booking.offer5985.shop Open in urlscan Pro
172.67.202.124 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://booking.offer5985.shop/p/4858681974
Submission: On July 30 via automatic, source openphish (July 30th 2024, 2:20:29 am UTC) — Scanned from DE

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 22 HTTP transactions. The main IP is 172.67.202.124, located in United States and belongs to CLOUDFLARENET, US. The main domain is booking.offer5985.shop.
TLS certificate: Issued by WE1 on July 25th 2024. Valid for: 3 months.

This is the only time booking.offer5985.shop was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Booking (Travel)

Domain & IP information

	IP Address	AS Autonomous System
18	172.67.202.124 172.67.202.124	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:266... 2600:9000:266e:fe00:5:bf05:acc0:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2606:4700:10:... 2606:4700:10::6816:1490	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2606:4700::68... 2606:4700::6811:f5cb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
22	5

18 172.67.202.124 (United States)

ASN13335 (CLOUDFLARENET, US)

booking.offer5985.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:266e:fe00:5:bf05:acc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cf.bstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:1490 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cdn.tailwindcss.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:f5cb (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	offer5985.shop booking.offer5985.shop	69 KB
2	unpkg.com 1 redirects unpkg.com — Cisco Umbrella Rank: 1314	23 KB
2	tailwindcss.com 1 redirects cdn.tailwindcss.com — Cisco Umbrella Rank: 23119	110 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	1 KB
1	bstatic.com cf.bstatic.com — Cisco Umbrella Rank: 19480	17 KB
22	5

	Domain	Requested by
18	booking.offer5985.shop	booking.offer5985.shop unpkg.com
2	unpkg.com	1 redirects booking.offer5985.shop
2	cdn.tailwindcss.com	1 redirects booking.offer5985.shop
1	fonts.googleapis.com	booking.offer5985.shop
1	cf.bstatic.com	booking.offer5985.shop
22	5

This site contains no links.

Subject Issuer	Validity	Valid
offer5985.shop WE1	`2024-07-25` - `2024-10-23`	3 months	crt.sh
*.bstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-29` - `2024-11-28`	a year	crt.sh
upload.video.google.com WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://booking.offer5985.shop/p/4858681974
Frame ID: 0F0780989DE2A921FF1B031B30A2DABA
Requests: 8 HTTP requests in this frame

Frame: https://booking.offer5985.shop/supportChatFrame/4858681974
Frame ID: 3387F11AF2CC62443A0F930BFCBF5A29
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Booking.com - Payment information

Detected technologies

Axios (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js

Page Statistics

22
Requests

91 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

219 kB
Transfer

591 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://cdn.tailwindcss.com/ HTTP 302
https://cdn.tailwindcss.com/3.4.5

Request Chain 15

https://unpkg.com/axios/dist/axios.min.js HTTP 302
https://unpkg.com/axios@1.7.2/dist/axios.min.js

22 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request 4858681974 Show response
booking.offer5985.shop/p/ 57 KB
14 KB 424ms
401ms Document
text/html 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/p/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 5bc89e80ec13a6df2535072a9f1c19f4700eb8214f566132792273953cc4923a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ab1de8f2afda02b-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 30 Jul 2024 02:20:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sFW9Q5ANMa6x8NUtSzOfn9OheRcxGDk2gBIKPvow7lUidcP4bAjvJlOy3egJD4tq6w5Oc5FLJcoHT0cyCM60U%2BNwxjxgVCHur2Yoo7E14eyMWfvQNINUZHX2Wo6E5Oe7RA1EW7DC0kFt"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express

GET
H3 200 script.js Show response
booking.offer5985.shop/services/booking/js/ 15 KB
4 KB 203ms
202ms Script
application/javascript 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/services/booking/js/script.js
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/p/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: cde4e1ecef591a0e656448a3dfe6d279c18e1907e952ac086d766d5d68364ff0

Request headers

Referer: https://booking.offer5985.shop/p/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:25 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Sun, 05 May 2024 14:44:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"3b34-18f49370e40"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TwM2S66QKsR2tu0M4Y1yQBm5LBAE2Bn5ljOn6pF5TD6UDUGRGMwku35lNkWhk1OJqlWgUjnR08h5Mp6LCavrgx9FDYUyedXEOeWUOh2vHfNl6pWhyUq0ztgbHdgnTeqz%2BYxgUwjd%2FWyG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 8ab1de91ac71a02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 styles.css
booking.offer5985.shop/services/booking/css/ 32 KB
8 KB 206ms
205ms Stylesheet
text/css 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/services/booking/css/styles.css
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/p/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: b2e3158656f24d0f69988896ea2facd530904745d286f84eadb67ceb2ce9d4c2

