payment-92832201943.instrument-ofgod.com Open in urlscan Pro
2607:f1c0:100f:f000::265 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://soulhealinguniversity.com/red.php
Effective URL:
https://payment-92832201943.instrument-ofgod.com/004/928-020-151e.xml?983428943898943289432849328493278432784372984372836af807136af8075753136af80...
Submission: On September 11 via manual (September 11th 2023, 1:13:34 am UTC) from CN — Scanned from DE

Summary HTTP 28 Redirects Behaviour Indicators

Summary

This website contacted 10 IPs in 3 countries across 10 domains to perform 28 HTTP transactions. The main IP is 2607:f1c0:100f:f000::265, located in United States and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is payment-92832201943.instrument-ofgod.com.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G2 on September 4th 2023. Valid for: a year.

This is the only time payment-92832201943.instrument-ofgod.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	74.208.236.12 74.208.236.12	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
2	2607:f1c0:100... 2607:f1c0:100f:f000::265	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	2a02:26f0:710... 2a02:26f0:7100:896::4b3f	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	99.86.4.2 99.86.4.2	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:a800:f:8ce2:fb80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	54.154.197.165 54.154.197.165	16509 (AMAZON-02) (AMAZON-02)
1	151.101.130.132 151.101.130.132	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
28	10

1 74.208.236.12 (Philadelphia, United States) 1 redirects

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
PTR: 74-208-236-12.elastic-ssl.ui-r.com

soulhealinguniversity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f1c0:100f:f000::265 (United States)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)

payment-92832201943.instrument-ofgod.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:7100:896::4b3f (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.dhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.2 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-2.fra6.r.cloudfront.net

web.btncdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:a800:f:8ce2:fb80:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.dwin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.154.197.165 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-197-165.eu-west-1.compute.amazonaws.com

resources.xg4ken.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.132 (United States)

ASN54113 (FASTLY, US)

pt.ispot.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	dhl.com www.dhl.com — Cisco Umbrella Rank: 43486	10 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 404	14 KB
2	instrument-ofgod.com payment-92832201943.instrument-ofgod.com	28 KB
1	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 53	2 KB
1	ispot.tv pt.ispot.tv — Cisco Umbrella Rank: 2884	314 B
1	xg4ken.com resources.xg4ken.com — Cisco Umbrella Rank: 7253	4 KB
1	dwin1.com www.dwin1.com — Cisco Umbrella Rank: 4556	11 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	102 KB
1	btncdn.com web.btncdn.com — Cisco Umbrella Rank: 14561	8 KB
1	soulhealinguniversity.com 1 redirects soulhealinguniversity.com	703 B
28	10

	Domain	Requested by
6	www.dhl.com	payment-92832201943.instrument-ofgod.com
3	bat.bing.com	payment-92832201943.instrument-ofgod.com
2	payment-92832201943.instrument-ofgod.com	payment-92832201943.instrument-ofgod.com
1	googleads.g.doubleclick.net	payment-92832201943.instrument-ofgod.com
1	pt.ispot.tv	payment-92832201943.instrument-ofgod.com
1	resources.xg4ken.com	payment-92832201943.instrument-ofgod.com
1	www.dwin1.com	payment-92832201943.instrument-ofgod.com
1	www.googletagmanager.com	payment-92832201943.instrument-ofgod.com
1	web.btncdn.com	payment-92832201943.instrument-ofgod.com
1	soulhealinguniversity.com	1 redirects
28	10

This site contains no links.

