urlscan.io logo urlscan.io
SecurityTrails logo

booking.validation-confi.info Open in urlscan Pro
2606:4700:3032::6815:4bbe  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://booking.validation-confi.info/u6549127672
Submission: On May 31 via api from GB — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3032::6815:4bbe, located in United States and belongs to CLOUDFLARENET, US. The main domain is booking.validation-confi.info.
TLS certificate: Issued by GTS CA 1P5 on May 30th 2024. Valid for: 3 months.
This is the only time booking.validation-confi.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Booking (Travel)

Domain & IP information

IP Address AS Autonomous System
16 2606:4700:303... 13335 (CLOUDFLAR...)
1 149.154.164.13 62041 (TELEGRAM)
1 2606:4700::68... 13335 (CLOUDFLAR...)
18 3
Apex Domain
Subdomains		 Transfer
16 validation-confi.info
booking.validation-confi.info
236 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
6 KB
1 telegra.ph
telegra.ph — Cisco Umbrella Rank: 81811
40 KB
18 3
Domain Requested by
16 booking.validation-confi.info booking.validation-confi.info
1 cdnjs.cloudflare.com booking.validation-confi.info
1 telegra.ph booking.validation-confi.info
18 3

This site contains no links.

Subject Issuer Validity Valid
validation-confi.info
GTS CA 1P5		 2024-05-30 -
2024-08-28		 3 months crt.sh
*.telegra.ph
Go Daddy Secure Certificate Authority - G2		 2023-09-05 -
2024-10-06		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh

This page contains 2 frames:

Primary Page: https://booking.validation-confi.info/u6549127672
Frame ID: EAACF907E653C52B52CDBD5319C8B2AF
Requests: 10 HTTP requests in this frame

Frame: https://booking.validation-confi.info/chat/477ESY7FB
Frame ID: 8075337D10AC8988EE734B10551AF2F8
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Booking.com | Official site | The best hotels & accommodation

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

283 kB
Transfer

805 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request u6549127672
booking.validation-confi.info/ 		98 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/u6549127672
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c264e0a309b450548b731816d8d8693fe830bfc807929d9d15b292c73c750c74

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
88c5a83b3c4a52b4-LHR
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 31 May 2024 08:40:06 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3g6mGrLHHPE0DKr2K5gmv3S2%2BuIpbqkLPMcnVfqbRsx1%2FwQkRlI%2B0wT0e%2BXEPbXIW8rn2cADpSE8NXgSLlVO5fHra82Fag%2Fv97mZOT05JcnVGOxZRjG3e0VL%2B0Ge3BP6UNxhObsuwm7mQTNXCa%2BK1xe4nGFooiu3DSu%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
styles-new4.css
booking.validation-confi.info/css/booking1/ 		34 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/css/booking1/styles-new4.css
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/u6549127672
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
794075538b19a75df8737bf2c563b3e46741007b3277ad98fced0622d9fb84d9

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/u6549127672
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:06:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6638c7b8-89d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8wiB7s%2FEzdFJzxM6owwvrieVmDa6jtLpXSH20Ed1wJLrVgQPXXr8YcA%2FBUXqw3ZiM0BFfaIVXnlV2DFgdD2%2BwwUN5EapsRqOZThbgBjM6IpgyqOOfGuEeQn6l5ywjq3Ff0M2aOBAn%2B8Uo%2BeyxjESjuMxxQ9XssvxqlKgVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
88c5a83f2f2652b4-LHR
alt-svc
h3=":443"; ma=86400
chat.css
booking.validation-confi.info/build/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/build/chat.css
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/u6549127672
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1fc1e7ad40e4ae54f2dbd4b1f8b0b09482bbcae9524a3a1743f0f5da062740d8

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/u6549127672
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:05:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6638c776-a0e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1s9Md50WNTwdn8HCYaHXXJy4Pk%2B%2B5eCzKq4UvA9f3A8b2KL2YAgocrIuLnVcjExqhTNiCDPwWMFfhlcuWK0dlA224MBbTH4q%2BTu%2FzzYBtrBjcpSMQsboTVDrjalWElNDHyRHMaj8UlnnQcEJrBVLx87ysy3wlvnQsVArTw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
88c5a83f2f2e52b4-LHR
alt-svc
h3=":443"; ma=86400
submit-new5.js
booking.validation-confi.info/css/booking1/ 		23 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/css/booking1/submit-new5.js
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/u6549127672
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
041a9f2109ba1a8868254c924dd5462bc08c42c6b634dca04563cfad33966a78