Request headers

Referer: https://booking.offer5985.shop/p/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:25 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Sat, 19 Aug 2023 22:18:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"802a-18a0fe0d338"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sVj%2BHCn2pojwQQWOyqahB47pSdd0yjBAL3b5JFdob4tLDLQDk9VgFM7WHi1EA7UF6VS0BJH%2B%2FNUEo%2FMpzCGNgI%2BiWDPkWsIOw4n9aHiUG%2BLjJxQx7JTzyUo7fVGdVI9WtinKJ3wbSdJN"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 8ab1de91ac75a02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 135549078.jpg
cf.bstatic.com/xdata/images/hotel/max500/ 17 KB
17 KB 54ms
8ms Image
image/jpeg 2600:9000:266e:fe00:5:bf05:acc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cf.bstatic.com/xdata/images/hotel/max500/135549078.jpg?k=ee3ff2e17c6892067797f22a4b2de9afa94ca79eb2bd9fc90fc5175663b14109&o=&hp=1

Requested by

Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/p/4858681974

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266e:fe00:5:bf05:acc0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

afdcc2ef49547416fbc66391440f227e7926afa54ecd32a23717046d7878f8e4

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://booking.offer5985.shop/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 18 Jul 2024 08:11:13 GMT
via: 1.1 f996db233b87d6765cc5ad56701268d8.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-P8
age: 1015752
etag: "247ade059b4cb0fa6cf8414057b9fb58d708b369"
x-cache: Hit from cloudfront
content-language: 17145
access-control-allow-origin: *
content-type: image/jpeg
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: Nk8560JZUZUgU-UcPrvQU4Ifwcojgq4IONeHeGgALbKhRdwfgOEHsQ==
x-xss-protection: 1; mode=block

GET
H3 200 support_parent.css
booking.offer5985.shop/css/ 5 KB
2 KB 199ms
199ms Stylesheet
text/css 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/css/support_parent.css
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/p/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 20f5cc0ebb84eb9bdeb82a9b908e9f922ab10ea415857c8b00b8302e00c61a5c

Request headers

Referer: https://booking.offer5985.shop/p/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:25 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Wed, 23 Aug 2023 14:42:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"12b3-18a22d925f8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wfvgv4OSBk47E2hc%2FVVl6AbgwKLOlY50LYD3J14Yr%2BoOc00WZ60rJmGwlrwWTOCF%2FZsMJsXKzvIvSQaIl2iGE0CiIAgkGq7NEjwuAlRi%2Bv2UPAmZvz5oqsr2avAKinPIwQK2Jluz442I"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 8ab1de91ec8da02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 flags.png
booking.offer5985.shop/services/booking/images/ 30 KB
30 KB 202ms
202ms Image
image/png 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://booking.offer5985.shop/services/booking/images/flags.png
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/p/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: fc78e1550450ab81964ef660b05cb14fb17e0b895b261925ad7e6e073502dfc4

Request headers

Referer: https://booking.offer5985.shop/p/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:25 GMT
cf-cache-status: REVALIDATED
last-modified: Sat, 19 Aug 2023 22:18:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"77d8-18a0fe0eaa8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g%2BnEBXn0FNyn15p5J%2BwX%2FcBhNBIxeLNkugfIvBxxU5%2BUJEMgYviGdC%2BiPPC%2FsPBwj%2Bts8lDmlPe6DxRE25ymWNSqVaeRA0Ydun92jQ%2BsBM6yH7Gi1Z%2FVqTImfDJZ4GORuelgXQ8RC52n"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8ab1de92fd2ba02b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 30680

GET
H3 200 4858681974 Show response
booking.offer5985.shop/supportChatFrame/ Frame 3387 4 KB
2 KB 296ms
296ms Document
text/html 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/supportChatFrame/4858681974
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/p/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 149f0814b304e828a44cf30d8e6976b2607458a398bdedb294d199344f341345

