www.booking-rewards.littlechelseaplace.co.uk
Open in
urlscan Pro
185.61.154.5
Malicious Activity!
Public Scan
URL:
https://www.booking-rewards.littlechelseaplace.co.uk/
Submission: On February 24 via automatic, source certstream-suspicious — Scanned from GB
Submission: On February 24 via automatic, source certstream-suspicious — Scanned from GB
Summary
This website contacted 6 IPs
in 5 countries
across 5 domains to perform 17 HTTP transactions.
The main IP is 185.61.154.5, located in
United Kingdom and
belongs to NAMECHEAP-NET, US.
The main domain is www.booking-rewards.littlechelseaplace.co.uk.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 24th 2023. Valid for: a year.
This is the only time www.booking-rewards.littlechelseaplace.co.uk was scanned on urlscan.io!
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 24th 2023. Valid for: a year.
This is the only time www.booking-rewards.littlechelseaplace.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Booking (Travel)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 185.61.154.5 185.61.154.5 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:80b::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 2a00:1450:400... 2a00:1450:400d:80d::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 2 | 2001:67c:4e8:... 2001:67c:4e8:f004::9 | 62041 (TELEGRAM) (TELEGRAM) | |
| 17 | 6 |
11
185.61.154.5
(United Kingdom)
ASN22612 (NAMECHEAP-NET, US)
PTR: server248-2.web-hosting.com
ASN22612 (NAMECHEAP-NET, US)
PTR: server248-2.web-hosting.com
| www.booking-rewards.littlechelseaplace.co.uk |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
littlechelseaplace.co.uk
www.booking-rewards.littlechelseaplace.co.uk |
59 KB |
| 2 |
telegram.org
api.telegram.org — Cisco Umbrella Rank: 45984 |
769 B |
| 2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 36 ajax.googleapis.com — Cisco Umbrella Rank: 306 |
32 KB |
| 1 |
gstatic.com
fonts.gstatic.com |
16 KB |
| 1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 788 |
12 KB |
| 17 | 5 |
| Domain | Requested by | |
|---|---|---|
| 11 | www.booking-rewards.littlechelseaplace.co.uk |
www.booking-rewards.littlechelseaplace.co.uk
|
| 2 | api.telegram.org |
www.booking-rewards.littlechelseaplace.co.uk
|
| 1 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | maxcdn.bootstrapcdn.com |
www.booking-rewards.littlechelseaplace.co.uk
|
| 1 | ajax.googleapis.com |
www.booking-rewards.littlechelseaplace.co.uk
|
| 1 | fonts.googleapis.com |
www.booking-rewards.littlechelseaplace.co.uk
|
| 17 | 6 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| booking-rewards.littlechelseaplace.co.uk Sectigo RSA Domain Validation Secure Server CA |
2023-02-24 - 2024-02-24 |
a year | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2023-02-08 - 2023-05-03 |
3 months | crt.sh |
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
| *.gstatic.com GTS CA 1C3 |
2023-02-08 - 2023-05-03 |
3 months | crt.sh |
| api.telegram.org Go Daddy Secure Certificate Authority - G2 |
2022-03-24 - 2023-04-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.booking-rewards.littlechelseaplace.co.uk/
Frame ID: F2BAB88BF3B225022C40057887F33A15
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Booking.comDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Laravel
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
Google Font API
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
www.booking-rewards.littlechelseaplace.co.uk/ |
8 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mystyle.css
www.booking-rewards.littlechelseaplace.co.uk/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.min.css
www.booking-rewards.littlechelseaplace.co.uk/css/ |
122 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
regular.css
www.booking-rewards.littlechelseaplace.co.uk/css/ |
633 B 527 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css2