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/u6549127672
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:06:17 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6638c7b9-5bad"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xc%2FB7RVcxw0P3v4lxIJToMp0Laxo5oPHGimkN1FWulMwjb1zvMTlvJZCTJydLwRkwfdJNsw5Im0MMDcCGWaGTWvUMKedha08AtgVGTSLn1%2Bl4iTW%2F%2BJ0jXhp4050MIsrGQHVrC0HLnP2vR9iZVkrDicmaUK7UyzC6CnIOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
88c5a8404ff452b4-LHR
alt-svc
h3=":443"; ma=86400
blur_input.js
booking.validation-confi.info/css/booking1/ 		21 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/css/booking1/blur_input.js
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/u6549127672
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5eaae12a5b85c3a24efd4d581e61ef3773befd9f64b1421c678038bf17c559ba

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/u6549127672
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:06:15 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6638c7b7-5465"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8qKX68ak2LuNfSDZ1DZRoVlYeiU27tpJ3IUBUeqbpGv5Cz40loC4Bu0KcYsFxwTdqa32xWOyyrwOwdK%2FrymDrvzQHOoWW3Buk5YdrHhRLhmG0m7qAUcQGF2PO3GrRwtktuGeYQk0Nej8kRXHZsTqEibs1ilPoViOvf1ViQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
88c5a8405ffb52b4-LHR
alt-svc
h3=":443"; ma=86400
jquery.min.js
booking.validation-confi.info/js/ 		87 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/js/jquery.min.js
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/u6549127672
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/u6549127672
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:07:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6638c7ea-15d84"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EOX4ekS4ikDsEZCyuqWyGMfRWRl%2BGr7mjSWlugEsHuvIPgkGwGvUeiA5UQi1yQ48nEXStL8oKfAf2DkTjRpLLe7fqML9yGtpJxsgIqiTRo6F7WezrbBJJZDgxA02VS%2FHF7uiXSTwFsxH6VMMM9tTNlujgVFuQeCXT85sbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
88c5a83f2f3352b4-LHR
alt-svc
h3=":443"; ma=86400
e44816aa92df716637bbe.jpg
telegra.ph/file/ 		40 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://telegra.ph/file/e44816aa92df716637bbe.jpg
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/u6549127672
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.154.164.13 London, United Kingdom, ASN62041 (TELEGRAM, VG),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
8f040f975e60ed1139624f21a3744a0da8a05609934f1c54b21f35b87482fdec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
nginx/1.20.1
etag
"6b545a8b8c25da3286f1189a2952853fb800559e"
content-type
image/jpeg
cache-control
max-age=10800, must-revalidate
content-length
40930
expires
Fri, 31 May 2024 11:40:06 GMT
477ESY7FB
booking.validation-confi.info/chat/ Frame 8075 		29 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/chat/477ESY7FB
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/u6549127672
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50950d707b7f80681b90aad1207ad00ff7746063414867a043733636cd874f96

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Referer
https://booking.validation-confi.info/u6549127672
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
88c5a8405ffd52b4-LHR
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 31 May 2024 08:40:06 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2TyZU0AAWphASVEO9zsqsaqvX9Pl3OAIeABjmv2HyCE2WuMu9WeA1cIjMLe3Qx%2F4sI2apdXK3f%2BhZTBUk3kAjCokiJtEL5aHLa2NPDLQTppAvRMQF9w%2B763tpY6scKpr4g9VGVgJrRYvACsOnN8aPZ5R6fr8BtAVC%2BFNEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
user_send_status.php
booking.validation-confi.info/ajax/ 		0
500 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/ajax/user_send_status.php
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/js/jquery.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://booking.validation-confi.info/u6549127672
X-Requested-With
XMLHttpRequest
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1OPazlNi0Topje8pInqvhm1NtktQBoReW7%2B7djui0S2O4DeXQMZPNRFdmt2qHbksVXz%2FdaJcrwTgZ4zms6E%2B0hnFH974J9VSOFeL6RjjG0LYzom%2FgVL2Z20Y0nr1iP9EcGpyXpHIRoXzkyWmRAWdDI1USaiBoj68nNjj2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
cf-ray
88c5a840680a52b4-LHR
alt-svc
h3=":443"; ma=86400
expires
Thu, 19 Nov 1981 08:52:00 GMT
flags.png
booking.validation-confi.info/css/booking1/img/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://booking.validation-confi.info/css/booking1/img/flags.png
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/css/booking1/styles-new4.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc78e1550450ab81964ef660b05cb14fb17e0b895b261925ad7e6e073502dfc4

