covid19.safarbooking.com Open in urlscan Pro
164.138.20.117 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://covid19.safarbooking.com/
Submission: On November 19 via automatic, source certstream-suspicious (November 19th 2020, 11:18:04 am UTC)

Summary HTTP 10 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 164.138.20.117, located in Tehran, Iran, Islamic Republic Of and belongs to RAV-NET-01, IR. The main domain is covid19.safarbooking.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 19th 2020. Valid for: 3 months.

This is the only time covid19.safarbooking.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
10	164.138.20.117 164.138.20.117		59431 (RAV-NET-01) (RAV-NET-01)
10	1

10 164.138.20.117 (Tehran, Iran, Islamic Republic Of)

ASN59431 (RAV-NET-01, IR)

covid19.safarbooking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	safarbooking.com covid19.safarbooking.com	165 KB
10	1

	Domain	Requested by
10	covid19.safarbooking.com	covid19.safarbooking.com
10	1

This site contains links to these domains. Also see Links.

Domain
safarbooking.com

Subject Issuer	Validity	Valid
covid19.safarbooking.com Let's Encrypt Authority X3	`2020-11-19` - `2021-02-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://covid19.safarbooking.com/
Frame ID: 731D5736CA81E852BD98725D3F16A9EF
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

165 kB
Transfer

409 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://safarbooking.com/
Title: طراحی شده توسط شرکت پیشتازان سفر پاژ - تولیدکننده نرم افزار ایرلاینی گریفین

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
covid19.safarbooking.com/ 2 KB
1 KB 384ms
90ms Document
text/html 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to

Full URL

https://covid19.safarbooking.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

e87d1f497e5e1cf8d4085b802f4040e2cc9f74f73f6b0e766c51ce62a5318491

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

:method: GET
:authority: covid19.safarbooking.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:47 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: ci_session=oe18vl6jb8pk1rolgrq6beckqih5pebv; expires=Thu, 19-Nov-2020 13:17:47 GMT; Max-Age=7200; path=/; HttpOnly
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
server: Microsoft-IIS/10.0
strict-transport-security: max-age=15768000
x-frame-options: DENY
content-encoding: gzip

GET
H2 200 bootstrap.min.css
covid19.safarbooking.com/assets/css/ 157 KB
24 KB 96ms
94ms Stylesheet
text/css 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to

Full URL

https://covid19.safarbooking.com/assets/css/bootstrap.min.css

Requested by

Host: covid19.safarbooking.com
URL: https://covid19.safarbooking.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

Referer: https://covid19.safarbooking.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:47 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 19 Nov 2020 10:51:06 GMT
server: Microsoft-IIS/10.0
etag: W/"5fb64e1a-27288"
x-frame-options: DENY
content-type: text/css
cache-control: max-age=315360000
strict-transport-security: max-age=15768000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
covid19.safarbooking.com/assets/css/ 6 KB
2 KB 175ms
174ms Stylesheet
text/css 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to

Full URL

https://covid19.safarbooking.com/assets/css/style.css

Requested by

Host: covid19.safarbooking.com
URL: https://covid19.safarbooking.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

162c9877a7f9663ccd9ecc178414c980a7e13c841a22c634f2767458648e98ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

Referer: https://covid19.safarbooking.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:47 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 19 Nov 2020 11:15:32 GMT
server: Microsoft-IIS/10.0
etag: W/"5fb653d4-174f"
x-frame-options: DENY
content-type: text/css
cache-control: max-age=315360000
strict-transport-security: max-age=15768000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.js Show response
covid19.safarbooking.com/assets/js/ 71 KB
24 KB 176ms
175ms Script
application/javascript 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to

Full URL

https://covid19.safarbooking.com/assets/js/jquery.js

Requested by

Host: covid19.safarbooking.com
URL: https://covid19.safarbooking.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

Referer: https://covid19.safarbooking.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:47 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 19 Nov 2020 10:51:08 GMT
server: Microsoft-IIS/10.0
etag: W/"5fb64e1c-11abc"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=315360000
strict-transport-security: max-age=15768000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 bootstrap.min.js Show response
covid19.safarbooking.com/assets/js/ 62 KB
15 KB 254ms
253ms Script
application/javascript 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to

Full URL

https://covid19.safarbooking.com/assets/js/bootstrap.min.js

Requested by

Host: covid19.safarbooking.com
URL: https://covid19.safarbooking.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

5ee2ebf07e7d323cf5460469dc9a1956a53c38f0003acd80f3e7db323cb4f718

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

Referer: https://covid19.safarbooking.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:47 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 19 Nov 2020 10:51:07 GMT
server: Microsoft-IIS/10.0
etag: W/"5fb64e1b-f709"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=315360000
strict-transport-security: max-age=15768000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 popper.min.js Show response
covid19.safarbooking.com/assets/js/ 21 KB
8 KB 255ms
254ms Script
application/javascript 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to

Full URL

https://covid19.safarbooking.com/assets/js/popper.min.js

Requested by

Host: covid19.safarbooking.com
URL: https://covid19.safarbooking.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

Referer: https://covid19.safarbooking.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:47 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 19 Nov 2020 10:51:08 GMT
server: Microsoft-IIS/10.0
etag: W/"5fb64e1c-52f1"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=315360000
strict-transport-security: max-age=15768000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 safar.png
covid19.safarbooking.com/assets/img/ 5 KB
5 KB 88ms
87ms Image
image/png 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://covid19.safarbooking.com/assets/img/safar.png

