urlscan.io logo urlscan.io
SecurityTrails logo

booking-sing-in.com Open in urlscan Pro
2606:4700:3032::6815:9fc  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://booking-sing-in.com/
Effective URL: https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Submission: On March 02 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3032::6815:9fc, located in United States and belongs to CLOUDFLARENET, US. The main domain is booking-sing-in.com.
TLS certificate: Issued by GTS CA 1P5 on February 24th 2024. Valid for: 3 months.
This is the only time booking-sing-in.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Booking (Travel)

Domain & IP information

IP Address AS Autonomous System
1 12 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a04:4e42:400... 54113 (FASTLY)
1 2600:9000:251... 16509 (AMAZON-02)
13 3
Apex Domain
Subdomains		 Transfer
12 booking-sing-in.com
booking-sing-in.com
56 KB
1 bstatic.com
q-xx.bstatic.com — Cisco Umbrella Rank: 15316
1 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310
16 KB
13 3
Domain Requested by
12 booking-sing-in.com 1 redirects booking-sing-in.com
cdn.jsdelivr.net
1 q-xx.bstatic.com booking-sing-in.com
1 cdn.jsdelivr.net booking-sing-in.com
13 3

This site contains links to these domains. Also see Links.

Domain
www.booking.com
admin.booking.com
partner.booking.com
Subject Issuer Validity Valid
booking-sing-in.com
GTS CA 1P5		 2024-02-24 -
2024-05-24		 3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-09-27 -
2024-10-28		 a year crt.sh
*.bstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-11-29 -
2024-11-28		 a year crt.sh

This page contains 1 frames:

Primary Page: https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Frame ID: 2AA4D811EB666293FA89A5795221A32B
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Booking.com

Page URL History Show full URLs

  1. https://booking-sing-in.com/ HTTP 302
    https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

72 kB
Transfer

342 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://booking-sing-in.com/ HTTP 302
    https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
booking-sing-in.com/
Redirect Chain
  • https://booking-sing-in.com/
  • https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
56 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
037ed8e38d857b06eb2273c1553c75aa87952eca0c1fe4170b51b7ff839c6b39

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
85df2ca2d972c3f3-EWR
content-encoding
br
content-type
text/html; charset=utf-8
date
Sat, 02 Mar 2024 06:01:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L8cRp1sv6sJbrpGSes5RPGyTeWI04U5XoT3pSvQq7qMNxW2zHLABPt2G2D8GXJOKKQGpgxQgNtvwycrevCXRWjHhcZUf5NXvQ9CfxMSUCwDrkwhxgYqzMyE%2BpgGntxMDAYXzfbcz1bcIRLcedKkMFrcp"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
85df2ca0cfbec3f3-EWR
content-type
text/html; charset=utf-8
date
Sat, 02 Mar 2024 06:01:49 GMT
location
/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lcfmhNHS9LYYl0el%2BBaqAzeEhvpxY%2Bk%2Fag%2FvTjBf7jRdlHBURCTJpWl481NI%2BGrDzSOf63%2BdVFVd8A5NGQnBChPUKNAG%2BxU0I4zMBRKycC4ECrrXKFgYweNHg3g6thWbx7240VfPg%2BOitLzjLjMdK0yx"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Cookie
826_870c205e4e40b913b2fc.css
booking-sing-in.com/static/styles/ 		60 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/static/styles/826_870c205e4e40b913b2fc.css
Requested by
Host: booking-sing-in.com
URL: https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e27699587add2db711900ce3fe3eb78eb8c3ea99948cc1b673c6e49d392f66b

Request headers

accept-language
en-US,en;q=0.9
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:49 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Fri, 23 Feb 2024 11:36:20 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"1708688180.122289-61284-3983085908"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MqDWND%2FZ4pFMUJECUaBAbdMrHbQvMUximZDViSMDw7GUrU%2BjCVUkX%2BDe0i0NmtzTylS3vSyB41HwtRdYblYee9%2BFjsMNa1xgPvfon6ietL3rwEopYKTNYmbNUIYtCSLuQnuQ9xTAVPbdeQaxO2e8zhLC"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
content-disposition
inline; filename=826_870c205e4e40b913b2fc.css
cf-ray
85df2ca39b097298-EWR
alt-svc
h3=":443"; ma=86400
925_1975cbc2f7eaad75f590.css
booking-sing-in.com/static/styles/ 		90 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/static/styles/925_1975cbc2f7eaad75f590.css
Requested by
Host: booking-sing-in.com
URL: https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d74100a825fc1a4af9272c442187ca4005d0dc1b7b8b61066e02059ada4ab13

