booking.property-ip8632.xyz Open in urlscan Pro
104.21.43.42 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://booking.property-ip8632.xyz/?utm=enATVWqA
Submission: On February 08 via automatic, source openphish (February 8th 2024, 3:25:45 pm UTC) — Scanned from DE

Summary HTTP 6 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 104.21.43.42, located in and belongs to CLOUDFLARENET, US. The main domain is booking.property-ip8632.xyz.
TLS certificate: Issued by GTS CA 1P5 on February 5th 2024. Valid for: 3 months.

This is the only time booking.property-ip8632.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Booking (Travel)

Domain & IP information

	IP Address	AS Autonomous System
4	104.21.43.42 104.21.43.42	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
6	3

4 104.21.43.42 (None, )

ASN13335 (CLOUDFLARENET, US)

booking.property-ip8632.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	property-ip8632.xyz booking.property-ip8632.xyz	87 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 761	30 KB
6	2

	Domain	Requested by
4	booking.property-ip8632.xyz	booking.property-ip8632.xyz
1	code.jquery.com	booking.property-ip8632.xyz
6	2

This site contains links to these domains. Also see Links.

Domain
partner.booking.com
join.booking.com
www.booking.com
admin.booking.com

Subject Issuer	Validity	Valid
property-ip8632.xyz GTS CA 1P5	`2024-02-05` - `2024-05-05`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://booking.property-ip8632.xyz/?utm=enATVWqA
Frame ID: 55714956332DFE585C8D77EBC4F6197E
Requests: 8 HTTP requests in this frame

Frame: data://truncated
Frame ID: 213D50D7A90B9AB12AE116CBF69DD845
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Booking.com

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

118 kB
Transfer

547 kB
Size

2
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://partner.booking.com/node/2170?utm_source=account&utm_medium=support_link

Search URL Search Domain Scan URL

URL: https://partner.booking.com/en-us?utm_source=extranet_login_page
Title: Partner Help

Search URL Search Domain Scan URL

URL: https://partner.booking.com/en-us/node/27/?utm_content=27&utm_source=extranet_login_page
Title: Partner Community

Search URL Search Domain Scan URL

URL: https://join.booking.com/?lang=en-us&aid=304142&utm_campaign=v1&utm_source=extranet_login_page&utm_medium=extranet&utm_content=default
Title: Create your partner account

Search URL Search Domain Scan URL

URL: https://www.booking.com/general.en-us.html?tmpl=docs/terms_of_use
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://admin.booking.com/hotel/hoteladmin/privacy.html?lang=en-us
Title: Privacy Statement