Subject Issuer	Validity	Valid
*.instrument-ofgod.com Encryption Everywhere DV TLS CA - G2	`2023-09-04` - `2024-09-04`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 05	`2023-07-26` - `2024-01-22`	6 months	crt.sh
www.dhl.com DPDHL Global TLS CA - I5	`2023-07-31` - `2024-07-30`	a year	crt.sh
*.btncdn.com Amazon RSA 2048 M01	`2023-03-07` - `2024-04-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.dwin1.com Amazon RSA 2048 M02	`2023-02-28` - `2023-12-01`	9 months	crt.sh
*.xg4ken.com Go Daddy Secure Certificate Authority - G2	`2022-10-18` - `2023-11-19`	a year	crt.sh
*.ispot.tv R3	`2023-07-13` - `2023-10-11`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://payment-92832201943.instrument-ofgod.com/004/928-020-151e.xml?983428943898943289432849328493278432784372984372836af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af80794d6-dd0f678cce4f&provider_id=internal&client_id=b3d186db-4e5d-49c8-8a12-5753136af8077
Frame ID: 2DB5413F16270B2546C065A252C72BCC
Requests: 1 HTTP requests in this frame

Frame: https://payment-92832201943.instrument-ofgod.com/eu/loading.php
Frame ID: A84116C85CA37DF2B3927105AA2D91CB
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home - Global Logistics and International Shipping

Page URL History Show full URLs

http://soulhealinguniversity.com/red.php HTTP 302
https://payment-92832201943.instrument-ofgod.com/004/928-020-151e.xml?983428943898943289432849328493278432784372984372836af80... Page URL

Detected technologies

AWIN (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

dwin1\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Page Statistics

28
Requests

61 %
HTTPS

60 %
IPv6

10
Domains

10
Subdomains

10
IPs

3
Countries

178 kB
Transfer

595 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://soulhealinguniversity.com/red.php HTTP 302
https://payment-92832201943.instrument-ofgod.com/004/928-020-151e.xml?983428943898943289432849328493278432784372984372836af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af80794d6-dd0f678cce4f&provider_id=internal&client_id=b3d186db-4e5d-49c8-8a12-5753136af8077 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 928-020-151e.xml Show response
payment-92832201943.instrument-ofgod.com/004/
Redirect Chain

http://soulhealinguniversity.com/red.php
https://payment-92832201943.instrument-ofgod.com/004/928-020-151e.xml?983428943898943289432849328493278432784372984372836af807136af8075753136af807136af8075753136af807136af8075753136af807136af807575...

2 KB
2 KB

842ms
368ms

Document
application/xml

2607:f1c0:100f:f000::265
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://payment-92832201943.instrument-ofgod.com/004/928-020-151e.xml?983428943898943289432849328493278432784372984372836af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af80794d6-dd0f678cce4f&provider_id=internal&client_id=b3d186db-4e5d-49c8-8a12-5753136af8077
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2607:f1c0:100f:f000::265 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 863d4adbda13e69698dda7907d514af5d102cf900c016660338c81ee7014c5b1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-length: 2390
content-type: application/xml
date: Mon, 11 Sep 2023 01:13:29 GMT
etag: "956-604ffb9c68855"
last-modified: Sun, 10 Sep 2023 11:44:00 GMT
server: Apache

Redirect headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Mon, 11 Sep 2023 01:13:28 GMT
Keep-Alive: timeout=15
Server: Apache
Transfer-Encoding: chunked
location: https://payment-92832201943.instrument-ofgod.com/004/928-020-151e.xml?983428943898943289432849328493278432784372984372836af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af80794d6-dd0f678cce4f&provider_id=internal&client_id=b3d186db-4e5d-49c8-8a12-5753136af8077

GET
H2 200 loading.php Show response
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 104 KB
26 KB 1254ms
1229ms Document
text/html 2607:f1c0:100f:f000::265
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to

Full URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php
Requested by: Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/004/928-020-151e.xml?983428943898943289432849328493278432784372984372836af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af80794d6-dd0f678cce4f&provider_id=internal&client_id=b3d186db-4e5d-49c8-8a12-5753136af8077
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2607:f1c0:100f:f000::265 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: 52cc9f035da4f25173d7a581e2017d1d9952968e05320798f834eff2c707974b

Request headers

Referer: https://payment-92832201943.instrument-ofgod.com/004/928-020-151e.xml?983428943898943289432849328493278432784372984372836af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af8075753136af807136af80794d6-dd0f678cce4f&provider_id=internal&client_id=b3d186db-4e5d-49c8-8a12-5753136af8077
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 11 Sep 2023 01:13:29 GMT
server: Apache

