mercury-scandalous-light.glitch.me Open in urlscan Pro
3.216.104.157  Malicious Activity! Public Scan

URL: http://mercury-scandalous-light.glitch.me/
Submission: On August 24 via automatic, source openphish — Scanned from DE

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 14 HTTP transactions. The main IP is 3.216.104.157, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is mercury-scandalous-light.glitch.me.
This is the only time mercury-scandalous-light.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
2 3.216.104.157 14618 (AMAZON-AES)
1 2001:4de0:ac1... 20446 (STACKPATH...)
9 23.45.108.153 16625 (AKAMAI-AS)
14 4
Apex Domain
Subdomains
Transfer
9 express.dhl
mydhl.express.dhl — Cisco Umbrella Rank: 44202
705 KB
2 glitch.me
mercury-scandalous-light.glitch.me
20 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 736
33 KB
14 3
Domain Requested by
9 mydhl.express.dhl mercury-scandalous-light.glitch.me
mydhl.express.dhl
2 mercury-scandalous-light.glitch.me mercury-scandalous-light.glitch.me
1 code.jquery.com mercury-scandalous-light.glitch.me
14 3

This site contains no links.

Subject Issuer Validity Valid
mydhl.express.dhl
DPDHL Global TLS CA - I5
2023-06-22 -
2024-06-21
a year crt.sh

This page contains 1 frames:

Primary Page: http://mercury-scandalous-light.glitch.me/
Frame ID: EF80FD5D15EA1839FAFDE19A47223DE7
Requests: 15 HTTP requests in this frame

Screenshot

Page Title

Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • <div class="[^"]*parbase
  • <div class="[^"]*aem-Grid
  • /etc/clientlibs/
  • /etc\.clientlibs/

