![](/screenshots/e9a11a25-9e7b-4896-86ac-980a03a4139d.png)
property.67851l.com
Open in
urlscan Pro
2606:4700:3037::ac43:c4c7
Malicious Activity!
Public Scan
Effective URL: https://property.67851l.com/227276035
Submission: On February 04 via api from US — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on February 2nd 2024. Valid for: 3 months.
This is the only time property.67851l.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Booking (Travel)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3034::6815:cf8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 23 | 2606:4700:303... 2606:4700:3037::ac43:c4c7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:9000:26a... 2600:9000:26a0:9200:5:bf05:acc0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 2606:4700:10:... 2606:4700:10::ac43:2910 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2606:4700::68... 2606:4700::6810:7baf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c09::5f | 15169 (GOOGLE) (GOOGLE) | |
25 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
67851l.com
3 redirects
property.67851l.com |
79 KB |
2 |
unpkg.com
1 redirects
unpkg.com — Cisco Umbrella Rank: 867 |
15 KB |
2 |
tailwindcss.com
1 redirects
cdn.tailwindcss.com — Cisco Umbrella Rank: 46008 |
109 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 28 |
1 KB |
1 |
bstatic.com
q-xx.bstatic.com — Cisco Umbrella Rank: 15869 |
132 KB |
25 | 5 |
Domain | Requested by | |
---|---|---|
24 | property.67851l.com |
3 redirects
property.67851l.com
unpkg.com |
2 | unpkg.com |
1 redirects
property.67851l.com
|
2 | cdn.tailwindcss.com |
1 redirects
property.67851l.com
|
1 | fonts.googleapis.com |
property.67851l.com
|
1 | q-xx.bstatic.com |
property.67851l.com
|
25 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
67851l.com GTS CA 1P5 |
2024-02-02 - 2024-05-02 |
3 months | crt.sh |
*.bstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-11-29 - 2024-11-28 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-01-09 - 2024-04-02 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://property.67851l.com/227276035
Frame ID: E8A892D8BF29610360E2A8F684CFFDAC
Requests: 7 HTTP requests in this frame
Frame:
https://property.67851l.com/supportChatFrame/227276035
Frame ID: BF3E1C69CCC711FCC2AE2B9026889D70
Requests: 14 HTTP requests in this frame
Frame:
https://property.67851l.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/24864818/main.js
Frame ID: FEBC9A9A45509D89320FECB76A7AB92E
Requests: 2 HTTP requests in this frame
Frame:
https://property.67851l.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/24864818/main.js
Frame ID: 42A1C3E05C3E00E04B2AB9756713C447
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/e9a11a25-9e7b-4896-86ac-980a03a4139d.png)
Page Title
Booking.com - Payment informationPage URL History Show full URLs
-
http://property.67851l.com/227276035
HTTP 301
https://property.67851l.com/227276035 Page URL
Detected technologies
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://property.67851l.com/227276035
HTTP 301
https://property.67851l.com/227276035 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- https://property.67851l.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://property.67851l.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/24864818/main.js
- https://cdn.tailwindcss.com/ HTTP 302
- https://cdn.tailwindcss.com/3.4.1
- https://unpkg.com/axios/dist/axios.min.js HTTP 302
- https://unpkg.com/axios@1.6.7/dist/axios.min.js
- https://property.67851l.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://property.67851l.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/24864818/main.js
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
227276035
property.67851l.com/ Redirect Chain
|
58 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
property.67851l.com/services/booking/js/ |
12 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
property.67851l.com/services/booking/css/ |
32 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
335279500.jpg
q-xx.bstatic.com/xdata/images/hotel/max1024x768/ |
131 KB 132 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
support_parent.css
property.67851l.com/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
227276035
property.67851l.com/supportChatFrame/ Frame BF3E |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flags.png
property.67851l.com/services/booking/images/ |
30 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pluxurydarklord.svg
