booking.extranprivacy.com Open in urlscan Pro
104.21.81.6  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response booking.extranprivacy.com/	306 KB 33 KB	976ms 634ms	Document text/html	104.21.81.6 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.81.6 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b94abe7257faae6d3334de4abe4e0d89b938d53ca66e022214f840c2aeb31cad Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8621da75cdbf4229-EWR content-encoding br content-type text/html; charset=UTF-8 date Sun, 10 Mar 2024 08:14:49 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hGMv6W1zABNG5WosOijMQx%2B2sD0AWw9vjtNxVRSuuDi7xJ4R59U4A3aVSzLFiz%2Ffb2vetTPmvK%2BialVKhyHU7GYp4Oe%2FiVopc1rrPEZHF7OE%2Ban%2FX%2BsECWIoKHd2eMwlMLZAWCQD6SCoqODc"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	416_1975cbc2f7eaad75f590.css cf.bstatic.com/psb/accountsportal/assets/	90 KB 91 KB	483ms 80ms	Stylesheet text/css	3.162.3.84 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cf.bstatic.com/psb/accountsportal/assets/416_1975cbc2f7eaad75f590.css Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.162.3.84 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-162-3-84.yul62.r.cloudfront.net Software AmazonS3 / Resource Hash 2d74100a825fc1a4af9272c442187ca4005d0dc1b7b8b61066e02059ada4ab13 Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 08:15:55 GMT via 1.1 327dc9ff74acc5a845efbe2daefaec7a.cloudfront.net (CloudFront) last-modified Tue, 28 Nov 2023 09:18:01 GMT server AmazonS3 x-amz-cf-pop YUL62-P2 age 86336 etag "d2e841cb3b0b0274a4196fd767d65edb" x-amz-server-side-encryption AES256 vary Origin x-cache Hit from cloudfront content-type text/css accept-ranges bytes content-length 92562 x-amz-cf-id prHiBtQBzlAhFPBp3pZ02n0nZR7YZY_ZOg7bbJSELyG7HKTSDqzDCg==
GET H2	200	549_473af0c65e95a32c7dab.css cf.bstatic.com/psb/accountsportal/assets/	73 KB 73 KB	460ms 57ms	Stylesheet text/css	3.162.3.84 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cf.bstatic.com/psb/accountsportal/assets/549_473af0c65e95a32c7dab.css Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.162.3.84 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-162-3-84.yul62.r.cloudfront.net Software AmazonS3 / Resource Hash dc40e27fb7e4940d78a22d31e49117ef41cb241f0a4c8a8b20c6e072bf66a3c6 Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 08:15:55 GMT via 1.1 327dc9ff74acc5a845efbe2daefaec7a.cloudfront.net (CloudFront) last-modified Tue, 28 Nov 2023 09:18:02 GMT server AmazonS3 x-amz-cf-pop YUL62-P2 age 86336 etag "7adaf892d5693d25b895600b85072e74" x-amz-server-side-encryption AES256 vary Origin x-cache Hit from cloudfront content-type text/css accept-ranges bytes content-length 74320 x-amz-cf-id kGW01dqW92zybB8Z4PfJvlUNWOgRCPBgoh-HoJFdJ5-X_jmEPs7OEQ==
GET H2	200	826_253079e92c11f7fb46bd.css cf.bstatic.com/psb/accountsportal/assets/	59 KB 60 KB	430ms 28ms	Stylesheet text/css	3.162.3.84 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cf.bstatic.com/psb/accountsportal/assets/826_253079e92c11f7fb46bd.css Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.162.3.84 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-162-3-84.yul62.r.cloudfront.net Software AmazonS3 / Resource Hash f6cf3b2e7de29f886185bc35d78511d7be137ef2d9193b8262c495acdb85a5a0 Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 08:15:55 GMT via 1.1 327dc9ff74acc5a845efbe2daefaec7a.cloudfront.net (CloudFront) last-modified Tue, 28 Nov 2023 09:18:02 GMT server AmazonS3 x-amz-cf-pop YUL62-P2 age 86336 etag "cc544e33fc1537b047f5a3aea46ef0be" x-amz-server-side-encryption AES256 vary Origin x-cache Hit from cloudfront content-type text/css accept-ranges bytes content-length 60864 x-amz-cf-id k0u56Z25jPHtLLD9WJiBcFgbCHq2IhgXaMqHN-pcpibwu8gw19hPJA==
