booking.extraguestbook.com Open in urlscan Pro
172.67.182.187 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://extraguestbook.com/
Effective URL:
https://booking.extraguestbook.com/win
Submission: On December 20 via manual (December 20th 2024, 3:23:06 am UTC) from TH — Scanned from DE

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 172.67.182.187, located in United States and belongs to CLOUDFLARENET, US. The main domain is booking.extraguestbook.com.
TLS certificate: Issued by WE1 on December 19th 2024. Valid for: 3 months.

This is the only time booking.extraguestbook.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Booking (Travel)

Domain & IP information

	IP Address		AS Autonomous System
4 14	172.67.182.187 172.67.182.187		13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	1

14 172.67.182.187 (United States) 4 redirects

ASN13335 (CLOUDFLARENET, US)

extraguestbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
booking.extraguestbook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	extraguestbook.com 4 redirects extraguestbook.com booking.extraguestbook.com	284 KB
10	1

	Domain	Requested by
12	booking.extraguestbook.com	2 redirects booking.extraguestbook.com
2	extraguestbook.com	2 redirects
10	2

This site contains links to these domains. Also see Links.

Domain
partner.booking.com

Subject Issuer	Validity	Valid
extraguestbook.com WE1	`2024-12-19` - `2025-03-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://booking.extraguestbook.com/win
Frame ID: 1071FE9B3D9AD48DE0C2C303E65FEF81
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://extraguestbook.com/ HTTP 302
https://extraguestbook.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcm... HTTP 302
https://booking.extraguestbook.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcm... HTTP 302
https://booking.extraguestbook.com/win Page URL

Page Statistics

10
Requests

90 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

280 kB
Transfer

1892 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://partner.booking.com/node/2170?utm_source=account&utm_medium=support_link

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://extraguestbook.com/ HTTP 302
https://extraguestbook.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP 302
https://booking.extraguestbook.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJlLThiOGUtNjI0NjllN2Y1ZGQ5In0yK1lHOEtPZGcwYXplS1N1OG5VZ25uQ3pSci1MYkt5TXFxaVNWanNsMjV4WnM6BFMyNTZCBGNvZGUqEzCSipujlK4nOgBCAFjd1NXosDI HTTP 302
https://booking.extraguestbook.com/win Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://booking.extraguestbook.com/favicon.ico HTTP 302
https://booking.extraguestbook.com/win

