booking.deal1941.bid
Open in
urlscan Pro
2606:4700:3036::6815:50f7
Malicious Activity!
Public Scan
Submission: On November 30 via api from BE — Scanned from DE
Summary
TLS certificate: Issued by E1 on November 27th 2023. Valid for: 3 months.
This is the only time booking.deal1941.bid was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Booking (Travel)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
18 | 2606:4700:303... 2606:4700:3036::6815:50f7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:225... 2600:9000:2251:b600:5:bf05:acc0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 2606:4700:10:... 2606:4700:10::6816:1490 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2606:4700::68... 2606:4700::6810:7baf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::200a | 15169 (GOOGLE) (GOOGLE) | |
22 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
deal1941.bid
booking.deal1941.bid |
67 KB |
2 |
unpkg.com
1 redirects
unpkg.com — Cisco Umbrella Rank: 857 |
13 KB |
2 |
tailwindcss.com
1 redirects
cdn.tailwindcss.com — Cisco Umbrella Rank: 47565 |
108 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29 |
1 KB |
1 |
bstatic.com
q-xx.bstatic.com — Cisco Umbrella Rank: 14074 |
138 KB |
22 | 5 |
Domain | Requested by | |
---|---|---|
18 | booking.deal1941.bid |
booking.deal1941.bid
unpkg.com |
2 | unpkg.com |
1 redirects
booking.deal1941.bid
|
2 | cdn.tailwindcss.com |
1 redirects
booking.deal1941.bid
|
1 | fonts.googleapis.com |
booking.deal1941.bid
|
1 | q-xx.bstatic.com |
booking.deal1941.bid
|
22 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
deal1941.bid E1 |
2023-11-27 - 2024-02-25 |
3 months | crt.sh |
*.bstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-09-13 - 2024-08-31 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://booking.deal1941.bid/secure-checkout/177295251
Frame ID: 2F50387D22743A49D807150D839C3EFD
Requests: 7 HTTP requests in this frame
Frame:
https://booking.deal1941.bid/supportChatFrame/177295251
Frame ID: 97524CF409B9A2113A57A1C86CB7EC80
Requests: 15 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://cdn.tailwindcss.com/ HTTP 302
- https://cdn.tailwindcss.com/3.3.5
- https://unpkg.com/axios/dist/axios.min.js HTTP 302
- https://unpkg.com/axios@1.6.2/dist/axios.min.js
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
177295251
booking.deal1941.bid/secure-checkout/ |
57 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
booking.deal1941.bid/services/booking/js/ |
12 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
booking.deal1941.bid/services/booking/css/ |
32 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
support_parent.css
booking.deal1941.bid/css/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
407928814.jpg
q-xx.bstatic.com/images/hotel/square850/407/ |
138 KB 138 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
177295251
booking.deal1941.bid/supportChatFrame/ Frame 9752 |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flags.png
booking.deal1941.bid/services/booking/images/ |
30 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pluxurydarklord.svg
booking.deal1941.bid/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chat.css
booking.deal1941.bid/assets/css/ Frame 9752 |
243 B 696 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.3.5
cdn.tailwindcss.com/ Frame 9752 Redirect Chain
|
355 KB 108 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bookmark.svg
booking.deal1941.bid/assets/icons/ Frame 9752 |
247 B 678 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chevron-down.svg
booking.deal1941.bid/assets/icons/ Frame 9752 |
231 B 673 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
close.svg
booking.deal1941.bid/assets/icons/ Frame 9752 |
230 B 661 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
person-circle.svg
booking.deal1941.bid/assets/icons/ Frame 9752 |
563 B 849 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
document.svg
booking.deal1941.bid/assets/icons/ Frame 9752 |
339 B 734 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
send.svg
booking.deal1941.bid/assets/icons/ Frame 9752 |
402 B 769 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
unpkg.com/axios@1.6.2/dist/ Frame 9752 Redirect Chain
|
33 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chat.js
booking.deal1941.bid/assets/js/ Frame 9752 |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ Frame 9752 |
14 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
booking.deal1941.bid/api/support/ Frame 9752 |
15 B 492 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
booking.deal1941.bid/api/support/ Frame 9752 |
15 B 486 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
booking.deal1941.bid/api/support/ Frame 9752 |
15 B 499 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Booking (Travel)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| documentPictureInPicture1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
booking.deal1941.bid/ | Name: connect.sid Value: s%3AvYj9FLPshZ3_jG6hGFVMh1gdkfs2VCRc.N0cpXH%2BoOlnKnO0KDjra3gqqKvFYZTEtnPbqr%2F3NQ40 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
booking.deal1941.bid
cdn.tailwindcss.com
fonts.googleapis.com
q-xx.bstatic.com
unpkg.com
2600:9000:2251:b600:5:bf05:acc0:93a1
2606:4700:10::6816:1490
2606:4700:3036::6815:50f7
2606:4700::6810:7baf
2a00:1450:4001:831::200a
0b965d3ec77652adf398871b30233235debf8a281d5ca62c71ecb355d32b96d3
1d3af5838269f41ffd019f04eefcf2b494953d28fb1401acfbfa4ec55c57d515
20f5cc0ebb84eb9bdeb82a9b908e9f922ab10ea415857c8b00b8302e00c61a5c
550f26d03776c62d33e90b8028c6b4e2e7d1301c6ff769cff94592a93df71c68
5e4ce7b36ba37b78a5d5f9fd08e6b7b54ba6879d651aa46ec9e1d6fa24ebe30a
670b213e16fbff2d33d74f23386683bf90f4c23a5a4b3b60572bbe8230c712fe
68c0e64ab68b5d9a9372d26e6b984b0053c4be39729fcba2305c5aaccd1b2944
78e5fb46ae07f5c47893dbb03c61ac161921ac86b95c93c92693da8be80ade71
78f70dbdf61859c3a382c96c27880fa5737216af6d491fedf73a3356ccab05bc
7af96b589c08faa9b3014d28497abd0b8e428307b8ec4b93f58977e9fd62905b
846a64b15537fd60cbebc9dbdca9a2df72aa05a6e564210f78acfd701a386ef7
97d008f0efeb03337a4a169d85b9f8907ef5d6dcb74fb88f7e2f981250903349
9a60eed802ef3d6b6784369cf91a4be28f925fa426293244ad43b9d2868f2988
b2e3158656f24d0f69988896ea2facd530904745d286f84eadb67ceb2ce9d4c2
b4784b8b0b3e2cfefe7106fea734e0a37df601a093d8bdb1aa3ee5216716546b
c5e7e8f07db5f90f5b179d122a425eacb8e7b0b57e79349f6e414158d3db0f77
d7a5152180593b0144e6a36c21ca0e19aa9a64da790d7a1d14f0cbe49d45525a
f8cbafd49c896a6e02a3a959409874806cff8792343936c0ba532f58ecc95333
fbb307bc48c763f9a4893ba918ca9a322f4e084dbb994504d526af90c1a4d1e9
fc78e1550450ab81964ef660b05cb14fb17e0b895b261925ad7e6e073502dfc4