www.dhldelivery.de Open in urlscan Pro
192.161.165.46 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.dhldelivery.de/
Submission: On May 15 via automatic, source certstream-suspicious (May 15th 2022, 1:06:08 pm UTC) — Scanned from DE

Summary HTTP 18 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 18 HTTP transactions. The main IP is 192.161.165.46, located in Los Angeles, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is www.dhldelivery.de.
TLS certificate: Issued by R3 on May 15th 2022. Valid for: 3 months.

This is the only time www.dhldelivery.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
16	192.161.165.46 192.161.165.46	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
2	2a02:26f0:fb:... 2a02:26f0:fb:18d::39ce	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
18	2

16 192.161.165.46 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: unassigned.quadranet.com

www.dhldelivery.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:fb:18d::39ce (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.dhl.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	dhldelivery.de www.dhldelivery.de	507 KB
2	dhl.de www.dhl.de — Cisco Umbrella Rank: 54864	11 KB
18	2

	Domain	Requested by
16	www.dhldelivery.de	www.dhldelivery.de
2	www.dhl.de	www.dhldelivery.de
18	2

This site contains links to these domains. Also see Links.

Domain
www.dhl.de
www.dhl.com
www.dpdhl.de
www.deutschepost.de
www.facebook.com
twitter.com
www.instagram.com
www.youtube.com
www.linkedin.com
www.xing.com

Subject Issuer	Validity	Valid
www.dhldelivery.de R3	`2022-05-15` - `2022-08-13`	3 months	crt.sh
www.dhl.de DPDHL Global TLS CA - I5	`2021-08-11` - `2022-08-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.dhldelivery.de/
Frame ID: 75E6A44883BED2A52EDF1F04DCC60D46
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DHL Online Frankierung | DHLarrow-downarrow-link-leftarrow-link-rightarrow-upbig_arrow_lbig_arrow_rcheckclose-boldclose-thindownloadShapeexternal_linkfacebookglobegoogleplusinfolinkarrowlinkedinShapeloginiconmonstr-menu-1minusplayplusprintsearchsharetimett-clearancedelaytt-currentlocationtt-deliveredtt-departedtt-exceptiontt-intransittt-locationtt-manifestrecievedtt-notificationtt-pleasecontacttt-podtt-shippercontactedtt-startvimeoweiboyoutubetwitterlogged-inarrow-down-02arrow-up-02instagramxingdhl-alert-inversenewsletter

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

Page Statistics

18
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

518 kB
Transfer

1583 kB
Size

1
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.dhl.de/dhl-geschaeftskunde-werden
Title: Kunde werden

Search URL Search Domain Scan URL

URL: http://www.dhl.com/
Title: DHL.com

Search URL Search Domain Scan URL

URL: http://www.dpdhl.de/
Title: Deutsche Post DHL Group

Search URL Search Domain Scan URL

URL: http://www.dpdhl.de/karriere
Title: Karriere

Search URL Search Domain Scan URL

URL: http://www.dpdhl.de/presse
Title: Presse

Search URL Search Domain Scan URL

URL: http://www.dpdhl.de/investoren
Title: Investoren

Search URL Search Domain Scan URL

URL: https://www.deutschepost.de/de/n/nachhaltigkeit.html
Title: Nachhaltigkeit

Search URL Search Domain Scan URL

URL: https://www.facebook.com/DHLPaket/

Search URL Search Domain Scan URL

URL: https://twitter.com/DHLPaket

Search URL Search Domain Scan URL

URL: https://www.instagram.com/dhl_global/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/dhl

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/dhl

Search URL Search Domain Scan URL

URL: https://www.xing.com/companies/deutschepostag

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.dhldelivery.de/ 127 KB
41 KB 965ms
343ms Document
text/html 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 3f6bfa38a8b5508f07fefa75fee96aa597115aea2d0656d2f72d9defbc6a2b20

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0 no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sun, 15 May 2022 13:06:01 GMT
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 app.4744d71a.css
www.dhldelivery.de/css/ 754 KB
115 KB 361ms
361ms Stylesheet
text/css 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/css/app.4744d71a.css
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 4aaf63de23b86a6574949f46a9d186d8e17de38afce3167f277443654691a215

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:01 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: text/css; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:01 GMT

GET
H2 200 app.e54ec06c.js Show response
www.dhldelivery.de/js/ 98 KB
22 KB 361ms
360ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/app.e54ec06c.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: acc0c456b7bffb15566798bd855fcb91a8dacd9dde0753edf74a767997b16d0d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:01 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:01 GMT

GET
H2 200 chunk-vendors.d868e65f.js Show response
www.dhldelivery.de/js/ 407 KB
142 KB 362ms
362ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/chunk-vendors.d868e65f.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 8f113c854a899c71f73c6a4c88a77fc50518cf6453ff4e9c70e0bf229235683d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:01 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:01 GMT