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request win Show response booking.extraguestbook.com/ Redirect Chain https://extraguestbook.com/ https://extraguestbook.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5OS00YjJl... https://booking.extraguestbook.com/sign-in?op_token=zXj81EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiYjEzZGNlMjQtMGM5... https://booking.extraguestbook.com/win	8 KB 4 KB	74ms 74ms	Document text/html	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/win Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `954fb0d0c3fa760bb7c026f3d69fdaa54eeef3f3301521ab92703908df519f0f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 cf-cache-status DYNAMIC cf-ray 8f4c82ea8e334db4-FRA content-encoding zstd content-type text/html; charset=UTF-8 date Fri, 20 Dec 2024 03:23:02 GMT expires Thu, 19 Nov 1981 08:52:00 GMT last-modified Friday, 20-Dec-2024 03:23:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache priority u=0,i report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z4wkFgZD7eujviVt3K2hr5xXNkrYvL0FlfG1pTHfcUtkDnLTxF1aRhWR2R6Vy7i9dS1CIwO%2BByqh39r5HhqiQnQtFNXQ2qDNJ%2F51iARvyf0y9Ly4HUeG7ktLE8STMAXxIviIcZPtEAu0z2qJ%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=10731&min_rtt=6542&rtt_var=6538&sent=19&recv=14&lost=0&retrans=0&sent_bytes=7289&recv_bytes=6271&delivery_rate=4093&cwnd=12000&unsent_bytes=0&cid=406b77040e58ef65&ts=572&x=1" cfExtPri cfHdrFlush;dur=0 Redirect headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 cf-cache-status DYNAMIC cf-ray 8f4c82e94dba4db4-FRA content-type text/html; charset=UTF-8 date Fri, 20 Dec 2024 03:23:02 GMT expires Thu, 19 Nov 1981 08:52:00 GMT last-modified Friday, 20-Dec-2024 03:23:02 GMT location /win nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache priority u=0,i report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A6AWWjS%2BYK9Ji4cJDVkM1Rmi6tu4jtUryAnyFWVfsI0DeDfiCRrIVbzQjyMw3ofmFIlJe7KennA8lt4O8tsy1q%2FeSFAT9J5UfNdWZKeAiz%2BusN3IhWvzgGyLU9NpQUOdMplMwXFskqmT8daTVQ%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=11139&min_rtt=6542&rtt_var=7630&sent=17&recv=13&lost=0&retrans=0&sent_bytes=6426&recv_bytes=5841&delivery_rate=12048&cwnd=12000&unsent_bytes=0&cid=406b77040e58ef65&ts=496&x=1" cfExtPri cfHdrFlush;dur=0
GET H3	200	css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css booking.extraguestbook.com/static/	24 KB 6 KB	188ms 187ms	Stylesheet text/css	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/static/css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css Requested by Host: booking.extraguestbook.com URL: https://booking.extraguestbook.com/win Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5b13ff3b2e19c2eec561fa89ec8358795373d08d801ea2c129ec1c26d8ff3de7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://booking.extraguestbook.com/win Response headers server cloudflare cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status BYPASS etag W/"67268c7e-6077" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rHWo14NU0zSX6IK%2BhoJl78jvjWPox0oFDjYQL5XD9rLojwCZwSCcQ1354miGjW%2FC3DyCSzFxMdsFFjLuLNvqDI1IFBIny500%2BVTCWXsEgwP7mljpfNiyBg1Z74RqTPvoPP5jqsVb%2FXAwZuI9TA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8f4c82eb0e644db4-FRA alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=8782&min_rtt=5951&rtt_var=4604&sent=32&recv=24&lost=0&retrans=0&sent_bytes=15716&recv_bytes=8711&delivery_rate=10902&cwnd=12000&unsent_bytes=0&cid=406b77040e58ef65&ts=762&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:02 GMT content-type text/css last-modified Friday, 20-Dec-2024 03:23:02 GMT vary Accept-Encoding priority u=0,i=?0
