{"report_id":"72b1ba4d-aa85-485e-a7c9-8d0a7fa467e2","version":6,"status":"done","tags":["hotel","travel","phishing"],"date":"2026-05-05T13:54:48Z","url":{"schema":"https","addr":"www.booking-com-nine.vercel.app/","fqdn":"www.booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"booking-com-nine.vercel.app/","fqdn":"booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"title":"Booking.com","dom":{"size":32150,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (10848)","md5":"c74b00466c20282bc6ab4e46ac936743","sha1":"579b084355c7772ae6c426636eab1e75ec58bfe4","sha256":"a529b1cd1715eb3c905da95f2a20e3bcb9db93ff53c88dbbdbac03e87c3ea3f5","sha512":"57a5bf6b1d9ab4e9069909f1fa19f2a187bf36effc374fbd49481bda3c9836931581f53e0cb4549c9449c5561cff57854d0bc799015dbc63cc2679489bd2bd20","ssdeep":"768:oUmSmemSm8mSmRmSmNXmSm4mSmkmSmewsls6hQr7BW6HLCOrnpDz2Vq:oUmSmemSm8mSmRmSmNXmSm4mSmkmSmei","tlshash":"81e26696656220749e3b4652a3ce1a2c76786dd35d068e59b1bf000dafc4ffc638372b","dom_hash":"domhashd7b2385837c235b50a33d7f815de8c1f","first_seen":"2026-05-05T00:11:48.726754Z","last_seen":"2026-05-05T13:54:53.211601Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.booking-com-nine.vercel.app/","fqdn":"www.booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.67","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-09T13:54:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":6}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"www.booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-05","alert":"Phishing Block","trigger":"www.booking-com-nine.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"www.booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-05","alert":"Phishing Block","trigger":"booking-com-nine.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]},"summary":[{"fqdn":"cf.bstatic.com","ip":{"addr":"3.167.2.74","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2009-04-24","domain_rank":109157,"first_seen":"2020-10-08T14:09:51Z","last_seen":"2026-05-04T01:43:48.505543Z","alert_count":0,"request_count":11,"received_data":152131,"sent_data":5962,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"www.booking-com-nine.vercel.app","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-05T13:54:49.077855Z","last_seen":"2026-05-05T13:54:49.077855Z","alert_count":6,"request_count":2,"received_data":1002,"sent_data":1000,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-05-03T22:20:33.622142Z","alert_count":0,"request_count":1,"received_data":2669,"sent_data":466,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"booking-com-nine.vercel.app","ip":{"addr":"64.29.17.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-05-05T00:11:37.253691Z","last_seen":"2026-05-05T00:11:37.253691Z","alert_count":20,"request_count":5,"received_data":521962,"sent_data":2344,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"fonts.gstatic.com","ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-05-03T22:17:40.953609Z","alert_count":0,"request_count":1,"received_data":35759,"sent_data":544,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"booking-com-nine.vercel.app/static/js/main.939417b7.js","fqdn":"booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"c90e4adee3ced51dd6fdb6651c96dfe3","sha1":"84931fcda88d96b2166c8f940c4469621c159781","sha256":"a500f9d3a865c2b5bbf1d74bc5e305e453c157a018c97825c519639ebe441db6","sha512":"049d7e0c676fa7f47583e40edfe1b73eaebe8c47f960d881ab32996af98fa44b0a3a6361c5df17903e4ba9194aa5110cabe1871106cfa6d473c69d677f94e172","ssdeep":"6144:TKuhrEUWzqyrXrV80uNZvOn+As/s+jZ98gLmg3:2mEkoK/fF5t","tlshash":"e6a409c875d1f0a15be311b640af000af33d6d6a984d9850f222e8d9bdf849ea277f5d","size":492766,"data":"","first_seen":"2026-05-05T00:11:48.731555Z","last_seen":"2026-05-05T13:54:53.220627Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cf.bstatic.com/static/img/theme-index/carousel_320x240/card-image-chalet_300/8ee014fcc493cb3334e25893a1dee8c6d36ed0ba.jpg","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"3.167.2.74","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.187Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bstatic.com","organization":"Booking.com BV"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 28 Oct 2025 00:00:00 GMT","end":"Tue, 20 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"76:E4:3D:9B:A1:1C:E4:06:81:80:6A:C7:58:7F:C7:1D:AD:48:39:CD","sha256":"C0:9C:06:CA:8D:27:2E:53:06:C4:DB:57:B6:0A:8D:F5:1C:AC:D2:58:CF:72:F6:37:58:00:2F:37:EA:14:39:E5"}}},"request":{"raw":"GET /static/img/theme-index/carousel_320x240/card-image-chalet_300/8ee014fcc493cb3334e25893a1dee8c6d36ed0ba.jpg HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\ncontent-length: 13158\r\ndate: Tue, 05 May 2026 13:54:29 GMT\r\nlast-modified: Mon, 14 Apr 2025 14:50:50 GMT\r\netag: \"d3b1ad34f8f42e04eef7b56de18d3c7f\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public,max-age=604800\r\nx-amz-version-id: cKrkNEUboDNiuBpGb3BlY978HIzpj_Fz\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Miss from cloudfront\r\nvia: 1.1 677df3933c00907ecb7cdafc768e98fc.