booking-dataposting.com
Open in
urlscan Pro
77.238.238.221
Malicious Activity!
Public Scan
Submission: On June 21 via automatic, source certstream-suspicious — Scanned from NL
Summary
TLS certificate: Issued by R10 on June 21st 2024. Valid for: 3 months.
This is the only time booking-dataposting.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Booking (Travel)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 77.238.238.221 77.238.238.221 | 216071 (VDSINA) (VDSINA) | |
1 | 2600:9000:225... 2600:9000:2251:9a00:5:bf05:acc0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
12 | 3 |
ASN216071 (VDSINA, AE)
PTR: v64914.hosted-by-vdsina.com
booking-dataposting.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
booking-dataposting.com
booking-dataposting.com |
101 KB |
1 |
bstatic.com
q-xx.bstatic.com — Cisco Umbrella Rank: 15739 |
1 KB |
12 | 2 |
Domain | Requested by | |
---|---|---|
11 | booking-dataposting.com |
booking-dataposting.com
|
1 | q-xx.bstatic.com | |
12 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
booking-dataposting.com R10 |
2024-06-21 - 2024-09-19 |
3 months | crt.sh |
*.bstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-11-29 - 2024-11-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://booking-dataposting.com/
Frame ID: D11555D92A6FB255BA1C7980F01F77C2
Requests: 14 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
booking-dataposting.com/ |
408 KB 61 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pulse.png
booking-dataposting.com/assets/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.7.1.min.js
booking-dataposting.com/assets/js/libs/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.maskedinput.min.js
booking-dataposting.com/assets/js/libs/ |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lang.js
booking-dataposting.com/assets/js/ |
7 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
booking-dataposting.com/assets/js/ |
13 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
522 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
35 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
getStep.php
booking-dataposting.com/php/api/ |
0 20 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gb.png
q-xx.bstatic.com/backend_static/common/flags/new/48-squared/ |
522 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
getStep.php
booking-dataposting.com/php/api/ |
0 43 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
getStep.php
booking-dataposting.com/php/api/ |
0 43 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
getStep.php
booking-dataposting.com/php/api/ |
0 43 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
getStep.php
booking-dataposting.com/php/api/ |
0 43 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Booking (Travel)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| savepage_ShadowLoader function| $ function| jQuery object| langList1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
booking-dataposting.com/ | Name: PHPSESSID Value: 5ld5utakfcsco21ios1jr0fpj9 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
booking-dataposting.com
q-xx.bstatic.com
2600:9000:2251:9a00:5:bf05:acc0:93a1
77.238.238.221
7981ede89a44f2569f030222c9dd4f48fa3c97ef6d6eb43ee7d7adde3ba47abd
996b0e99fcc7a553eac6f51569be5429b1bf8c071a708289fab808d7660cf74c
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
b8b4dfde81a9f938cb44edacaee03f1c1313128c1d5785123b130adb406f8b3f
d4b7a731ce8c2a070e2f5dec6a819c1903b6e25abd4349a71ce909ae29f3a73f
d6f79c7389572e669b21ab457744dbf52cc988920015468251df5ac817048946
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
fd1afa3f755d7c3fae2fcdb33564409f18a66314cb4e73958640da48a93d6749