dndlabs.io
Open in
urlscan Pro
165.22.47.208
Malicious Activity!
Public Scan
Effective URL: https://dndlabs.io/wordpress/wp-content/plugins/updraftplus/images/notices/SHIPMENT/trackingreference?auth/track
Submission: On March 11 via api from BE
Summary
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on November 15th 2020. Valid for: a year.
This is the only time dndlabs.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 74.114.154.22 74.114.154.22 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
4 | 192.0.77.40 192.0.77.40 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 12 | 165.22.47.208 165.22.47.208 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
16 | 4 |
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: rs5-nyc.serverhostgroup.com
dndlabs.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
dndlabs.io
1 redirects
dndlabs.io |
596 KB |
5 |
tumblr.com
dhlhq-service.tumblr.com assets.tumblr.com |
149 KB |
16 | 2 |
Domain | Requested by | |
---|---|---|
12 | dndlabs.io |
1 redirects
dhlhq-service.tumblr.com
dndlabs.io |
4 | assets.tumblr.com |
dhlhq-service.tumblr.com
|
1 | dhlhq-service.tumblr.com | |
16 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
track.dhlparcel.co.uk |
www.youtube.com |
www.facebook.com |
www.linkedin.com |
www.instagram.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.tumblr.com Sectigo RSA Domain Validation Secure Server CA |
2020-03-26 - 2022-06-28 |
2 years | crt.sh |
dndlabs.io RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2020-11-15 - 2021-11-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://dndlabs.io/wordpress/wp-content/plugins/updraftplus/images/notices/SHIPMENT/trackingreference?auth/track
Frame ID: C88F70DEB1CFBA1D4958ACCB7104C5DA
Requests: 29 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://dhlhq-service.tumblr.com/ Page URL
-
https://dndlabs.io/wordpress/wp-content/plugins/updraftplus/images/notices/SHIPMENT/
HTTP 302
https://dndlabs.io/wordpress/wp-content/plugins/updraftplus/images/notices/SHIPMENT/trackingref... Page URL
Detected technologies
Lua (Programming Languages) ExpandDetected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
OpenResty (Web Servers) Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Go to DHL Parcel UK Tracking
Search URL Search Domain Scan URL
Title: Visit us on
Search URL Search Domain Scan URL
Title: Visit us on
Search URL Search Domain Scan URL
Title: Visit us on
Search URL Search Domain Scan URL
Title: Visit us on
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://dhlhq-service.tumblr.com/ Page URL
-
https://dndlabs.io/wordpress/wp-content/plugins/updraftplus/images/notices/SHIPMENT/
HTTP 302
https://dndlabs.io/wordpress/wp-content/plugins/updraftplus/images/notices/SHIPMENT/trackingreference?auth/track Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
dhlhq-service.tumblr.com/ |
11 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stylesheet.css
assets.tumblr.com/fonts/gibson/ |
2 KB 716 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pre_tumblelog.js
assets.tumblr.com/assets/scripts/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.build.js
assets.tumblr.com/client/prod/standalone/tumblelog/ |
698 KB 142 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tumblelog_post_message_queue.js
assets.tumblr.com/assets/scripts/ |
355 B 223 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
Primary Request
trackingreference
dndlabs.io/wordpress/wp-content/plugins/updraftplus/images/notices/SHIPMENT/ Redirect Chain
|
1 MB 596 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
bundle.42d05e577ad02daf36f0f37173cd30b9.css
dndlabs.io/etc/clientlibs/dhl/clientlib-all/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
03f859bf58e4d37841070de34be7d978.woff
dndlabs.io/etc/clientlibs/dhl/clientlib-all/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
4a350e02a03ac62e72e9ea575b31ce84.woff
dndlabs.io/etc/clientlibs/dhl/clientlib-all/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
4e23ecf085132857bdb54b4da7373151.woff
dndlabs.io/etc/clientlibs/dhl/clientlib-all/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
5132a7ca80ea9e18ec8cecc618cf5a0b.woff
dndlabs.io/etc/clientlibs/dhl/clientlib-all/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
5344c951fb831328c1d467dc06f04e60.woff
dndlabs.io/etc/clientlibs/dhl/clientlib-all/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
67dd9346877fd6c6a83d3ce92d6a8adf.woff
dndlabs.io/etc/clientlibs/dhl/clientlib-all/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
c2d3739d2debffea340a58b7b8ab3c61.woff
dndlabs.io/etc/clientlibs/dhl/clientlib-all/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
d2c082a9f78e61ea7ccefecaca4da8a3.woff
dndlabs.io/etc/clientlibs/dhl/clientlib-all/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
e39bd2e2657ce5dd6f9c33df18529233.woff
dndlabs.io/etc/clientlibs/dhl/clientlib-all/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
51 KB 51 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 9 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
47 KB 47 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
48 KB 48 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
48 KB 48 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
35 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
53 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests; default-src https: data:; script-src https: data: 'unsafe-inline' 'unsafe-eval'; style-src https: blob: 'unsafe-inline'; |
Strict-Transport-Security | max-age=15552001 |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.tumblr.com
dhlhq-service.tumblr.com
dndlabs.io
165.22.47.208
192.0.77.40
74.114.154.22
09c684a161aed10b05b23225ed6b67e8270389ef1e2d58b111b53eb1b4165f82
254cf231aeb12fa55b835a27e3a065fbdca885e532b1ad1ecaca8337ce996910
25872db2d1c2c6b58c76ab41bf171906a23078982e363d9bcbce89d61a53a025
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
43027752f5a04142e6518a4fd8ef54e7e73cfba7820da9c03c1ad38835f04fe2
4b621cd4ccf986847c5f640d6ab7a713e3355bdd9e1510ccc97d09f150f5955f
5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038
70d3e8b2eabcdf9e7085598091a6f2e325818b03996d7dd7dac4473cda40cb3e
83a37945905e7dc340d377804e0f29b55b230fcadb43878f18922a1f9b4558be
8da3c9b02ef69da302a40a822adcfa050b0341291124953194341e718808d4e4
acd3eaf2b608fb48f9915964c36772b322ad91106508c4490e2a72122db4d347
c32f1a0f5b093b6b2c8f5df0bf93856359769ee6bbab40975043cd133711d528
d8f8520f4c4489713db3fddc7871e7ff437bfb1d9bf13210c6c5bffbd6697a61
db154e472ec01a2a6a45576e0e382f42622dd0ec306c1dd594a4090a8b3aa45e
f01c2e1870fcd75ceca3b4c42c3110cb0aa4b933b562cf3d2c7ddd20ce03c7ee