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: J9zecjSVBeBs5XpyCfCy40F-votnPmr7xURpjb7Fb_FO3J6L5C1hRw==\r\ntiming-allow-origin: *\r\nvary: Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":13158,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 320x213, components 3","md5":"d3b1ad34f8f42e04eef7b56de18d3c7f","sha1":"08dcd35333a597067da77ecbcdcbac7ed3b0a1b3","sha256":"27a178d173124974078965594b90f4b10dddec024432d1dd97c7ebc8cb219550","sha512":"a4b59950adfe248978374085fbdb031f0e10e01fc0a40b70ec1e3151f954a6333d9ebaea0fb22dc0a9af3ff2e565fc1bfac6415de9cfc6b6bda5dbe56357fa5d","ssdeep":"192:W66ZKzVvMNZdCwa0kDD1T0hb0foA05hjVFzr8Oh0TxLTca1NZuZlQjwd9bJwxS3n:W7wzVUpa0hbL/r8Oh0xLTxZuZujwd9wS","tlshash":"b142af669f111c84cf8af73ed4d1729391de48e632d2ab76940c1f92ce12db9ec5c660","first_seen":"2025-09-03T21:04:44.048625Z","last_seen":"2026-07-30T16:07:06.323442Z","times_seen":33,"resource_available":false,"data":null}},"time_used":139,"timings":{"blocked":21,"dns":0,"connect":0,"send":0,"wait":117,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.booking-com-nine.vercel.app/","fqdn":"www.booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-05T13:54:25.766Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: www.booking-com-nine.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T15:40:42.100018Z","times_seen":17857324,"resource_available":true,"data":null}},"time_used":371,"timings":{"blocked":0,"dns":21,"connect":1,"send":0,"wait":0,"receive":0,"ssl":347},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"www.booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-05","alert":"Phishing Block","trigger":"www.booking-com-nine.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"www.booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"www.booking-com-nine.vercel.app/","fqdn":"www.booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-05T13:54:27.235Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: www.booking-com-nine.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/html\r\ndate: Tue, 05 May 2026 13:54:27 GMT\r\nlocation: https://booking-com-nine.vercel.app/\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-id: arn1::d4cjn-1777989267592-993326ebbf29\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":646,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T15:40:42.100018Z","times_seen":17857324,"resource_available":true,"data":null}},"time_used":712,"timings":{"blocked":351,"dns":1,"connect":1,"send":0,"wait":10,"receive":0,"ssl":347},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"www.booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-05","alert":"Phishing Block","trigger":"www.booking-com-nine.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"www.booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Ubuntu\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"172.217.20.170","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:27.882Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Apr 2026 05:19:27 GMT","end":"Wed, 01 Jul 2026 05:19:26 GMT"},"fingerprint":{"sha1":"E9:E5:B7:DA:0A:AE:59:02:EA:10:61:71:9B:52:3A:08:42:A0:67:A5","sha256":"F6:1D:CE:31:AA:9C:7B:58:1D:1D:14:96:99:B6:58:CC:FB:AE:D5:3C:F8:FB:40:E3:45:2D:4A:54:11:B4:E2:F3"}}},"request":{"raw":"GET /css2?family=Ubuntu\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 05 May 2026 13:54:28 GMT\r\ndate: Tue, 05 May 2026 13:54:28 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1983,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"73dd84a0f895126b4fcae3c4d97a1a4c","sha1":"972dd8bb117d576a8b3dec2b4aa72d5f141ae010","sha256":"630c353679a0ce1e6b18f8cb4c5cdf498e78686163bcde71a931011293fe681c","sha512":"d8374d692b39da2fea0e80c2b6c50a0088608f6d476983ca39a82a84be8dac799a2667644a8225e82747309adbd50f52267663d675435cff5e7ea5f69075d866","ssdeep":"","tlshash":"5d417aa2145a9400ea934cc223cfbf2aad4f25556049c5ba6bfe1cd89ce6c3a4359f4d","first_seen":"2025-09-03T00:17:11.16488Z","last_seen":"2026-08-11T20:41:08.513378Z","times_seen":1095,"resource_available":false,"data":null}},"time_used":257,"timings":{"blocked":112,"dns":1,"connect":21,"send":0,"wait":31,"receive":0,"ssl":90},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cf.bstatic.com/xdata/images/city/max500/689422.webp?k=2595c93e7e067b9ba95f90713f80ba6e5fa88a66e6e55600bd27a5128808fdf2\u0026o=","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"3.167.2.74","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bstatic.com","organization":"Booking.com