Scam Lookup
Automated Website Trust & Risk Intelligence Report
https://scamlookup.net/website/expedia
Generated: Sat, 05 Sep 2026 10:52:48 GMT
Target Website: expedia.com
Overall Trust Score: 88/100 (Trusted)
expedia.com
Trusted
Scanned: Sep 5, 10:52 AMTRUST SCORE
88
CONFIDENT
Low Risk
88/100
TRUST SCORE
CONFIDENT
Low Risk
SAFETY
100/100
100/100
TRANSPARENCY
15/100
15/100
DOMAIN RISK
LowLow Tier
LowRisk
SSL SECURITY
100/100
100/100
PAYMENT RISK
NoNo Risk
NoRisk
VERDICT
Trusted
Trusted
AI Security Summary
88/100 — trusted. Long-established domain (30.8 years old), clean threat reputation, no impersonation patterns. Verdict driven by: no privacy policy found; no terms of service found; no contact page found — worth extra caution before trusting.
No malware/phishing on feedsGood reputationHTTPS enabled
HTTPS & SSL
SecureSecure
C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
Threat Status
CleanClean
No blacklists or malware
Domain Age
30.8 years30.8 years
Registered 11/25/1995
Reputation
High TrustHigh Trust
Based on 65+ verified signals
IP & Server
23.212.250.1823.212.250.18
cloudflare
Email Security
ProtectedProtected
SPF, DMARC, MX active
Performance
36 / 10036 / 100
Standard speed
Redirects
1 Hop1 Hop
Redirect chain analyzed
Top Priority RecommendationAction Needed
Site returned HTTP 429
The server is reachable but did not return a success status.
Why it matters
Addressing this signal prevents trust downgrades and potential security risks.
View Glossary GuidePositive Signals
- HTTPS is enforced
- Served through Cloudflare
- 4 address record(s) resolved
- IPv6 (AAAA) available
- 10 authoritative nameservers
- Domain registered 31+ years ago
- Owner information disclosed
- Valid SSL / TLS certificate active
Warnings
- Site returned HTTP 429
- No privacy policy found
- No terms of service found
- No contact page found
- Large response served uncompressed
Critical Issues
No critical issues found
Domain passes all high-risk checks
- Registrar Name
- CSC Corporate Domains, Inc.
- Creation Date
- November 25, 1995 (30.8 years ago)
- Last Updated
- August 10, 2022
- Registry Expiry Date
- October 12, 2026
- WHOIS Privacy Protection
- Publicly Visible
- Domain Status Codes
- client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
ICANN Status Badges
client transfer prohibitedserver delete prohibitedserver transfer prohibitedserver update prohibited
Domain registered 31+ years ago
Long-established domains are far less likely to be disposable scams.
+15
Registered via CSC Corporate Domains, Inc.
Owner information disclosed
The domain publishes registrant contact info — a small positive transparency signal.
+2
Security Header Baseline
Strict-Transport-SecurityMissing
Content-Security-PolicyMissing
X-Frame-Options Present
X-Content-Type-Options Present
Referrer-PolicyMissing
Permissions-PolicyMissing
Recommended Missing Headers
missing: Referrer Policymissing: Permissions Policy
All Response Headers (28)
HSTS is set
Tells browsers to only use HTTPS for this domain.
+6
Content Security Policy is set
Restricts which scripts and resources the page can load.
+5
X-Frame-Options is set
Prevents clickjacking by disallowing framing.
+3
X-Content-Type-Options is set
Blocks MIME-sniffing browser attacks.
+2
Missing Referrer Policy
Controls what referrer information is sent with requests.
-2
Missing Permissions Policy
Restricts access to powerful browser features (camera, mic, etc.).
