urlscan.io logo urlscan.io
SecurityTrails logo

booking.guesthelp-online.com Open in urlscan Pro
2a06:98c1:3120::3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://urly.fi/3j15
Effective URL: https://booking.guesthelp-online.com/p/6941136664
Submission: On November 22 via manual from NL — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 1 countries across 5 domains to perform 19 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is booking.guesthelp-online.com.
TLS certificate: Issued by GTS CA 1P5 on November 13th 2023. Valid for: 3 months.
This is the only time booking.guesthelp-online.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Booking (Travel)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 15 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2600:9000:225... 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 3 18.245.60.76 16509 (AMAZON-02)
19 5
1    2606:4700:3037::6815:5e93 (United States)

ASN13335 (CLOUDFLARENET, US)
urly.fi
15    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
booking.guesthelp-online.com
1    2600:9000:2251:6400:5:bf05:acc0:93a1 (United States)

ASN16509 (AMAZON-02, US)
cf2.bstatic.com
1    2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
3    18.245.60.76 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-60-76.fra60.r.cloudfront.net
booking.com
www.booking.com
Apex Domain
Subdomains		 Transfer
15 guesthelp-online.com
booking.guesthelp-online.com
192 KB
3 booking.com
booking.com — Cisco Umbrella Rank: 9264
www.booking.com — Cisco Umbrella Rank: 12201
3 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223
6 KB
1 bstatic.com
cf2.bstatic.com
105 KB
1 urly.fi
urly.fi
446 B
19 5
Domain Requested by
15 booking.guesthelp-online.com 1 redirects booking.guesthelp-online.com
2 www.booking.com 1 redirects
1 booking.com 1 redirects
1 cdnjs.cloudflare.com booking.guesthelp-online.com
1 cf2.bstatic.com booking.guesthelp-online.com
1 urly.fi 1 redirects
19 6

This site contains no links.

Subject Issuer Validity Valid
guesthelp-online.com
GTS CA 1P5		 2023-11-13 -
2024-02-11		 3 months crt.sh
*.bstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-13 -
2024-08-31		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh

This page contains 2 frames:

Primary Page: https://booking.guesthelp-online.com/p/6941136664
Frame ID: 3A7D4551A03C3D28C0241A20409C3728
Requests: 11 HTTP requests in this frame

Frame: https://booking.guesthelp-online.com/chat/6941136664
Frame ID: 8AA36F854D6DE40D2716BD9B648DFF98
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Booking.com | Official site | The best hotels & accommodation

Page URL History Show full URLs

  1. https://urly.fi/3j15 HTTP 301
    https://booking.guesthelp-online.com/p/6941136664 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

84 %
HTTPS

80 %
IPv6

5
Domains

6
Subdomains

5
IPs

1
Countries

303 kB
Transfer

697 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://urly.fi/3j15 HTTP 301
    https://booking.guesthelp-online.com/p/6941136664 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15
  • https://booking.guesthelp-online.com/chat/%7Bimage%7D HTTP 302
  • https://booking.com/ HTTP 301
  • https://www.booking.com/ HTTP 302
  • https://www.booking.com/index.fi.html?label=gen173rf-1BCAEoggI46AdIM1gDaEiIAQGYAQy4ARfIAQzYAQHoAQGIAgGiAhxib29raW5nLmd1ZXN0aGVscC1vbmxpbmUuY29tqAIDuALatviqBsACAdICJDBjNjMyYmNkLTU3ODYtNDQ4OS05MmEzLTYzZDMxODc1ZGI2ZNgCBeACAQ&sid=6e534110c5ad525849c62b9cdbc4580a&keep_landing=1&sb_price_type=total&

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 6941136664
booking.guesthelp-online.com/p/
Redirect Chain
  • https://urly.fi/3j15
  • https://booking.guesthelp-online.com/p/6941136664
98 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/p/6941136664
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98e81d2b56b2584354fdeef956fc425a23dd0ed4359aba0bf7874b0267b1c702