GET b4.css
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET
H2 204 20013160.js Show response
bat.bing.com/p/action/ Frame A841 0
133 B 80ms
31ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/20013160.js

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Mon, 11 Sep 2023 01:13:31 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5A9D83401773402FA7EFFD6AF2E65DEF Ref B: FRAEDGE1109 Ref C: 2023-09-11T01:13:31Z
x-cache: CONFIG_NOCACHE

GET 3.css
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET x1.css
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET x2.css
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET x3.css
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET x4.css
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET 43.css
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET
H2 200 dhl-logo.svg
www.dhl.com/content/dam/dhl/global/core/images/logos/ Frame A841 2 KB
1 KB 97ms
18ms Image
image/svg+xml 2a02:26f0:7100:896::4b3f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.com/content/dam/dhl/global/core/images/logos/dhl-logo.svg

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100:896::4b3f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 11 Sep 2023 01:13:31 GMT
strict-transport-security: max-age=31536000
x-akamai-cache: Hit from child
content-length: 722
referrer-policy: same-origin
last-modified: Thu, 17 Aug 2023 04:17:06 GMT
etag: "643-60316af5e89c0-gzip"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=0
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Mon, 11 Sep 2023 01:13:31 GMT

GET 2.css
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET laod.gif
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET
H2 200 bat.js Show response
bat.bing.com/ Frame A841 44 KB
13 KB 76ms
31ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a236aed5086b9c24d3cc94944d4349e9ce469f325ac23bafcaa5fe3659b15fd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Mon, 11 Sep 2023 01:13:31 GMT
last-modified: Wed, 06 Sep 2023 22:41:28 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D3480BCC5BF8441F82C22A4594153698 Ref B: FRAEDGE1109 Ref C: 2023-09-11T01:13:31Z
etag: "09cc4613e1d91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 12981

GET
H/1.1 200
OK button.js Show response
web.btncdn.com/v1/ Frame A841 19 KB
8 KB 52ms
8ms Script
application/javascript 99.86.4.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web.btncdn.com/v1/button.js
Requested by: Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.2 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-2.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cead3ec262b19eab66896b105af98bc13a04e856bfa3c8994378d4ebdcdb2a71

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

x-amz-version-id: tfcxMwwN8WFDkY3IIcOKqPAVtWvfuYVl
Content-Encoding: gzip
Via: 1.1 2ef0748a2a8fca13fd6065b6b046c33c.cloudfront.net (CloudFront)
Date: Sun, 10 Sep 2023 14:13:11 GMT
X-Amz-Cf-Pop: FRA6-C1
Age: 39620
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Thu, 20 Oct 2022 17:31:48 GMT
Server: AmazonS3
ETag: W/"c720002805746dabed07fffad3441370"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
X-Amz-Cf-Id: xvXZTKZ3bzyetMhBL3jq-wTQmm6mMXdIREm5uuEaVi94tIEgyItStg==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame A841 360 KB
102 KB 42ms
15ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KWW5SS

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9c0c895d6359c757d5c34d7a89b4073b141355bb2fcc995be956c3bcdc0dfe73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 01:13:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103609
x-xss-protection: 0
last-modified: Mon, 11 Sep 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 11 Sep 2023 01:13:31 GMT

GET .enterprise.js
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET
H2 200 6220.js Show response
www.dwin1.com/ Frame A841 38 KB
11 KB 80ms
12ms Script
application/javascript 2600:9000:214f:a800:f:8ce2:fb80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dwin1.com/6220.js
Requested by: Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:a800:f:8ce2:fb80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cd6173667980494adf24037b018b5ef14a6efa014188ee0b5eb1b376ae9c26ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

x-amz-version-id: mQEazX6tbKa4u4TNE5D6oL0o.NW36iAA
content-encoding: gzip
via: 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
date: Mon, 11 Sep 2023 01:09:50 GMT
x-amz-cf-pop: FRA53-C1
age: 228
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Wed, 06 Sep 2023 09:07:16 GMT
server: AmazonS3
etag: W/"b43d36ee88d693636d21be65aede4262"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600, s-maxage=600
x-amz-cf-id: Ohpw5YphiDw9yTAfzP_CSKuFsZhXyjRkjPaAS6Dbm8eNvg5zNL5RNg==