-2
- IPv4 Addresses (A)
- 23.212.250.18, 23.212.250.7
- IPv6 Addresses (AAAA)
- 2600:1408:c400:c::17cd:689a, 2600:1408:c400:c::17cd:6895
- Mail Servers (MX)
- mxa.expediagroup.com (Priority: 10), mxb.expediagroup.com (Priority: 10)
- Authoritative Nameservers (NS)
- dns1.p09.nsone.net, dns2.p09.nsone.net, dns3.p09.nsone.net, dns4.p09.nsone.net, pdns1.ultradns.net, pdns3.ultradns.org, pdns2.ultradns.net, pdns6.ultradns.co.uk, pdns4.ultradns.org, pdns5.ultradns.info
- TXT Records Found
- 44 TXT verification records
A Records (IPv4)
23.212.250.1823.212.250.7
TXT Verification Records
MS=ms41917382
ZOOM_verify_ofBcMvjmQlCZcaU4dvIkgQ
_globalsign-domain-verification=VhFG-UAc8IPlmik4wizjFi149rlyYfubwGgIy_Ila4
_qhfakp24u4ate3lbyvw1p3veiru4lkd
_slnmbnij2ra2pe5luncgck1q9xp153b
_wona8ky5rjcq7mpv89xu2z03gzgw4ox
adobe-idp-site-verification=abcfaaf9-27be-4dca-a1e1-c927aef12f3f
amazonses:6N5k7dR50wcCMNvXtEVCL7tVvOqZBQmuFFEJLokVIfE=
amazonses:Fo+DrXJ2hWyGoODXpSHEzYI4Uw9L93rskKKD/pbX9qk=
amazonses:GpLcOvJxxnz0UuiDzgnZCnWdvkNwNJNDoZsi+jNLl70=
amazonses:JqZ7DCH6v3rdHV51NIWOkU7wPgB0aSTP0Z1hF9tr9N8=
amazonses:L/znkTRG3CC7az8kQioGsNeARe/8ERvOQUwjq69Ov8A=
amazonses:LZ0J6MYU9V4K1tMfUCKKyF2lrqYy7/T1a3SGHMTkgdI=
amazonses:Qz9hS4Kkufxpp+jJXEYur6QH8sCMrNyMuMgqWDY0res=
amazonses:glyQN3VG7+2GwQzW53o2g3FKyzhxfj1s1MoJmxgF/IM=
amazonses:mDgr5HTfTVGx3+y1oKrXWeGLfIIUB6TYS727YPN+MVM=
amazonses:oZ2yR24a2IvFfvd7rTosskhpBLV0+ALRtvkRJIjx0fo=
amazonses:sG5OYkWVHIpG/aa9orqZIna+hfMfRpT1SGaCb4D4XVw=
amazonses:t7uPAmLr+GQsilBGtLdODuKQfxX78F7KKROYzkXeDnk=
anthropic-domain-verification-gvhc3w=7DZit0fI0UvkLidnFGXWSj673
apple-domain-verification=0Cq9m86umSJj48Lc
apple-domain-verification=dzOcCMjpBEyl50Bc6Wb_j4B10rRmI1Jan_auP5P2lcQ
atlassian-domain-verification=BoDCBNyHJzHh97Myx/Z4n3grU8sMEGR10Mi8CdpStC01PdMAuIARlKP/odGI7CvN
ca3-7a14c6a8346148a8a530cc85edf8eaa2
cisco-ci-domain-verification=353929ee9fd3a3760facd2437590f676e7cf9395c48c74d21b1df486d09f3374
docusign=4188e9ec-e035-430e-88b2-7a13724ef5a5
docusign=af374066-7f8d-4e9e-aa34-ced1f3929a3d
dropbox-domain-verification=4ujrmug64lqg
facebook-domain-verification=imkvqqxv2t6mzz9o2rqoowbjmebkw9
facebook-domain-verification=s4h6e1h04jupatgxdgiqjclfwmvxu1
google-site-verification=FpDWRaM4PuuKkac8GS2WnRrOL2ETEawDDPSUqkJHUmc
google-site-verification=nK8ds4mXu1b3H3be6v0EFQoBDNL0ehLYho-eRN0mmik
lucid-verification=kfm1DJP5pmf-wyf1qxd
mailru-verification: 1b3eba1af3b91214
miro-verification=d36744c01c72c4c0e036eacc18ffe55264b3bf81
openai-domain-verification=dv-LcuXOUafDEymiB6NOaKRg5yD
perplexity-ai-domain-verification-kx8cwa=8WA6k9CqOacJLnLYJunqAVGGC
slack-domain-verification=81W2yd6WvPIV2bIiJ0v7Z9CctNAA8jqAQl8WaAJq
smartsheet-site-validation=1faPwvohZowpNS7Bl4ROqo9qp0soq7Mo
teamviewer-sso-verification=aed054b0717d4220825c45cb229bfdb2
tiktok-developers-site-verification=xu7umPD0SGmugD16amWLt5izfF818tcR
v=spf1 include:_spf.expedia.com a:b.spf.service-now.com include:_spf.qemailserver.com include:spf.clearslide.com include:mail.zendesk.com include:_spf.salesforce.com include:_spf.sidetrade.net ip4:212.99.44.68 ip4:212.99.44.69 ip4:83.138.167.180 ip4:195.5" "0.76.198 ip4:83.138.167.180/30 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:148.105.8.0/21 ip4:199.15.213.62 ip4:199.15.213.63 ip4:192.28.150.108 ip4:66.244.67.50 -all
x034XVMC1Z3q1tp7Rd2+WV9Cf8GQ7wqakjbNinoZvSGB2K7/oQbi2hLe8HLezV0ia4zePzaZaIAwzuXiMPSM9A==
_o4ot2wbs5egjtzzg5r2kjfb5iwrf0mp
4 address record(s) resolved
+4
IPv6 (AAAA) available
Modern dual-stack setup.