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
82a222858a901c16-OSL
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 22 Nov 2023 15:16:40 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vs7xKI1YGVGd7wOpk578FygYss5EUm58ycldo8OkunopNTpanPJVIA1A7Xw2nqm78yEVJmVjW5ITOtih%2Fj5Z6FmIuo8NPzi149LmdLzVHb4qXNxhUK8BKfUrbS7VFSA9ZiNuQPS17HF4kz3%2Fw%2BpJO0ZaZyHNcqf9aWfY"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
82a22283bccc569f-OSL
content-type
text/html; charset=utf-8
date
Wed, 22 Nov 2023 15:16:39 GMT
location
https://booking.guesthelp-online.com/p/6941136664
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1ImnJTCFzvlUqXsPh8fuXu8jsHtISg6hsUCtbwqXz8bd3gReyrozwXnPZ1y54xqE1iyc6sdQAT%2FIF7Q1T1budF1KeaLat73PcPoWcgXUi%2FkEvszeT10FkG3H%2BNxSoZELXD18lQ7s"}],"group":"cf-nel","max_age":604800}
server
cloudflare
styles3.css
booking.guesthelp-online.com/css/booking1/ 		34 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/css/booking1/styles3.css
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/p/6941136664
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc052d928f0a7507aba9d381da1f927298df5c0cb802d302a77ba196d9f47317

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/p/6941136664
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:40 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 30 Oct 2023 17:36:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"653fe9a2-8950"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EBNvkkxP2s6fsIgGGf%2FoUFg%2BX1ly7k8xYEvd6q%2B8Y8Bbx9Pko4n4nADEHMiFl%2F3qmJGfBvCSb34zij2f3WabyHwlTbQi3o8GUuvYN1vwraKfG7D70suVizQpOAllYSkjjYQgzGL%2FWOxCiaOAslB5KXhsUTyybFrDBhd6"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
82a22288ce0e1c16-OSL
alt-svc
h3=":443"; ma=86400
chat.css
booking.guesthelp-online.com/build/ 		3 KB
982 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/build/chat.css
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/p/6941136664
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1fc1e7ad40e4ae54f2dbd4b1f8b0b09482bbcae9524a3a1743f0f5da062740d8

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/p/6941136664
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:40 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 30 Oct 2023 17:36:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"653fe98c-a0e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BP%2B%2FdAHqzqpPGABCoRvxoCJJPaNHqO2t9Umxhe0PQpHQ89UmTnJMx0ThEB98IDiDTtKdltTSWdg9ZF3VKaI03RWh5BGI9eh%2F6y4f8mNFNDMcVDvq3i0HVDJVsAkV9cdl54vX9Pz%2FOdaDp076x111NrlA%2B%2F8W7vT%2FUt%2BH"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
82a22288ce101c16-OSL
alt-svc
h3=":443"; ma=86400
submit.js
booking.guesthelp-online.com/css/booking1/ 		22 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/css/booking1/submit.js
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/p/6941136664
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9cd9d78e7013b1d96cf305c9010d521a75f0bfabc5a0d79d46acc6d60b85ac82

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/p/6941136664
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:41 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 30 Oct 2023 17:36:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"653fe9a2-56f2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EvmwHArkr0SaAlWAs%2B%2F%2BVA8rocSf8magaweQaiUatNBP4so670zpCnwpqR910RLWXgzGxoW7n1jI3y258mtnVOG5%2Fh2AbbRUnUBgfBzuGZnX4y2YXVaeESVJWXOauU5z9FgA%2BnNXfQisanIkPG6%2BT4KSzXRp7ypINhdC"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
82a2228b2dcc56a8-OSL
alt-svc
h3=":443"; ma=86400
blur_input.js
booking.guesthelp-online.com/css/booking1/ 		21 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/css/booking1/blur_input.js
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/p/6941136664
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5eaae12a5b85c3a24efd4d581e61ef3773befd9f64b1421c678038bf17c559ba