Request headers

Referer: https://booking.offer5985.shop/p/4858681974
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8ab1de932d44a02b-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 30 Jul 2024 02:20:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gKjU9qK%2F9GYJto71evBZNi4e54y%2FlviLJIPNX5DSB4%2FUfho7BD8yLV4FKYH6XQd2ZS5K22Y0UiKP27xkAEzHSpqwAlaZaSvjRyrwzr6PFx0C3c17bLpoU%2FA60DjmHlSYcJVXItYOxd99"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express

GET
H3 200 pluxurydarklord.svg
booking.offer5985.shop/img/ 1 KB
1 KB 192ms
192ms Image
image/svg+xml 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://booking.offer5985.shop/img/pluxurydarklord.svg
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/css/support_parent.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: fbb307bc48c763f9a4893ba918ca9a322f4e084dbb994504d526af90c1a4d1e9

Request headers

Referer: https://booking.offer5985.shop/css/support_parent.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:25 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Wed, 23 Aug 2023 14:41:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"4b6-18a22d77460"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xsgagGkyKOuWsQd6bNQ%2BqXqw9m2N2M1fixqgi9Z5hXVFz%2Fb3QKvHYwCpL8FjKxP1OtrTYf1qrDTZ2yvb5m98Vs5ATexjs9RN9TrdZOwFjEkZT%2Bcz367ilhdGVK8q10sRDmT4NtZKwjQK"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8ab1de932d43a02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 chat.css
booking.offer5985.shop/assets/css/ Frame 3387 243 B
678 B 196ms
195ms Stylesheet
text/css 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/assets/css/chat.css
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: c5e7e8f07db5f90f5b179d122a425eacb8e7b0b57e79349f6e414158d3db0f77

Request headers

Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:25 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Wed, 23 Aug 2023 14:01:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"f3-18a22b2e8e8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QMHpbrjO%2FwW847WIb4ph2osGybTujlzELoxeSiuG1DxrftE3ftO2LBQp0JGZVn7WH%2BNjXJNZtxGgFTId0%2FB8o7jR9a9ouojFBo%2FWOmwslOcZG6%2BQlUp13ZuvmkAi1ZYiD9o4M0FsnWhR"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 8ab1de951e7fa02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H2

200

3.4.5 Show response
cdn.tailwindcss.com/ Frame 3387
Redirect Chain

https://cdn.tailwindcss.com/
https://cdn.tailwindcss.com/3.4.5

358 KB
110 KB

14ms
14ms

Script
text/javascript

2606:4700:10::6816:1490
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.tailwindcss.com/3.4.5

Requested by

Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974

Protocol

Server

2606:4700:10::6816:1490 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f0570ef81afaa4194fa4ffe80fb291971f0ce27cecd0a1100fdcb4865703364

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://booking.offer5985.shop/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:25 GMT
content-encoding: br
strict-transport-security: max-age=63072000
last-modified: Mon, 15 Jul 2024 15:34:05 GMT
x-vercel-id: cle1::iad1::rxrqj-1721057644624-6d3492af5914
cf-cache-status: HIT
age: 1248354
server: cloudflare
x-vercel-cache: MISS
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=31536000
cf-ray: 8ab1de955c8a3a90-FRA

Redirect headers

date: Tue, 30 Jul 2024 02:20:25 GMT
strict-transport-security: max-age=63072000
cf-cache-status: HIT
x-vercel-id: cle1::iad1::2ttfk-1722304700190-c0cfd6059d89
server: cloudflare
age: 655
x-vercel-cache: MISS
vary: Accept-Encoding
location: /3.4.5
cache-control: max-age=14400
cf-ray: 8ab1de953c7c3a90-FRA
content-length: 0

GET
H3 200 bookmark.svg
booking.offer5985.shop/assets/icons/ Frame 3387 247 B
668 B 196ms
195ms Image
image/svg+xml 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://booking.offer5985.shop/assets/icons/bookmark.svg
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 846a64b15537fd60cbebc9dbdca9a2df72aa05a6e564210f78acfd701a386ef7