GET
H2 200 chunk-616d1e22.940b78ff.css
www.dhldelivery.de/css/ 0
230 B 360ms
358ms Other
text/css 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/css/chunk-616d1e22.940b78ff.css
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:01 GMT
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
x-cache: MISS
content-type: text/css; charset=utf-8
cache-control: max-age=43200
content-length: 60
expires: Mon, 16 May 2022 01:06:01 GMT

GET
H2 200 chunk-17874aa8.c2c326e1.js
www.dhldelivery.de/js/ 0
21 KB 363ms
360ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/chunk-17874aa8.c2c326e1.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:01 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:01 GMT

GET
H2 200 chunk-2d20916c.9758bfe4.js
www.dhldelivery.de/js/ 0
5 KB 361ms
359ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/chunk-2d20916c.9758bfe4.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:01 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:01 GMT

GET
H2 200 chunk-2fcac651.27592786.js
www.dhldelivery.de/js/ 0
9 KB 530ms
528ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/chunk-2fcac651.27592786.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:01 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:01 GMT

GET
H2 200 chunk-616d1e22.6b331fab.js
www.dhldelivery.de/js/ 0
3 KB 530ms
529ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/chunk-616d1e22.6b331fab.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:01 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:01 GMT

GET
H2 200 chunk-f6431998.48f64280.js
www.dhldelivery.de/js/ 0
16 KB 701ms
700ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/chunk-f6431998.48f64280.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:01 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:01 GMT

GET
H2 200 chunk-2fcac651.27592786.js Show response
www.dhldelivery.de/js/ 25 KB
9 KB 177ms
176ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/chunk-2fcac651.27592786.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/js/app.e54ec06c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 2eaa8462c3b4ab46960dbe7220259fe672e14da02311a7267858b8d4e4a24dc6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:03 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:03 GMT

GET
H2 200 chunk-f6431998.48f64280.js Show response
www.dhldelivery.de/js/ 43 KB
16 KB 178ms
177ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/chunk-f6431998.48f64280.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/js/app.e54ec06c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: ec939be676c2b65da233d502ac9cc41a66038f71466d1aa62d8019dc3f54f606

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:03 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:03 GMT

GET
H2 200 chunk-2d20916c.9758bfe4.js Show response
www.dhldelivery.de/js/ 16 KB
5 KB 178ms
178ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/js/chunk-2d20916c.9758bfe4.js
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/js/app.e54ec06c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: cb054e4b5feb97f55c4edc27baa20a7628c529158d2c0b346cd2c9fb81117ac2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:03 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Mon, 16 May 2022 01:06:03 GMT

GET
H2 200 dhl-official.svg
www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/icons/ 2 KB
4 KB 233ms
25ms Image
image/svg+xml 2a02:26f0:fb:18d::39ce
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/icons/dhl-official.svg

Requested by

Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/verifizieren/dieanschrift

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:fb:18d::39ce Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

IPNP /

Resource Hash

aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains
content-encoding: gzip
x-content-type-options: NOSNIFF
content-security-policy-report-only: default-src 'self' data: https://fonts.gstatic.com/ https://cdn.podigee.com/ https://main.podigee-cdn.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; img-src 'self' data: https://pixel.consentric.de/ https://c1.adform.net/ https://t23.intelliad.de/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://deutschepostag1.d3.sc.omtrdc.net/ https://deutschepostwpmdpagprod2.112.2o7.net/ https://deutschepostpostidprod.112.2o7.net/ https://deutschepostag.112.2o7.net/ https://www.gstatic.com/ https://cdn.cookielaw.org/ https://www.facebook.com/ https://www.google.com/ https://t.leadlab.click/ https://insight.adsrvr.org/ https://www.bing.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.youtube.com/ https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://maps.google.com/ https://maps.googleapis.com/ https://cookie-cdn.cookiepro.com/ https://geolocation.onetrust.com/ https://www.bing.com/ https://r.bing.com/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://dev.virtualearth.net/ https://service.force.com/ https://d.la1-c1-fra.salesforceliveagent.com/ https://d.la3-c2-fra.salesforceliveagent.com/ https://d.la1-c1cs-fra.salesforceliveagent.com/ https://meinservice.my.salesforce.com/ https://www.google.com/ https://www.gstatic.com/ https://meinservice-dhl-sites.secure.force.com/ https://static.heidelpay.com/ https://www.google-analytics.com/ https://connect.facebook.net/ https://www.googletagmanager.com/ https://cdn.tt.omtrdc.net/ https://meinservice--rqa.my.salesforce.com/ https://pay.google.com/ https://assets.braintreegateway.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; style-src 'self' 'unsafe-inline' https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.bing.com/ https://r.bing.com/ https://meinservice-dhl-sites.secure.force.com/ https://cdn.tt.omtrdc.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; frame-src 'self' https://www.youtube.com/ https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.google.com/ https://payment.heidelpay.com/ https://assets.adobedtm.com/ https://deutschepost.elaine-asp.de/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; connect-src 'self' https://geolocation.onetrust.com/ https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://dpcomepost.tt.omtrdc.net/ https://privacyportal-de.onetrust.com/ https://t.leadlab.click/ https://www.bing.com/ https://meinservice--rqa.my.salesforce.com/ https://deutschepostag1.d3.sc.omtrdc.net/ https://meinservice-dhl-sites.secure.force.com/ https://pixel.consentric.de/ https://meinservice.my.salesforce.com/ https://client-analytics.braintreegateway.com/ https://api.braintreegateway.com/ https://api.sandbox.braintreegateway.com/ https://payments.braintree-api.com/ https://payments.sandbox.braintree-api.com/ https://assets.braintreegateway.com/ https://braintree-sample-merchant.herokuapp.com/ https://origin-analytics-sand.sandbox.braintree-api.com/ https://depst-salaut-prod1.pegacloud.net/ https://depst-mara-dt1-decisionhub.pegacloud.net/ https://depst-mara-stg1-decisionhub.pegacloud.net/ https://depst-mara-prod1-decisionhub.pegacloud.net/ https://payment.heidelpay.com/ https://api.heidelpay.com/ https://www.google-analytics.com/ https://insight.adsrvr.org/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; report-uri /bin/csp/report
producers: IPNP-P-CP
x-dpwn-is-secure: 1
x-dns-prefetch-control: off
content-length: 729
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: IPNP
x-frame-options: SAMEORIGIN
date: Sun, 15 May 2022 13:06:04 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: must-revalidate, max-age=2931
accept-ranges: bytes
expires: Sun, 15 May 2022 13:54:55 GMT