GET
H2 200 ktag.js Show response
resources.xg4ken.com/js/v2/ Frame A841 9 KB
4 KB 133ms
33ms Script
application/javascript 54.154.197.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3E88-3EB

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.154.197.165 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-197-165.eu-west-1.compute.amazonaws.com

Software

nginx /

Resource Hash

6269bafb85bd4d4fed6589655f7e0b8b612397226168098f95d3507848075f6d

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 01:13:31 GMT
content-encoding: gzip
last-modified: Mon, 14 Nov 2022 12:23:07 GMT
server: nginx
etag: "6372332b-dd8"
content-type: application/javascript
cache-control: max-age=86400, public
content-length: 3544
x-xss-protection: 1; mode=block
expires: Tue, 12 Sep 2023 01:13:31 GMT

GET
H2 200 TC-3512-1.gif
pt.ispot.tv/v2/ Frame A841 43 B
314 B 51ms
6ms Image
image/gif 151.101.130.132
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pt.ispot.tv/v2/TC-3512-1.gif?app=web&type=visit&customdata=customer_new&cid=EHVPhNER8GQYnTckchNbkNvrxvrR&uid=undefined
Requested by: Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.132 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Mon, 11 Sep 2023 01:13:31 GMT
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 43
expires: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1001213127/ Frame A841 3 KB
2 KB 296ms
19ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1001213127/?random=1685150597578&cv=11&fst=1685150597578&bg=ffffff&guid=ON&async=1&gtm=45He35o0&u_w=1920&u_h=1080&url=http%3A%2F%2Flocalhost%2FDHL%2520pages%2Femail.html&ref=http%3A%2F%2Flocalhost%2FDHL%2520pages%2F&hn=www.googleadservices.com&frm=0&tiba=DHL%20-%20Login%20Page&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B113.0.5672.127%7CChromium%3B113.0.5672.127%7CNot-A.Brand%3B24.0.0.0&uamb=0&uap=Windows&uapv=15.0.0&uaw=0&data=ecomm_prodid%3D%3Becomm_pagetype%3Dother%3Becomm_totalvalue%3D%3Becomm_rec_prodid%3D%3Becomm_category%3D%3Becomm_pvalue%3D%3Becomm_quantity%3D%3Ba%3D%3Bg%3D%3Bhasaccount%3Dfalse%3Bcqs%3D%3Brp%3D%3Bly%3D%3Bhs%3D%3B_google_crm_id%3D&rfmt=3&fmt=4

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f5159ed817a4952293ea822af8e624cd283e8dd61f37991cf312554b7877def2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 11 Sep 2023 01:13:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1420
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET jquery.js
payment-92832201943.instrument-ofgod.com/eu/ Frame A841 0
0

GET
H2 204 0
bat.bing.com/action/ Frame A841 0
486 B 72ms
28ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=20013160&tm=gtm002&Ver=2&mid=9b4fe03d-5a05-4e50-9dd7-df8b0679b41d&sid=4a5c5080fc2b11edbaf7af41c3df18da&vid=47fd46d0f0f411ed9e88c173434cd4aa&vids=0&msclkid=N&uach=pv%3D15.0.0&pi=918639831&lg=en&sw=1920&sh=1080&sc=24&tl=DHL%20-%20Login%20Page&p=http%3A%2F%2Flocalhost%2FDHL%2520pages%2Femail.html&r=http%3A%2F%2Flocalhost%2FDHL%2520pages%2F&lt=1517&evt=pageLoad&sv=1&rn=688028