Requested by

Host: covid19.safarbooking.com
URL: https://covid19.safarbooking.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

dc90bab7a451f2052f3023bac62f022c48b94bd1923fb46905ccd6e8d82d0efb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

Referer: https://covid19.safarbooking.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:47 GMT
last-modified: Thu, 19 Nov 2020 10:51:07 GMT
server: Microsoft-IIS/10.0
etag: "5fb64e1b-139e"
x-frame-options: DENY
content-type: image/png
cache-control: max-age=315360000
strict-transport-security: max-age=15768000
accept-ranges: bytes
content-length: 5022
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 IRANSansWeb_Medium.woff2
covid19.safarbooking.com/assets/fonts/woff2/ 26 KB
27 KB 92ms
91ms Font
application/octet-stream 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to

Full URL

https://covid19.safarbooking.com/assets/fonts/woff2/IRANSansWeb_Medium.woff2

Requested by

Host: covid19.safarbooking.com
URL: https://covid19.safarbooking.com/assets/css/style.css

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

5e8559023c88d8bd7c7c91c55f05d89620c836c37cf7a49f33212b966efed2ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

Origin: https://covid19.safarbooking.com
Referer: https://covid19.safarbooking.com/assets/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:48 GMT
last-modified: Thu, 19 Nov 2020 10:51:28 GMT
server: Microsoft-IIS/10.0
etag: "5fb64e30-6980"
x-frame-options: DENY
content-type: application/octet-stream
strict-transport-security: max-age=15768000
accept-ranges: bytes
content-length: 27008

GET
H2 200 IRANSansWeb.woff2
covid19.safarbooking.com/assets/fonts/woff2/ 31 KB
31 KB 94ms
94ms Font
application/octet-stream 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to

Full URL

https://covid19.safarbooking.com/assets/fonts/woff2/IRANSansWeb.woff2

Requested by

Host: covid19.safarbooking.com
URL: https://covid19.safarbooking.com/assets/css/style.css

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

f8d61fa1ee0a23f68a0322d69d7c67263f9e0b3786015752b4daf5fb4f21bf9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

Origin: https://covid19.safarbooking.com
Referer: https://covid19.safarbooking.com/assets/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:48 GMT
last-modified: Thu, 19 Nov 2020 10:51:28 GMT
server: Microsoft-IIS/10.0
etag: "5fb64e30-7b4c"
x-frame-options: DENY
content-type: application/octet-stream
strict-transport-security: max-age=15768000
accept-ranges: bytes
content-length: 31564

GET
H2 200 IRANSansWeb_Bold.woff2
covid19.safarbooking.com/assets/fonts/woff2/ 29 KB
29 KB 98ms
98ms Font
application/octet-stream 164.138.20.117
RAV-NET-01

General

Check archive.org

Show headers Download Go to

Full URL

https://covid19.safarbooking.com/assets/fonts/woff2/IRANSansWeb_Bold.woff2

Requested by

Host: covid19.safarbooking.com
URL: https://covid19.safarbooking.com/assets/css/style.css

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

164.138.20.117 Tehran, Iran, Islamic Republic Of, ASN59431 (RAV-NET-01, IR),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

d8ec49de9c004f18b228d28027b6f25dd854da6aa5f9b901777e593c59371ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Request headers

Origin: https://covid19.safarbooking.com
Referer: https://covid19.safarbooking.com/assets/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 11:17:48 GMT
last-modified: Thu, 19 Nov 2020 10:51:28 GMT
server: Microsoft-IIS/10.0
etag: "5fb64e30-73fc"
x-frame-options: DENY
content-type: application/octet-stream
strict-transport-security: max-age=15768000
accept-ranges: bytes
content-length: 29692

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			covid19.safarbooking.com/	1970-01-19 14:03:11	Name: ci_session Value: oe18vl6jb8pk1rolgrq6beckqih5pebv

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

covid19.safarbooking.com
164.138.20.117
162c9877a7f9663ccd9ecc178414c980a7e13c841a22c634f2767458648e98ce
5e8559023c88d8bd7c7c91c55f05d89620c836c37cf7a49f33212b966efed2ff
5ee2ebf07e7d323cf5460469dc9a1956a53c38f0003acd80f3e7db323cb4f718
d8ec49de9c004f18b228d28027b6f25dd854da6aa5f9b901777e593c59371ea7
dc90bab7a451f2052f3023bac62f022c48b94bd1923fb46905ccd6e8d82d0efb
e3e5f35d586c0e6a9a9d7187687be087580c40a5f8d0e52f0c4053bbc25c98db
e87d1f497e5e1cf8d4085b802f4040e2cc9f74f73f6b0e766c51ce62a5318491
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f8d61fa1ee0a23f68a0322d69d7c67263f9e0b3786015752b4daf5fb4f21bf9d
fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f

covid19.safarbooking.com Open in urlscan Pro 164.138.20.117 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

165 kBTransfer

409 kBSize

1 Cookies

1 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

covid19.safarbooking.com Open in urlscan Pro
164.138.20.117 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

165 kB
Transfer

409 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions