dhlparcel.ddns.net
Open in
urlscan Pro
103.142.204.181
Malicious Activity!
Public Scan
Submitted URL: http://smarturl.it/kml0yo?email=nimit.shah@citi.com
Effective URL: https://dhlparcel.ddns.net/DHL/hl/deutcheautolink.php?email=nimit.shah%40citi.com
Submission: On March 11 via manual from US
Effective URL: https://dhlparcel.ddns.net/DHL/hl/deutcheautolink.php?email=nimit.shah%40citi.com
Submission: On March 11 via manual from US
Summary
This website contacted 1 IPs
in 2 countries
across 3 domains to perform 3 HTTP transactions.
The main IP is 103.142.204.181, located in
United States and
belongs to XRCLOUDNETINC-AS-AP XRCLOUD.NET INC., HK.
The main domain is dhlparcel.ddns.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 10th 2020. Valid for: 3 months.
This is the only time dhlparcel.ddns.net was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 10th 2020. Valid for: 3 months.
This is the only time dhlparcel.ddns.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 54.175.187.212 54.175.187.212 | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 1 1 | 217.174.152.38 217.174.152.38 | 31083 (TELEPOINT) (TELEPOINT) | |
| 3 | 103.142.204.181 103.142.204.181 | 136746 (XRCLOUDNE...) (XRCLOUDNETINC-AS-AP XRCLOUD.NET INC.) | |
| 3 | 1 |
1
54.175.187.212
(Ashburn, United States)
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-175-187-212.compute-1.amazonaws.com
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-175-187-212.compute-1.amazonaws.com
| smarturl.it |
1
217.174.152.38
(Dobrich, Bulgaria)
ASN31083 (TELEPOINT, BG)
PTR: honey.vivawebhost.com
ASN31083 (TELEPOINT, BG)
PTR: honey.vivawebhost.com
| dhl.bakerwala.com |
3
103.142.204.181
(United States)
ASN136746 (XRCLOUDNETINC-AS-AP XRCLOUD.NET INC., HK)
ASN136746 (XRCLOUDNETINC-AS-AP XRCLOUD.NET INC., HK)
| dhlparcel.ddns.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
ddns.net
dhlparcel.ddns.net |
305 KB |
| 1 |
bakerwala.com
1 redirects
dhl.bakerwala.com |
281 B |
| 1 |
smarturl.it
1 redirects
smarturl.it |
1 KB |
| 3 | 3 |
| Domain | Requested by | |
|---|---|---|
| 3 | dhlparcel.ddns.net |
dhlparcel.ddns.net
|
| 1 | dhl.bakerwala.com | 1 redirects |
| 1 | smarturl.it | 1 redirects |
| 3 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| dhlparcel.ddns.net cPanel, Inc. Certification Authority |
2020-03-10 - 2020-06-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dhlparcel.ddns.net/DHL/hl/deutcheautolink.php?email=nimit.shah%40citi.com
Frame ID: E1D684FE35D93CF1478C1540E0FE9D01
Requests: 3 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://smarturl.it/kml0yo?email=nimit.shah@citi.com
HTTP 301
http://dhl.bakerwala.com/?email=nimit.shah%40citi.com HTTP 302
https://dhlparcel.ddns.net/DHL/hl/deutcheautolink.php?email=nimit.shah%40citi.com Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://smarturl.it/kml0yo?email=nimit.shah@citi.com
HTTP 301
http://dhl.bakerwala.com/?email=nimit.shah%40citi.com HTTP 302
https://dhlparcel.ddns.net/DHL/hl/deutcheautolink.php?email=nimit.shah%40citi.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
deutcheautolink.php
dhlparcel.ddns.net/DHL/hl/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
butts.jpg
dhlparcel.ddns.net/DHL/hl/mgjss/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
leyinleyin.jpg
dhlparcel.ddns.net/DHL/hl/mgjss/ |
300 KB 300 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dhl.bakerwala.com
dhlparcel.ddns.net
smarturl.it
103.142.204.181
217.174.152.38
54.175.187.212
36efac88a37707de014915765b4bf6cdc63810ade588732ed6d9de0a88233a57
418d1991741b54879307ec05caee82d99f790a9f2102be6381aac6d5d2d6f32a
9c3e014d9504263a21513eb708bb4c4dce45610b32f44a70f1e7fbf174420614