Request headers

accept-language
en-US,en;q=0.9
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:49 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Fri, 23 Feb 2024 11:36:20 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"1708688180.6782835-92562-4144239045"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v0FX2hGhJ8rKfNTvJxKqSMEToaxRfS3CaH7g1lbndY0rE5KXUf8WjVxYS%2BzO5%2F73tsYPl0vGkQ66X8kr62ja7YgDS35hBoeeXsrKSe6HXvofJYKfm330nL6pXUG9uHAnTz6Z6JtIhkeEIVFzTknAAC44"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
content-disposition
inline; filename=925_1975cbc2f7eaad75f590.css
cf-ray
85df2ca39b0a7298-EWR
alt-svc
h3=":443"; ma=86400
146_afde72b9aaa8302ff017.css
booking-sing-in.com/static/styles/ 		73 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/static/styles/146_afde72b9aaa8302ff017.css
Requested by
Host: booking-sing-in.com
URL: https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4567d6213bc1480a45f493da8d292339522d45ac15c8ba1723aa342b155393f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:49 GMT
strict-transport-security
max-age=31536000
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Fri, 23 Feb 2024 11:36:20 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"1708688180.094289-74745-4244509152"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YqSy8lRBn25n09WK0lCtf28mVFoswny5ohRIaRxJuC98WbHDc%2B%2Fqi%2FsS%2FsuDGCWg1oOzx%2BN88WbR%2Be0l3hT5b0jhTkaU1im1NwJkpelyZzZ8FTosy6T7aJStBfepH3FIOWoClYED18eGj6Yuxxngo55P"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
cache-control
max-age=14400
content-disposition
inline; filename=146_afde72b9aaa8302ff017.css
cf-ray
85df2ca39b0b7298-EWR
alt-svc
h3=":443"; ma=86400
stile.css
booking-sing-in.com/static/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/static/stile.css
Requested by
Host: booking-sing-in.com
URL: https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:49 GMT
content-encoding
br
cf-cache-status
EXPIRED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qu6xUhkXa3lojJE%2Bt9RICXdS%2F9tXQtg0GT5jl5FFU64%2B8f3IBxZXGi7wsjlkfYfy7yHVbB1Ix2XpUA4FSdywu2f1cv5hvT%2B4ta%2Bz9p%2BqCnh%2F3nlWBl9zYnQUTfKaHzDEnuvFFshaXQ6WEOZ3Zl7mG%2BNz"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
cache-control
max-age=14400
cf-ray
85df2ca39b0f7298-EWR
alt-svc
h3=":443"; ma=86400
axios.min.js
cdn.jsdelivr.net/npm/axios/dist/ 		40 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Requested by
Host: booking-sing-in.com
URL: https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3434b67595c68071824e142d077ce7e105d40ac40b15164896d11e54078d0213
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-US,en;q=0.9
Referer
https://booking-sing-in.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sat, 02 Mar 2024 06:01:49 GMT
x-content-type-options
nosniff
content-encoding
br
age
6337
x-jsd-version
1.6.7
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
15620
x-served-by
cache-fra-etou8220107-FRA, cache-lga21927-LGA
x-jsd-version-type
version
etag
W/"a025-pU1dreb3BCFPYYTIFZJhWMD8IeA"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
jfalhwkfafwahkl.js
booking-sing-in.com/static/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/static/jfalhwkfafwahkl.js
Requested by
Host: booking-sing-in.com
URL: https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0affa491a8f8bfe93a9c3be3a05f1952a9f4cb96f16871bfb5bdf4559dece37c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:49 GMT
strict-transport-security
max-age=31536000
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Fri, 23 Feb 2024 11:36:18 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"1708688178.7263029-7260-4261154282"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rKAbJEZnKK4u3wlb6wEVVFZI7d744IgtkROjYIzBfNi%2BhVuBaUUcs96vcvf5dCZkrmfIi95WtvhjbOwlgVSP%2FG0TmNn5ncpeiPdWQVf7dD%2BUISzQuzBg2Acp97DTbJIgmQf516ilO8xiHHUK56dl2tg2"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=utf-8
cache-control
max-age=14400
content-disposition
inline; filename=jfalhwkfafwahkl.js
cf-ray
85df2ca3bb297298-EWR
alt-svc
h3=":443"; ma=86400
us.png
q-xx.bstatic.com/backend_static/common/flags/new/48-squared/ 		642 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Requested by
Host: booking-sing-in.com
URL: https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2512:9200:5:bf05:acc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a333d02eedde7a4dd8643d58b0ea7947268a1762f35f517eb6000ec9e7fcfae8
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://booking-sing-in.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 10:03:36 GMT
via
1.1 812385435e4a24499dabb443924e6b50.cloudfront.net (CloudFront)
nel
{"report_to":"default","max_age":600}
x-amz-cf-pop
JFK50-P7
age
935893
x-cache
Hit from cloudfront
content-length
642
x-xss-protection
1; mode=block
last-modified
Mon, 07 Sep 2020 09:08:23 GMT
server
nginx
etag
"5f55f887-282"
report-to
{"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
rmMH4IbZhAKahI6usOxZu9qNIjOmgyTqGHLA7qhl9cwTk3lKaI3voA==
expires
Thu, 21 Mar 2024 10:03:36 GMT
getMessages
booking-sing-in.com/api/support/ 		3 KB
839 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/api/support/getMessages
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b0317396830dc5766521c1e91e8e7468eeeb4e24a8f4b7bc052cad6ee2596e0