GET H2	200	asset.76f4cfe389ea593cf33909bbcedb7949.js Show response saa.booking.com/	39 KB 13 KB	502ms 418ms	Script application/javascript	3.162.3.59 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://saa.booking.com/asset.76f4cfe389ea593cf33909bbcedb7949.js Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.162.3.59 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-162-3-59.yul62.r.cloudfront.net Software Perl Dancer2 0.300004 / Resource Hash 950d7028921f91f48d3242b0eace0b1a0be2e3290714014a3025953c44facb32 Security Headers Name Value Strict-Transport-Security max-age=604800; includeSubDomains X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sun, 10 Mar 2024 08:14:50 GMT content-encoding gzip via 1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront) strict-transport-security max-age=604800; includeSubDomains x-amz-cf-pop YUL62-P2 x-cache Miss from cloudfront content-length 12485 x-xss-protection 1; mode=block last-modified Mon, 30 Sep 2013 09:36:48 GMT server Perl Dancer2 0.300004 etag 76f4cfe389ea593cf33909bbcedb7949 vary Accept-Encoding content-type application/javascript cache-control public, max-age=31536000 x-amz-cf-id 4gcX1TpS9yW7IRSdiVc0MC4VYnbpAB-FEj5Bpzs5CSIn1jB63oqAuA== expires Tue, 31 Dec 2030 23:30:45 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	914ms 21ms	Script text/javascript	142.251.167.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.167.100 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS ww-in-f100.1e100.net Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Sun, 10 Mar 2024 06:41:56 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 5575 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Sun, 10 Mar 2024 08:41:56 GMT
GET H2	200	px.v7.5.3.min.js Show response q.bstatic.com/libs/asec/btmgmt/	269 KB 99 KB	434ms 26ms	Script application/javascript	3.162.3.129 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://q.bstatic.com/libs/asec/btmgmt/px.v7.5.3.min.js Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.162.3.129 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-162-3-129.yul62.r.cloudfront.net Software nginx / Resource Hash 0e3cd6436c3188852c7bc0a21b4c6789c22306fe5f5d64c1507d9f24590f7670 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://booking.extranprivacy.com/ Origin https://booking.extranprivacy.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Tue, 20 Feb 2024 10:03:32 GMT content-encoding br via 1.1 bf162a8b9bcf17e02f2843479d4278e2.cloudfront.net (CloudFront) nel {"report_to":"default","max_age":600} x-amz-cf-pop YUL62-P2 age 1635078 x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Wed, 31 Jan 2024 09:24:57 GMT server nginx etag W/"65ba11e9-4335e" vary Accept-Encoding report-to {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} content-type application/javascript access-control-allow-origin * cache-control max-age=2592000 timing-allow-origin * x-amz-cf-id XXY0cfJz-tvFkZArcBLwRpe5ctJzcsF28M-SbSOGh3cfqGAuf_UbtA== expires Thu, 21 Mar 2024 10:03:32 GMT
POST H2	200	collector Show response collector-pxikkul2rm.px-cloud.net/api/v2/	539 B 790 B	70ms 43ms	XHR application/json	35.190.10.96 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://collector-pxikkul2rm.px-cloud.net/api/v2/collector Requested by Host: q.bstatic.com URL: https://q.bstatic.com/libs/asec/btmgmt/px.v7.5.3.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 96.10.190.35.bc.googleusercontent.com Software / Resource Hash 269281c539330d9944c4f5865e8393aa49a786690d3fe3ab85b9ae3694890c16 Request headers Referer https://booking.extranprivacy.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Sun, 10 Mar 2024 08:14:49 GMT via 1.1 google access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE content-type application/json; charset=utf-8 access-control-allow-origin https://booking.extranprivacy.com access-control-allow-credentials true timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 539
