dhl-empfangsbestatigung.com Open in urlscan Pro
8.209.100.31 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://s.id/empfangsbestatigung
Effective URL:
https://dhl-empfangsbestatigung.com/versand/
Submission Tags: falconsandbox
Submission: On April 10 via api (April 10th 2021, 4:13:52 pm UTC) from US

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 11 HTTP transactions. The main IP is 8.209.100.31, located in Singapore and belongs to CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN. The main domain is dhl-empfangsbestatigung.com.
TLS certificate: Issued by R3 on April 9th 2021. Valid for: 3 months.

This is the only time dhl-empfangsbestatigung.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2 2	2402:ee80:59:... 2402:ee80:59:2::136	132647 (IDNIC-PAN...) (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia)
3	8.209.100.31 8.209.100.31	45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.)
2	2a02:26f0:6c0... 2a02:26f0:6c00:1bc::39ce	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	3

2 2402:ee80:59:2::136 (Indonesia) 2 redirects

ASN132647 (IDNIC-PANDI-AS-ID Pengelola Nama Domain Internet Indonesia, ID)

s.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 8.209.100.31 (Singapore)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)

dhl-empfangsbestatigung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:1bc::39ce (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.dhl.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	dhl-empfangsbestatigung.com dhl-empfangsbestatigung.com	28 KB
2	dhl.de www.dhl.de	5 KB
2	s.id 2 redirects s.id	1 KB
11	3

	Domain	Requested by
3	dhl-empfangsbestatigung.com	dhl-empfangsbestatigung.com
2	www.dhl.de	dhl-empfangsbestatigung.com
2	s.id	2 redirects
11	3

This site contains no links.

Subject Issuer	Validity	Valid
dhl-empfangsbestatigung.com R3	`2021-04-09` - `2021-07-08`	3 months	crt.sh
www.dhl.de DPDHL Global TLS CA - I5	`2020-08-21` - `2021-08-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://dhl-empfangsbestatigung.com/versand/
Frame ID: 3967BA23CF543C944C74BDE38284B3D0
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://s.id/empfangsbestatigung HTTP 301
https://s.id/empfangsbestatigung HTTP 301
https://dhl-empfangsbestatigung.com/versand/ Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

45 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

33 kB
Transfer

252 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://s.id/empfangsbestatigung HTTP 301
https://s.id/empfangsbestatigung HTTP 301
https://dhl-empfangsbestatigung.com/versand/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
dhl-empfangsbestatigung.com/versand/
Redirect Chain

http://s.id/empfangsbestatigung
https://s.id/empfangsbestatigung
https://dhl-empfangsbestatigung.com/versand/

96 KB
8 KB

468ms
72ms

Document
text/html

8.209.100.31
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: https://dhl-empfangsbestatigung.com/versand/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.209.100.31 , Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: e440a182a48a2487dd164543fa983df27245d879e5a85539122007847e798efb

Request headers

Host: dhl-empfangsbestatigung.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 16:13:36 GMT
Server: Apache/2.4.18 (Ubuntu)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 8175
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Server: nginx/1.18.0
Date: Sat, 10 Apr 2021 16:13:36 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 79
Connection: keep-alive
Location: https://dhl-empfangsbestatigung.com/versand/
Strict-Transport-Security: max-age=63072000
Referrer-Policy: no-referrer
Content-Security-Policy: upgrade-insecure-requests
Feature-Policy: geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()

GET
H/1.1 200
OK style.css
dhl-empfangsbestatigung.com/versand/ 145 KB
20 KB 76ms
75ms Stylesheet
text/css 8.209.100.31
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: https://dhl-empfangsbestatigung.com/versand/style.css
Requested by: Host: dhl-empfangsbestatigung.com
URL: https://dhl-empfangsbestatigung.com/versand/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.209.100.31 , Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 6dda6a7b143c66bb52777565a93cf95c79f3190400a9f39eb0f0478ba8160eb1

Request headers

Referer: https://dhl-empfangsbestatigung.com/versand/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 16:13:36 GMT
Content-Encoding: gzip
Last-Modified: Sun, 28 Feb 2021 16:04:52 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "24588-5bc67a9531100-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 19817

GET
H2 200 dhl-official.svg
www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/icons/ 2 KB
1 KB 42ms
18ms Image
image/svg+xml 2a02:26f0:6c00:1bc::39ce
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/icons/dhl-official.svg

Requested by

Host: dhl-empfangsbestatigung.com
URL: https://dhl-empfangsbestatigung.com/versand/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:1bc::39ce Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

IPNP /

Resource Hash

aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://dhl-empfangsbestatigung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains
content-encoding: gzip
x-content-type-options: NOSNIFF
x-dns-prefetch-control: off
producers: IPNP-P-CP
x-dpwn-is-secure: 1
content-length: 729
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: IPNP
x-frame-options: SAMEORIGIN
date: Sat, 10 Apr 2021 16:13:36 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: must-revalidate, max-age=355
accept-ranges: bytes
expires: Sat, 10 Apr 2021 16:19:31 GMT

GET
H/1.1 404
Not Found sprite.svg
dhl-empfangsbestatigung.com/etc.clientlibs/redesign/clientlibs/static/resources/icons/ 0
0 151ms
66ms Other
text/html 8.209.100.31
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: https://dhl-empfangsbestatigung.com/etc.clientlibs/redesign/clientlibs/static/resources/icons/sprite.svg
Requested by: Host: dhl-empfangsbestatigung.com
URL: https://dhl-empfangsbestatigung.com/versand/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.209.100.31 , Singapore, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash

Request headers

Referer: https://dhl-empfangsbestatigung.com/versand/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sat, 10 Apr 2021 16:13:37 GMT
Server: Apache/2.4.18 (Ubuntu)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 290
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 dhl-group.svg
www.dhl.de/content/dam/images/ 9 KB
4 KB 36ms
19ms Image
image/svg+xml 2a02:26f0:6c00:1bc::39ce
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.de/content/dam/images/dhl-group.svg

Requested by

Host: dhl-empfangsbestatigung.com
URL: https://dhl-empfangsbestatigung.com/versand/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:1bc::39ce Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

IPNP /

Resource Hash

55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://dhl-empfangsbestatigung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains
content-encoding: gzip
x-content-type-options: NOSNIFF
x-dns-prefetch-control: off
producers: IPNP-P-CP
x-dpwn-is-secure: 1
content-length: 3240
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: IPNP
x-frame-options: SAMEORIGIN
date: Sat, 10 Apr 2021 16:13:36 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: must-revalidate, max-age=2739
accept-ranges: bytes
expires: Sat, 10 Apr 2021 16:59:15 GMT

GET delivery-rg.woff2
www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/ 0
0

GET delivery-bd.woff2
www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/ 0
0

GET delivery-cdblk.woff2
www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/ 0
0

GET delivery-rg.woff
www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/ 0
0

GET delivery-bd.woff
www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/ 0
0

GET delivery-cdblk.woff
www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.dhl.de
URL: https://www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/delivery-rg.woff2

Domain: www.dhl.de
URL: https://www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/delivery-bd.woff2

Domain: www.dhl.de
URL: https://www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/delivery-cdblk.woff2

Domain: www.dhl.de
URL: https://www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/delivery-rg.woff

Domain: www.dhl.de
URL: https://www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/delivery-bd.woff

Domain: www.dhl.de
URL: https://www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/fonts/delivery-cdblk.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dhl-empfangsbestatigung.com
s.id
www.dhl.de
www.dhl.de
2402:ee80:59:2::136
2a02:26f0:6c00:1bc::39ce
8.209.100.31
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114
6dda6a7b143c66bb52777565a93cf95c79f3190400a9f39eb0f0478ba8160eb1
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
e440a182a48a2487dd164543fa983df27245d879e5a85539122007847e798efb

dhl-empfangsbestatigung.com Open in urlscan Pro 8.209.100.31 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

45 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

33 kBTransfer

252 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

dhl-empfangsbestatigung.com Open in urlscan Pro
8.209.100.31 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

45 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

33 kB
Transfer

252 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!