app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io Open in urlscan Pro
46.252.181.151  Malicious Activity! Public Scan

Submitted URL: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443
Effective URL: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Submission: On June 13 via api from JP — Scanned from FR

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 46.252.181.151, located in France and belongs to MAGICRETAIL, FR. The main domain is app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io.
TLS certificate: Issued by R3 on May 26th 2023. Valid for: 3 months.
This is the only time app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
3 11 46.252.181.151 43424 (MAGICRETAIL)
1 1 185.42.117.192 43424 (MAGICRETAIL)
8 1
Apex Domain
Subdomains
Transfer
12 cleverapps.io
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io
201 KB
8 1
Domain Requested by
12 app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io 4 redirects app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io
8 1

This site contains no links.

Subject Issuer Validity Valid
*.cleverapps.io
R3
2023-05-26 -
2023-08-24
3 months crt.sh

This page contains 1 frames:

Primary Page: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Frame ID: E26CE6CD3DEDB398C99BB67FF8C87A1B
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

herzlich willkommen

Page URL History Show full URLs

  1. https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443 HTTP 301
    http://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/ HTTP 301
    https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/ HTTP 302
    https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/index.php?valid=true&id=59589932 HTTP 302
    https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

200 kB
Transfer

400 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443 HTTP 301
    http://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/ HTTP 301
    https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/ HTTP 302
    https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/index.php?valid=true&id=59589932 HTTP 302
    https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 00951124a.php
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/
Redirect Chain
  • https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443
  • http://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/
  • https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/
  • https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/index.php?valid=true&id=59589932
  • https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
3 KB
2 KB
Document
General
Full URL
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.252.181.151 , France, ASN43424 (MAGICRETAIL, FR),
Reverse DNS
Software
Apache /
Resource Hash
18b1d0159d40823c271bb511fbe944f67c62778ff7c6601f14b69b349179057c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Content-Encoding
gzip
Content-Length
1260
Content-Type
text/html; charset-UTF-8;charset=UTF-8
Date
Tue, 13 Jun 2023 20:33:39 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
Apache
Sozu-Id
01H2V7DJDC4N7TCEKMNM4MNBH3
Vary
Accept-Encoding

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Content-Encoding
gzip
Content-Length
311
Content-Type
text/html; charset-UTF-8;charset=UTF-8
Date
Tue, 13 Jun 2023 20:33:38 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Location
./00951124a.php?web=succes&local=_&id=17296708
Pragma
no-cache
Server
Apache
Sozu-Id
01H2V7DBH4FZJY3DWF2GR3B9EK
Vary
Accept-Encoding
style.css
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/css/
208 KB
72 KB
Stylesheet
General
Full URL
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/css/style.css
Requested by
Host: app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io
URL: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.252.181.151 , France, ASN43424 (MAGICRETAIL, FR),
Reverse DNS
Software
Apache /
Resource Hash
4f8f4fd45d94287ee659e98b6351916a02a5cbf388a53a31fa0219e06a7d03b0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date
Tue, 13 Jun 2023 20:33:40 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2023 20:31:39 GMT
Server
Apache
ETag
"34151-5fe08b8ea44f7-gzip"
Vary
Accept-Encoding
Transfer-Encoding
chunked
Content-Type
text/css
Sozu-Id
01H2V7DKH9DNX7WGX6XDV1E05A
Accept-Ranges
bytes
style.js
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/js/
96 KB
34 KB
Script
General
Full URL
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/js/style.js
Requested by
Host: app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io
URL: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.252.181.151 , France, ASN43424 (MAGICRETAIL, FR),
Reverse DNS
Software
Apache /
Resource Hash
b56dd0f5e443608e46b42696f86fe376190c1688f2586cf5345b0b43f2973a5c