+2
10 authoritative nameservers
+2
- Registrable Domain
- expedia.com
- Registrar Organization
- CSC Corporate Domains, Inc.
- WHOIS Privacy Status
- Public Registration Data
- Registry Status Codes
- client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
- Delegated Authoritative Nameservers
- dns1.p09.nsone.net, dns2.p09.nsone.net, dns3.p09.nsone.net, dns4.p09.nsone.net, pdns1.ultradns.net, pdns2.ultradns.net, pdns3.ultradns.org, pdns4.ultradns.org, pdns5.ultradns.info, pdns6.ultradns.co.uk
- Registration Lifecycle
- Registered: 1995 → Expires: 2026
Nameservers (NS)
dns1.p09.nsone.netdns2.p09.nsone.netdns3.p09.nsone.netdns4.p09.nsone.netpdns1.ultradns.netpdns2.ultradns.netpdns3.ultradns.orgpdns4.ultradns.orgpdns5.ultradns.infopdns6.ultradns.co.uk
Domain registered 31+ years ago
Long-established domains are far less likely to be disposable scams.
+15
Registered via CSC Corporate Domains, Inc.
Owner information disclosed
The domain publishes registrant contact info — a small positive transparency signal.
+2
- SPF Record
- v=spf1 include:_spf.expedia.com a:b.spf.service-now.com include:_spf.qemailserver.com include:spf.clearslide.com include:mail.zendesk.com include:_spf.salesforce.com include:_spf.sidetrade.net ip4:212.99.44.68 ip4:212.99.44.69 ip4:83.138.167.180 ip4:195.5" "0.76.198 ip4:83.138.167.180/30 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:148.105.8.0/21 ip4:199.15.213.62 ip4:199.15.213.63 ip4:192.28.150.108 ip4:66.244.67.50 -all
- DMARC Policy Mode
- Policy: REJECT
- DMARC Raw Record
- v=DMARC1; p=reject; fo=1; rua=mailto:expedia@rua.netcraft.com,mailto:dmarc_agg@dmarc.250ok.net ; ruf=mailto:expedia@ruf.netcraft.com,mailto:dmarc_fr@dmarc.250ok.net
- DKIM Selectors Detected
- selector1, s1, s2
Email Protection Summary: This domain has strong email authentication configured to prevent spammers from sending emails impersonating this brand.
SPF record published
+5
DMARC published (reject)
+6
DKIM configured (selector1, s1, s2)
+3
URLhaus Malware
Clean / Not Listed
PhishStats Feed
Clean / Not Listed
Google Safe Browsing
Not checked
- Root Domain Label
- expedia
- Top-Level Domain (TLD)
- .com (Standard TLD)
- Punycode Obfuscation
- No (Standard ASCII)
- Homoglyph / Lookalike Script
- No mixed scripts
- Brand Match Analysis
- No recognized brand impersonation
- Typosquatting Risk
- Clean
No impersonation patterns detected
Domain doesn't look like a typosquat, doesn't embed a well-known brand, and uses ASCII characters.