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/css/booking1/styles-new4.css
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
cf-cache-status
REVALIDATED
last-modified
Mon, 06 May 2024 12:06:20 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"6638c7bc-77d8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l86MgvVRXHa9niKlEL62CUKbqtzE9qEtWPSmPYz%2FO35rBuEgbf%2FDTZZF5w%2Bm%2Fry6lrWnuV3YLwMG1zu9r057Rcec1mgIeqnA1h8bixwYMB5AGFIL%2BPo7VLmoBY06jBaFiefxuqZEYR2i2SPO%2FdsL5F7OPWCkobj%2BgGZZRw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
88c5a840781352b4-LHR
alt-svc
h3=":443"; ma=86400
content-length
30680
chat.css
booking.validation-confi.info/css/ Frame 8075 		106 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/css/chat.css
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/chat/477ESY7FB
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1c9ad009f4d6ed374fe5404e3276bbbc345396e772cd72491a88c1173582ec3

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/chat/477ESY7FB
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:05:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6638c7a3-1a924"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L8e4E7WBKwhl628TxNfu0VcKF9FtSniyj2cEXbhaFlVPg49%2BwJQK4iApNhdRWdIBtWgk2SMqcEv4H9L6dvKadiiO59FxhRQbfVKfTD9Pl0q0KG1QWEtPYPnY1HMeMyIIDdZAocvZd%2BkI8%2BOCYVe5l5YcWuG5KT5SggwoYA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
88c5a84188cf52b4-LHR
alt-svc
h3=":443"; ma=86400
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ Frame 8075 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/chat/477ESY7FB
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
130393
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5631
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q%2BexfJkIgEXYkQdneSBCB8fNUiKOsxD9XRW7llMnjSmWPoCakbGsz%2FSYm4a3WpjrIB2lzs1%2F9XKq%2BuBFRGdrlds7tVgzDxPpnIz7qp8Mc8iQAeS0jNITaCO0Y8dWZinbKxgfxiIMWzAwz2Kr6DVXu42g"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88c5a8424c4d79c5-LHR
expires
Wed, 21 May 2025 08:40:06 GMT
support.png
booking.validation-confi.info/img/ Frame 8075 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://booking.validation-confi.info/img/support.png
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/chat/477ESY7FB
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f38df22b91417e6c60a0c086f7997c1ba6c5b844b3c947d07ed7e88650442973

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/chat/477ESY7FB
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:06:57 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"6638c7e1-3d12"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KCzDVntRoWnRtRreMWbdY3UsoGqKtd7UmcMM5B4apAQm2UcWAdEtaV3P%2BEqjg9HZ6Y8eW2VuPpuVV6etFyZmh94zcRYamxxSdyTPA%2Funem3KNSXDGTAfHnKQurXWMzBysWNa8PL1b05hw9qi75TKkNG1BG4N0wxeT7WA9A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
88c5a84188d052b4-LHR
alt-svc
h3=":443"; ma=86400
content-length
15634
support-open.png
booking.validation-confi.info/img/ Frame 8075 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://booking.validation-confi.info/img/support-open.png
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/chat/477ESY7FB
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
560b6b311920854bb28122c60e1262f34723ed8bff0b6970300bd04d9369adeb

