www.booking.hx.nu Open in urlscan Pro
89.221.250.33 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.booking.hx.nu/
Submission: On April 06 via automatic, source certstream-suspicious (April 6th 2020, 12:30:03 pm UTC)

Summary HTTP 13 Redirects Links 9 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 89.221.250.33, located in Sweden and belongs to TELE2, SE. The main domain is www.booking.hx.nu.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 7th 2020. Valid for: 3 months.

This is the only time www.booking.hx.nu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1	89.221.250.33 89.221.250.33		1257 (TELE2) (TELE2)
1	2a00:1450:400... 2a00:1450:4001:816::200a		15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81d::2008		15169 (GOOGLE) (GOOGLE)
13	4

1 89.221.250.33 (Sweden)

ASN1257 (TELE2, SE)
PTR: www001.aname.net

www.booking.hx.nu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	google-analytics.com ssl.google-analytics.com	17 KB
1	googleapis.com fonts.googleapis.com	642 B
1	hx.nu www.booking.hx.nu	3 KB
0	planetscolonies.com Failed www.planetscolonies.com Failed
13	4

	Domain	Requested by
2	ssl.google-analytics.com	www.booking.hx.nu
1	fonts.googleapis.com	www.booking.hx.nu
1	www.booking.hx.nu
0	www.planetscolonies.com Failed	www.booking.hx.nu
13	4

This site contains links to these domains. Also see Links.

Domain
www.planetscolonies.com
planetscolonies.com

Subject Issuer	Validity	Valid
booking.hx.nu Let's Encrypt Authority X3	`2020-02-07` - `2020-05-07`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.booking.hx.nu/
Frame ID: 5350BA89D5A6F78CEB722D6CA5DB1FFF
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
html /<!--[^>]+WP-Super-Cache/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
html /<!--[^>]+WP-Super-Cache/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
html /<!--[^>]+WP-Super-Cache/i

WordPress Super Cache (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

html /<!--[^>]+WP-Super-Cache/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

13
Requests

31 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

21 kB
Transfer

56 kB
Size

5
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.planetscolonies.com/
Title: Planets: Colonies II

Search URL Search Domain Scan URL

URL: https://www.planetscolonies.com/introduction/
Title: 1: Introduction – Welcome to Planets: Colonies!

Search URL Search Domain Scan URL

URL: https://www.planetscolonies.com/how-do-i-get-started/
Title: 2: How Do I Get Started?

Search URL Search Domain Scan URL

URL: https://www.planetscolonies.com/rules/
Title: 3: The Rules

Search URL Search Domain Scan URL

URL: https://www.planetscolonies.com/backstory/
Title: 4: Backstory & Setting

Search URL Search Domain Scan URL

URL: https://www.planetscolonies.com/devicium-what-does-it-do/
Title: 5: Devicium – What Does It Do?

Search URL Search Domain Scan URL

URL: https://www.planetscolonies.com/combat-espionage-guide/
Title: 6: Combat & Espionage Guide

Search URL Search Domain Scan URL

URL: http://planetscolonies.com/forum/index.php?sid=0d4ba56563200a242d57486d43f84f47
Title: Forum

Search URL Search Domain Scan URL

URL: https://www.planetscolonies.com/2013/10/work-in-progress/
Title: Work In Progress...

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.booking.hx.nu/ 8 KB
3 KB 299ms
60ms Document
text/html 89.221.250.33
TELE2

General

Check archive.org

Show headers Download Go to

Full URL: https://www.booking.hx.nu/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 89.221.250.33 , Sweden, ASN1257 (TELE2, SE),
Reverse DNS: www001.aname.net
Software: Apache /
Resource Hash: 59d98765a3ce0ca8e164b6d2dcf6e0f14fbde15a0231fed4af337a9d4ab2a332

Request headers

Host: www.booking.hx.nu
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Mon, 06 Apr 2020 12:29:42 GMT
Server: Apache
Vary: Accept-Encoding,Cookie
Cache-Control: max-age=3, must-revalidate
WP-Super-Cache: Served supercache file from PHP
Content-Encoding: gzip
Keep-Alive: timeout=5, max=200
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET autoptimize_fc5e81e1367a0b27c3fe138ccce85f6f.php
www.planetscolonies.com/wp-content/cache/autoptimize/ 0
0

GET
H2 200 css
fonts.googleapis.com/ 2 KB
642 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:816::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Ubuntu+Condensed&ver=4.7.7

Requested by

Host: www.booking.hx.nu
URL: https://www.booking.hx.nu/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b5c9af7ba728ed18a351bc388654fbab98bdb8dcb93ce0ab911801c44a38e750