BV"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 28 Oct 2025 00:00:00 GMT","end":"Tue, 20 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"76:E4:3D:9B:A1:1C:E4:06:81:80:6A:C7:58:7F:C7:1D:AD:48:39:CD","sha256":"C0:9C:06:CA:8D:27:2E:53:06:C4:DB:57:B6:0A:8D:F5:1C:AC:D2:58:CF:72:F6:37:58:00:2F:37:EA:14:39:E5"}}},"request":{"raw":"GET /xdata/images/city/max500/689422.webp?k=2595c93e7e067b9ba95f90713f80ba6e5fa88a66e6e55600bd27a5128808fdf2\u0026o= HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/webp\r\nserver: nginx\r\ndate: Sat, 02 May 2026 04:32:17 GMT\r\netag: \"6648a2af7ace80fea2b955a4ee3d109f37bd087c\"\r\ncontent-language: 43394\r\ncache-control: max-age=2592000\r\naccess-control-allow-origin: *\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload;\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 677df3933c00907ecb7cdafc768e98fc.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: K8i9bH7fAvDfmuo6kOv_A3RMq0cxEFd5Io4EucAc2fNoPu5MJb001g==\r\nage: 292931\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":43394,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 500x500, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"88ae03fca3a91b4958279c715321f652","sha1":"f8cd796a433bf62cdaeaa72bf9eaa186573d3806","sha256":"28ae610d702a0efeb564568460829472ee6e63559bbf68aae3d929dddbb952ad","sha512":"7aa2e732e45ffa58e8617fba997890600f6096326fec90b8becbc35306fd18c8ddc9ee557fb28116d197ab1b8479e06f070dd4c5cfd50c8b14188b398b7120c5","ssdeep":"768:pFJHanC7J20JBZPNqCL31Yzi2Pn6LVqXize7PV36OVXiCNA2ZR0rKOzfp0Y1xFW5:p36nUn3OCL3CIIq6hyQyKODR1xNv2O0H","tlshash":"ac1302031632b92de77571e3c16fc735709eb7f8915da920afe2ea0850b69c0cfa6059","first_seen":"2026-05-05T00:11:48.739824Z","last_seen":"2026-05-05T13:54:53.216071Z","times_seen":3,"resource_available":false,"data":null}},"time_used":90,"timings":{"blocked":31,"dns":18,"connect":1,"send":0,"wait":5,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cf.bstatic.com/xdata/images/xphoto/square300/57584488.webp?k=bf724e4e9b9b75480bbe7fc675460a089ba6414fe4693b83ea3fdd8e938832a6\u0026o=","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"3.167.2.74","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.181Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bstatic.com","organization":"Booking.com BV"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 28 Oct 2025 00:00:00 GMT","end":"Tue, 20 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"76:E4:3D:9B:A1:1C:E4:06:81:80:6A:C7:58:7F:C7:1D:AD:48:39:CD","sha256":"C0:9C:06:CA:8D:27:2E:53:06:C4:DB:57:B6:0A:8D:F5:1C:AC:D2:58:CF:72:F6:37:58:00:2F:37:EA:14:39:E5"}}},"request":{"raw":"GET /xdata/images/xphoto/square300/57584488.webp?k=bf724e4e9b9b75480bbe7fc675460a089ba6414fe4693b83ea3fdd8e938832a6\u0026o= HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/webp\r\ncontent-length: 7386\r\nserver: nginx\r\ndate: Thu, 30 Apr 2026 00:56:29 GMT\r\ncontent-language: 7386\r\ncache-control: max-age=2592000\r\naccess-control-allow-origin: *\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload;\r\netag: \"407c698843930aa8d22d959c6bdabfe333258fce\"\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 677df3933c00907ecb7cdafc768e98fc.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: _JQdZYwwPCGuoUTLGQZ5Xy-hjzmo0BMobH3XacnNXNi_NHJ537V-1w==\r\nage: 478679\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7386,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 300x300, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d6a027f227da40f4efe44d9d50391070","sha1":"5d6f9d816d16910b576fd01bc3715fae7f54a0b5","sha256":"54096d6ba48e65a6cd780ad8da8e159a86ab42c0ea12a0276b99016753cdba84","sha512":"5ae60967a388cd391411a1b6574b1cd68ba64d481f3ef96a72d9b6788ae4f5e58b00cff2c0f064879dbb5ffa59a9dbc45c7d50ccefe221e9e70102336e7b3bc0","ssdeep":"192:o6/QZs7B6Bsu7idN9bhgSzkhYEZ5fogk9eoXqsBi7/26QiAmXQuwKAgre:7/QZM0BzuxWSHMKNcOV5mXQ0m","tlshash":"36e1b057c9c3b0d3d934ef4692831ceab3e84a3d55c45b92db6597227438f6d211d424","first_seen":"2026-05-05T00:11:48.760202Z","last_seen":"2026-07-30T16:07:06.330975Z","times_seen":4,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":30,"dns":13,"connect":0,"send":0,"wait":6,"receive":0,"ssl":22},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"booking-com-nine.vercel.app/favicon.ico","fqdn":"booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.445Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: booking-com-nine.