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	595ms 15ms	Script text/javascript	142.251.167.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.167.100 Farmingdale, United States, ASN15169 (GOOGLE, US), Reverse DNS ww-in-f100.1e100.net Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Sun, 10 Mar 2024 06:41:56 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 5575 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Sun, 10 Mar 2024 08:41:56 GMT
GET H2	200	925_946cf100110ca1d365b2.js Show response cf.bstatic.com/psb/accountsportal/assets/	322 KB 323 KB	25ms 25ms	Script application/javascript	3.162.3.84 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cf.bstatic.com/psb/accountsportal/assets/925_946cf100110ca1d365b2.js Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.162.3.84 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-162-3-84.yul62.r.cloudfront.net Software AmazonS3 / Resource Hash 3b7358bfce3de8628b41c4cc5c16e0cf066987982d0de773f9d1acf7af403917 Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sat, 09 Mar 2024 08:15:55 GMT via 1.1 327dc9ff74acc5a845efbe2daefaec7a.cloudfront.net (CloudFront) last-modified Tue, 21 Nov 2023 10:06:58 GMT server AmazonS3 x-amz-cf-pop YUL62-P2 age 86336 etag "d87554c4a30570d493203c517a40f340" x-amz-server-side-encryption AES256 vary Origin x-cache Hit from cloudfront x-amz-meta-x-deployment-hash ee7ab0e25154ef4a78b71406e457af1bd88253723856b487486a67726e83d9da content-type application/javascript accept-ranges bytes content-length 329710 x-amz-cf-id z1TxawSBdMnMxCpM4rT9qU8TucyUSKMDX7gyoixEu8v1MTk6SXG_5g==
GET H2	200	jquery.min.js Show response snipp.ru/cdn/jquery/2.1.1/	82 KB 29 KB	2924ms 133ms	Script application/x-javascript	45.130.41.42 BEGET-AS
General Check archive.org Show headers Download Go to Full URL https://snipp.ru/cdn/jquery/2.1.1/jquery.min.js Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 45.130.41.42 St Petersburg, Russian Federation, ASN198610 (BEGET-AS, RU), Reverse DNS ssl.thomas.beget.com Software nginx-reuseport/1.21.1 / Resource Hash 874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4 Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sun, 10 Mar 2024 08:14:53 GMT content-encoding gzip last-modified Tue, 29 Sep 2020 19:42:10 GMT server nginx-reuseport/1.21.1 etag W/"5f738e12-14915" vary Accept-Encoding content-type application/x-javascript cache-control max-age=604800 expires Sun, 17 Mar 2024 08:14:53 GMT
GET H2	200	fvtrpw.gif account.booking.com/_/	35 B 2 KB	796ms 218ms	Image image/gif	3.161.213.128 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://account.booking.com/_/fvtrpw.gif Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.161.213.128 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-161-213-128.yul62.r.cloudfront.net Software envoy / Resource Hash 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39 Security Headers Name Value Content-Security-Policy frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=168c39fd5983002c&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19Zyxa7NlRtcqsS_DY8i0BHQh4ZpSzDTCnk Strict-Transport-Security max-age=604800; includeSubDomains X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Sun, 10 Mar 2024 08:14:51 GMT content-security-policy frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=168c39fd5983002c&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19Zyxa7NlRtcqsS_DY8i0BHQh4ZpSzDTCnk via 1.1 