Request headers

Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:25 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 22 Aug 2023 08:23:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"f7-18a1c570a88"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KtBL8ecqsfchZ1NHUvH%2BKlIbR0YA5LxgxDHTARGJayEFtoV%2BbUic7lFUDOto18L%2BtRXo%2FswiEKeZdUWfEw5VTlteYyyvGuwiBdy%2BVFwfH7yvAbgTljLsXPNzvwhcL9tKGFzxeu2a5Ca%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8ab1de951e80a02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 chevron-down.svg
booking.offer5985.shop/assets/icons/ Frame 3387 231 B
656 B 226ms
226ms Image
image/svg+xml 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://booking.offer5985.shop/assets/icons/chevron-down.svg
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d7a5152180593b0144e6a36c21ca0e19aa9a64da790d7a1d14f0cbe49d45525a

Request headers

Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:25 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 22 Aug 2023 14:42:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"e7-18a1db2d5b0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MlwdJFog9YeTLYAeR7vNcP3703zSgbAHrU5F%2BtXl4i8OHwYswhIvIlVAgau7LIZAAw%2FJzkc2eSirVBRSAf8gLZP7GfTEvtH%2FmKQLFvhDI3PUJHwTOHPX%2Bl22rhvj6EtpA9hZmi%2FD2ygg"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8ab1de951e81a02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 close.svg
booking.offer5985.shop/assets/icons/ Frame 3387 230 B
650 B 220ms
220ms Image
image/svg+xml 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://booking.offer5985.shop/assets/icons/close.svg
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9a60eed802ef3d6b6784369cf91a4be28f925fa426293244ad43b9d2868f2988

Request headers

Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:26 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 22 Aug 2023 08:16:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"e6-18a1c513e28"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ML61MpC7%2BRoGoCQdNtXu%2FnAGcNIxCyHiCMY%2FNNEjJ5%2FRCsqkcnl%2BNkrfuiXYA5kWJ4GaVMtgWL82a7YPJT5dv6TF9x14CPpT786uM3HvhEAj7xcZoxUconk805IjDQ1%2FGc6hksI59cKC"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8ab1de965f1ea02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 person-circle.svg
booking.offer5985.shop/assets/icons/ Frame 3387 563 B
833 B 232ms
232ms Image
image/svg+xml 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://booking.offer5985.shop/assets/icons/person-circle.svg
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: b4784b8b0b3e2cfefe7106fea734e0a37df601a093d8bdb1aa3ee5216716546b

Request headers

Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:26 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 22 Aug 2023 08:20:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"233-18a1c54eb90"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u2%2Fxs6HiG0Jl02xvOCxgMvh7PZaQ5%2FTXnNLpxzkhhD9r8GIpwKYZv23MfuzDMf8WNv2W0s7CgYQvC7v%2FvahBfiQRoRgZpV5lcnSCQpy2CzrEa4%2FrCIQw21oNPsG6upj806pgL0SupDnD"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8ab1de968f39a02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 document.svg
booking.offer5985.shop/assets/icons/ Frame 3387 339 B
717 B 234ms
233ms Image
image/svg+xml 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://booking.offer5985.shop/assets/icons/document.svg
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 1d3af5838269f41ffd019f04eefcf2b494953d28fb1401acfbfa4ec55c57d515

Request headers

Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:26 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 22 Aug 2023 14:37:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"153-18a1dadebe0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dQe9OFHD7Mby1chAKdPnEJW4ljSbXnUdYyximo69TUwSsqJuWwWtn6KJ%2BOXBCq9XJTE9ry7B1oQUjWZwKbyEnUydhCheV2FSPyCebmwcLq3NeNhGThVNbKTWCrfKPbNi%2Fp6nBveRnRAR"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8ab1de970f7da02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 send.svg
booking.offer5985.shop/assets/icons/ Frame 3387 402 B
757 B 230ms
229ms Image
image/svg+xml 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://booking.offer5985.shop/assets/icons/send.svg
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 97d008f0efeb03337a4a169d85b9f8907ef5d6dcb74fb88f7e2f981250903349

Request headers

Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:26 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 22 Aug 2023 08:14:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"192-18a1c4f1f30"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gKk5Ch8j%2FJcL4%2BsgWnxNIKq1P3pdATyg%2FLILrCbkSOujw0e43z6sgZ9EMdTqBqKECWrsYLueAswT513yjkW3AjiAQfIWHw9sKxQfqXJ%2Bc1a2oZC87OKwzf%2FwAskYzO2NJW0FKrWc5z7x"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 8ab1de970f7fa02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H2

200

axios.min.js Show response
unpkg.com/axios@1.7.2/dist/ Frame 3387
Redirect Chain

https://unpkg.com/axios/dist/axios.min.js
https://unpkg.com/axios@1.7.2/dist/axios.min.js