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response booking.property-ip8632.xyz/	459 KB 86 KB	563ms 180ms	Document text/html	104.21.43.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.property-ip8632.xyz/?utm=enATVWqA Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.43.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.24 Resource Hash `3079c03292f830b4e05a6c51bf4ea076a95635d66c1a96e96b3975d22f61cb5c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8524e2f62d72695e-FRA content-encoding br content-type text/html; charset=UTF-8 date Thu, 08 Feb 2024 15:25:40 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xw%2B8ez0Ew2Ok8oWGlTuEEjhY3MFRJDA2IQ%2FXwtam2l5XlMaE1FQ755N7Tvk8Y1PwuWyX9XB9H6bgEmjhhMzBhaFhTBCnCt%2FR8M6eout%2FFm7iXRlAczTLJ04JyWnV7r%2BMEHzo%2B%2FK60maLb8moIWY%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.2.24
GET DATA	200 OK	truncated /	642 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a333d02eedde7a4dd8643d58b0ea7947268a1762f35f517eb6000ec9e7fcfae8` Request headers accept-language de-DE,de;q=0.9 Referer https://booking.property-ip8632.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	35 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39` Request headers accept-language de-DE,de;q=0.9 Referer https://booking.property-ip8632.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	393ms 20ms	Script application/javascript	151.101.66.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: booking.property-ip8632.xyz URL: https://booking.property-ip8632.xyz/?utm=enATVWqA Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.66.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers Referer https://booking.property-ip8632.xyz/ Origin https://booking.property-ip8632.xyz accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36 Response headers date Thu, 08 Feb 2024 15:25:40 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 6803324 x-cache HIT, HIT content-length 30875 x-served-by cache-lga21931-LGA, cache-fra-etou8220114-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1707405941.795641,VS0,VE0 etag W/"28feccc0-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 4, 950231
GET DATA	200 OK	truncated / Frame 213D	81 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743` Request headers accept-language de-DE,de;q=0.9 Referer https://booking.property-ip8632.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36 Response headers Content-Type image/png
POST H2	200	window.php Show response booking.property-ip8632.xyz/	17 B 337 B	1144ms 1143ms	XHR text/html	104.21.43.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.property-ip8632.xyz/window.php Requested by Host: booking.property-ip8632.xyz URL: https://booking.property-ip8632.xyz/?utm=enATVWqA Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.43.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.24 Resource Hash `3dd6ce6d6c16a472bbb56ad171ecd50420232dc8c55e8fac71709c806527bd24` Request headers Referer https://booking.property-ip8632.xyz/?utm=enATVWqA accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Thu, 08 Feb 2024 15:25:42 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.2.24 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t%2FPAqHuIvfZ9fzoMXJLPFEHD1zPad5ffyxpYhgfMbtHgPygZkBDQtlU9QPEXOQdVWwfCEcako3PjONqEgJPKmyvH3X7pJ61q3inujv9Su71bBo%2FjgHiLNgpTqaEe4eIoUML5aAr%2FLzAzspacBeI%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 8524e3007e76695e-FRA alt-svc h3=":443"; ma=86400
POST H2	200	window.php Show response booking.property-ip8632.xyz/	17 B 324 B	1157ms 1157ms	XHR text/html	104.21.43.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.property-ip8632.xyz/window.php Requested by Host: booking.property-ip8632.xyz URL: https://booking.property-ip8632.xyz/?utm=enATVWqA Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.43.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.24 Resource Hash `3dd6ce6d6c16a472bbb56ad171ecd50420232dc8c55e8fac71709c806527bd24` Request headers Referer https://booking.property-ip8632.xyz/?utm=enATVWqA accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Thu, 08 Feb 2024 15:25:43 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.2.24 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BIIWpfx5jF0iRSHUx0U8z92zojLZogrTQR6E4V0KfdXKg1XoDW5RkXxC3EN6uyrE%2F92JM5Qq6YphWlqg92EtN8GimsmI9iE5leTb7QjD3cc9jIABNNqwW7Sdr6zUWAF5aDBd%2BiO7W1jES%2BY7lrc%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 8524e306bf14695e-FRA alt-svc h3=":443"; ma=86400
POST H2	200	window.php Show response booking.property-ip8632.xyz/	17 B 322 B	1129ms 1129ms	XHR text/html	104.21.43.42 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.property-ip8632.xyz/window.php Requested by Host: booking.property-ip8632.xyz URL: https://booking.property-ip8632.xyz/?utm=enATVWqA Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.43.42 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.24 Resource Hash `3dd6ce6d6c16a472bbb56ad171ecd50420232dc8c55e8fac71709c806527bd24` Request headers Referer https://booking.property-ip8632.xyz/?utm=enATVWqA accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Thu, 08 Feb 2024 15:25:44 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.2.24 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z5rlPMwi7DV7jeaIUsxWLXiYINloifDLTXcQxmP0RED81iDb5ZP64y2BCsKcPjxvOxp1QghmB7BFFXmicqdGsso2vTb%2BVnSWepR0B2PLMQoFYwQjFQYDqPN2sX4QBqbuZbv5bAKVDKSvOki1%2FFQ%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 8524e30cf809695e-FRA alt-svc h3=":443"; ma=86400
POST		window.php booking.property-ip8632.xyz/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: booking.property-ip8632.xyz
URL: https://booking.property-ip8632.xyz/window.php

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Booking (Travel)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			booking.property-ip8632.xyz/	1969-12-31 23:59:59	Name: bk-utm Value: enATVWqA
			booking.property-ip8632.xyz/	1969-12-31 23:59:59	Name: admin-bk Value: 60604164

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

booking.property-ip8632.xyz
code.jquery.com
booking.property-ip8632.xyz
104.21.43.42
151.101.66.137
3079c03292f830b4e05a6c51bf4ea076a95635d66c1a96e96b3975d22f61cb5c
3dd6ce6d6c16a472bbb56ad171ecd50420232dc8c55e8fac71709c806527bd24
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
a333d02eedde7a4dd8643d58b0ea7947268a1762f35f517eb6000ec9e7fcfae8
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

booking.property-ip8632.xyz Open in urlscan Pro 104.21.43.42 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

83 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

118 kBTransfer

547 kBSize

2 Cookies

6 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

2 Cookies

Indicators

booking.property-ip8632.xyz Open in urlscan Pro
104.21.43.42 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

118 kB
Transfer

547 kB
Size

2
Cookies

6 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!