booking-hotel83.cfd Open in urlscan Pro
91.92.245.66  Malicious Activity! Public Scan

Submitted URL: http://booking-hotel83.cfd/
Effective URL: https://booking-hotel83.cfd/
Submission: On September 17 via manual from IN — Scanned from DE

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 91.92.245.66, located in Bulgaria and belongs to LIMENET, US. The main domain is booking-hotel83.cfd.
TLS certificate: Issued by R11 on September 14th 2024. Valid for: 3 months.
This is the only time booking-hotel83.cfd was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Booking (Travel)

Domain & IP information

IP Address AS Autonomous System
4 91.92.245.66 394711 (LIMENET)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:266... 16509 (AMAZON-02)
8 5
Apex Domain
Subdomains
Transfer
4 booking-hotel83.cfd
booking-hotel83.cfd
100 KB
1 bstatic.com
q-xx.bstatic.com — Cisco Umbrella Rank: 18691
1 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
1001 B
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 314
19 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 215
6 KB
8 5
Domain Requested by
4 booking-hotel83.cfd booking-hotel83.cfd
1 q-xx.bstatic.com booking-hotel83.cfd
1 fonts.googleapis.com booking-hotel83.cfd
1 cdn.jsdelivr.net booking-hotel83.cfd
1 cdnjs.cloudflare.com booking-hotel83.cfd
8 5

This site contains links to these domains. Also see Links.

Domain
account.booking.com
partner.booking.com
www.booking.com
admin.booking.com
Subject Issuer Validity Valid
booking-hotel83.cfd
R11
2024-09-14 -
2024-12-13
3 months crt.sh
cdnjs.cloudflare.com
WE1
2024-07-31 -
2024-10-29
3 months crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA
2024-05-04 -
2025-05-04
a year crt.sh
upload.video.google.com
WR2
2024-08-12 -
2024-11-04
3 months crt.sh
*.bstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-11-29 -
2024-11-28
a year crt.sh

This page contains 1 frames:

Primary Page: https://booking-hotel83.cfd/
Frame ID: 826F670FE5EBBF1E6327A4AD8B029DFA
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Booking.com

Page URL History Show full URLs

  1. http://booking-hotel83.cfd/ HTTP 307
    https://booking-hotel83.cfd/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • /npm/sweetalert2@([\d.]+)

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

8
Requests

100 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

127 kB
Transfer

211 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://booking-hotel83.cfd/ HTTP 307
    https://booking-hotel83.cfd/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
booking-hotel83.cfd/
Redirect Chain
  • http://booking-hotel83.cfd/
  • https://booking-hotel83.cfd/
6 KB
3 KB
Document
General
Full URL
https://booking-hotel83.cfd/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.92.245.66 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
nginx/1.26.2 /
Resource Hash
c8317c5f432d79f91ef88ad51d168699c17e206e861bd1bb6ea230daca73e40b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Length
3057
Content-Type
text/html; charset=UTF-8
Date
Tue, 17 Sep 2024 04:20:55 GMT
Server
nginx/1.26.2
Vary
Accept-Encoding

Redirect headers

Location
https://booking-hotel83.cfd/
Non-Authoritative-Reason
HttpsUpgrades
css.css
booking-hotel83.cfd/css/
9 KB
3 KB
Stylesheet
General
Full URL
https://booking-hotel83.cfd/css/css.css
Requested by
Host: booking-hotel83.cfd
URL: https://booking-hotel83.cfd/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.92.245.66 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
nginx/1.26.2 /
Resource Hash
c0b69aed9eb8dc2d35af6806ff7cfe9d8f24824a888a6cbef169f905703f0a03