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/chat/477ESY7FB
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:06:57 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"6638c7e1-5400"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R%2Bz3UbWznisAUCC1gHVND0CF1vXjSpTcXk3gpuzGLXg1hOMVwQ3xY15VEebxE4CnevoFFsMhs2CRmvbhM07QFYtqcXrFW8xuES29MDFd2lP7ByIQg3ewyh%2FPycHCEb5IazqNmHI4EaaqCvMUIRJ6SdW%2BJCXZRc7tQwPw8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
88c5a84188d252b4-LHR
alt-svc
h3=":443"; ma=86400
content-length
21504
jquery.min.js
booking.validation-confi.info/dist/new_card_design/ Frame 8075 		87 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/dist/new_card_design/jquery.min.js
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/chat/477ESY7FB
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/chat/477ESY7FB
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:06 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:06:31 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6638c7c7-15d84"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CPdg8tJUGjupWtaVa1ydWwKwyWm2hWSpqlPxOS9BsjT%2B5n3kYcs84CY2iFo2Kw1pN8hj7A28sCOXIemcGGUnIJo0wjDT3nDKi6ih%2Fj%2B9LBox%2Fs43qk04K79HvfkQZSo2bhas9N5HQPzcnMhQSgN8TPh27znfkawRtLRKig%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
88c5a84188d352b4-LHR
alt-svc
h3=":443"; ma=86400
msg_check.php
booking.validation-confi.info/ajax/ Frame 8075 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/ajax/msg_check.php
Requested by
Host: booking.validation-confi.info
URL: https://booking.validation-confi.info/dist/new_card_design/jquery.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19262297ed9803f5715ce0b82b7a242f79d05f4744fb13a365803d73bd17ce24

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://booking.validation-confi.info/chat/477ESY7FB
X-Requested-With
XMLHttpRequest
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 31 May 2024 08:40:07 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FT7XHybMywua1%2BDhnZ14hx9oz4A8x7BuYqg859kleksIKLYyKijwIA8Lu9PhM97Sw9Cat1OGKPQfuLb0ABVnw5x7qrAVgzZiiChEpBH5AuFxz2xRYXHHemTCi%2BlgFYK74SGBOFRLBk0cPQA8t7Gwju3%2Bo%2Bbqrz5WhnHv7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
cf-ray
88c5a842f9f852b4-LHR
alt-svc
h3=":443"; ma=86400
expires
Thu, 19 Nov 1981 08:52:00 GMT
favicon.ico
booking.validation-confi.info/ 		177 KB
44 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://booking.validation-confi.info/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63f125a6025a5caea38f91b98ffd8d560cdf532329f12e4fe143453161ce7dea

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/u6549127672
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 08:40:07 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 06 May 2024 12:05:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"2c208-617c7e173397d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D2mBNY%2Bwe3fFxRRTx0iSUQakYjq%2F1FNdJhJ%2FoY%2FIYZmX%2F87UNVLRt9%2BQzS9spbvfpgJEKCov%2BY0nng13OO3%2Bn%2BQpMcT4UnBUGavFIgwhGIiEQC4RNkVMKzsf99hgktUFMlZNL7fnhHnjOHEkLSvWaFEQ4t5n%2Fg59gn09Lw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/vnd.microsoft.icon
cache-control
max-age=14400
cf-ray
88c5a842fa0052b4-LHR
alt-svc
h3=":443"; ma=86400
%7Bimage%7D
booking.validation-confi.info/chat/ Frame 8075 		0
507 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://booking.validation-confi.info/chat/%7Bimage%7D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::6815:4bbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://booking.validation-confi.info/chat/477ESY7FB
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 31 May 2024 08:40:07 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BdyG5fMABlit6DzcmmyyBWvd%2B8rOoiGnZfUG3IngHWZMS4EUNaC7CnFZueVPNbKyI%2Bw6%2Bgiy03za8TiVBjRrcxB6sLQsz5yPP0jjWeqLfzpUxj3GOSsvSw%2Bk2fW5YBDOyQk4Sh8Wk3xpD1GFn%2FiNS13aURIaP5b%2FVmNfOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
cf-ray
88c5a8441aeb52b4-LHR
alt-svc
h3=":443"; ma=86400
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Booking (Travel)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery number| get_status function| onPage function| scrollToErrorInput

1 Cookies

Domain/Path Name / Value
booking.validation-confi.info/ Name: PHPSESSID
Value: u6evug8jj01jg7pt969basr7sm