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 49473\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"favicon.ico\"\r\ncontent-encoding: br\r\ncontent-type: image/vnd.microsoft.icon\r\ndate: Tue, 05 May 2026 13:54:28 GMT\r\netag: W/\"c92b85a5b907c70211f4ec25e29a8c4a\"\r\nlast-modified: Tue, 05 May 2026 00:09:54 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::d7pjj-1777989268447-ed3b085833cd\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":3870,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 4 icons, 16x16 with PNG image data, 16 x 16, 8-bit colormap, non-interlaced, 32 bits/pixel, 24x24 with \n- PNG image data, 24 x 24, 8-bit colormap, non-interlaced, 32 bits/pixel","md5":"c92b85a5b907c70211f4ec25e29a8c4a","sha1":"1120538c77ad1f28a89243b4b53fe2ac16cc3bc6","sha256":"3d10f7da6c603178340081668c4ac5b3ae9743ca9a262ab0fcd312fbb9f48bdd","sha512":"d792613e3c31d3aea08ae9ce51a26498afed8b48c93290640c64d0a23edc85e524bc1d090b5ba3fa161b3f2f7d31f9d1da5db77b14189fc3f8ed81ff830fa70c","ssdeep":"","tlshash":"26815cb31b994539e5cb0317fa069036d8f1d11e09b5493e1a938c05ad2fe99c26a36e","first_seen":"2023-04-12T20:45:07Z","last_seen":"2026-08-12T16:00:48.83007Z","times_seen":11625,"resource_available":false,"data":null}},"time_used":14,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":14,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-05","alert":"Phishing Block","trigger":"booking-com-nine.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"booking-com-nine.vercel.app/","fqdn":"booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-05T13:54:27.607Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: booking-com-nine.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 57083\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline\r\ncontent-type: text/html; charset=utf-8\r\ndate: Tue, 05 May 2026 13:54:27 GMT\r\netag: \"82d9b98355b3ba36be4d81679c43d69b\"\r\nlast-modified: Mon, 04 May 2026 22:03:04 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::znpt8-1777989267661-fdb210b80b20\r\ncontent-length: 646\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]}],"data":{"size":646,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (646), with no line terminators","md5":"82d9b98355b3ba36be4d81679c43d69b","sha1":"713626699dbdddf76dc051425c0f8b9c34b77119","sha256":"da59c11f3e557ce29d212bef687ea5ec53f544ada04fbf2d5cc16a2c235eeb05","sha512":"f7925056b2401b79f5a11e36b5adc87d988ffc919ab0beca3b756357514e9fef6d55324592797a5fabda581f2ae37c7c3a5deab3de099e69b5ee7c811676769d","ssdeep":"","tlshash":"c8f07d52cc01c48d9730977bfeb2b06cc54ab90cea51fc54b8da18ba4dd4bb38d66951","first_seen":"2026-05-05T00:11:48.7562Z","last_seen":"2026-05-05T13:54:53.218379Z","times_seen":3,"resource_available":false,"data":null}},"time_used":114,"timings":{"blocked":48,"dns":22,"connect":1,"send":0,"wait":10,"receive":8,"ssl":23},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-05","alert":"Phishing Block","trigger":"booking-com-nine.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cf.bstatic.com/xdata/images/city/max500/957801.webp?k=a969e39bcd40cdcc21786ba92826063e3cb09bf307bcfeac2aa392b838e9b7a5\u0026o=","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"3.167.2.74","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.177Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bstatic.com","organization":"Booking.com BV"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 28 Oct 2025 00:00:00 GMT","end":"Tue, 20 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"76:E4:3D:9B:A1:1C:E4:06:81:80:6A:C7:58:7F:C7:1D:AD:48:39:CD","sha256":"C0:9C:06:CA:8D:27:2E:53:06:C4:DB:57:B6:0A:8D:F5:1C:AC:D2:58:CF:72:F6:37:58:00:2F:37:EA:14:39:E5"}}},"request":{"raw":"GET /xdata/images/city/max500/957801.webp?k=a969e39bcd40cdcc21786ba92826063e3cb09bf307bcfeac2aa392b838e9b7a5\u0026o= HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 Not Found\r\ncontent-type: text/html;charset=iso-8859-1\r\ncontent-length: 398\r\nserver: nginx\r\ndate: Tue, 05 May 2026 13:54:28 GMT\r\ncache-control: must-revalidate,no-cache,no-store\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload;\r\nx-cache: Error from cloudfront\r\nvia: 1.1 677df3933c00907ecb7cdafc768e98fc.