dhl.versand.website
Open in
urlscan Pro
195.35.78.44
Malicious Activity!
Public Scan
URL:
http://dhl.versand.website/go?r=f84dfcdb5162657c588449eb5e015d5f-fb370f12bb
Submission: On August 03 via manual from DE
Submission: On August 03 via manual from DE
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 6 HTTP transactions.
The main IP is 195.35.78.44, located in
Karlsruhe, Germany and
belongs to ENBW-AG, DE.
The main domain is dhl.versand.website.
This is the only time dhl.versand.website was scanned on urlscan.io!
This is the only time dhl.versand.website was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 195.35.78.44 195.35.78.44 | 15698 (ENBW-AG) (ENBW-AG) | |
| 6 | 2 |
6
195.35.78.44
(Karlsruhe, Germany)
ASN15698 (ENBW-AG, DE)
ASN15698 (ENBW-AG, DE)
| dhl.versand.website | |
| catch-us-if-you-can.org | |
| dashboard.catch-us-if-you-can.org |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
catch-us-if-you-can.org
catch-us-if-you-can.org dashboard.catch-us-if-you-can.org |
8 KB |
| 1 |
versand.website
dhl.versand.website |
405 KB |
| 6 | 2 |
| Domain | Requested by | |
|---|---|---|
| 3 | catch-us-if-you-can.org |
dhl.versand.website
|
| 2 | dashboard.catch-us-if-you-can.org |
dhl.versand.website
|
| 1 | dhl.versand.website | |
| 6 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.catch-us-if-you-can.org RapidSSL TLS RSA CA G1 |
2020-06-03 - 2022-06-03 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://dhl.versand.website/go?r=f84dfcdb5162657c588449eb5e015d5f-fb370f12bb
Frame ID: 2B952B8969D21428357B0D3C070D89B8
Requests: 14 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
go
dhl.versand.website/ |
405 KB 405 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
33 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
33 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
33 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
36 KB 0 |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
keepref.js
catch-us-if-you-can.org/ |
563 B 845 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
initgc.js
catch-us-if-you-can.org/ |
192 B 473 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
count.js
dashboard.catch-us-if-you-can.org/ |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
countfuncs.js
catch-us-if-you-can.org/ |
728 B 1010 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
102 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
count
dashboard.catch-us-if-you-can.org/ |
43 B 454 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| findGetParameter object| goatcounter function| sleep function| count_and_stay function| count_and_redirect string| redirect_to string| phishing_domain0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
catch-us-if-you-can.org
dashboard.catch-us-if-you-can.org
dhl.versand.website
195.35.78.44
0b94fd0a536d8f6a0d6a97e1f52a449f55b0dda230c015328710c61955102c35
2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7
2fd1d54eaf8eb8b048439b403682e0a2996695fddfa868d485d0ea35c2f0f655
34d2b75b6fcf7bc5fc35a9d5531ebac4ea16cddf3ac213e836dad3b7b4010f1f
3c1a9d367b05e54510f2d9139ed64cabc18afbd5bb697ce14202b3b1d9df3d24
41b4a75c89d2860d206985b9a04448e8f809595ec6e088b3f44315285e0d563f
42cb846e07917f6731406e500f24aeb2e88c42cda124eaa59e08c5331cad8bcb
4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114
8ef2e763cf232a209ec9a8db241dd9b6cd193a6447cba2f45d8163def5c8d38e
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
c0e63d74933ba810e5b215e3cc655ebbcae33e13883dd6cd10a26cd938ba233a
ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1
db5ffa6e23423c2affe94a4259f6e293d453ae2f8166f5acbb5b474761fd4479