urlscan.io logo urlscan.io
SecurityTrails logo

stephanienelson.fr Open in urlscan Pro
213.186.33.3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://stephanienelson.fr/indexx.html
Submission: On September 01 via manual from CY — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 213.186.33.3, located in France and belongs to OVH, FR. The main domain is stephanienelson.fr.
This is the only time stephanienelson.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 213.186.33.3 16276 (OVH)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 3
Apex Domain
Subdomains		 Transfer
1 updateship.shop
updateship.shop
1 stephanienelson.fr
stephanienelson.fr
300 KB
2 2
Domain Requested by
1 updateship.shop stephanienelson.fr
1 stephanienelson.fr
2 2
Subject Issuer Validity Valid
updateship.shop
E1		 2023-08-18 -
2023-11-16		 3 months crt.sh

This page contains 2 frames:

Primary Page: http://stephanienelson.fr/indexx.html
Frame ID: 7CC5EB23D80AC8EA7D99C4186479321E
Requests: 4 HTTP requests in this frame

Frame: https://updateship.shop/sk/stara/users/
Frame ID: 50ACCD70368F82A5FF0417D7BABFCA27
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Export, import and express courier delivery services with DHL ExpressBack ButtonSearch IconFilter Icon

Page Statistics

2
Requests

50 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

339 kB
Transfer

1350 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request indexx.html
stephanienelson.fr/ 		1 MB
300 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://stephanienelson.fr/indexx.html
Protocol
HTTP/1.1
Server
213.186.33.3 , France, ASN16276 (OVH, FR),
Reverse DNS
cluster015.ovh.net
Software
Apache /
Resource Hash
1a60610e163034cfc85d525040be27d501e350864df3ab6cdf074705ae768c77

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-type
text/html
date
Fri, 01 Sep 2023 09:32:06 GMT
server
Apache
transfer-encoding
chunked
vary
Accept-Encoding
x-iplb-instance
28305
x-iplb-request-id
B22190B1:C01C_D5BA2103:0050_64F1AF96_5F93:20BAD
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
http://stephanienelson.fr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/png
/
updateship.shop/sk/stara/users/ Frame 50AC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://updateship.shop/sk/stara/users/
Requested by
Host: stephanienelson.fr
URL: http://stephanienelson.fr/indexx.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:ab91 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://stephanienelson.fr/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=15
cf-ray
7ffc81100c642a2f-CDG
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 01 Sep 2023 09:32:07 GMT
expires
Fri, 01 Sep 2023 09:32:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v%2FGQWP%2Fa11AuODFRs0qlQMzNofyQ6aGv0vmzmrRUAXU1Rc1TbWB6dEk9DdrhyLjoI3Q2c0%2F1N6AyfzfNDlUq1kg4kn3cCL2tbgTb4%2BAilspGOj5qXonFTCSbAKJM4TYZubyRexGhrQS9DgwwKMU%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
truncated
/ 		103 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
71cd76e19df0aad70f2e9b57c162a03070836e1056ca8b3353511ee87b2ae08a

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
http://stephanienelson.fr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		38 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
45d3acaec05fa388ae52fbcabd2a573e43a7f8ef69f526641d918696f0b42b68

Request headers

Referer
http://stephanienelson.fr/
Origin
http://stephanienelson.fr
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
application/x-font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 function| savepage_ShadowLoader

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: chrome-error://chromewebdata/
Message:
Failed to load resource: the server responded with a status of 403 ()
other error URL: chrome-error://chromewebdata/
Message:
Refused to display 'https://updateship.shop/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.