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/p/6941136664
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:41 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 30 Oct 2023 17:36:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"653fe9a1-5465"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kkBFM57gr70lyAxlsqUXIdHh1VvyEdP0B9mdT%2F9YwYksUGZM8aqh3suFrDws2yo6z1gGIxaCKFMhfPSCCU4YWAvY%2BEGqSiaFz06MGECa3cwU3JA8%2BjFUGSh6RY1f4ryRq4SP34JlKmfQaXxkO8GGOudTRzvhpoMFUPKv"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
82a2228b6e2056a8-OSL
alt-svc
h3=":443"; ma=86400
jquery.min.js
booking.guesthelp-online.com/js/ 		87 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/js/jquery.min.js
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/p/6941136664
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/p/6941136664
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:40 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 30 Oct 2023 17:36:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"653fe9b6-15d84"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5AfkwI%2FmpEYGfSdwxCTHrV8vxIhvpj%2F7otiy%2FTqBtrJmXpMD3XLYgI48%2Fkg98ejWAuPH9f7TZe%2BtlT8YL7F3o9WjNMM84mFwOGQ5J7XyPeMSxQ29zz2k0cMkPzBnSw4UzExpjCujdsHr5z9YP4MKBd2AsYlDPzg7NX7n"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
82a22288ce111c16-OSL
alt-svc
h3=":443"; ma=86400
485921623.jpg
cf2.bstatic.com/xdata/images/hotel/max1280x900/ 		105 KB
105 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cf2.bstatic.com/xdata/images/hotel/max1280x900/485921623.jpg?k=1aaccecfc4bca5af2ad1313c3216e399372313ff2219fc351b3737d8019b4295&o=&hp=1
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/p/6941136664
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2251:6400:5:bf05:acc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
41f9695c22083953b0027d8ceacaf87d7a62c5f74e4343f9a7e99a7aea5a3434
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 14:15:48 GMT
via
1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
FRA60-P3
age
3652
etag
"81ccabc87b92514417fced75576de0cca160da96"
x-cache
Hit from cloudfront
content-language
107087
access-control-allow-origin
*
content-type
image/jpeg
cache-control
max-age=2592000
timing-allow-origin
*
x-amz-cf-id
jbWdWz0qMzyZnQ4wHQ8egkW5XRZDXB4XvEwQAlVH9VkciG36Bva0Pg==
x-xss-protection
1; mode=block
6941136664
booking.guesthelp-online.com/chat/ Frame 8AA3 		29 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/chat/6941136664
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/p/6941136664
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfcbe5e2b5f553b4348bc609418b5ebc2d78a226083b8cc7a41b8d5b3429c590

Request headers

Referer
https://booking.guesthelp-online.com/p/6941136664
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
82a2228b6e2956a8-OSL
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 22 Nov 2023 15:16:41 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5u9pEReKIBBFw1ukA85YpbEscZ0TQ4ZRkKxfBDYmSmzzGicjqZLzgufmG4vqXGbhXIFeuzpAYypG6K2x9CJIgpwQSbHHLOzGGVrZoNUY0qrHhenYu3vseMaamPuNnrszD3j0%2FWm%2BRmEr5wdnG3uc55n0Ja3U2LHvGK1k"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
user_send_status.php
booking.guesthelp-online.com/ajax/ 		0
501 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/ajax/user_send_status.php
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/js/jquery.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://booking.guesthelp-online.com/p/6941136664
X-Requested-With
XMLHttpRequest
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 22 Nov 2023 15:16:41 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kJsnuh%2BUt%2F7WX%2FqK8WNU6dShrkrkFWP5PPcG5jDxVKHY9oz%2F6lmt87ioZWfj2OdK8tJ7C6quPFf7PhEFGIbqcZ1bpjNc43%2FZVv1aXjQa0v3uw9vAIjviLRuVF0msXJdYOR%2FPP9sYOG7cnB2Z%2FCvl33Ray%2FlkiuNZtaDj"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
cf-ray
82a2228bdeb256a8-OSL
alt-svc
h3=":443"; ma=86400
expires
Thu, 19 Nov 1981 08:52:00 GMT
flags.png
booking.guesthelp-online.com/css/booking1/img/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://booking.guesthelp-online.com/css/booking1/img/flags.png
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/css/booking1/styles3.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc78e1550450ab81964ef660b05cb14fb17e0b895b261925ad7e6e073502dfc4

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/css/booking1/styles3.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:41 GMT
cf-cache-status
MISS
last-modified
Mon, 30 Oct 2023 17:36:36 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"653fe9a4-77d8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V6B%2FQ3lL6wVZbuJ%2BdFVfiGlVJTsr0izWCeRLOqjlL5HRiy1sodDeCCm8aiS68L%2B35rPuogJwiWGelEN%2BM6rlxHDm55JYASz5nMHWJaXyOdsDsEm6xF%2BFyrMUp0vRDQMLMq%2F9Jb6L%2BILm%2FjQD1G2a3syPUpIGv09F%2BrRt"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
82a2228c2f1056a8-OSL
alt-svc
h3=":443"; ma=86400
content-length
30680
chat.css
booking.guesthelp-online.com/css/ Frame 8AA3 		106 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/css/chat.css
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/chat/6941136664
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1c9ad009f4d6ed374fe5404e3276bbbc345396e772cd72491a88c1173582ec3