51 KB
23 KB

22ms
21ms

Script
application/javascript

2606:4700::6811:f5cb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/axios@1.7.2/dist/axios.min.js

Requested by

Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974

Protocol

Server

2606:4700::6811:f5cb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ad11c4cb079bba93156727270f510292eedcc0716c6f21725074a59ec8b9b96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://booking.offer5985.shop/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:26 GMT
content-encoding: br
via: 1.1 fly.io
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5995176
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HYE1JEAWYGE0W5JSQJMPZN6T-fra
server: cloudflare
etag: "cc17-STt0F4pjQp//KqsIGzocpz02IIU"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8ab1de977eb33659-FRA

Redirect headers

date: Tue, 30 Jul 2024 02:20:26 GMT
content-encoding: br
via: 1.1 fly.io
cf-cache-status: HIT
fly-request-id: 01J40PZQX90TA7SXGXHAQV8ZSG-fra
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 32
server: cloudflare
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /axios@1.7.2/dist/axios.min.js
cache-control: public, s-maxage=600, max-age=60
cf-ray: 8ab1de974e9e3659-FRA

GET
H3 200 chat.js Show response
booking.offer5985.shop/assets/js/ Frame 3387 6 KB
2 KB 223ms
222ms Script
application/javascript 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/assets/js/chat.js
Requested by: Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/supportChatFrame/4858681974
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e0a55e5c281b52f05a188f5f4f4604a82ac1ae8faa681ade87ff2aa7f17fae1e

Request headers

Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:26 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Thu, 07 Dec 2023 12:27:31 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"1832-18c443f5738"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yMrQ6NZ47Dyzexox9HZmYLayZZiye3677BDfykV0xiytqcgYA0BVlhQQNwwaa5aNUpuFDvAuyrXe08tCmX%2BwBbo%2BFC9tiKE2DI%2FgvsyVJsxjNj0RijbfrP9WVszlLW%2BN0CEWYPkEcgBt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=14400
cf-ray: 8ab1de970f7ea02b-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 css2
fonts.googleapis.com/ Frame 3387 14 KB
1 KB 81ms
31ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Manrope:wght@200;300;400;500;600;700;800&display=swap

Requested by

Host: booking.offer5985.shop
URL: https://booking.offer5985.shop/assets/css/chat.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

052677c71e9626b42accce0a8c40dfecf94784271e67547f30a4664c11750473

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://booking.offer5985.shop/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 30 Jul 2024 02:20:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 30 Jul 2024 00:39:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 30 Jul 2024 02:20:26 GMT

POST
H3 200 getMessages Show response
booking.offer5985.shop/api/support/ Frame 3387 27 B
493 B 225ms
223ms XHR
application/json 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/api/support/getMessages
Requested by: Host: unpkg.com
URL: https://unpkg.com/axios/dist/axios.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 12f4bb3900ae3d0d83b7f00ec74d8bdbdd6877c78ec8ef7873de567e940dbd50

Request headers

Accept: application/json, text/plain, */*
Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 30 Jul 2024 02:20:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"1b-JdRC7uUKY1POKHHgmkfxEUy6yKQ"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=idVzsk7MCkqXn4JuwUldRotiRe0hdOx5%2F%2B010e0YxI6Ohh57S9fK%2F6CAk4jYHNUQjUtWrPlp9%2FUz92%2F%2BC6iLszFXMy8FP8RrLFaQGuQpQJx3Q3V%2F2esIRkhjqA1x0EptYsx1X%2B9wBLNz"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
cf-ray: 8ab1de98783da02b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 27

GET
H3 404 favicon.ico
booking.offer5985.shop/ 9 B
487 B 254ms
254ms Other
text/plain 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

Referer: https://booking.offer5985.shop/p/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 02:20:26 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"9-0gXL1ngzMqISxa6S1zx3F4wtLyg"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QZMYkPItM9%2BvfDPuh0lSnzyLxNpKL8eQrO3cthdoQRgxTHSE05cJ0kcYyoKt%2FepMltLFpakb3rHbSeqrCEp3nYVxUq0%2FSx15K3IcaHv0WxNqlTHODHXgyIQ1ICw2LWZA5lLzqgDY1C5i"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
cache-control: max-age=14400
cf-ray: 8ab1de988840a02b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 9