property.67851l.com/img/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
property.67851l.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/24864818/ Frame FEBC Redirect Chain
|
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
8506609ee804747a
property.67851l.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame FEBC |
0 600 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chat.css
property.67851l.com/assets/css/ Frame BF3E |
243 B 685 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.4.1
cdn.tailwindcss.com/ Frame BF3E Redirect Chain
|
359 KB 109 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bookmark.svg
property.67851l.com/assets/icons/ Frame BF3E |
247 B 672 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chevron-down.svg
property.67851l.com/assets/icons/ Frame BF3E |
231 B 662 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
close.svg
property.67851l.com/assets/icons/ Frame BF3E |
230 B 652 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
person-circle.svg
property.67851l.com/assets/icons/ Frame BF3E |
563 B 846 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
document.svg
property.67851l.com/assets/icons/ Frame BF3E |
339 B 724 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
send.svg
property.67851l.com/assets/icons/ Frame BF3E |
402 B 765 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
unpkg.com/axios@1.6.7/dist/ Frame BF3E Redirect Chain
|
40 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chat.js
property.67851l.com/assets/js/ Frame BF3E |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ Frame BF3E |
14 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
property.67851l.com/api/support/ Frame BF3E |
655 B 868 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
property.67851l.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/24864818/ Frame 42A1 Redirect Chain
|
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
850660a4c8e58dfc
property.67851l.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 42A1 |
0 600 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
getMessages
property.67851l.com/api/support/ Frame BF3E |
655 B 868 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Booking (Travel)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 12 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
property.67851l.com/ | Name: connect.sid Value: s%3AsgehnSlrS115pTishEIOCfVvQwNpvx-y.jv%2BzJT9Y7yhDIey7LfeMECbOZA%2Bp7Hg3YAZWH5%2BGtLI |
|
.67851l.com/ | Name: cf_clearance Value: NsV9jPhjkaYGk1x14p6QNX1ovkNl1SP7.M0SrmWHSvs-1707086031-1-AVKSfN/xO3ha7/p+hK8cCuXu1nwVmJTR7tKM1lo/6fyQaRyFTihqdUNMNpSGh64cybEHkkqWpP2tICD9JVcapdU= |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.tailwindcss.com
fonts.googleapis.com
property.67851l.com
q-xx.bstatic.com
unpkg.com
2600:9000:26a0:9200:5:bf05:acc0:93a1
2606:4700:10::ac43:2910
2606:4700:3034::6815:cf8
2606:4700:3037::ac43:c4c7
2606:4700::6810:7baf
2607:f8b0:4004:c09::5f
151c30a9c3810c4a00decc7ac92110d0660b64b6e25973116935faa14d232a81
1ba429b8f53977afea022467d9522fc4088662a2c10e3ff0e9388d90b5922ca5
1d3af5838269f41ffd019f04eefcf2b494953d28fb1401acfbfa4ec55c57d515
20f5cc0ebb84eb9bdeb82a9b908e9f922ab10ea415857c8b00b8302e00c61a5c
3434b67595c68071824e142d077ce7e105d40ac40b15164896d11e54078d0213
34995af887a3ea31158280fa5ebde071c7bb0da3f010e1f875d187fd66414f63
548d3fcf016980e21a6c570c4a483bbdd7a94e3034f04dd30c4c1bd07a0cf653
5f828c998ccfe61f1b8725f7216182ec868f227f61bfe6fc1d1b5b54115180d4
65aff1e9fb62ed664397563a2cdcd0be05cbdab5c00ea86bcc4a6aa163618da1
846a64b15537fd60cbebc9dbdca9a2df72aa05a6e564210f78acfd701a386ef7
97d008f0efeb03337a4a169d85b9f8907ef5d6dcb74fb88f7e2f981250903349
9a60eed802ef3d6b6784369cf91a4be28f925fa426293244ad43b9d2868f2988
a140484b48096baf0db17d9db57a330c818b6bca7607152884b2eefce4e02b87
b2e3158656f24d0f69988896ea2facd530904745d286f84eadb67ceb2ce9d4c2
b4784b8b0b3e2cfefe7106fea734e0a37df601a093d8bdb1aa3ee5216716546b
c31c39cd310b2936d2299950df11f47d5639fde96739699e7eb774230c7982af
c5e7e8f07db5f90f5b179d122a425eacb8e7b0b57e79349f6e414158d3db0f77
d0dad8e522baa6dfee18b21884922c32b85ec1a9b3fa56552d531bc5febd64f9
d7a5152180593b0144e6a36c21ca0e19aa9a64da790d7a1d14f0cbe49d45525a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f478e86a01c73529dadedccaef4461597687e99bfd322538ede1aee95935aeda
f8cbafd49c896a6e02a3a959409874806cff8792343936c0ba532f58ecc95333
fbb307bc48c763f9a4893ba918ca9a322f4e084dbb994504d526af90c1a4d1e9
fc78e1550450ab81964ef660b05cb14fb17e0b895b261925ad7e6e073502dfc4