+8
Detected Technologies by Category
js
ReactSvelte
css
Tailwind CSS
analytics
Google Analytics
cdn
Cloudflare
Page Metadata & Fingerprint
- HTML Title
- Bot or Not?
- Meta Description
- —
- Document Language
- en
- Character Encoding
- UTF-8
- Viewport Setting
- width=device-width, initial-scale=1.0
- Generator Software
- —
5 technologies detected
React, Svelte, Tailwind CSS, Google Analytics, Cloudflare
Mobile viewport configured
+2
Missing meta description
-2
Items to Fix & Optimize
Text compression (Brotli/Gzip)
MUCH NEEDEDEnable on server or CDN
Modern image formats (WebP/AVIF/SVG)
OPTIONALConvert heavy images to WebP/AVIF
Protocol
HTTP/2
Binary framing, multiplexed
Compression
NONE
No compression detected
Optimization Signals (From Detectable Headers & Assets)
Image Formats
Legacy / Unchecked
Transfer
Uncompressed
Transport
HTTP/2
These are server-side signals. Actual Core Web Vitals (LCP, INP, CLS) require real-user measurement via PageSpeed Insights.
Detected Asset & Image Formats
WebPAVIFSVGJPEGPNG
- HTTP Response Time
- 543 ms
- Payload Body Size
- 110.6 KB
- Compression Status
- Uncompressed
- Cache Directives
- no-cache, no-store, must-revalidate
Large response served uncompressed
Enable gzip or brotli at the edge to cut transfer size dramatically.
-3
AI Content Evaluation
88/100 — trusted. Long-established domain (30.8 years old), clean threat reputation, no impersonation patterns. Verdict driven by: no privacy policy found; no terms of service found; no contact page found — worth extra caution before trusting.
- Payment Red Flags
- None (No suspicious payment requests)
- High-Pressure Language
- None (No artificial urgency detected)
- Disposable Domain Risk
- No (Established infrastructure)
- Text Scanned Depth
- 129 characters verified
No scam-correlated language found on the home page
No crypto-only / gift-card / wire-only payment demands, and no obvious urgency tactics.
+6
- Primary Web Server
- cloudflare
- CDN / Cloud Provider
- Cloudflare
- Primary IP Address
- 23.212.250.18
- HTTP Status Code
- 429 OK
- Final Landing Destination
- https://www.expedia.com/
- Redirect Hop Count
- 1 hop
Redirect Hop Chain
- 1.https://expedia.com/ → https://www.expedia.com/
Site returned HTTP 429
The server is reachable but did not return a success status.
-6
HTTPS is enforced
All redirects stayed on HTTPS. Traffic is encrypted end-to-end.
+10
Served through Cloudflare
Sites behind a major CDN benefit from DDoS protection and edge caching.
+4
- Certificate Authority (Issuer)
- C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1
- Subject Common Name (CN)
- analytics-api-internal-v2.test.epsdecaf.expedia.com
- Validity Period
- 60 days remaining (Expires: 2026-11-04T23:59:59Z)
- Subject Alternative Names (SANs)
- 40 domains protected
- Certificates Logged (CT)
- 100 certs recorded
Subject Alternative Names (Sample)
analytics-api-internal-v2.test.epsdecaf.expedia.comsta.corp.securityengineering.expedia.comrsati206-test.expedia.comamex-itin-sync-int.expedia.comamex-itinerary-orchestrator-int.us-west-2.int.expedia.comyeoman-int.expedia.comrsati-test-204.expedia.comrsati-test-207.expedia.comcommercial-terms-management-service.test.epsdecaf.expedia.comeps-cims-main-us-west-2.prod.epsdecaf.expedia.comeps-cims-main-us-west-2.test.epsdecaf.expedia.comanalytics-api-external-v2.prod.epsdecaf.expedia.comanalytics-api-internal-v2.prod.epsdecaf.expedia.comportal-lambdas-us-west-2-main.test.epsdecaf.expedia.comportal-lambdas-us-west-2-main.prod.epsdecaf.expedia.comeps-offline-support-api-us-west-2.test.epsdecaf.expedia.comeps-offline-support-api-us-west-2.prod.epsdecaf.expedia.comeps-console-ldap-api-us-west-2.test.epsdecaf.expedia.comeps-console-ldap-api-us-west-2.prod.epsdecaf.expedia.comcomeforstayfor.expedia.ca+20 more
Valid SSL / TLS certificate active
Issued by C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, valid for 60 remaining days.