0880eac0689b5b1cff547e39e0daa976.cloudfront.net (CloudFront) strict-transport-security max-age=604800; includeSubDomains server envoy x-amz-cf-pop YUL62-P1 content-security-policy-report-only base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com *.perimeterx.net *.pxchk.net *.px-cdn.net *.px-client.net *.px-cloud.net 'self' 'report-sample'; default-src *.bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss *.bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net *.px-cloud.net *.perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=168c39fd5983002c&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19Zyxa7NlRtcqsS_DY8i0BHQh4ZpSzDTCnk; script-src saa.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-WUR0ET6AFrckCmT' 'report-sample'; style-src *.bstatic.com bstatic.com *.static.booking.cn 'self' 'unsafe-inline' x-cache Miss from cloudfront content-type image/gif content-disposition attachment; filename=etnht.gif x-amz-cf-id WUKNilnBgUOV3hmxKwkNIt92JfEjkYjKkHb4bt2N5WiJqXMuJrpxbA== x-xss-protection 1; mode=block
GET H2	200	us.png q-xx.bstatic.com/backend_static/common/flags/new/48-squared/	642 B 1 KB	26ms 25ms	Image image/png	3.162.3.84 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.162.3.84 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-162-3-84.yul62.r.cloudfront.net Software nginx / Resource Hash a333d02eedde7a4dd8643d58b0ea7947268a1762f35f517eb6000ec9e7fcfae8 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://booking.extranprivacy.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Tue, 20 Feb 2024 10:03:36 GMT via 1.1 327dc9ff74acc5a845efbe2daefaec7a.cloudfront.net (CloudFront) nel {"report_to":"default","max_age":600} x-amz-cf-pop YUL62-P2 age 1635074 x-cache Hit from cloudfront content-length 642 x-xss-protection 1; mode=block last-modified Mon, 07 Sep 2020 09:08:23 GMT server nginx etag "5f55f887-282" report-to {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} content-type image/png access-control-allow-origin * cache-control max-age=2592000 accept-ranges bytes timing-allow-origin * x-amz-cf-id 0RHbPDAbzZXrHmWmU9uOk_8kfGlHPxHm3VRoMmAKRN1L9OYfBj9Fag== expires Thu, 21 Mar 2024 10:03:36 GMT
GET H2	200	px.v7.5.3.min.js Show response q.bstatic.com/libs/asec/btmgmt/	269 KB 99 KB	25ms 24ms	Script application/javascript	3.162.3.129 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://q.bstatic.com/libs/asec/btmgmt/px.v7.5.3.min.js Requested by Host: booking.extranprivacy.com URL: https://booking.extranprivacy.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.162.3.129 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-3-162-3-129.yul62.r.cloudfront.net Software nginx / Resource Hash 0e3cd6436c3188852c7bc0a21b4c6789c22306fe5f5d64c1507d9f24590f7670 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://booking.extranprivacy.com/ Origin https://booking.extranprivacy.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Tue, 20 Feb 2024 10:03:32 GMT content-encoding br via 1.1 bf162a8b9bcf17e02f2843479d4278e2.cloudfront.net (CloudFront) nel {"report_to":"default","max_age":600} x-amz-cf-pop YUL62-P2 age 1635082 x-cache Hit from cloudfront x-xss-protection 1; mode=block last-modified Wed, 31 Jan 2024 09:24:57 GMT server nginx etag W/"65ba11e9-4335e" vary Accept-Encoding report-to {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} content-type application/javascript access-control-allow-origin * cache-control max-age=2592000 timing-allow-origin * x-amz-cf-id 44-ZswfI-7EJsT3ZRNxvTF4Y6749KBqcot6gprV1SHnipUE-1bt6ow== expires Thu, 21 Mar 2024 10:03:32 GMT