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/chat/6941136664
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:41 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 30 Oct 2023 17:36:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"653fe99a-1a924"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HBqTzwF935F5oZ3K6%2FElTKb23Bo2rHe40rPnezxXt0RzsbsoVyO13IRoEjlW53NX0T0Sblx%2Fr2QFZfduWnOyywcW%2BsP%2BJnF338FlFe16xw53CJJqmqfQdar3ruu87FG22Tdrl8yriexdmiekVdDDivGwzHKBFlDV6j0S"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
82a2228d38b556a8-OSL
alt-svc
h3=":443"; ma=86400
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ Frame 8AA3 		30 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/chat/6941136664
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:41 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
2208756
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5631
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OxTv1%2BflJXLMh8O97Klo6jEkjk0EEWqNkfph1ejefgVQQdl5JWAeAK%2BXZjFUwTRjRu451pT3krhWjl3QxsZmYWAqAx8cO6W82HgjfJzvgDNvpqtI54F2WdZ6d7Mx787sEU8sdDEx8gKTp3I0QaBOxxkI"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
82a2228e0a68b511-OSL
expires
Mon, 11 Nov 2024 15:16:41 GMT
support.png
booking.guesthelp-online.com/img/ Frame 8AA3 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://booking.guesthelp-online.com/img/support.png
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/chat/6941136664
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f38df22b91417e6c60a0c086f7997c1ba6c5b844b3c947d07ed7e88650442973

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/chat/6941136664
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:41 GMT
cf-cache-status
MISS
last-modified
Thu, 16 Nov 2023 14:41:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"65562a14-3d12"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tth1lvXNzR8Kme%2B5jkKStT2AAEaZUMtzoucFxV34Iwb5BPVmJcBA%2FFWZ70egJNmFz4TTBGoYblbg2y2dS6gUypHtUPqe%2FVz1ZE7KvgrntwMXpMOK1VbSOTkFYuRCOTgllEm7ydGbjXbRij9wWdUwQxw0tSNgaUe4ozUX"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
82a2228d48b756a8-OSL
alt-svc
h3=":443"; ma=86400
content-length
15634
support-open.png
booking.guesthelp-online.com/img/ Frame 8AA3 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://booking.guesthelp-online.com/img/support-open.png
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/chat/6941136664
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
560b6b311920854bb28122c60e1262f34723ed8bff0b6970300bd04d9369adeb

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/chat/6941136664
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:41 GMT
cf-cache-status
MISS
last-modified
Thu, 16 Nov 2023 14:41:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"65562a14-5400"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D%2BLcrZKcCN9YfKgHEwxKNGVyNIOmcwqJWF7TLdggNfE1SknDeyk7cU9mrWqFvrKz8cTHS63OpLLvvvt1WgQ%2BE6CyP0MQg%2FmazvAPzD7IUBVoZyZwODwo3SAEBmnQJXWAPg59oSLWC9uFjpjOd73acpmxUFbSeSC%2BPNeX"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
82a2228d790156a8-OSL
alt-svc
h3=":443"; ma=86400
content-length
21504
jquery.min.js
booking.guesthelp-online.com/dist/new_card_design/ Frame 8AA3 		87 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/dist/new_card_design/jquery.min.js
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/chat/6941136664
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/chat/6941136664
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Wed, 22 Nov 2023 15:16:41 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 30 Oct 2023 17:36:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"653fe9ab-15d84"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EaEqLdJGPzcaQsaqiNO4GvRVUWKa45jBmBiNHWQaQOUoPWROzN13iPtN6V84SA5D2Fjohf3nlFtSbv0cHj4fPRrdWCR0kgwZVOYRC4zyUbZFDEu18XCXXPrReRmm4VgziZBZfZcOTnrDd0kj9q6iBh6kED3EeH1%2FPkLq"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
82a2228db95356a8-OSL
alt-svc
h3=":443"; ma=86400
msg_check.php
booking.guesthelp-online.com/ajax/ Frame 8AA3 		7 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://booking.guesthelp-online.com/ajax/msg_check.php
Requested by
Host: booking.guesthelp-online.com
URL: https://booking.guesthelp-online.com/dist/new_card_design/jquery.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
46f2c78155f8661f258c1cc2d00fddb51cf8415999624bf173d921fc8bcb2cf7