Request headers

Accept
application/json, text/plain, */*
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:50 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VvH8rj2dswOuY2mKmKmDXo2nAzYdug0agymk7VfXAFjmKAWqzMV3Mj5%2F3XQ1Lykr2B%2BMlMSFTVb2q8b85eH%2BW%2FZBuc7UFNFupDpJqes%2FYo06XtG5ej9LqyZM694b9MxXngaMNgGg3XJWJjxJFetIQKkF"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
85df2ca60dc57298-EWR
alt-svc
h3=":443"; ma=86400
getMessages
booking-sing-in.com/api/support/ 		3 KB
834 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/api/support/getMessages
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b0317396830dc5766521c1e91e8e7468eeeb4e24a8f4b7bc052cad6ee2596e0

Request headers

Accept
application/json, text/plain, */*
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:50 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ylwoQS42mguqOCKx8vhzO85tKlsCjH5Jb7hAaK0gi9Utg8Cc2QiJs6v%2FjbubxZ4ueOKgcXzn1bIU12UXfmcxm1cKkWa2rb3Dbq3Hmxr4fub5nOR9w%2F75yzRNgJ%2FA7UdXYoq0dZSuWYKJYWRSVKW6x9vc"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
85df2cac1c0a7298-EWR
alt-svc
h3=":443"; ma=86400
getMessages
booking-sing-in.com/api/support/ 		3 KB
832 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/api/support/getMessages
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b0317396830dc5766521c1e91e8e7468eeeb4e24a8f4b7bc052cad6ee2596e0

Request headers

Accept
application/json, text/plain, */*
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:51 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hlaxDeA0LQ9CrZY2jpLkz69agjR%2Fszt0VNgHhCPK69ngoYKY3FF6SXD8mXHYDoHGOF3Ih16g4cntcvMDrLddXO4waxhw7k4R08fZMKfL8o4mABO8DessJPhVQ4RSs7NBEibxPLWos3JT1yLzMTyzB6Cd"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
85df2cb25ada7298-EWR
alt-svc
h3=":443"; ma=86400
getMessages
booking-sing-in.com/api/support/ 		3 KB
843 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/api/support/getMessages
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b0317396830dc5766521c1e91e8e7468eeeb4e24a8f4b7bc052cad6ee2596e0

Request headers

Accept
application/json, text/plain, */*
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:52 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bAEG0wHbho%2BGg5Fwf1fG0%2Fs5qJ3m4DAX%2FeEtxNBiOJ7bsLwzYNXv%2FMzfVaBkXgiKiA0%2FXlFi5u%2Fw6zL3LE0MObWYULUzQVXbLWDlMtos7%2BAiQUQ6UVIOlxCiYJeMlajCLuVF19D7NkLy%2FBjLYH1DqYRl"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
85df2cb8aa9c7298-EWR
alt-svc
h3=":443"; ma=86400
getMessages
booking-sing-in.com/api/support/ 		3 KB
837 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://booking-sing-in.com/api/support/getMessages
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios/dist/axios.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:9fc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b0317396830dc5766521c1e91e8e7468eeeb4e24a8f4b7bc052cad6ee2596e0

Request headers

Accept
application/json, text/plain, */*
Referer
https://booking-sing-in.com/sign-in%3Fop_token=NhIeNEhODKgCUltgbZeRfeBnmp51mKEG0Io3RRjTUiZ5pC8n9h
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Sat, 02 Mar 2024 06:01:53 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DN0fIAvHrxSDiFmFh0kstS%2BpwnYT4t9PBzQ5GO4%2BUcCWE0ztjuiIbX6jY2pl4PoKvq2tHLCFcTpfEjmuMKiUQnzbyyPd%2FRUtksC4iNLLx%2FSr8Wu%2BKasVt9v4BMUiA1AnAJEPEdb6fso8njQ5GgTz4c3G"}],"group":"cf-nel","max_age":604800}
content-type
application/json
cf-ray
85df2cbed9ce7298-EWR
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Booking (Travel)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| axios object| submitButtonLogin object| submitButtonPass object| submitButtonPulse object| submitButtonCall object| submitButtonSms object| submitButtonError object| submitButtonFagwa object| submitButtonVer object| submitButtonCode object| submitButtonCodePulse object| loginError object| errorIcon object| app1Element object| app2Element object| app3Element object| app4Element object| app5Element object| app6Element object| app7Element object| app8Element object| loginInput object| PassnInput object| phoneInput object| kbx object| displayValueElement object| phoneValueElement function| handleButtonClick function| awgawg function| swahwehaweh function| fetchMessages

1 Cookies

Domain/Path Name / Value
booking-sing-in.com/ Name: session
Value: eyJyYW5kb21fc3RyaW5nIjoiTmhJZU5FaE9ES2dDVWx0Z2JaZVJmZUJubXA1MW1LRUcwSW8zUlJqVFVpWjVwQzhuOWgifQ.ZeLAzQ.2tbvmNzoZW8IRlKYvixhwSe2emU

1 Console Messages

Source Level URL
Text
network error URL: https://booking-sing-in.com/static/stile.css
Message:
Failed to load resource: the server responded with a status of 404 ()