POST H2	200	collector Show response collector-pxikkul2rm.px-cloud.net/api/v2/	593 B 649 B	58ms 55ms	XHR application/json	35.190.10.96 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://collector-pxikkul2rm.px-cloud.net/api/v2/collector Requested by Host: q.bstatic.com URL: https://q.bstatic.com/libs/asec/btmgmt/px.v7.5.3.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.10.96 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 96.10.190.35.bc.googleusercontent.com Software / Resource Hash 0751deeb3f51f0004d5f038bbdfc3eb1aa7ed3232881836170e7bd785fbd64bc Request headers Referer https://booking.extranprivacy.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Sun, 10 Mar 2024 08:14:54 GMT via 1.1 google access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE content-type application/json; charset=utf-8 access-control-allow-origin https://booking.extranprivacy.com access-control-allow-credentials true timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 593

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Booking (Travel)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| _pxAppId object| PXikKuL2RM object| PX undefined| _ikKuL2RMhandler function| viewDiv function| hideDiv undefined| params undefined| search_params string| GoogleAnalyticsObject function| ga object| webpackChunkbookings_web_accounts_portal_workspaces object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| $ function| jQuery object| $jscomp function| docReady string| _pxParam1

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.extranprivacy.com/	1969-12-31 23:59:59	Name: pxcts Value: 4432fc7f-deb6-11ee-908b-05a7b280e611
			.extranprivacy.com/	1970-01-21 03:46:34	Name: _pxvid Value: 4432effe-deb6-11ee-908b-c518c7d40f86
			booking.extranprivacy.com/	1970-01-20 19:00:58	Name: _pxff_cfp Value: 1
			booking.extranprivacy.com/	1970-01-20 19:00:58	Name: _pxff_ddtc Value: 1
			.extranprivacy.com/	1970-01-21 04:36:58	Name: _ga Value: GA1.2.1468213825.1710058491
			.extranprivacy.com/	1970-01-20 19:02:24	Name: _gid Value: GA1.2.1806926904.1710058491
			.extranprivacy.com/	1970-01-20 19:00:58	Name: _px3 Value: 65169e264e0c58fa05aa052e13a6e743fe04ad2d52020d25bd3466846b6ca164:UaYq0aEjicS2FpR+1/T0UwZsS8prWcO5hetuG3QZ7ngGrNsGxrMoBzQVw+IM6Bv8nE7hM5fgFncnb6JvLWpPNA==:1000:MmnV/81jBMPR/153TuVoW0Q6VGI+OFs1RLJksPA4axVZEgZ37YJ8A09jcWAdriWsafWptSGJdNUWH1bDQZGSMhtcXTmGDdcrc07sU2fCLGU3y43g/tKntP7zq5+k7jmrY/TTC8ls6TiwIh5mu/s3xSlRwm3vcCL3t72dJE0O9feA6f1nYtmQk/4ObVMDmJw0YOM3tOBZbcsRiZZd8OBoKHjzdH++xNVmjrrhF8vB9y8=
			.extranprivacy.com/	1970-01-20 19:00:58	Name: _pxde Value: 090b60f8b954b81c114a0f4761742a6f8c4d3731c55c3611c792d7d5b85763ca:eyJ0aW1lc3RhbXAiOjE3MTAwNTg0OTUyNTAsImZfa2IiOjAsImlwY19pZCI6W119

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.booking.com
booking.extranprivacy.com
cf.bstatic.com
collector-pxikkul2rm.px-cloud.net
q-xx.bstatic.com
q.bstatic.com
saa.booking.com
snipp.ru
www.google-analytics.com
104.21.81.6
142.251.167.100
3.161.213.128
3.162.3.129
3.162.3.59
3.162.3.84
35.190.10.96
45.130.41.42
0751deeb3f51f0004d5f038bbdfc3eb1aa7ed3232881836170e7bd785fbd64bc
0e3cd6436c3188852c7bc0a21b4c6789c22306fe5f5d64c1507d9f24590f7670
269281c539330d9944c4f5865e8393aa49a786690d3fe3ab85b9ae3694890c16
2d74100a825fc1a4af9272c442187ca4005d0dc1b7b8b61066e02059ada4ab13
3b7358bfce3de8628b41c4cc5c16e0cf066987982d0de773f9d1acf7af403917
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
950d7028921f91f48d3242b0eace0b1a0be2e3290714014a3025953c44facb32
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
a333d02eedde7a4dd8643d58b0ea7947268a1762f35f517eb6000ec9e7fcfae8
b94abe7257faae6d3334de4abe4e0d89b938d53ca66e022214f840c2aeb31cad
dc40e27fb7e4940d78a22d31e49117ef41cb241f0a4c8a8b20c6e072bf66a3c6
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
f6cf3b2e7de29f886185bc35d78511d7be137ef2d9193b8262c495acdb85a5a0