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: 5wd0KpJoLMaj-7qDmrifhJ9zabLlqBCpEYt3R_qL3W2mSLDiRRxOCA==\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T15:40:42.100018Z","times_seen":17857324,"resource_available":true,"data":null}},"time_used":125,"timings":{"blocked":29,"dns":14,"connect":0,"send":0,"wait":52,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cf.bstatic.com/static/img/theme-index/carousel_320x240/card-image-apartments_300/9f60235dc09a3ac3f0a93adbc901c61ecd1ce72e.jpg","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"3.167.2.74","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.182Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bstatic.com","organization":"Booking.com BV"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 28 Oct 2025 00:00:00 GMT","end":"Tue, 20 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"76:E4:3D:9B:A1:1C:E4:06:81:80:6A:C7:58:7F:C7:1D:AD:48:39:CD","sha256":"C0:9C:06:CA:8D:27:2E:53:06:C4:DB:57:B6:0A:8D:F5:1C:AC:D2:58:CF:72:F6:37:58:00:2F:37:EA:14:39:E5"}}},"request":{"raw":"GET /static/img/theme-index/carousel_320x240/card-image-apartments_300/9f60235dc09a3ac3f0a93adbc901c61ecd1ce72e.jpg HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\ncontent-length: 13122\r\ndate: Tue, 05 May 2026 13:54:29 GMT\r\nlast-modified: Mon, 14 Apr 2025 14:50:50 GMT\r\netag: \"8ccb92ff4c9d26e076c80729bb49718e\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public,max-age=604800\r\nx-amz-version-id: BJF6N6QjatZZLJ8vCGBY91Zkw8GiM4pK\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Miss from cloudfront\r\nvia: 1.1 677df3933c00907ecb7cdafc768e98fc.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: tlTS6vPZJEGFs3Ay12n1KeXg6kO49J7uRIe5wxopJ9Nk2UC8aQOkIw==\r\ntiming-allow-origin: *\r\nvary: Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":13122,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 320x213, components 3","md5":"8ccb92ff4c9d26e076c80729bb49718e","sha1":"2d94f1a62182b8d089295af14aa2911546232ce0","sha256":"2dd73be248f7c814b16d453b131ffdea6722e44bd612226a2fa81e86d7756ead","sha512":"a19e74782043de68a426e1a0ac8c85830aacd71262ecaeb115ac86a447af86457398e17a0844377fe50c3c439ee3bd6ee841e51b8190384104de31261fdb161b","ssdeep":"384:Wo9XnIJkY4l1aEIV/+KMyuVRZMzjywQ5Gz02jF:WGXnQSaE1KMyunZ8jVQ5hsF","tlshash":"b342cfa78775a479d30889f1dc6e060453ecd22aa3a6b77b98517d204432cb74d16e8d","first_seen":"2025-09-03T21:04:44.079875Z","last_seen":"2026-07-30T16:07:06.321109Z","times_seen":33,"resource_available":false,"data":null}},"time_used":197,"timings":{"blocked":35,"dns":10,"connect":8,"send":0,"wait":109,"receive":1,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"booking-com-nine.vercel.app/logo192.png","fqdn":"booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.444Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /logo192.png HTTP/1.1\r\nHost: booking-com-nine.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 49392\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"logo192.png\"\r\ncontent-type: image/png\r\ndate: Tue, 05 May 2026 13:54:28 GMT\r\netag: \"33dbdd0177549353eeeb785d02c294af\"\r\nlast-modified: Tue, 05 May 2026 00:11:16 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::46gnr-1777989268448-7fe9c9822487\r\ncontent-length: 5347\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":5347,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"33dbdd0177549353eeeb785d02c294af","sha1":"7f4f2d68782a7fafceda84554ecab9b489877500","sha256":"c386396ec70db3608075b5fbfaac4ab1ccaa86ba05a68ab393ec551eb66c3e00","sha512":"e34572cf754ff7e1d0acb12d8275252230ad1dd9adc5858e807fef0fb61aea82cb1f9ca3ebab3eeb449460373140105f8d773e7bddbf6745f9e81cc1546621f4","ssdeep":"96:gMgJkzj81lSl2dxYAYKsHHVIqApHGoKf4slNb6LQbTehYx5AtKAdmTRwy/Ik2k3:gMct0nKsUwXTbnkeAMA+Twkv","tlshash":"deb18e4e37e13c238137de00aa8ee5ddff52c6ff81226144e24933e9243839d9591916","first_seen":"2023-04-21T11:39:01Z","last_seen":"2026-08-12T16:00:48.845641Z","times_seen":14033,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-05","alert":"Phishing Block","trigger":"booking-com-nine.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"booking-com-nine.vercel.app/static/js/main.939417b7.js","fqdn":"booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:27.839Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /static/js/main.939417b7.js HTTP/1.1\r\nHost: booking-com-nine.