![](/screenshots/9005f1b4-5aff-45ca-926b-a286c0fd8a85.png)
booking.policy-secure.com
Open in
urlscan Pro
2606:4700:3037::ac43:8ee0
Malicious Activity!
Public Scan
Submission: On January 03 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on December 19th 2023. Valid for: 3 months.
This is the only time booking.policy-secure.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Booking (Travel)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
16 | 2606:4700:303... 2606:4700:3037::ac43:8ee0 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:212... 2600:9000:2127:800:5:bf05:acc0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 2606:4700:10:... 2606:4700:10::6816:1490 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2606:4700::68... 2606:4700::6810:7caf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::200a | 15169 (GOOGLE) (GOOGLE) | |
21 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
policy-secure.com
booking.policy-secure.com |
66 KB |
2 |
unpkg.com
1 redirects
unpkg.com — Cisco Umbrella Rank: 1326 |
13 KB |
2 |
tailwindcss.com
1 redirects
cdn.tailwindcss.com — Cisco Umbrella Rank: 57927 |
108 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 115 |
1 KB |
1 |
bstatic.com
q-xx.bstatic.com — Cisco Umbrella Rank: 17272 |
107 KB |
21 | 5 |
Domain | Requested by | |
---|---|---|
16 | booking.policy-secure.com |
booking.policy-secure.com
unpkg.com |
2 | unpkg.com |
1 redirects
booking.policy-secure.com
|
2 | cdn.tailwindcss.com |
1 redirects
booking.policy-secure.com
|
1 | fonts.googleapis.com |
booking.policy-secure.com
|
1 | q-xx.bstatic.com |
booking.policy-secure.com
|
21 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
policy-secure.com GTS CA 1P5 |
2023-12-19 - 2024-03-18 |
3 months | crt.sh |
*.bstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-11-29 - 2024-11-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://booking.policy-secure.com/p/255823090
Frame ID: D69F130A6CD305C6658FE4F21987B83F
Requests: 7 HTTP requests in this frame
Frame:
https://booking.policy-secure.com/supportChatFrame/255823090
Frame ID: BB65ADEAC21EF3D81259B6604E20F320
Requests: 14 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://cdn.tailwindcss.com/ HTTP 302
- https://cdn.tailwindcss.com/3.4.0
- https://unpkg.com/axios/dist/axios.min.js HTTP 302
- https://unpkg.com/axios@1.6.3/dist/axios.min.js
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
255823090
booking.policy-secure.com/p/ |
57 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
booking.policy-secure.com/services/booking/js/ |
12 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
booking.policy-secure.com/services/booking/css/ |
32 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
81730921.jpg
q-xx.bstatic.com/xdata/images/hotel/max1024x768/ |
106 KB 107 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
support_parent.css
booking.policy-secure.com/css/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
255823090
booking.policy-secure.com/supportChatFrame/ Frame BB65 |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flags.png
booking.policy-secure.com/services/booking/images/ |
30 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pluxurydarklord.svg
booking.policy-secure.com/img/ |
1 KB 996 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chat.css
booking.policy-secure.com/assets/css/ Frame BB65 |
243 B 524 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.4.0
cdn.tailwindcss.com/ Frame BB65 Redirect Chain
|
358 KB 108 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bookmark.svg
booking.policy-secure.com/assets/icons/ Frame BB65 |
247 B 631 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chevron-down.svg
booking.policy-secure.com/assets/icons/ Frame BB65 |
231 B 543 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
close.svg
booking.policy-secure.com/assets/icons/ Frame BB65 |
230 B 699 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
person-circle.svg
booking.policy-secure.com/assets/icons/ Frame BB65 |
563 B 846 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
document.svg
booking.policy-secure.com/assets/icons/ Frame BB65 |
339 B 735 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
send.svg
booking.policy-secure.com/assets/icons/ Frame BB65 |
402 B 766 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
unpkg.com/axios@1.6.3/dist/ Frame BB65 Redirect Chain
|
33 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chat.js
booking.policy-secure.com/assets/js/ Frame BB65 |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ Frame BB65 |
14 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
booking.policy-secure.com/api/support/ Frame BB65 |
577 B 827 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
getMessages
booking.policy-secure.com/api/support/ Frame BB65 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- booking.policy-secure.com
- URL
- https://booking.policy-secure.com/api/support/getMessages
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Booking (Travel)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| documentPictureInPicture1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
booking.policy-secure.com/ | Name: connect.sid Value: s%3A9bmeKchKatyjIbZE-5F6ztGwJk6ws0Xl.FzHk57hhfmoFt3mTReN7tuAN7S4DfhZXpDpoDuYvQns |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
booking.policy-secure.com
cdn.tailwindcss.com
fonts.googleapis.com
q-xx.bstatic.com
unpkg.com
booking.policy-secure.com
2600:9000:2127:800:5:bf05:acc0:93a1
2606:4700:10::6816:1490
2606:4700:3037::ac43:8ee0
2606:4700::6810:7caf
2a00:1450:4001:806::200a
0282adc43b576a263e038d53053446efc5459d2f44ec69e8663291ad9cf0d41b
1d3af5838269f41ffd019f04eefcf2b494953d28fb1401acfbfa4ec55c57d515
1fce0beadbc7270cf55beebaee126f85f63a9bb25e35c2b02c12e30e3ecb4a41
20f5cc0ebb84eb9bdeb82a9b908e9f922ab10ea415857c8b00b8302e00c61a5c
2cdd009888f8087c718c5bda1bf754bc57a66717675d0a58229db1287fe1652a
3a08df88bf98ff7398eddb4aacf63b7a2ceef99b7ea7d756b00591390b1f08a5
548d3fcf016980e21a6c570c4a483bbdd7a94e3034f04dd30c4c1bd07a0cf653
846a64b15537fd60cbebc9dbdca9a2df72aa05a6e564210f78acfd701a386ef7
97d008f0efeb03337a4a169d85b9f8907ef5d6dcb74fb88f7e2f981250903349
9a60eed802ef3d6b6784369cf91a4be28f925fa426293244ad43b9d2868f2988
a140484b48096baf0db17d9db57a330c818b6bca7607152884b2eefce4e02b87
b2e3158656f24d0f69988896ea2facd530904745d286f84eadb67ceb2ce9d4c2
b4784b8b0b3e2cfefe7106fea734e0a37df601a093d8bdb1aa3ee5216716546b
ba643f1bfafb283772f97877bca3896472fd7c39ccef5df329b69110170eeebd
c5e7e8f07db5f90f5b179d122a425eacb8e7b0b57e79349f6e414158d3db0f77
d7a5152180593b0144e6a36c21ca0e19aa9a64da790d7a1d14f0cbe49d45525a
d8e5d42e50fb2431310f365785619e52687fd5f77455fa79f68009d6ee99db3d
f8cbafd49c896a6e02a3a959409874806cff8792343936c0ba532f58ecc95333
fbb307bc48c763f9a4893ba918ca9a322f4e084dbb994504d526af90c1a4d1e9
fc78e1550450ab81964ef660b05cb14fb17e0b895b261925ad7e6e073502dfc4