booking.extranprivacy.com
Open in
urlscan Pro
2606:4700:3032::ac43:8895
Malicious Activity!
Public Scan
Submission: On March 09 via api from US — Scanned from US
Summary
This is the only time booking.extranprivacy.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Booking (Travel)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:303... 2606:4700:3032::ac43:8895 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 2600:9000:251... 2600:9000:2512:3c00:5:bf05:acc0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 13.225.63.85 13.225.63.85 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:822::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:9000:251... 2600:9000:2512:c200:5:bf05:acc0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 45.130.41.42 45.130.41.42 | 198610 (BEGET-AS) (BEGET-AS) | |
1 | 13.226.34.41 13.226.34.41 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 35.190.10.96 35.190.10.96 | 15169 (GOOGLE) (GOOGLE) | |
13 | 8 |
ASN16509 (AMAZON-02, US)
cf.bstatic.com | |
q-xx.bstatic.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-85.ewr53.r.cloudfront.net
saa.booking.com |
ASN198610 (BEGET-AS, RU)
PTR: ssl.thomas.beget.com
snipp.ru |
ASN16509 (AMAZON-02, US)
PTR: server-13-226-34-41.ewr53.r.cloudfront.net
account.booking.com |
ASN15169 (GOOGLE, US)
PTR: 96.10.190.35.bc.googleusercontent.com
collector-pxikkul2rm.px-cloud.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
bstatic.com
cf.bstatic.com — Cisco Umbrella Rank: 14775 q.bstatic.com — Cisco Umbrella Rank: 85372 q-xx.bstatic.com — Cisco Umbrella Rank: 15316 |
647 KB |
2 |
px-cloud.net
collector-pxikkul2rm.px-cloud.net — Cisco Umbrella Rank: 55884 |
1 KB |
2 |
booking.com
saa.booking.com — Cisco Umbrella Rank: 181007 account.booking.com — Cisco Umbrella Rank: 15164 |
15 KB |
1 |
snipp.ru
snipp.ru |
29 KB |
1 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 29 |
21 KB |
1 |
extranprivacy.com
booking.extranprivacy.com |
47 KB |
13 | 6 |
Domain | Requested by | |
---|---|---|
4 | cf.bstatic.com |
booking.extranprivacy.com
|
2 | collector-pxikkul2rm.px-cloud.net |
q.bstatic.com
|
1 | q-xx.bstatic.com |
booking.extranprivacy.com
|
1 | account.booking.com |
booking.extranprivacy.com
|
1 | snipp.ru |
booking.extranprivacy.com
|
1 | q.bstatic.com |
booking.extranprivacy.com
|
1 | www.google-analytics.com |
booking.extranprivacy.com
|
1 | saa.booking.com |
booking.extranprivacy.com
|
1 | booking.extranprivacy.com | |
13 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.bstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-11-29 - 2024-11-28 |
a year | crt.sh |
*.booking.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-06-12 - 2024-05-18 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
snipp.ru R3 |
2024-02-10 - 2024-05-10 |
3 months | crt.sh |
*.px-cloud.net Sectigo RSA Domain Validation Secure Server CA |
2023-08-15 - 2024-09-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://booking.extranprivacy.com/
Frame ID: 5C8A010B958F975FE199503DC50B2029
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Booking.comDetected technologies
Google Analytics (Analytics) ExpandDetected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
PerimeterX (Security) Expand
Detected patterns
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
booking.extranprivacy.com/ |
306 KB 47 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
416_1975cbc2f7eaad75f590.css
cf.bstatic.com/psb/accountsportal/assets/ |
90 KB 91 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
549_473af0c65e95a32c7dab.css
cf.bstatic.com/psb/accountsportal/assets/ |
73 KB 73 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
826_253079e92c11f7fb46bd.css
cf.bstatic.com/psb/accountsportal/assets/ |
