{"report_id":"97ca01c7-e76c-4037-947a-136ca0518835","version":6,"status":"done","tags":["hotel","travel","phishing"],"date":"2026-05-03T14:58:05Z","url":{"schema":"https","addr":"www.mybooking-com.vercel.app/login","fqdn":"www.mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"mybooking-com.vercel.app/login","fqdn":"mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"title":"Booking.com","dom":{"size":10161,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (10159), with no line terminators","md5":"8770eea7cfe3a88563430f26f5e73563","sha1":"6dc62ab3099b866a9a995b34d0b2ab75e4917905","sha256":"0529c9637f9c334fd7985040f68f5372196aa1d03dedc45fa1c107ce51be3c7e","sha512":"49aad16942a8478e35e1dc39d489aa7ed59e4927afe0ee6dc55526a05da1da27719518b1c6a87d8d3440f34f28bedc32b98920c6f4e7aa2bcd8cbc984253a82f","ssdeep":"192:HQhEzLdy/F6Y3q+NM51RwFeH+b2wQIhc3p2:HLvd6l3tNYkw42Zv3E","tlshash":"3f22f8346640284d8557830afc309714933b5b9df9de80a86efd8e22d2c76745d6a9c8","dom_hash":"domhashf1a8f42ce9b7db1df8c01eb2e9015de5","first_seen":"2026-02-15T14:16:12.841618Z","last_seen":"2026-06-03T12:18:46.753709Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"www.mybooking-com.vercel.app/login","fqdn":"www.mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.3","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-07T14:58:05Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"www.mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"www.mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]},"summary":[{"fqdn":"mybooking-com.vercel.app","ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2026-02-15T14:16:10.548177Z","last_seen":"2026-05-02T13:04:11.582218Z","alert_count":12,"request_count":4,"received_data":948914,"sent_data":1882,"comment":"","tags":null,"fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]}]},{"fqdn":"q-xx.bstatic.com","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2009-04-24","domain_rank":84511,"first_seen":"2018-03-07T16:49:05Z","last_seen":"2026-05-01T03:40:32.192449Z","alert_count":0,"request_count":2,"received_data":967,"sent_data":968,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}]},{"fqdn":"www.mybooking-com.vercel.app","ip":{"addr":"64.29.17.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2020-01-28","domain_rank":0,"first_seen":"2026-05-03T01:57:54.971019Z","last_seen":"2026-05-03T01:57:54.971019Z","alert_count":4,"request_count":2,"received_data":4034,"sent_data":1004,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"mybooking-com.vercel.app/static/js/main.3a5193bd.js","fqdn":"mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"d7959e5bc578f4b0370bd3a051df6247","sha1":"6ff46b7d412d0302c30a2cf1a0e80697e69bd91d","sha256":"dcc3754d7060265301839917b79f87b2443e246707c8a415da1f7ba78bd526f9","sha512":"2296f84b9818376fc36bc605ee817f98edfd9168f6887748652fcbb10d099a9f93e3d7b2db59aff68d36c5e902d2f3300d58589842cdcf9ece4b6668caa18dfd","ssdeep":"6144:BmXDqQhN9QSkWGfqqrXfMucH2AG0+53kEwtLZztrh7xUia7czKfComDMig4gl9tc:U6Stqwuc4353kEGLZztt7yiapf298e","tlshash":"4c153a88b691f0a15ba35179407f050af33e2d6da80dc4a0f236e8d97db859d6237f2d","size":917831,"data":"","first_seen":"2026-02-15T14:16:12.844057Z","last_seen":"2026-06-03T12:18:46.759273Z","times_seen":6,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"mybooking-com.vercel.app/login","fqdn":"mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-03T14:57:44.443Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /login HTTP/1.1\r\nHost: mybooking-com.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 122331\r\ncache-control: s-maxage=0\r\ncontent-disposition: inline; filename=\"index.html\"\r\ncontent-encoding: br\r\ncontent-type: text/html; charset=utf-8\r\ndate: Sun, 03 May 2026 14:57:44 GMT\r\netag: W/\"77fdb6296fba81846e5b5bb9afd1ab04\"\r\nlast-modified: Sat, 02 May 2026 04:58:53 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::xvq8k-1777820264504-f5b61ae6f22d\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"React","description":"React is an open-source JavaScript library for building user interfaces or UI components.","website":"https://reactjs.org","common_platform_enumeration":"cpe:2.3:a:facebook:react:*:*:*:*:*:*:*:*","icon":"React.svg","categories":["JavaScript frameworks"]}],"data":{"size":3676,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3676), with no line terminators","md5":"77fdb6296fba81846e5b5bb9afd1ab04","sha1":"0f62b6ec2fe1e8c5683f5d66e65c559d944634a8","sha256":"08ce2a57dff17aa7f3f4b70086e11d66edc786078dff4ead77fdf8668e3586a4","sha512":"518bf140e4b8ef5a38f661273aa8f87f745d523bfce8e65b6d7cc0bf893a2f7a519662b6f5575c07433218ba6d177b4302683ad372370117197b5e9843bf91c0","ssdeep":"","tlshash":"45713b679e6188af1c55432e4c72703c8e677d0fb4967c28b5e8652382e8fe23c61d24","first_seen":"2026-02-15T14:16:12.842966Z","last_seen":"2026-06-03T12:18:46.757192Z","times_seen":6,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":54,"dns":29,"connect":1,"send":0,"wait":10,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mybooking-com.vercel.app/static/css/main.2728b087.css","fqdn":"mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mybooking-com.vercel.app/login","date":"2026-05-03T14:57:44.706Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /static/css/main.2728b087.css HTTP/1.1\r\nHost: mybooking-com.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mybooking-com.vercel.app/login\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 115994\r\ncache-control: s-maxage=31536000, immutable\r\ncontent-disposition: inline; filename=\"main.2728b087.css\"\r\ncontent-encoding: br\r\ncontent-type: text/css; charset=utf-8\r\ndate: Sun, 03 May 2026 14:57:44 GMT\r\netag: W/\"b47e7e7cb6a1b850144c4a8709657522\"\r\nlast-modified: Sat, 02 May 2026 06:44:30 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::wwq4c-1777820264709-1c330136a5f7\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19917,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (19872)","md5":"b47e7e7cb6a1b850144c4a8709657522","sha1":"e426a2bc59aa40637b6292405f8d6c955f07557a","sha256":"19facb65b6872e8506602979c1ff6ff77c07a6196368ab67de5fcdde6f93ac5b","sha512":"d9a84136d9387e46eb7e6c92495afa1293e69a0c4bccff927ec5dfaeac8077af5ebc5547e28b1291b05bf55c534480543397fdb93e800947e4d61d55e3f5d8bc","ssdeep":"192:tXOVQXuNL6abcxe5I7obR+/MmcRFzQmrAlQQW0vhmG5pOrQ8+J:vXuN6CWhMm8zQVlQgt","tlshash":"fc92c8312b44311de837c536acd0bacd7034a025f5576b6afa677536c9cb06a3b3ea09","first_seen":"2026-02-15T14:16:12.845186Z","last_seen":"2026-06-03T12:18:46.76262Z","times_seen":6,"resource_available":false,"data":null}},"time_used":25,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":25,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mybooking-com.vercel.app/static/js/main.3a5193bd.js","fqdn":"mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mybooking-com.vercel.app/login","date":"2026-05-03T14:57:44.703Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /static/js/main.3a5193bd.js HTTP/1.1\r\nHost: mybooking-com.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mybooking-com.vercel.app/login\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccess-control-allow-origin: *\r\nage: 115993\r\ncache-control: s-maxage=31536000, immutable\r\ncontent-disposition: inline; filename=\"main.3a5193bd.js\"\r\ncontent-encoding: br\r\ncontent-type: application/javascript; charset=utf-8\r\ndate: Sun, 03 May 2026 14:57:44 GMT\r\netag: W/\"d7959e5bc578f4b0370bd3a051df6247\"\r\nlast-modified: Sat, 02 May 2026 06:44:30 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::xvq8k-1777820264708-34207872b514\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":917831,"size_decoded":0,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (65465)","md5":"d7959e5bc578f4b0370bd3a051df6247","sha1":"6ff46b7d412d0302c30a2cf1a0e80697e69bd91d","sha256":"dcc3754d7060265301839917b79f87b2443e246707c8a415da1f7ba78bd526f9","sha512":"2296f84b9818376fc36bc605ee817f98edfd9168f6887748652fcbb10d099a9f93e3d7b2db59aff68d36c5e902d2f3300d58589842cdcf9ece4b6668caa18dfd","ssdeep":"6144:BmXDqQhN9QSkWGfqqrXfMucH2AG0+53kEwtLZztrh7xUia7czKfComDMig4gl9tc:U6Stqwuc4353kEGLZztt7yiapf298e","tlshash":"4c153a88b691f0a15ba35179407f050af33e2d6da80dc4a0f236e8d97db859d6237f2d","first_seen":"2026-02-15T14:16:12.844057Z","last_seen":"2026-06-03T12:18:46.759273Z","times_seen":6,"resource_available":true,"data":null}},"time_used":16,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":16,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"q-xx.bstatic.com/backend_static/common/flags/new/48-squared/in.png","fqdn":"q-xx.