GET H3	200	css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.css booking.extraguestbook.com/static/	802 KB 109 KB	180ms 180ms	Stylesheet text/css	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/static/css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.css Requested by Host: booking.extraguestbook.com URL: https://booking.extraguestbook.com/win Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `17bf7329db361de5e5f1e25e82f00e41555fb5e7ea7c0115952c3677be33e0a0` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://booking.extraguestbook.com/win Response headers server cloudflare cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status BYPASS etag W/"67268c7f-c86e1" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ncj6cp23j4kqp4fSoYXEYKLFyozUj8RYoVdCXzImGU7NATTPY9Cr7QDnFO37acZMVMq1tpjueKEkK9VD%2BZccE4JUd%2F5H8Ga47FrTyed5TXLBHAyHZtIpWdnbBIBIKfdq86%2FtBsKCfUESvYWfQA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8f4c82eb0e664db4-FRA alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=8782&min_rtt=5951&rtt_var=4604&sent=29&recv=24&lost=0&retrans=0&sent_bytes=13470&recv_bytes=8711&delivery_rate=10902&cwnd=12000&unsent_bytes=0&cid=406b77040e58ef65&ts=755&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:02 GMT content-type text/css last-modified Friday, 20-Dec-2024 03:23:02 GMT vary Accept-Encoding priority u=0,i=?0
GET H3	200	45_1975cbc2f7eaad75f590.css booking.extraguestbook.com/static/	90 KB 17 KB	181ms 180ms	Stylesheet text/css	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/static/45_1975cbc2f7eaad75f590.css Requested by Host: booking.extraguestbook.com URL: https://booking.extraguestbook.com/win Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `96f1beb125f73c511d8b401c7cb7af1469ceed1a89003beecb8646166dc41f07` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://booking.extraguestbook.com/win Response headers server cloudflare cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status BYPASS etag W/"672e5544-16800" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UqFzRWfFGVCDVo9zn1n9d0OxqP4RYtH4KAGAAgUn4bTDjk6DMVtbgK2hjCUrf7pPG20%2BPfw7fNhu%2Bp5JWkFPmxvnYsCFbyaNIXovrzpuwu9mCOKB1gzzkUyCnaM3wbr4y2kvry6%2B9ewLGkm0pA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8f4c82eb0e694db4-FRA alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=8782&min_rtt=5951&rtt_var=4604&sent=30&recv=24&lost=0&retrans=0&sent_bytes=14216&recv_bytes=8711&delivery_rate=10902&cwnd=12000&unsent_bytes=0&cid=406b77040e58ef65&ts=757&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:02 GMT content-type text/css last-modified Friday, 20-Dec-2024 03:23:02 GMT vary Accept-Encoding priority u=0,i=?0
GET H3	200	938_afde72b9aaa8302ff017.css booking.extraguestbook.com/static/	73 KB 9 KB	183ms 183ms	Stylesheet text/css	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/static/938_afde72b9aaa8302ff017.css Requested by Host: booking.extraguestbook.com URL: https://booking.extraguestbook.com/win Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4567d6213bc1480a45f493da8d292339522d45ac15c8ba1723aa342b155393f7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://booking.extraguestbook.com/win Response headers server cloudflare cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status BYPASS etag W/"672e5545-123f9" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HFO%2BzjLecOu2zLbsEcqr9iaVY%2FELjeAae%2F4Fk%2BVY1ExgJdQs6KK4Uxj%2BJrqBdkvsujCoL8tuwI8ZlBphgLxOA8%2Fw3D6x%2Fc9kzb1u%2FhJpGhR7XOUOH6W%2FCpbvGUSQdukXfKi02pSJC9HuqMFxBg%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8f4c82eb0e6a4db4-FRA alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=8782&min_rtt=5951&rtt_var=4604&sent=31&recv=24&lost=0&retrans=0&sent_bytes=14961&recv_bytes=8711&delivery_rate=10902&cwnd=12000&unsent_bytes=0&cid=406b77040e58ef65&ts=758&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:02 GMT content-type text/css last-modified Friday, 20-Dec-2024 03:23:02 GMT vary Accept-Encoding priority u=0,i=?0
GET H3	200	826_0d1737e180931a217647.css booking.extraguestbook.com/static/	60 KB 14 KB	188ms 187ms	Stylesheet text/css	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/static/826_0d1737e180931a217647.css Requested by Host: booking.extraguestbook.com URL: https://booking.extraguestbook.com/win Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5522523714d946a5810383bbca991c678457eed981b987d65f352c9fed2dc7d9` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://booking.extraguestbook.com/win Response headers server cloudflare cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status BYPASS etag W/"672e5545-ef43" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hGoGpZUMcZ22unvIgb0qvpb3pymoPD3yP4PPaT%2B6Pdufk4hwHl%2FTA%2FKUPd37zcRWXiKyvIWgS4wsWEzHHpFDLRZ7QJ1w580GI6L8oKHUXSQn8sGBjJG6%2ByuQ5D0zRB3dJ5a4rfdgkSMUYLsJfw%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8f4c82eb0e6c4db4-FRA alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=8782&min_rtt=5951&rtt_var=4604&sent=33&recv=24&lost=0&retrans=0&sent_bytes=16465&recv_bytes=8711&delivery_rate=10902&cwnd=12000&unsent_bytes=0&cid=406b77040e58ef65&ts=763&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:02 GMT content-type text/css last-modified Friday, 20-Dec-2024 03:23:02 GMT vary Accept-Encoding priority u=0,i=?0