Request headers

Referer
https://booking-hotel83.cfd/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 17 Sep 2024 04:20:55 GMT
Content-Encoding
gzip
Last-Modified
Sat, 20 Jan 2024 21:10:36 GMT
Server
nginx/1.26.2
ETag
W/"65ac36cc-24cc"
Transfer-Encoding
chunked
Content-Type
text/css
Connection
keep-alive
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/
30 KB
6 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: booking-hotel83.cfd
URL: https://booking-hotel83.cfd/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://booking-hotel83.cfd/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 04:20:55 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
485062
cross-origin-resource-policy
cross-origin
content-length
5631
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ag%2BdPhWY7CAbJHzlMJCXgzf5zLsVuKFkxXWuJQW9CJtgzQX7%2BZqnAcKnZghN%2BBh9uEOmABaWP%2F7WZ5wC6ijF5f4mPf1z1jrAybCPfgD3hSKl6gxZ4DGxVCluhdiTDa5r4xEJxT%2FSCXcorBbcVs7fUDOl"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8c464e775ee23a7e-FRA
expires
Sun, 07 Sep 2025 04:20:55 GMT
sweetalert2@11
cdn.jsdelivr.net/npm/
69 KB
19 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/sweetalert2@11
Requested by
Host: booking-hotel83.cfd
URL: https://booking-hotel83.cfd/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
069c8857b6377b6a67ab2f134065f1b263a24388d73434ce4c118bd931097836
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://booking-hotel83.cfd/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Tue, 17 Sep 2024 04:20:55 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
31642
x-jsd-version
11.14.0
x-cache
HIT, MISS
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
18281
x-served-by
cache-fra-eddf8230029-FRA, cache-lga21956-LGA
x-jsd-version-type
version
server
cloudflare
etag
W/"1143e-b0gbx6jMQnAZZQUyVF3WRULZcBc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YwfzpAmNCfsYdFsQaG0%2BFeXnYztmhHy%2BXh2ok%2B44LwXn%2BDwDbDgZwpaJlyCU6nULAfY%2BECAcSgGBW%2Forfr1EyGrN8%2BCNDYxhqSrRin3wUvL%2Bj7g1kGD6AQo4j2UkkseakMnncS3IYTv0yPi4B4g%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8c464e777b02bb65-FRA
css
fonts.googleapis.com/
2 KB
1001 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto
Requested by
Host: booking-hotel83.cfd
URL: https://booking-hotel83.cfd/css/css.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
158235a454c29707117f6570f40fcc1e7d143f14dc1af1085979b47cf19e4871
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://booking-hotel83.cfd/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 17 Sep 2024 04:20:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 17 Sep 2024 04:05:31 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 17 Sep 2024 04:20:55 GMT
avenirnextcyr-bold.ttf
booking-hotel83.cfd/fonts/
86 KB
87 KB
Font
General
Full URL
https://booking-hotel83.cfd/fonts/avenirnextcyr-bold.ttf
Requested by
Host: booking-hotel83.cfd
URL: https://booking-hotel83.cfd/css/css.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.92.245.66 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
nginx/1.26.2 /
Resource Hash
5f5482b3d9d687d674a5262ed3b20699a057b9e227f7e4c471d1a00189b8ff74

Request headers

Referer
https://booking-hotel83.cfd/css/css.css
Origin
https://booking-hotel83.cfd
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 17 Sep 2024 04:20:55 GMT
Last-Modified
Sat, 20 Jan 2024 18:22:22 GMT
Server
nginx/1.26.2
ETag
"159dc-60f64ad7c1380"
Content-Type
font/ttf
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
88540
us.png
q-xx.bstatic.com/backend_static/common/flags/new/48-squared/
642 B
1 KB
Image
General
Full URL
https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Requested by
Host: booking-hotel83.cfd
URL: https://booking-hotel83.cfd/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:266e:c600:5:bf05:acc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a333d02eedde7a4dd8643d58b0ea7947268a1762f35f517eb6000ec9e7fcfae8
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://booking-hotel83.cfd/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Sun, 01 Sep 2024 02:26:30 GMT
via
1.1 383422f03bfc9d77974d0ac637421c22.cloudfront.net (CloudFront)
nel
{"report_to":"default","max_age":600}
x-amz-cf-pop
FRA56-P8
age
1389265
x-cache
Hit from cloudfront
content-length
642
x-xss-protection
1; mode=block
last-modified
Mon, 07 Sep 2020 10:40:08 GMT
server
nginx
etag
"5f560e08-282"
report-to
{"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
_DVlBKkxEfjMcwReEEJTMiaVbWvzYy_6WAV_Re6T3S7rlSOqO5q2Xw==
expires
Tue, 01 Oct 2024 02:26:30 GMT
favicon.png
booking-hotel83.cfd/img/
7 KB
7 KB
Other
General
Full URL
https://booking-hotel83.cfd/img/favicon.png
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
91.92.245.66 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
nginx/1.26.2 /
Resource Hash
441427ac121ba6f174f9505aa4227a93f57ab7811c0467b0af690e392303ec8a

Request headers

Referer
https://booking-hotel83.cfd/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

Date
Tue, 17 Sep 2024 04:20:55 GMT
Last-Modified
Sat, 08 Jun 2024 12:43:16 GMT
Server
nginx/1.26.2
ETag
"666451e4-1b27"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6951

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Booking (Travel)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal

0 Cookies