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mybooking-com.vercel.app/login","date":"2026-05-03T14:57:45.018Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /backend_static/common/flags/new/48-squared/in.png HTTP/1.1\r\nHost: q-xx.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mybooking-com.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T16:53:52.226617Z","times_seen":17858133,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.mybooking-com.vercel.app/login","fqdn":"www.mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"ip":{"addr":"64.29.17.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-03T14:57:44.053Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /login HTTP/1.1\r\nHost: www.mybooking-com.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 Temporary Redirect\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/html\r\ndate: Sun, 03 May 2026 14:57:44 GMT\r\nlocation: https://mybooking-com.vercel.app/login\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-id: arn1::6fgzg-1777820264429-927739dc00d9\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"Temporary Redirect","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":3676,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T16:53:52.226617Z","times_seen":17858133,"resource_available":true,"data":null}},"time_used":715,"timings":{"blocked":353,"dns":1,"connect":1,"send":0,"wait":10,"receive":0,"ssl":348},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"www.mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"www.mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"q-xx.bstatic.com/backend_static/common/flags/new/48-squared/in.png","fqdn":"q-xx.bstatic.com","domain":"bstatic.com","tld":"com"},"ip":{"addr":"52.84.50.116","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mybooking-com.vercel.app/login","date":"2026-05-03T14:57:45.050Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.bstatic.com","organization":"Booking.com BV"},"issuer":{"commonName":"DigiCert Global G2 TLS RSA SHA256 2020 CA1","organization":"DigiCert Inc"},"validity":{"start":"Tue, 28 Oct 2025 00:00:00 GMT","end":"Tue, 20 Oct 2026 23:59:59 GMT"},"fingerprint":{"sha1":"76:E4:3D:9B:A1:1C:E4:06:81:80:6A:C7:58:7F:C7:1D:AD:48:39:CD","sha256":"C0:9C:06:CA:8D:27:2E:53:06:C4:DB:57:B6:0A:8D:F5:1C:AC:D2:58:CF:72:F6:37:58:00:2F:37:EA:14:39:E5"}}},"request":{"raw":"GET /backend_static/common/flags/new/48-squared/in.png HTTP/1.1\r\nHost: q-xx.bstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mybooking-com.vercel.app/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: image/png\r\ncontent-length: 344\r\ndate: Thu, 30 Apr 2026 05:24:41 GMT\r\nlast-modified: Mon, 12 May 2025 10:32:15 GMT\r\netag: \"d393a8574f0e51fce295082d390baad2\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public,max-age=604800\r\nx-amz-version-id: DZAYEY_QFd2sS3RsE6yRnSq3zCu7cV4L\r\naccept-ranges: bytes\r\nserver: AmazonS3\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 42f63300fbd68ad2da1e182d0d6d6948.