GET H3	200	css_H7dPp81WTvvS--0HVXMJ9Hozig2DMTF7X1aURkZvL00.css booking.extraguestbook.com/static/	1 KB 1 KB	126ms 126ms	Stylesheet text/css	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/static/css_H7dPp81WTvvS--0HVXMJ9Hozig2DMTF7X1aURkZvL00.css Requested by Host: booking.extraguestbook.com URL: https://booking.extraguestbook.com/win Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b4802a25c8ab499057a3e341740b9c8a74062e8ccb84af347fea6e46f8f3eafa` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://booking.extraguestbook.com/win Response headers server cloudflare cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status BYPASS etag W/"67268c7f-500" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SRGEWIxyOdMAWGz%2BHJbt%2BjcjPDFdLSDctbZOVpIZnlX%2FORHKo0GqVz17nuCGx5sFRKZ2bcNp6xs%2FchUpmSAqH1wbdirsqQeIvUeccKCfqkGRProB3Ha%2BadRQYYrauV5GQZSLhcS3Cgu55Ssy5g%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8f4c82eb1e6f4db4-FRA alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=9181&min_rtt=5951&rtt_var=5076&sent=27&recv=23&lost=0&retrans=0&sent_bytes=12046&recv_bytes=8668&delivery_rate=64899&cwnd=12000&unsent_bytes=0&cid=406b77040e58ef65&ts=709&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:02 GMT content-type text/css last-modified Friday, 20-Dec-2024 03:23:02 GMT vary Accept-Encoding priority u=4,i=?0
GET H3	200	css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css booking.extraguestbook.com/static/	24 KB 6 KB	72ms 72ms	Stylesheet text/css	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/static/css_399BM-E_9aHp94scPSljMDjXwz84BMBa3y-GIQG8XYY.css Requested by Host: booking.extraguestbook.com URL: https://booking.extraguestbook.com/win Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5b13ff3b2e19c2eec561fa89ec8358795373d08d801ea2c129ec1c26d8ff3de7` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://booking.extraguestbook.com/win Response headers server cloudflare cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status BYPASS etag W/"67268c7e-6077" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FcXWC%2F34Y9cmE%2Fvp1eEnWTiJHK%2B%2FlMc25f%2BYRfZml8KBNIr2%2B8fvx4JcCEEoAkYLmnMPfAtQYHCGnhccvgZML%2FtQeaSsXHj%2FFJw9dsF7QTP6kVleNemN9pjnqBngIhV0vQ5o0A%2FJt6xK5vLssg%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8f4c82ec3edd4db4-FRA alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=6733&min_rtt=5871&rtt_var=623&sent=76&recv=48&lost=0&retrans=0&sent_bytes=62861&recv_bytes=10092&delivery_rate=4286681&cwnd=26400&unsent_bytes=0&cid=406b77040e58ef65&ts=837&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:02 GMT content-type text/css last-modified Friday, 20-Dec-2024 03:23:02 GMT vary Accept-Encoding priority u=0,i=?0
GET H3	200	css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.css booking.extraguestbook.com/static/	802 KB 108 KB	70ms 69ms	Stylesheet text/css	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/static/css_3iFMQAIstg4teIom2wVaOik81XAQ5V-7tH-iz2mq5to.css Requested by Host: booking.extraguestbook.com URL: https://booking.extraguestbook.com/win Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `17bf7329db361de5e5f1e25e82f00e41555fb5e7ea7c0115952c3677be33e0a0` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://booking.extraguestbook.com/win Response headers server cloudflare cache-control no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status BYPASS etag W/"67268c7f-c86e1" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XX2M5Xcjeq9UEqXlA%2Bb%2FNghcISLip5hUU0UL9Pdf68pA5uQAD0AYbbEhLKZn3FIIPgS6EqeYHQ9tP0IN%2BxYqMJ72va08kNMbfxwtsq83jTqtQ9MqdUXlBkmh49f4uMOEMjoVENZgWs8EilQeRQ%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8f4c82edefa24db4-FRA alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=6476&min_rtt=5871&rtt_var=563&sent=188&recv=74&lost=0&retrans=0&sent_bytes=182974&recv_bytes=11598&delivery_rate=1122977&cwnd=51600&unsent_bytes=0&cid=406b77040e58ef65&ts=1108&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:02 GMT content-type text/css last-modified Friday, 20-Dec-2024 03:23:02 GMT vary Accept-Encoding priority u=0,i=?0