POST
H3 200 getMessages Show response
booking.offer5985.shop/api/support/ Frame 3387 27 B
484 B 218ms
217ms XHR
application/json 172.67.202.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://booking.offer5985.shop/api/support/getMessages
Requested by: Host: unpkg.com
URL: https://unpkg.com/axios/dist/axios.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 12f4bb3900ae3d0d83b7f00ec74d8bdbdd6877c78ec8ef7873de567e940dbd50

Request headers

Accept: application/json, text/plain, */*
Referer: https://booking.offer5985.shop/supportChatFrame/4858681974
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 30 Jul 2024 02:20:28 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"1b-JdRC7uUKY1POKHHgmkfxEUy6yKQ"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nz60OM3S2Of7Xhy0xz90ydpMs81zGyaRVDdAXsUN70NUXDmrUOqXPLFufCyxGgyQtCWlEQmFfsfB9GutOvUfbSo7evAMKEjS3YH7yYIx7XmaxrftQVBGBHxScvkdPmVkMzhHjIwPzIqR"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
cf-ray: 8ab1dea34e09a02b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 27

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Booking (Travel)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			booking.offer5985.shop/	1970-01-20 22:26:32	Name: connect.sid Value: s%3AdxYCh7hqvvlFwBgNwOQ7DOhHD1BF9HlD.2CfevDqbjTRoJWJufh4GqjfGDb1UUb%2B%2BidLm4Wvet%2FQ

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://booking.offer5985.shop/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

booking.offer5985.shop
cdn.tailwindcss.com
cf.bstatic.com
fonts.googleapis.com
unpkg.com
172.67.202.124
2600:9000:266e:fe00:5:bf05:acc0:93a1
2606:4700:10::6816:1490
2606:4700::6811:f5cb
2a00:1450:4001:80b::200a
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
052677c71e9626b42accce0a8c40dfecf94784271e67547f30a4664c11750473
12f4bb3900ae3d0d83b7f00ec74d8bdbdd6877c78ec8ef7873de567e940dbd50
149f0814b304e828a44cf30d8e6976b2607458a398bdedb294d199344f341345
1d3af5838269f41ffd019f04eefcf2b494953d28fb1401acfbfa4ec55c57d515
20f5cc0ebb84eb9bdeb82a9b908e9f922ab10ea415857c8b00b8302e00c61a5c
2f0570ef81afaa4194fa4ffe80fb291971f0ce27cecd0a1100fdcb4865703364
5bc89e80ec13a6df2535072a9f1c19f4700eb8214f566132792273953cc4923a
846a64b15537fd60cbebc9dbdca9a2df72aa05a6e564210f78acfd701a386ef7
8ad11c4cb079bba93156727270f510292eedcc0716c6f21725074a59ec8b9b96
97d008f0efeb03337a4a169d85b9f8907ef5d6dcb74fb88f7e2f981250903349
9a60eed802ef3d6b6784369cf91a4be28f925fa426293244ad43b9d2868f2988
afdcc2ef49547416fbc66391440f227e7926afa54ecd32a23717046d7878f8e4
b2e3158656f24d0f69988896ea2facd530904745d286f84eadb67ceb2ce9d4c2
b4784b8b0b3e2cfefe7106fea734e0a37df601a093d8bdb1aa3ee5216716546b
c5e7e8f07db5f90f5b179d122a425eacb8e7b0b57e79349f6e414158d3db0f77
cde4e1ecef591a0e656448a3dfe6d279c18e1907e952ac086d766d5d68364ff0
d7a5152180593b0144e6a36c21ca0e19aa9a64da790d7a1d14f0cbe49d45525a
e0a55e5c281b52f05a188f5f4f4604a82ac1ae8faa681ade87ff2aa7f17fae1e
fbb307bc48c763f9a4893ba918ca9a322f4e084dbb994504d526af90c1a4d1e9
fc78e1550450ab81964ef660b05cb14fb17e0b895b261925ad7e6e073502dfc4

booking.offer5985.shop Open in urlscan Pro 172.67.202.124 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

22 Requests

91 %HTTPS

80 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

219 kBTransfer

591 kBSize

1 Cookies

0 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

booking.offer5985.shop Open in urlscan Pro
172.67.202.124 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

91 %
HTTPS

80 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

219 kB
Transfer

591 kB
Size

1
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!