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 49392\r\ncache-control: s-maxage=31536000, immutable\r\ncontent-disposition: inline; filename=\"main.939417b7.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Tue, 05 May 2026 13:54:27 GMT\r\netag: W/\"c90e4adee3ced51dd6fdb6651c96dfe3\"\r\nlast-modified: Tue, 05 May 2026 00:11:15 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::s9pjr-1777989267851-fdfd42376343\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":492766,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"c90e4adee3ced51dd6fdb6651c96dfe3","sha1":"84931fcda88d96b2166c8f940c4469621c159781","sha256":"a500f9d3a865c2b5bbf1d74bc5e305e453c157a018c97825c519639ebe441db6","sha512":"049d7e0c676fa7f47583e40edfe1b73eaebe8c47f960d881ab32996af98fa44b0a3a6361c5df17903e4ba9194aa5110cabe1871106cfa6d473c69d677f94e172","ssdeep":"6144:TKuhrEUWzqyrXrV80uNZvOn+As/s+jZ98gLmg3:2mEkoK/fF5t","tlshash":"e6a409c875d1f0a15be311b640af000af33d6d6a984d9850f222e8d9bdf849ea277f5d","first_seen":"2026-05-05T00:11:48.731555Z","last_seen":"2026-05-05T13:54:53.220627Z","times_seen":3,"resource_available":true,"data":null}},"time_used":24,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":24,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-05","alert":"Phishing Block","trigger":"booking-com-nine.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cf.bstatic.com/xdata/images/city/max500/957801.webp?k=a969e39bcd40cdcc21786ba92826063e3cb09bf307bcfeac2aa392b838e9b7a5\u0026o=","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.126Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /xdata/images/city/max500/957801.webp?k=a969e39bcd40cdcc21786ba92826063e3cb09bf307bcfeac2aa392b838e9b7a5\u0026o= HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T15:40:42.100018Z","times_seen":17857324,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cf.bstatic.com/xdata/images/city/max500/690334.webp?k=b99df435f06a15a1568ddd5f55d239507c0156985577681ab91274f917af6dbb\u0026o=","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.131Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /xdata/images/city/max500/690334.webp?k=b99df435f06a15a1568ddd5f55d239507c0156985577681ab91274f917af6dbb\u0026o= HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T15:40:42.100018Z","times_seen":17857324,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cf.bstatic.com/xdata/images/city/max500/689422.webp?k=2595c93e7e067b9ba95f90713f80ba6e5fa88a66e6e55600bd27a5128808fdf2\u0026o=","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.136Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /xdata/images/city/max500/689422.webp?k=2595c93e7e067b9ba95f90713f80ba6e5fa88a66e6e55600bd27a5128808fdf2\u0026o= HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T15:40:42.100018Z","times_seen":17857324,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cf.bstatic.com/xdata/images/city/max500/690334.webp?k=b99df435f06a15a1568ddd5f55d239507c0156985577681ab91274f917af6dbb\u0026o=","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"3.167.2.74","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.179Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bstatic.com","organization":"Booking.com BV"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 28 Oct 2025 00:00:00 GMT","end":"Tue, 20 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"76:E4:3D:9B:A1:1C:E4:06:81:80:6A:C7:58:7F:C7:1D:AD:48:39:CD","sha256":"C0:9C:06:CA:8D:27:2E:53:06:C4:DB:57:B6:0A:8D:F5:1C:AC:D2:58:CF:72:F6:37:58:00:2F:37:EA:14:39:E5"}}},"request":{"raw":"GET /xdata/images/city/max500/690334.webp?k=b99df435f06a15a1568ddd5f55d239507c0156985577681ab91274f917af6dbb\u0026o= HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/webp\r\nserver: nginx\r\ndate: Mon, 04 May 2026 10:03:56 GMT\r\netag: \"99ccf90fab212c5a8099ebbab25da2e07892302e\"\r\ncontent-language: 41782\r\ncache-control: max-age=2592000\r\naccess-control-allow-origin: *\r\nx-xss-protection: 1; mode=block\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload;\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 677df3933c00907ecb7cdafc768e98fc.