GET H3	200	win booking.extraguestbook.com/ Redirect Chain https://booking.extraguestbook.com/favicon.ico https://booking.extraguestbook.com/win	8 KB 4 KB	72ms 72ms	Other text/html	172.67.182.187 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extraguestbook.com/win Protocol H3 Server 172.67.182.187 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `954fb0d0c3fa760bb7c026f3d69fdaa54eeef3f3301521ab92703908df519f0f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://booking.extraguestbook.com/win Response headers cache-control no-store, no-cache, must-revalidate, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status DYNAMIC pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IB6fmGKGfzLVxpuh0HngTYzs3o2cyqVlAShfJ9FMT03jsOjPmvflKGdaqAfuDj96%2B0Ign%2BjVHVCr6gJ2HX0v%2BD8mZ2sz619LINrQTRu7iZ1xBokbeQ6Uem2vGJLfm3%2FbdOmgiVdw%2FaRSappYXw%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8f4c82ef78284db4-FRA expires Thu, 19 Nov 1981 08:52:00 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=6466&min_rtt=5871&rtt_var=429&sent=288&recv=89&lost=0&retrans=0&sent_bytes=297192&recv_bytes=12957&delivery_rate=6511&cwnd=86400&unsent_bytes=0&cid=406b77040e58ef65&ts=1354&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:03 GMT content-type text/html; charset=UTF-8 last-modified Friday, 20-Dec-2024 03:23:02 GMT server cloudflare priority u=1,i Redirect headers cf-cache-status BYPASS report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1GXOQt5ecTMw80gZfZ8qCYaZzSdUTXD1SNWI3gBZ9TBXW8gkCUF5NOMK2wJ8dA%2FhTMoc6Hl9VwZaJVOY8r1H1AktPgYKX%2BVeacYOEv5IUWXz%2Fl4msN2OUw%2BQO4qQu9IBojufL2krdRXfcKVtJQ%3D%3D"}],"group":"cf-nel","max_age":604800} expires Thu, 19 Nov 1981 08:52:00 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=6310&min_rtt=5871&rtt_var=156&sent=286&recv=87&lost=0&retrans=0&sent_bytes=296342&recv_bytes=12526&delivery_rate=1115527&cwnd=86400&unsent_bytes=0&cid=406b77040e58ef65&ts=1281&x=1", cfExtPri, cfHdrFlush;dur=0 date Fri, 20 Dec 2024 03:23:02 GMT content-type text/html; charset=UTF-8 last-modified Friday, 20-Dec-2024 03:23:02 GMT vary Accept-Encoding priority u=1,i cache-control no-store, no-cache, must-revalidate, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 location /win nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache cf-ray 8f4c82eeafe04db4-FRA server cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Booking (Travel)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			extraguestbook.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2mkdilmbgcd4fvst3egjinmbpb
			booking.extraguestbook.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: acqv121ons11rq7c3kinfqoqtj

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

booking.extraguestbook.com
extraguestbook.com
172.67.182.187
17bf7329db361de5e5f1e25e82f00e41555fb5e7ea7c0115952c3677be33e0a0
4567d6213bc1480a45f493da8d292339522d45ac15c8ba1723aa342b155393f7
5522523714d946a5810383bbca991c678457eed981b987d65f352c9fed2dc7d9
5b13ff3b2e19c2eec561fa89ec8358795373d08d801ea2c129ec1c26d8ff3de7
954fb0d0c3fa760bb7c026f3d69fdaa54eeef3f3301521ab92703908df519f0f
96f1beb125f73c511d8b401c7cb7af1469ceed1a89003beecb8646166dc41f07
b4802a25c8ab499057a3e341740b9c8a74062e8ccb84af347fea6e46f8f3eafa

booking.extraguestbook.com Open in urlscan Pro 172.67.182.187 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

10 Requests

90 %HTTPS

0 %IPv6

1 Domains

2 Subdomains

1 IPs

1 Countries

280 kBTransfer

1892 kBSize

2 Cookies

1 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Indicators

booking.extraguestbook.com Open in urlscan Pro
172.67.182.187 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

280 kB
Transfer

1892 kB
Size

2
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!