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.booking.hx.nu/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 06 Apr 2020 12:29:43 GMT
server: ESF
date: Mon, 06 Apr 2020 12:29:43 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 06 Apr 2020 12:29:43 GMT

GET jquery.js
www.planetscolonies.com/wp-includes/js/jquery/ 0
0

GET jquery-migrate.min.js
www.planetscolonies.com/wp-includes/js/jquery/ 0
0

GET jscripts.php
www.planetscolonies.com/wp-content/plugins/wp-spamshield/js/ 0
0

GET Test1.1.jpg
www.planetscolonies.com/wp-content/uploads/2015/02/ 0
0

GET Test2.1.jpg
www.planetscolonies.com/wp-content/uploads/2015/02/ 0
0

GET Test3.1.jpg
www.planetscolonies.com/wp-content/uploads/2015/02/ 0
0

GET jscripts-ftr-min.js
www.planetscolonies.com/wp-content/plugins/wp-spamshield/js/ 0
0

GET autoptimize_010342fa162d8f77a66f3f85b98ab481.php
www.planetscolonies.com/wp-content/cache/autoptimize/ 0
0

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: www.booking.hx.nu
URL: https://www.booking.hx.nu/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.booking.hx.nu/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 6903
date: Mon, 06 Apr 2020 10:34:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 17168
expires: Mon, 06 Apr 2020 12:34:40 GMT

GET
H2 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
101 B 14ms
14ms Image
image/gif 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1882576541&utmhn=www.booking.hx.nu&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Planets%3A%20Colonies%20II%20-%20Tales%20of%20Greed%20and%20Devicium&utmhid=354375889&utmr=-&utmp=%2F&utmht=1586176183067&utmac=UA-45425927-1&utmdid=i9k95&utmcc=__utma%3D186256058.1526074641.1586176183.1586176183.1586176183.1%3B%2B__utmz%3D186256058.1586176183.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=734269912&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: www.booking.hx.nu
URL: https://www.booking.hx.nu/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.booking.hx.nu/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 06 Apr 2020 12:29:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.planetscolonies.com
URL: https://www.planetscolonies.com/wp-content/cache/autoptimize/autoptimize_fc5e81e1367a0b27c3fe138ccce85f6f.php

Domain: www.planetscolonies.com
URL: https://www.planetscolonies.com/wp-includes/js/jquery/jquery.js?ver=1.12.4

Domain: www.planetscolonies.com
URL: https://www.planetscolonies.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1

Domain: www.planetscolonies.com
URL: https://www.planetscolonies.com/wp-content/plugins/wp-spamshield/js/jscripts.php

Domain: www.planetscolonies.com
URL: http://www.planetscolonies.com/wp-content/uploads/2015/02/Test1.1.jpg

Domain: www.planetscolonies.com
URL: http://www.planetscolonies.com/wp-content/uploads/2015/02/Test2.1.jpg

Domain: www.planetscolonies.com
URL: http://www.planetscolonies.com/wp-content/uploads/2015/02/Test3.1.jpg

Domain: www.planetscolonies.com
URL: https://www.planetscolonies.com/wp-content/plugins/wp-spamshield/js/jscripts-ftr-min.js

Domain: www.planetscolonies.com
URL: https://www.planetscolonies.com/wp-content/cache/autoptimize/autoptimize_010342fa162d8f77a66f3f85b98ab481.php

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| _gaq string| r3f5x9JS string| hf4N string| hf4V object| _gat object| gaGlobal

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.booking.hx.nu/	1970-01-19 08:36:16	Name: __utmt Value: 1
			.booking.hx.nu/	1970-01-19 08:36:17	Name: __utmb Value: 186256058.1.10.1586176183
			.booking.hx.nu/	1970-01-19 12:59:04	Name: __utmz Value: 186256058.1586176183.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
			.booking.hx.nu/	1969-12-31 23:59:59	Name: __utmc Value: 186256058
			.booking.hx.nu/	1970-01-20 02:07:28	Name: __utma Value: 186256058.1526074641.1586176183.1586176183.1586176183.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
ssl.google-analytics.com
www.booking.hx.nu
www.planetscolonies.com
www.planetscolonies.com
2a00:1450:4001:816::200a
2a00:1450:4001:81d::2008
89.221.250.33
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
59d98765a3ce0ca8e164b6d2dcf6e0f14fbde15a0231fed4af337a9d4ab2a332
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
b5c9af7ba728ed18a351bc388654fbab98bdb8dcb93ce0ab911801c44a38e750