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 11 Sep 2023 01:13:31 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7C2EE8D462DA4CAEB0D07D85272E5152 Ref B: FRAEDGE1109 Ref C: 2023-09-11T01:13:31Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 glo-footer-logo.svg
www.dhl.com/content/dam/dhl/global/core/images/logos/ Frame A841 4 KB
3 KB 58ms
33ms Image
image/svg+xml 2a02:26f0:7100:896::4b3f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.com/content/dam/dhl/global/core/images/logos/glo-footer-logo.svg

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100:896::4b3f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

90fb9be0fae070f08d943401c91c851f70f58ceaf874f4e75aeed2ac3c5a38da

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 11 Sep 2023 01:13:31 GMT
strict-transport-security: max-age=31536000
x-akamai-cache: Hit from child
content-length: 1997
referrer-policy: same-origin
last-modified: Thu, 17 Aug 2023 03:28:52 GMT
etag: "1197-6031602d633f2-gzip"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=222484
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Wed, 13 Sep 2023 15:01:35 GMT

GET
H2 200 youtube-new.svg
www.dhl.com/content/dam/dhl/global/core/images/logos/ Frame A841 1 KB
1 KB 58ms
33ms Image
image/svg+xml 2a02:26f0:7100:896::4b3f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.com/content/dam/dhl/global/core/images/logos/youtube-new.svg

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100:896::4b3f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

acd3eaf2b608fb48f9915964c36772b322ad91106508c4490e2a72122db4d347

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 11 Sep 2023 01:13:31 GMT
strict-transport-security: max-age=31536000
x-akamai-cache: Hit from child
content-length: 614
referrer-policy: same-origin
last-modified: Sun, 20 Aug 2023 05:39:55 GMT
etag: "584-603543112bd7f-gzip"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=211025
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Wed, 13 Sep 2023 11:50:36 GMT

GET
H2 200 facebook-new.svg
www.dhl.com/content/dam/dhl/global/core/images/logos/ Frame A841 1 KB
1 KB 36ms
32ms Image
image/svg+xml 2a02:26f0:7100:896::4b3f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.com/content/dam/dhl/global/core/images/logos/facebook-new.svg

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100:896::4b3f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

43027752f5a04142e6518a4fd8ef54e7e73cfba7820da9c03c1ad38835f04fe2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 11 Sep 2023 01:13:31 GMT
strict-transport-security: max-age=31536000
x-akamai-cache: Hit from child
content-length: 698
referrer-policy: same-origin
last-modified: Thu, 17 Aug 2023 03:28:52 GMT
etag: "57e-6031602e18b6f-gzip"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=0
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Mon, 11 Sep 2023 01:13:31 GMT

GET
H2 200 linkedIn-new.svg
www.dhl.com/content/dam/dhl/global/core/images/logos/ Frame A841 2 KB
1 KB 48ms
47ms Image
image/svg+xml 2a02:26f0:7100:896::4b3f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.com/content/dam/dhl/global/core/images/logos/linkedIn-new.svg

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100:896::4b3f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

c32f1a0f5b093b6b2c8f5df0bf93856359769ee6bbab40975043cd133711d528

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 11 Sep 2023 01:13:31 GMT
strict-transport-security: max-age=31536000
x-akamai-cache: Hit from child
content-length: 738
referrer-policy: same-origin
last-modified: Wed, 16 Aug 2023 14:03:59 GMT
etag: "66f-6030ac462560a-gzip"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=0
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Mon, 11 Sep 2023 01:13:31 GMT

GET
H2 200 instagram-new.svg
www.dhl.com/content/dam/dhl/global/core/images/logos/ Frame A841 4 KB
2 KB 35ms
34ms Image
image/svg+xml 2a02:26f0:7100:896::4b3f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.com/content/dam/dhl/global/core/images/logos/instagram-new.svg

Requested by

Host: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/loading.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:7100:896::4b3f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f01c2e1870fcd75ceca3b4c42c3110cb0aa4b933b562cf3d2c7ddd20ce03c7ee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://payment-92832201943.instrument-ofgod.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 11 Sep 2023 01:13:31 GMT
strict-transport-security: max-age=31536000
x-akamai-cache: Hit from child
content-length: 1608
referrer-policy: same-origin
last-modified: Thu, 17 Aug 2023 03:28:52 GMT
etag: "119c-6031602dbda8c-gzip"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=0
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Mon, 11 Sep 2023 01:13:31 GMT