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: Mr9A9l2w3gHgVWMw7sWEHqRRkOQyh2quwy4r9HEAb3NUgJtEQMO3gg==\r\nage: 100232\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":41782,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 500x500, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7659efee1e604458214625c23d6f11c1","sha1":"df53dca49d8b128cc4d880487e6ec74a333ffbb1","sha256":"ec0599ad9111e5bbcf90c867d615d6399dd0bee34f2e5c006c60b40dd8e14863","sha512":"01369f46c5441796fcd96193f2e6b3c029eb0df0484f41006b0459f8ac7d01e12a82eec09b3f5e77b9bec7db75a04a46fb98dd259d768b185b69bfe1350c360f","ssdeep":"768:QAI3yA8n45lctIgBH2E09V6f7toVBN9OQv0yd8uYQp6G2GYbXjW:3HA/ogEy6ztofN9OmH6+Yby","tlshash":"3a130235b06a4250d5b3c0d9553601e74b2fcc6b6a62d279499824fcbde3a8b06ff5f0","first_seen":"2026-05-05T00:11:48.735901Z","last_seen":"2026-05-05T13:54:53.22174Z","times_seen":3,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":31,"dns":16,"connect":1,"send":0,"wait":6,"receive":0,"ssl":25},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"booking-com-nine.vercel.app/static/css/main.895cad53.css","fqdn":"booking-com-nine.vercel.app","domain":"booking-com-nine.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.67","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:27.841Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /static/css/main.895cad53.css HTTP/1.1\r\nHost: booking-com-nine.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 49392\r\ncache-control: s-maxage=31536000, immutable\r\ncontent-disposition: inline; filename=\"main.895cad53.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Tue, 05 May 2026 13:54:27 GMT\r\netag: W/\"89126c6cdf59adb397c09f40648bff3d\"\r\nlast-modified: Tue, 05 May 2026 00:11:15 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::d7pjj-1777989267845-9854854647b1\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16637,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (16592)","md5":"89126c6cdf59adb397c09f40648bff3d","sha1":"ccc0e620fe99f52fb12178bfc2ccae504d138ee5","sha256":"e4e08bfb48b3bec132c4df73e713b37887ab0066696ac45575c942f4bca4d845","sha512":"258018b48ee091c067eae64f0d8db76f4d0bdfbf504ae67ab4989f900dd8e4041e17bfef98c28a2eb2d611fca9a0f7262b61f8c812f5e8acc10bfb84e66813e0","ssdeep":"192:TXPMAMDNR+/MmcRFzQmbdTBcopKXY3kC/vb+gsU+M:zMm8zQTjUB","tlshash":"d872e9316304311df437cc35acc0faca60746162fa577b69f9662139cacb0a93b7a716","first_seen":"2026-05-05T00:11:48.757558Z","last_seen":"2026-05-05T13:54:53.222791Z","times_seen":3,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-05","alert":"Phishing Block","trigger":"booking-com-nine.vercel.app","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-05","alert":"Sinkholed","trigger":"booking-com-nine.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"cf.bstatic.com/static/img/theme-index/carousel_320x240/bg_resorts/6f87c6143fbd51a0bb5d15ca3b9cf84211ab0884.jpg","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"3.167.2.74","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.184Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bstatic.com","organization":"Booking.com BV"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 28 Oct 2025 00:00:00 GMT","end":"Tue, 20 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"76:E4:3D:9B:A1:1C:E4:06:81:80:6A:C7:58:7F:C7:1D:AD:48:39:CD","sha256":"C0:9C:06:CA:8D:27:2E:53:06:C4:DB:57:B6:0A:8D:F5:1C:AC:D2:58:CF:72:F6:37:58:00:2F:37:EA:14:39:E5"}}},"request":{"raw":"GET /static/img/theme-index/carousel_320x240/bg_resorts/6f87c6143fbd51a0bb5d15ca3b9cf84211ab0884.jpg HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\ncontent-length: 12776\r\ndate: Tue, 05 May 2026 13:54:29 GMT\r\nlast-modified: Mon, 14 Apr 2025 14:50:49 GMT\r\netag: \"7fa3c63971c02583fc523383958f3f1b\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public,max-age=604800\r\nx-amz-version-id: xu3CPB_x77It0bo.wtxBDHlthHzf_SbZ\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Miss from cloudfront\r\nvia: 1.1 677df3933c00907ecb7cdafc768e98fc.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: zU6X227uaOYBdezEhEF7nnzr9-UiyjJ3GOm9jdnHbHqTv0vWYZ-uqg==\r\ntiming-allow-origin: *\r\nvary: Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]}],"data":{"size":12776,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 320x213, components 3","md5":"7fa3c63971c02583fc523383958f3f1b","sha1":"f62089cecb7d0dcbe6cf7426e5c233ab690e832a","sha256":"d6d9c35fc5ec5ab6e359297be79e5c52fbc2440b4150a910e54aefc1255fc200","sha512":"3d4159ad2dc861cc86a1f700e36f0167daf95d253d4e2d6a90df771f7c53632142b954f412c1f6de9d3fa103d596463030d8cb6322267821c7f46d19a3a7b5aa","ssdeep":"384:Wza6GzRW3lK5pZE4MGJiC2k68lZJRLPC6HFK0:Wza6GzWQEbTkxv7DFK0","tlshash":"4842bf710e67529acbe7da3f6e1036db8356d891ed2463f80054a071ce12d7a363d66c","first_seen":"2025-09-03T21:04:44.111002Z","last_seen":"2026-07-30T16:07:06.333641Z","times_seen":33,"resource_available":false,"data":null}},"time_used":136,"timings":{"blocked":35,"dns":11,"connect":9,"send":0,"wait":46,"receive":1,"ssl":23},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cf.bstatic.com/static/img/theme-index/carousel_320x240/card-image-villas_300/dd0d7f8202676306a661aa4f0cf1ffab31286211.jpg","fqdn":"cf.