+10
Key Legal & Transparency Pages
privacy PageNot linked
terms PageNot linked
contact PageNot linked
about PageNot linked
refund PageNot linked
shipping PageNot linked
cookies PageNot linked
- Published Phone Numbers
- 88-55560893, 9797114112, 119111116105102, 111112111100111, 1169797112, 979999111114
No privacy policy found
Legally required in most jurisdictions. Its absence is a real red flag.
-4
No terms of service found
Reputable sites usually publish a terms of service.
-4
No contact page found
Reputable sites usually publish a contact page.
-4
No about page found
Reputable sites usually publish a about page.
-3
No refund/return policy found
Reputable sites usually publish a refund/return policy.
-3
No cookie policy found
Reputable sites usually publish a cookie policy.
-2
Phone number published
+2
- Robots.txt Directives
- Present & Configured
- Sitemaps Declared
- None in robots.txt
- Disallow Rules Count
- 62 rules
View Raw robots.txt
# # General bots # user-agent: * #hotel disallow: /Hotel-Search disallow: /hotel-search disallow: /search? disallow: /*/search? disallow: /ugc/urs/api/hotelreviews/hotel/HOTELID/ disallow: /LastBooking/ElapsedTime disallow: /*chkin=* disallow: /*chkout=* disallow: /HotelCheckout disallow: /Checkout disallow: /checkout disallow: /HotelBookingConfirmation disallow: /en-au/ disallow: /en-nz/ #flight disallow: /Flights-Search disallow: /Flight-Information disallow: /Flight-SearchResults disallow: /Flights-BagFees disallow: /Details disallow: /FlightCheckout disallow: /Confirmation-Flight #package disallow: /MultiItemCheckout disallow: /MultiItemBookingConfirmation disallow: /flexibleshopping #car disallow: /carsearch disallow: /CarCheckout #activities disallow: /things-to-do/search? disallow: /things-to-do/*/search? disallow: /*/things-to-do/search disallow: /things-to-do/reviews-external$ #cruise disallow: /Cruise-Search disallow: /Cruise-CabinCategory disallow: /CruiseCheckout #other disallow: /legacyGOTO disallow: /go/ disallow: /info/ disallow: /trips/ disallow: /Search-Results disallow: /user/createaccount disallow: /signup?* disallow: /login?* #test-seo disallow: /api/uisprime/track disallow: /trvl-px/ disallow: /egcs/v2/collect disallow: /api/ucs/shortlist/ disallow: /api/v4/typeahead/ disallow: /p/home disallow: /*/p/home disallow: /auth/ disallow: /*/auth/ disallow: /*/sso/ # # Ads # user-agent: google-hoteladsverifier user-agent: Mediapartners-Google user-agent: AdsBot-Google-Mobile user-agent: AdsBot-Google user-agent: AdIdxBot user-agent: OAI-AdsBot allow: / #test-seo disallow: /api/uisprime/track disallow: /trvl-px/ disallow: /egcs/v2/collect disallow: /api/ucs/shortlist/ disallow: /api/v4/typeahead/ # # SemrushBot # user-agent: SemrushBot disallow: / # # AI Search # user-agent: OAI-SearchBot user-agent: ChatGPT-User user-agent: PerplexityBot user-agent: Perplexity-User user-agent: Claude-User user-agent: Claude-SearchBot allow: / disallow: /p/home disallow: /*/p/home disallow: /auth/ disallow: /*/auth/ disallow: /*/sso/
robots.txt published
+2
Export & Share Intelligence
Download the complete official PDF verification report (all sections and technical signals expanded), or export raw JSON telemetry.
Scan Engine Performance
Automated multi-signal inspection pipeline
Signals Analyzed
37
This scan
Sources Checked
18
Live security feeds
Scan Duration
5.69s
Ultra-fast
Last Scan
9/5/2026
Live timestamp
Overall Risk
Low Risk