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://booking.guesthelp-online.com/chat/6941136664
X-Requested-With
XMLHttpRequest
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 22 Nov 2023 15:16:41 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XriSTn%2BqLMe7rOJnPiQMlIwkyyj1QxnwmdStGS%2Buk%2FBiOsavSjZ5Wk%2Fwp7DAtCRa6MdJzGgMXXJnPLiRx0g0OR1FSIrnWp9ra5uTlaFD9fCCtRt9reIOa4JmSQYRhzfc7aJLIpOB2cv9oi1zUZ8rXiuP0kBB4uNlrKTH"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate
cf-ray
82a222906d5856a8-OSL
alt-svc
h3=":443"; ma=86400
expires
Thu, 19 Nov 1981 08:52:00 GMT
index.fi.html
www.booking.com/ Frame 8AA3
Redirect Chain
  • https://booking.guesthelp-online.com/chat/%7Bimage%7D
  • https://booking.com/
  • https://www.booking.com/
  • https://www.booking.com/index.fi.html?label=gen173rf-1BCAEoggI46AdIM1gDaEiIAQGYAQy4ARfIAQzYAQHoAQGIAgGiAhxib29raW5nLmd1ZXN0aGVscC1vbmxpbmUuY29tqAIDuALatviqBsACAdICJDBjNjMyYmNkLTU3ODYtNDQ4OS05MmEzLT...
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.booking.com/index.fi.html?label=gen173rf-1BCAEoggI46AdIM1gDaEiIAQGYAQy4ARfIAQzYAQHoAQGIAgGiAhxib29raW5nLmd1ZXN0aGVscC1vbmxpbmUuY29tqAIDuALatviqBsACAdICJDBjNjMyYmNkLTU3ODYtNDQ4OS05MmEzLTYzZDMxODc1ZGI2ZNgCBeACAQ&sid=6e534110c5ad525849c62b9cdbc4580a&keep_landing=1&sb_price_type=total&
Protocol
H2
Server
18.245.60.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-245-60-76.fra60.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://booking.guesthelp-online.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Redirect headers

date
Wed, 22 Nov 2023 15:16:42 GMT
strict-transport-security
max-age=300; includeSubDomains
via
1.1 0254a3d4b384cab4933ea28efe6685c2.cloudfront.net (CloudFront)
nel
{"report_to":"default","max_age":604800}
server
nginx
x-amz-cf-pop
FRA60-P5
content-security-policy-report-only
base-uri 'none'; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=146&pid=b3b76b6dd1be0127&e=UmFuZG9tSVYkc2RlIyh9YYYdGuViorKPt4U56YDcYw06xaqkKhiLraeQ37FNsgxc; script-src 'self' 'nonce-HXWPqW9FFOP3FSH' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: 'sha256-47mKTaMaEn1L3m5DAz9muidMqw636xxw7EFAK/YnPdg=' 'sha256-iry7oJKoKJ+9HSjmU3E1TlRlpSesJWZ1vapuUz2MP38='
x-recruiting
Like HTTP headers? Come write ours: https://careers.booking.com
report-to
{"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800,"group":"default"}
location
/index.fi.html?label=gen173rf-1BCAEoggI46AdIM1gDaEiIAQGYAQy4ARfIAQzYAQHoAQGIAgGiAhxib29raW5nLmd1ZXN0aGVscC1vbmxpbmUuY29tqAIDuALatviqBsACAdICJDBjNjMyYmNkLTU3ODYtNDQ4OS05MmEzLTYzZDMxODc1ZGI2ZNgCBeACAQ&sid=6e534110c5ad525849c62b9cdbc4580a&keep_landing=1&sb_price_type=total&
x-cache
Miss from cloudfront
x-terms-of-service
https://www.booking.com/content/terms.html
x-amz-cf-id
bKZLiUdk3SEcPtyrZXNxq0A682sYlb4u7lKHztpsxjffi5WaWwRL0Q==
x-xss-protection
1; mode=block
payment_card_status.php
booking.guesthelp-online.com/ajax/ 		0
0
user_send_status.php
booking.guesthelp-online.com/ajax/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
booking.guesthelp-online.com
URL
https://booking.guesthelp-online.com/ajax/payment_card_status.php
Domain
booking.guesthelp-online.com
URL
https://booking.guesthelp-online.com/ajax/user_send_status.php

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Booking (Travel)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| $ function| jQuery number| get_status function| onPage function| scrollToErrorInput

2 Cookies

Domain/Path Name / Value
booking.guesthelp-online.com/ Name: PHPSESSID
Value: vsbk8nktv0cp638trfm1jah4sd
.booking.com/ Name: bkng
Value: 11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT9DpF%2Bv51PctYFDuUAPjRrQZzmKMCMV3cClC84tNeus2%2F%2BfYVAyReV%2BetDuN%2FGML1TKM0i7QpBDRvBlFr%2BYDHkmAPCkxA%2BeKOh7f65b2lN0LMDJt%2B%2BLbqxBufXqLvpROWk7A8OkWkje8yZjorQXxj0Zbye1CWdx2DI%3D