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

64 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

758 kB
Transfer

1391 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
mercury-scandalous-light.glitch.me/
19 KB
20 KB
Document
General
Full URL
http://mercury-scandalous-light.glitch.me/
Protocol
HTTP/1.1
Server
3.216.104.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-216-104-157.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
fb529c37591d63908ad915ac9e3e1e7a95639b1b15eb080cac33f5248698131a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Length
19681
Content-Type
text/html; charset=utf-8
Date
Thu, 24 Aug 2023 01:10:28 GMT
accept-ranges
bytes
cache-control
no-cache
etag
"ef52b1160564f0e189693ba9f6065f1b"
last-modified
Fri, 12 Feb 2021 18:16:02 GMT
server
AmazonS3
x-amz-id-2
YGLneaq4O/Af6/mnjwIxA8bcIpwllox52lmtnLuPuzRzsm+QMhSTpDNdKUvv1WnPl1qKci9tV8g=
x-amz-request-id
YX1XCT62YDFRHS86
x-amz-version-id
WPrcrMedFbu7JvrpBdNZR3cvvRgUK5_4
jquery-1.11.1.min.js
code.jquery.com/
94 KB
33 KB
Script
General
Full URL
http://code.jquery.com/jquery-1.11.1.min.js
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
HTTP/1.1
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Thu, 24 Aug 2023 01:10:28 GMT
Content-Encoding
gzip
Last-Modified
Fri, 12 Aug 2022 13:47:01 GMT
Server
nginx
ETag
W/"62f659d5-1762a"
Vary
Accept-Encoding
X-HW
1692839428.dop222.fr8.t,1692839428.cds227.fr8.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
33202
ewf-base.css
mydhl.express.dhl/etc/clientlibs/dhl/global/public/stylesheets/
251 KB
46 KB
Stylesheet
General
Full URL
https://mydhl.express.dhl/etc/clientlibs/dhl/global/public/stylesheets/ewf-base.css
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.108.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-153.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
33a63cf332ee53d36a10004b159764e4c022483f46abdfe50e7b8bf9dabee8b4
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000 ; includeSubDomains
date
Thu, 24 Aug 2023 01:10:28 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1692839428848_390277172_597697725_50_121212_6_0_255";dur=1
content-length
47094
x-akamai-tls
tls1.2
last-modified
Tue, 22 Aug 2023 07:30:44 GMT
server
nginx
etag
"3ead0-6037df90f3dd2-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=86400, public
accept-ranges
bytes
expires
Thu, 24 Aug 2023 00:47:44 GMT
ewf-components.css
mydhl.express.dhl/etc/clientlibs/dhl/global/public/stylesheets/
226 KB
48 KB
Stylesheet
General
Full URL
https://mydhl.express.dhl/etc/clientlibs/dhl/global/public/stylesheets/ewf-components.css
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.108.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-153.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
0db0ea4a576ba2a3938f02f4863d509ae40487875386279f782fbaf18de72573
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000 ; includeSubDomains
date
Thu, 24 Aug 2023 01:10:28 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1692839428870_390277172_597697726_50_121012_6_19_255";dur=1
content-length
49022
x-akamai-tls
tls1.2
last-modified
Mon, 21 Aug 2023 05:11:08 GMT
server
nginx
etag
"3891c-60367e7f4505c-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=86400, public
accept-ranges
bytes
expires
Wed, 23 Aug 2023 07:20:56 GMT
ewf-cosmetic.css
mydhl.express.dhl/etc/clientlibs/dhl/global/public/stylesheets/
8 KB
3 KB
Stylesheet
General
Full URL
https://mydhl.express.dhl/etc/clientlibs/dhl/global/public/stylesheets/ewf-cosmetic.css
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.108.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-153.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e4a2f7c9c80eb07517984a09b072326db6ae91f5e0742540f01903724c4ebb2f
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000 ; includeSubDomains
date
Thu, 24 Aug 2023 01:10:28 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1692839428870_390277172_597697727_52_120991_6_0_255";dur=1
content-length
2266
x-akamai-tls
tls1.2
last-modified
Sat, 19 Aug 2023 03:18:35 GMT
server
nginx
etag
"20bb-6033e19c04911-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=86400, public
accept-ranges
bytes
expires
Wed, 23 Aug 2023 07:20:56 GMT
jquery.js
mydhl.express.dhl/etc.clientlibs/clientlibs/granite/
289 KB
101 KB
Script
General
Full URL
https://mydhl.express.dhl/etc.clientlibs/clientlibs/granite/jquery.js
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.108.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-153.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b9dd2080ab9f46659b9ceb72fd93def941195e854ccfa6b5409a20c40a0425bd
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000 ; includeSubDomains
date
Thu, 24 Aug 2023 01:10:28 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1692839428870_390277172_597697728_107_120972_6_0_219";dur=1
content-length
102928
x-akamai-tls
tls1.2
last-modified
Sat, 19 Aug 2023 03:18:36 GMT
server
nginx
etag
"4849e-6033e19d72dd7-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=86400, public
accept-ranges
bytes
expires
Thu, 24 Aug 2023 00:47:44 GMT
dhl_express_logo_transparent.png
mydhl.express.dhl/content/dam/ewf/logos/
2 KB
2 KB
Image
General
Full URL
https://mydhl.express.dhl/content/dam/ewf/logos/dhl_express_logo_transparent.png
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.108.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-153.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
35b8eca53271516f3d66a3dd8f89e1366edb87adad26015424148de71dfcce46
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
date
Thu, 24 Aug 2023 01:10:28 GMT
content-disposition
attachment
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1692839428870_390277172_597697729_48_121322_6_0_146";dur=1
content-length
1940
x-akamai-tls
tls1.2
last-modified
Fri, 18 Aug 2023 22:50:43 GMT
server
nginx
etag
"794-6033a5bcf96c3"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=10800, public
accept-ranges
bytes
expires
Wed, 23 Aug 2023 20:10:32 GMT
logout-image.png
mydhl.express.dhl/content/dhl/dam/
125 KB
126 KB
Image
General
Full URL
https://mydhl.express.dhl/content/dhl/dam/logout-image.png
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.108.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-153.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
bec410bdccc6b1342258f0aa17fb3ddf86a362141a485a44a85b4da078804201
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
strict-transport-security
max-age=31536000 ; includeSubDomains
date
Thu, 24 Aug 2023 01:10:28 GMT
content-disposition
attachment
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1692839428870_390277172_597697730_106_121859_6_0_146";dur=1
content-length
128091
dc-name
CBJ
x-akamai-tls
tls1.2
last-modified
Sat, 19 Aug 2023 13:06:36 GMT
server
nginx
etag
"1f45b-6034650b2a3a8"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=10800, public
accept-ranges
bytes
expires
Tue, 22 Aug 2023 10:20:56 GMT
MyDHL_Logo_73x38.png
mydhl.express.dhl/content/dam/ewf/logos/
2 KB
2 KB
Image
General
Full URL
https://mydhl.express.dhl/content/dam/ewf/logos/MyDHL_Logo_73x38.png
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.108.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-153.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
52aef0018a3fd9fc92f48bd3dd5cb9a69390ad34764ac653a249306d5dc9f694
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
date
Thu, 24 Aug 2023 01:10:29 GMT
content-disposition
attachment
server-timing
cdn-cache; desc=HIT, edge; dur=6, ak_p; desc="1692839429006_390277172_597697783_622_12808_10_0_146";dur=1
content-length
1965
x-akamai-tls
tls1.2
last-modified
Mon, 21 Aug 2023 05:11:08 GMT
server
nginx
etag
"7ad-60367e7f42dfc"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=10800, public
accept-ranges
bytes
expires
Tue, 22 Aug 2023 10:20:56 GMT
accessibility.css
mercury-scandalous-light.glitch.me/Login_files/
0
0
Stylesheet
General
Full URL
http://mercury-scandalous-light.glitch.me/Login_files/accessibility.css
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
HTTP/1.1
Server
3.216.104.157 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-216-104-157.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Date
Thu, 24 Aug 2023 01:10:28 GMT
Cache-Control
max-age=0
Connection
keep-alive
Content-Length
3672
footer-logo.png
mydhl.express.dhl/content/dam/ewf/logos/
6 KB
7 KB
Image
General
Full URL
https://mydhl.express.dhl/content/dam/ewf/logos/footer-logo.png
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.108.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-153.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
baed8711f954b7a12fd77083f6bedaa1277f31e99b378ea6cda883474077355e
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
date
Thu, 24 Aug 2023 01:10:29 GMT
content-disposition
attachment
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1692839429026_390277172_597697790_211_12701_9_0_146";dur=1
content-length
6506
x-akamai-tls
tls1.2
last-modified
Sun, 20 Aug 2023 19:58:10 GMT
server
nginx
etag
"196a-603602e677e7f"
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
max-age=10800, public
accept-ranges
bytes
expires
Mon, 21 Aug 2023 04:44:46 GMT
us_background.jpg
mydhl.express.dhl/content/dam/ewf/country-background/us/
369 KB
369 KB
Image
General
Full URL
https://mydhl.express.dhl/content/dam/ewf/country-background/us/us_background.jpg
Requested by
Host: mercury-scandalous-light.glitch.me
URL: http://mercury-scandalous-light.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.45.108.153 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-108-153.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
0ad62234ce1eaba093267da112aba2bbedddc888dded6101ec7cf52d81176eed
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.dhl.com ws: https: http:
strict-transport-security
max-age=31536000 ; includeSubDomains
x-content-type-options
nosniff
date
Thu, 24 Aug 2023 01:10:29 GMT
content-disposition
attachment
server-timing
cdn-cache; desc=HIT, edge; dur=4, ak_p; desc="1692839429102_390277172_597697826_1893_12857_9_0_146";dur=1
content-length
377471
x-akamai-tls
tls1.2
last-modified
Fri, 18 Aug 2023 22:56:50 GMT
server
nginx
etag
"5c27f-6033a71b3aaaa"
x-frame-options
SAMEORIGIN
content-type
image/jpeg
cache-control
max-age=10800, public
accept-ranges
bytes
expires
Mon, 21 Aug 2023 04:03:24 GMT
truncated
/
505 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
13599f9bdecf3f99eb5c05ef5b532d0a56f84abc0d63697a28ed69b054be7905