59 KB 60 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset.76f4cfe389ea593cf33909bbcedb7949.js
saa.booking.com/ |
39 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
px.v7.5.3.min.js
q.bstatic.com/libs/asec/btmgmt/ |
269 KB 99 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
925_946cf100110ca1d365b2.js
cf.bstatic.com/psb/accountsportal/assets/ |
322 KB 323 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
snipp.ru/cdn/jquery/2.1.1/ |
82 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fvtrpw.gif
account.booking.com/_/ |
35 B 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collector
collector-pxikkul2rm.px-cloud.net/api/v2/ |
543 B 793 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
us.png
q-xx.bstatic.com/backend_static/common/flags/new/48-squared/ |
642 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collector
collector-pxikkul2rm.px-cloud.net/api/v2/ |
597 B 653 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Booking (Travel)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| _pxAppId object| PXikKuL2RM object| PX undefined| _ikKuL2RMhandler function| viewDiv function| hideDiv undefined| params undefined| search_params string| GoogleAnalyticsObject function| ga object| webpackChunkbookings_web_accounts_portal_workspaces object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| $ function| jQuery object| $jscomp function| docReady string| _pxParam18 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.extranprivacy.com/ | Name: _ga Value: GA1.2.1858910321.1709972155 |
|
.extranprivacy.com/ | Name: _gid Value: GA1.2.1453542644.1709972155 |
|
.extranprivacy.com/ | Name: pxcts Value: 40592dae-dded-11ee-b6a9-4aebe33041b9 |
|
.extranprivacy.com/ | Name: _pxvid Value: 40592023-dded-11ee-b6a9-a9a94b6a8deb |
|
booking.extranprivacy.com/ | Name: _pxff_cfp Value: 1 |
|
booking.extranprivacy.com/ | Name: _pxff_ddtc Value: 1 |
|
.extranprivacy.com/ | Name: _px3 Value: 841b66e3722e614e6b262b9c9f40e53451a9e9cb26902aa6b4dacd684492d6eb:+eGvLN7A1O5TcI92szMOVuqBRUmDu5E+Lk+UT9WfjXjafSYe39sollyh+g3VkPcbdP57oSgAoUjZQXn1iQ59JA==:1000:1RnQjO37oAZx+HVJkoR8TPO/MjN3EkIWrm81e2hG3IDUrdUQzps430vT7yw3+uZhYkynuouxasKV8NwuUybE+dHmLIyM04y21TaHcIVeTKY9B0yLW6pZv2/o706Qs3TfH7lQ4tW1FYITGRRGfS24J4z5RTvN6G+t6MlreAVwnOa8vk4wHU4uIcMVAHibJyPgDLu+8QDCpK3pB/ipFIGDgYVPSx1bkESEdKfYP2shODE= |
|
.extranprivacy.com/ | Name: _pxde Value: 12c8b79b47a61101288adc33573cdc33deead7a20db508874a74f0371ba23772:eyJ0aW1lc3RhbXAiOjE3MDk5NzIxNTU5ODksImZfa2IiOjAsImlwY19pZCI6WzEzXX0= |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
account.booking.com
booking.extranprivacy.com
cf.bstatic.com
collector-pxikkul2rm.px-cloud.net
q-xx.bstatic.com
q.bstatic.com
saa.booking.com
snipp.ru
www.google-analytics.com
13.225.63.85
13.226.34.41
2600:9000:2512:3c00:5:bf05:acc0:93a1
2600:9000:2512:c200:5:bf05:acc0:93a1
2606:4700:3032::ac43:8895
2607:f8b0:4006:822::200e
35.190.10.96
45.130.41.42
0e3cd6436c3188852c7bc0a21b4c6789c22306fe5f5d64c1507d9f24590f7670
2d74100a825fc1a4af9272c442187ca4005d0dc1b7b8b61066e02059ada4ab13
3b7358bfce3de8628b41c4cc5c16e0cf066987982d0de773f9d1acf7af403917
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
950d7028921f91f48d3242b0eace0b1a0be2e3290714014a3025953c44facb32
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
9f3236f13f7cdca778305d3c1f0263c5bb57b5c7bed70677b756ece75b5edba3
a333d02eedde7a4dd8643d58b0ea7947268a1762f35f517eb6000ec9e7fcfae8
b8305ed5c06afa979240619fa84ecffade5eced3cbd79ce1c17de1f03e2f8453
b94abe7257faae6d3334de4abe4e0d89b938d53ca66e022214f840c2aeb31cad
dc40e27fb7e4940d78a22d31e49117ef41cb241f0a4c8a8b20c6e072bf66a3c6
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
f6cf3b2e7de29f886185bc35d78511d7be137ef2d9193b8262c495acdb85a5a0