fonts.googleapis.com/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
download.png
www.booking-rewards.littlechelseaplace.co.uk/images/ |
642 B 842 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
download%20(2).png
www.booking-rewards.littlechelseaplace.co.uk/images/ |
969 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
download%20(1).png
www.booking-rewards.littlechelseaplace.co.uk/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
main.js
www.booking-rewards.littlechelseaplace.co.uk/js/ |
521 B 340 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/ |
39 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
anis.js
www.booking-rewards.littlechelseaplace.co.uk/js/ |
3 KB 988 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
startup.js
www.booking-rewards.littlechelseaplace.co.uk/js/ |
788 B 652 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fa-regular-400.woff2
www.booking-rewards.littlechelseaplace.co.uk/webfonts/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
OPTIONS H2 |
sendMessage
api.telegram.org/bot5698907203:AAFBXV5ty9dQH85xzNW2lV5ZI1ukQu1ztm0/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
sendMessage
api.telegram.org/bot5698907203:AAFBXV5ty9dQH85xzNW2lV5ZI1ukQu1ztm0/ |
523 B 769 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
.png%22){kind=link}
.png){kind=link}
.png){kind=link}
.png%22){kind=link}
.png){kind=link}
.png){kind=link}
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Booking (Travel)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| phoneNumber function| returnEmail function| $ function| jQuery boolean| ret function| IsEmail2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.booking-rewards.littlechelseaplace.co.uk/ | Name: XSRF-TOKEN Value: eyJpdiI6IktiMk1pSWlXbzFsUW9idS9xRkJleVE9PSIsInZhbHVlIjoiMTdwNndqS2pUT2o1OVdoTTBOYWcwMisybkVvY2RZK21xbERrdUJIekwyM3pPbHIyMDBvWCtkWG00RmVFMnV4TzNlY0hsV1hOcUoyejJUeFkyNUN0anI1dTNwWFNuejdpZit6L1RqZE9vNjVEcHRZTDFPU1lsQllpdkV3S3hlKysiLCJtYWMiOiJkNmE0ZWI0ZDMwMDAwOWU1NjBmMGQ2OTk3ODE4NTVjMzA1ZTY2OWY5Yzk3ZGUxNmEyNTA0ZjA3YmVlMjc1ZjQ4IiwidGFnIjoiIn0%3D |
|
| www.booking-rewards.littlechelseaplace.co.uk/ | Name: laravel_session Value: eyJpdiI6IkZMRmdNSStXVjdjQ3JXY00vcmIrWVE9PSIsInZhbHVlIjoiMXlObXZ5YUZTQVZXK2hKT0tMKzJ5RWkzb3NRV0pOVFdmaXN1cFFrdkJTWkdwaUlXSzdXWDlRZTVOUVlobE9IUUhaK0dtd0VyOXFRUTZBajB1MmJnZ3BRSkVIQWQ4czUyWjA4UmVYcnhHa0JreFJQbERJRmFuU0lnQ2JoYmg4aC8iLCJtYWMiOiJmNWIzN2QwYmVhYWZlYTIxNDZmYTMyMWFjOTZhNmMzOTBhYzI5OWI1N2JjODA0NTc3OTEyMDM0OWYyYzliOTQ3IiwidGFnIjoiIn0%3D |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.telegram.org
fonts.googleapis.com
fonts.gstatic.com
maxcdn.bootstrapcdn.com
www.booking-rewards.littlechelseaplace.co.uk
185.61.154.5
2001:67c:4e8:f004::9
2606:4700::6812:acf
2a00:1450:4001:80b::200a
2a00:1450:4001:828::200a
2a00:1450:400d:80d::2003
15a3a60f2debbd541f2dcb629aea18e0bb080388c6bb0a27f0e9c96d44399c38
22825bf6516ae2b375b906d555ef8ab89bd86ca7edb2559360284c29a2036497
3b686bb90d2a76c9e0b0ad5eb72482103cf9cee09ed45a92daac10045cdf2f2a
54b7196b0e8eee7f6935fe22e28e675fd38e42d97533d347cc645de3c7147d3f
5549e947317293dccdc1fba4f3df4781266f1b121e0138c7f00fc8a7def5f4b4
5ba147023e40e224a8b68709ab02c66b5e39254fcdbb4c5a460d0c320b48da96
65fe99e962a62c784f2efa815f59e96601689b796cc59fd60713292ea53be2c5
775845e997f649f7e00bf4cbc1987cedf4d3d019cf01e9ebc62b1760ff343c2e
7dbdee3f0229ed8233d2d5712211fbfef4bb52f38528df0a9b892a2244395544
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe
a333d02eedde7a4dd8643d58b0ea7947268a1762f35f517eb6000ec9e7fcfae8
a910fad5148cf6125d48b7231580f4ae66d27804e886fe0f4ce58599c0962fef
f3adde03218042a0526b354594ee0ef5d75ba4f8ed74ceb9b8d6feae133a0779
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fe69d94841462d397faeff253ee09a6dc7941be931f942a55e6b9def8f3b048d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e