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P3\r\nx-amz-cf-id: NsKeZxGniUuJx9f67U7aEUQNmzFsvSIJNjB_4NOGIORymdH1Ney19Q==\r\nage: 293585\r\ntiming-allow-origin: *\r\nvary: Origin\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Amazon S3","description":"Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.","website":"https://aws.amazon.com/s3/","common_platform_enumeration":"","icon":"Amazon S3.svg","categories":["CDN"]}],"data":{"size":344,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 48 x 48, 8-bit colormap, non-interlaced","md5":"d393a8574f0e51fce295082d390baad2","sha1":"bd9f6c20fc33d74ca2b49e828721298c1beaabe7","sha256":"fe628ee3822daace85b0d6b50b24295b25406735b724d65ac7813d3a23e35bb2","sha512":"606abe5930f2be28dfb5cf40249e005ac9ce0f0347c15a6bb8f9c1774a21abeeb7fc2be0be7d55243eb640a2410e7149d3b4c9cb875e242b2e494e5741eea290","ssdeep":"","tlshash":"d7e0c042b3804494c818c29396491edeee124827c1502353241c2229457d9c585c01c3","first_seen":"2023-04-17T15:07:43Z","last_seen":"2026-08-03T21:44:44.365775Z","times_seen":410,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":110,"dns":100,"connect":1,"send":0,"wait":5,"receive":1,"ssl":6},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mybooking-com.vercel.app/logo192.png","fqdn":"mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"ip":{"addr":"216.198.79.131","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mybooking-com.vercel.app/login","date":"2026-05-03T14:57:45.216Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.vercel.app","organization":""},"issuer":{"commonName":"WR1","organization":"Google Trust Services"},"validity":{"start":"Tue, 28 Apr 2026 02:04:43 GMT","end":"Mon, 27 Jul 2026 02:04:42 GMT"},"fingerprint":{"sha1":"26:33:D5:7C:A2:5E:E5:03:8C:D8:EA:45:43:9F:3B:5B:E3:1E:B6:A2","sha256":"F8:32:DF:B2:65:37:61:E8:B0:00:1D:BA:F8:4E:AB:20:66:7C:9B:FB:05:20:70:05:47:D3:B3:BF:54:81:43:AA"}}},"request":{"raw":"GET /logo192.png HTTP/1.1\r\nHost: mybooking-com.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://mybooking-com.vercel.app/login\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\nage: 115993\r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-disposition: inline; filename=\"logo192.png\"\r\ncontent-type: image/png\r\ndate: Sun, 03 May 2026 14:57:45 GMT\r\netag: \"33dbdd0177549353eeeb785d02c294af\"\r\nlast-modified: Sat, 02 May 2026 06:44:31 GMT\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000; includeSubDomains; preload\r\nx-vercel-cache: HIT\r\nx-vercel-id: arn1::zrhsj-1777820265222-b608e7f536e3\r\ncontent-length: 5347\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":5347,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit colormap, non-interlaced","md5":"33dbdd0177549353eeeb785d02c294af","sha1":"7f4f2d68782a7fafceda84554ecab9b489877500","sha256":"c386396ec70db3608075b5fbfaac4ab1ccaa86ba05a68ab393ec551eb66c3e00","sha512":"e34572cf754ff7e1d0acb12d8275252230ad1dd9adc5858e807fef0fb61aea82cb1f9ca3ebab3eeb449460373140105f8d773e7bddbf6745f9e81cc1546621f4","ssdeep":"96:gMgJkzj81lSl2dxYAYKsHHVIqApHGoKf4slNb6LQbTehYx5AtKAdmTRwy/Ik2k3:gMct0nKsUwXTbnkeAMA+Twkv","tlshash":"deb18e4e37e13c238137de00aa8ee5ddff52c6ff81226144e24933e9243839d9591916","first_seen":"2023-04-21T11:39:01Z","last_seen":"2026-08-12T16:42:58.345781Z","times_seen":14034,"resource_available":false,"data":null}},"time_used":23,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":22,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Booking.com","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Booking.com phishing","tags":["hotel","travel","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.mybooking-com.vercel.app/login","fqdn":"www.mybooking-com.vercel.app","domain":"mybooking-com.vercel.app","tld":"vercel.app"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-03T14:57:42.503Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET /login HTTP/1.1\r\nHost: www.mybooking-com.vercel.app\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-12T16:53:52.226617Z","times_seen":17858133,"resource_available":true,"data":null}},"time_used":436,"timings":{"blocked":0,"dns":20,"connect":1,"send":0,"wait":0,"receive":0,"ssl":411},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"www.mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-05-03","alert":"Sinkholed","trigger":"www.mybooking-com.vercel.app","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}}]}