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"3.167.2.74","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bstatic.com","organization":"Booking.com BV"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 28 Oct 2025 00:00:00 GMT","end":"Tue, 20 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"76:E4:3D:9B:A1:1C:E4:06:81:80:6A:C7:58:7F:C7:1D:AD:48:39:CD","sha256":"C0:9C:06:CA:8D:27:2E:53:06:C4:DB:57:B6:0A:8D:F5:1C:AC:D2:58:CF:72:F6:37:58:00:2F:37:EA:14:39:E5"}}},"request":{"raw":"GET /static/img/theme-index/carousel_320x240/card-image-villas_300/dd0d7f8202676306a661aa4f0cf1ffab31286211.jpg HTTP/1.1\r\nHost: cf.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://booking-com-nine.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/jpeg\r\ncontent-length: 15810\r\ndate: Tue, 05 May 2026 13:54:29 GMT\r\nlast-modified: Mon, 14 Apr 2025 14:50:50 GMT\r\netag: \"8fb4eb378a6786b42bbf0e60d71a6d65\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public,max-age=604800\r\nx-amz-version-id: 6LH8IdkFxKG.GrjLcCggOiL4Khl2jieU\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Miss from cloudfront\r\nvia: 1.1 677df3933c00907ecb7cdafc768e98fc.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P2\r\nx-amz-cf-id: _gSFRZab8XzkoetkgFKTswF_azSV9WXDWI4twvYI5D4d-PGS-2O2lg==\r\ntiming-allow-origin: *\r\nvary: Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":15810,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 350x350, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=2], baseline, precision 8, 302x240, components 3","md5":"8fb4eb378a6786b42bbf0e60d71a6d65","sha1":"c67f180501175b04bac4f8064a03a6e52361a1d5","sha256":"be06d2c5dba658a92042aa84896c2c2fc61dbb7ff0466471556a67fd0b59ea90","sha512":"4591bf785514a6b1a34a0792b663d47e0449ed609268562b1696ef9f17083ff5b612bdf0b887fe0e62476168b00b2bb5a30e3750bfa4378a6cff60684486bc06","ssdeep":"384:QnajbXUMK591mYSFZN3aRlq92DE3gqppGEk9hSncP4p9QKv:QnYbjftdaee53Ens4v7v","tlshash":"5962b04533818e6fcf94547992835ed384d9c8805af31bb74b27780faa97cf4595618c","first_seen":"2025-09-03T21:04:44.085264Z","last_seen":"2026-07-30T16:07:06.312501Z","times_seen":32,"resource_available":false,"data":null}},"time_used":126,"timings":{"blocked":22,"dns":0,"connect":0,"send":0,"wait":102,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/ubuntu/v21/4iCs6KVjbNBYlgoKfw72.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"172.217.20.163","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://booking-com-nine.vercel.app/","date":"2026-05-05T13:54:28.189Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WR2","organization":"Google Trust Services"},"validity":{"start":"Wed, 08 Apr 2026 05:19:27 GMT","end":"Wed, 01 Jul 2026 05:19:26 GMT"},"fingerprint":{"sha1":"BF:D8:14:32:18:86:B9:95:54:75:8D:F9:5F:29:DE:4E:F8:F8:F7:13","sha256":"0E:FA:80:0B:F4:13:81:81:4D:CF:50:35:5A:DD:DB:FA:00:0B:34:B2:2D:5D:28:08:E4:45:1F:2C:EF:D2:21:C2"}}},"request":{"raw":"GET /s/ubuntu/v21/4iCs6KVjbNBYlgoKfw72.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nOrigin: https://booking-com-nine.vercel.app\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 34924\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 30 Apr 2026 11:51:18 GMT\r\nexpires: Fri, 30 Apr 2027 11:51:18 GMT\r\ncache-control: public, max-age=31536000\r\nage: 439390\r\nlast-modified: Wed, 27 Aug 2025 19:19:11 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":34924,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 34924, version 1.0","md5":"4a8b9af22b314f408f66a17f71e28908","sha1":"6b5600d84c178cd28b23b583bbcaa4eb12efff25","sha256":"dabae363ac0ae6c3b2a137a32f7132b42520a8af252f87aa6c2198f2a79cf91c","sha512":"17dbf975ba4d4a818f25bb52dfdec52ff0ad6291c37981bce0313075c13751180a30ec81db40e1b2092a92e9491d275fa253e879e3e62d97ba235295da4ddd74","ssdeep":"768:C4rzLlWA+tpuAdMEUDz1whQjKgz63b6G8tWbxfw6abvdNwGFbML:xz+/uAdMEUDZKYI3bqtMY6WvkGFML","tlshash":"e3f2f1d39beb766c5e3fa89c32b3d2653969580430737119b0a2674842e274c56e6d03","first_seen":"2025-09-02T19:57:23.465236Z","last_seen":"2026-08-12T13:57:48.693583Z","times_seen":21796,"resource_available":false,"data":null}},"time_used":443,"timings":{"blocked":211,"dns":12,"connect":11,"send":0,"wait":10,"receive":9,"ssl":185},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}