GET
DATA 200
OK truncated
/ Frame A841 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/b4.css

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/3.css

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/x1.css

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/x2.css

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/x3.css

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/x4.css

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/43.css

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/2.css

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/laod.gif

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/.enterprise.js?onload=EtsyRenderRecaptcha1437762502&render=6Ldgkr0ZAAAAAGnf08YhMemepXW29Ux9rtJCcBD3&hl=en&badge=none

Domain: payment-92832201943.instrument-ofgod.com
URL: https://payment-92832201943.instrument-ofgod.com/eu/jquery.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| _0x1fe6 function| _0x257c

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.ispot.tv/	1970-01-21 00:15:54	Name: pt Value: v2:73a60c4e8b60b999ab3f8fd3b791e86879ccadb1cb02b3d35659be31391398b8\|d3e2a6226cd759988b19d33a8451243c92075afcdbb2eeb67908a821cb93ac9c
.bing.com/	1970-01-21 00:01:30	Name: MUID Value: 2EE10347DC0567B12A3310CEDD6E6680
.doubleclick.net/	1970-01-20 14:39:55	Name: test_cookie Value: CheckForPermission

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bat.bing.com
googleads.g.doubleclick.net
payment-92832201943.instrument-ofgod.com
pt.ispot.tv
resources.xg4ken.com
soulhealinguniversity.com
web.btncdn.com
www.dhl.com
www.dwin1.com
www.googletagmanager.com
payment-92832201943.instrument-ofgod.com
151.101.130.132
2600:9000:214f:a800:f:8ce2:fb80:93a1
2607:f1c0:100f:f000::265
2620:1ec:c11::200
2a00:1450:4001:80b::2002
2a00:1450:4001:811::2008
2a02:26f0:7100:896::4b3f
54.154.197.165
74.208.236.12
99.86.4.2
0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
43027752f5a04142e6518a4fd8ef54e7e73cfba7820da9c03c1ad38835f04fe2
52cc9f035da4f25173d7a581e2017d1d9952968e05320798f834eff2c707974b
6269bafb85bd4d4fed6589655f7e0b8b612397226168098f95d3507848075f6d
863d4adbda13e69698dda7907d514af5d102cf900c016660338c81ee7014c5b1
90fb9be0fae070f08d943401c91c851f70f58ceaf874f4e75aeed2ac3c5a38da
9c0c895d6359c757d5c34d7a89b4073b141355bb2fcc995be956c3bcdc0dfe73
a236aed5086b9c24d3cc94944d4349e9ce469f325ac23bafcaa5fe3659b15fd1
acd3eaf2b608fb48f9915964c36772b322ad91106508c4490e2a72122db4d347
c32f1a0f5b093b6b2c8f5df0bf93856359769ee6bbab40975043cd133711d528
cd6173667980494adf24037b018b5ef14a6efa014188ee0b5eb1b376ae9c26ba
cead3ec262b19eab66896b105af98bc13a04e856bfa3c8994378d4ebdcdb2a71
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f01c2e1870fcd75ceca3b4c42c3110cb0aa4b933b562cf3d2c7ddd20ce03c7ee
f5159ed817a4952293ea822af8e624cd283e8dd61f37991cf312554b7877def2

payment-92832201943.instrument-ofgod.com Open in urlscan Pro 2607:f1c0:100f:f000::265 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

28 Requests

61 %HTTPS

60 %IPv6

10 Domains

10 Subdomains

10 IPs

3 Countries

178 kBTransfer

595 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

28 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

3 Cookies

Indicators

payment-92832201943.instrument-ofgod.com Open in urlscan Pro
2607:f1c0:100f:f000::265 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

28
Requests

61 %
HTTPS

60 %
IPv6

10
Domains

10
Subdomains

10
IPs

3
Countries

178 kB
Transfer

595 kB
Size

3
Cookies

28 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!