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date
Tue, 13 Jun 2023 20:33:40 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2023 20:31:40 GMT
Server
Apache
ETag
"17f6f-5fe08b8fc4a3e-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Sozu-Id
01H2V7DMA536W4AVFZ0WNDZ69E
Accept-Ranges
bytes
Content-Length
34470
lg.svg
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/
2 KB
1 KB
Image
General
Full URL
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/lg.svg
Requested by
Host: app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io
URL: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.252.181.151 , France, ASN43424 (MAGICRETAIL, FR),
Reverse DNS
Software
Apache /
Resource Hash
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date
Tue, 13 Jun 2023 20:33:40 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2023 20:31:39 GMT
Server
Apache
ETag
"7f8-5fe08b8ee196f-gzip"
Vary
Accept-Encoding
Content-Type
image/svg+xml
Sozu-Id
01H2V7DMMHNGF1EYSSTNSNHBMH
Accept-Ranges
bytes
Content-Length
729
pak.png
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/
878 B
1 KB
Image
General
Full URL
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/pak.png
Requested by
Host: app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io
URL: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.252.181.151 , France, ASN43424 (MAGICRETAIL, FR),
Reverse DNS
Software
Apache /
Resource Hash
4057023fcfa4360934b1a1409a74a40ffbc2bb7dacd2bcc6f69d66a9673f09e8

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date
Tue, 13 Jun 2023 20:33:40 GMT
Last-Modified
Tue, 13 Jun 2023 20:31:39 GMT
Server
Apache
ETag
"36e-5fe08b8f1de47"
Content-Type
image/png
Sozu-Id
01H2V7DMVRYPYB1SF1D4G67T4Y
Accept-Ranges
bytes
Content-Length
878
ta3.svg
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/
2 KB
1 KB
Image
General
Full URL
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/ta3.svg
Requested by
Host: app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io
URL: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.252.181.151 , France, ASN43424 (MAGICRETAIL, FR),
Reverse DNS
Software
Apache /
Resource Hash
42794908246997d603888b2c2098941e0c3f9b7b0f719134365789189c7edac0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date
Tue, 13 Jun 2023 20:33:40 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2023 20:31:40 GMT
Server
Apache
ETag
"77d-5fe08b8f8b05e-gzip"
Vary
Accept-Encoding
Content-Type
image/svg+xml
Sozu-Id
01H2V7DMWNT1XCC3BRC6VYGF00
Accept-Ranges
bytes
Content-Length
1048
pub.jpg
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/
80 KB
80 KB
Image
General
Full URL
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/pub.jpg
Requested by
Host: app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io
URL: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.252.181.151 , France, ASN43424 (MAGICRETAIL, FR),
Reverse DNS
Software
Apache /
Resource Hash
fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date
Tue, 13 Jun 2023 20:33:41 GMT
Last-Modified
Tue, 13 Jun 2023 20:31:39 GMT
Server
Apache
ETag
"140d5-5fe08b8f6666f"
Content-Type
image/jpeg
Sozu-Id
01H2V7DMYYMTT9DXNSJ4MD4EB4
Accept-Ranges
bytes
Content-Length
82133
pubr.gif
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/
8 KB
8 KB
Image
General
Full URL
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/layout/img/pubr.gif
Requested by
Host: app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io
URL: https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.252.181.151 , France, ASN43424 (MAGICRETAIL, FR),
Reverse DNS
Software
Apache /
Resource Hash
38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/d86123a11c9c4e44a5f59871f447c443/F004f19441/00951124a.php?web=succes&local=_&id=17296708
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date
Tue, 13 Jun 2023 20:33:41 GMT
Last-Modified
Tue, 13 Jun 2023 20:31:40 GMT
Server
Apache
ETag
"2098-5fe08b8f827a6"
Content-Type
image/gif
Sozu-Id
01H2V7DMZ8558T0N62VGFFTZJ5
Accept-Ranges
bytes
Content-Length
8344

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| preventBack object| Modernizr function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
app-038e1553-5c33-4243-901e-fb136725ebdd.cleverapps.io/ Name: PHPSESSID
Value: k2t2rc290rl6d6l4el49c05o5l