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mercury-scandalous-light.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

Content-Type
image/png
dhl-icon.woff
mydhl.express.dhl/etc/clientlibs/dhl/global/public/fonts/
0
0

dhl-icon.ttf
mydhl.express.dhl/etc/clientlibs/dhl/global/public/fonts/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
mydhl.express.dhl
URL
https://mydhl.express.dhl/etc/clientlibs/dhl/global/public/fonts/dhl-icon.woff?versionHash=ue0020142
Domain
mydhl.express.dhl
URL
https://mydhl.express.dhl/etc/clientlibs/dhl/global/public/fonts/dhl-icon.ttf?versionHash=ue0020142

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery undefined| ie9ConsoleMethods function| validateForm function| ValidateEmail object| matched object| browser

0 Cookies

5 Console Messages

Source Level URL
Text
network error URL: http://mercury-scandalous-light.glitch.me/Login_files/accessibility.css
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
javascript error URL: http://mercury-scandalous-light.glitch.me/
Message:
Access to font at 'https://mydhl.express.dhl/etc/clientlibs/dhl/global/public/fonts/dhl-icon.woff?versionHash=ue0020142' from origin 'http://mercury-scandalous-light.glitch.me' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://mydhl.express.dhl/etc/clientlibs/dhl/global/public/fonts/dhl-icon.woff?versionHash=ue0020142
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: http://mercury-scandalous-light.glitch.me/
Message:
Access to font at 'https://mydhl.express.dhl/etc/clientlibs/dhl/global/public/fonts/dhl-icon.ttf?versionHash=ue0020142' from origin 'http://mercury-scandalous-light.glitch.me' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://mydhl.express.dhl/etc/clientlibs/dhl/global/public/fonts/dhl-icon.ttf?versionHash=ue0020142
Message:
Failed to load resource: net::ERR_FAILED