381110d2f69b50db86a2963a4e13683feba7a0bee6
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
54f294873f35180bb43c2d86bfff562195e700d181e3deecacc3232f3cf9b1e2
616b37bc7bd1b2514f27a81cd2703a053cdf81d6ac098ee3298e963bc822de23
6bc5622bfab1a16855ad49b99a3f9ed8eb24f49da469a113f9000b866f109e2e
6f005368978df37b680de2dc8a22007a600378ba5568a573432a3fdeb8bdb674
77f4202b0dd725b625864c4325ed26291ad5eb1adea7bc11b9c3d1c9f5da7511
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
8262482b0bae9f20c73829a8a1d3f665b2cd492489365da4600c85df012b927e
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
89afa070f0725955ca890f158b1aa9cc1cbba57ae5383c50fbc020dde603423a
8a7d024a35f5ef90cc5b7d1ae106dfb5d7202aa7ff27fbee01569747e87ba25f
9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3
a6760631fecfe59ed152aeb2c51fdcb515ac00cd4755449016b5b34813735d00
ab21762c3f447aa08cbefd5ea3866165f925bd5058a9ae19e23721462de6fb60
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a
ca66d8e749753384506d8b92e1004b154d0102f0ac8aada6d1c26b309ae6dc72
d3ed930bffbc2adbc25f5563f1592629e94dc740cc64244676a18412bbd26f68
d813f437bbfbafef2652feda67788f6e5b48aebb6f60ca976d89a506a9156534
da482890b20fb4687125256abaa522d0a4641b158bb3b9ca566566e8865aba1c
da7ca2b4251081f029bf1895e6d6ec80c3562729796cd76066d655ed14a7c610
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
fcc0659caa3230eed52d2ec43a8538a2e02e5a5ac292aad206a14a81d17ec946