GET
H2 200 dhl-group.svg
www.dhl.de/content/dam/images/ 9 KB
7 KB 238ms
30ms Image
image/svg+xml 2a02:26f0:fb:18d::39ce
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.de/content/dam/images/dhl-group.svg

Requested by

Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/verifizieren/dieanschrift

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:fb:18d::39ce Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

IPNP /

Resource Hash

55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains
content-encoding: gzip
x-content-type-options: NOSNIFF
content-security-policy-report-only: default-src 'self' data: https://fonts.gstatic.com/ https://cdn.podigee.com/ https://main.podigee-cdn.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; img-src 'self' data: https://pixel.consentric.de/ https://c1.adform.net/ https://t23.intelliad.de/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://deutschepostag1.d3.sc.omtrdc.net/ https://deutschepostwpmdpagprod2.112.2o7.net/ https://deutschepostpostidprod.112.2o7.net/ https://deutschepostag.112.2o7.net/ https://www.gstatic.com/ https://cdn.cookielaw.org/ https://www.facebook.com/ https://www.google.com/ https://t.leadlab.click/ https://insight.adsrvr.org/ https://www.bing.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.youtube.com/ https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://maps.google.com/ https://maps.googleapis.com/ https://cookie-cdn.cookiepro.com/ https://geolocation.onetrust.com/ https://www.bing.com/ https://r.bing.com/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://dev.virtualearth.net/ https://service.force.com/ https://d.la1-c1-fra.salesforceliveagent.com/ https://d.la3-c2-fra.salesforceliveagent.com/ https://d.la1-c1cs-fra.salesforceliveagent.com/ https://meinservice.my.salesforce.com/ https://www.google.com/ https://www.gstatic.com/ https://meinservice-dhl-sites.secure.force.com/ https://static.heidelpay.com/ https://www.google-analytics.com/ https://connect.facebook.net/ https://www.googletagmanager.com/ https://cdn.tt.omtrdc.net/ https://meinservice--rqa.my.salesforce.com/ https://pay.google.com/ https://assets.braintreegateway.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; style-src 'self' 'unsafe-inline' https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.bing.com/ https://r.bing.com/ https://meinservice-dhl-sites.secure.force.com/ https://cdn.tt.omtrdc.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; frame-src 'self' https://www.youtube.com/ https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.google.com/ https://payment.heidelpay.com/ https://assets.adobedtm.com/ https://deutschepost.elaine-asp.de/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; connect-src 'self' https://geolocation.onetrust.com/ https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://dpcomepost.tt.omtrdc.net/ https://privacyportal-de.onetrust.com/ https://t.leadlab.click/ https://www.bing.com/ https://meinservice--rqa.my.salesforce.com/ https://deutschepostag1.d3.sc.omtrdc.net/ https://meinservice-dhl-sites.secure.force.com/ https://pixel.consentric.de/ https://meinservice.my.salesforce.com/ https://client-analytics.braintreegateway.com/ https://api.braintreegateway.com/ https://api.sandbox.braintreegateway.com/ https://payments.braintree-api.com/ https://payments.sandbox.braintree-api.com/ https://assets.braintreegateway.com/ https://braintree-sample-merchant.herokuapp.com/ https://origin-analytics-sand.sandbox.braintree-api.com/ https://depst-salaut-prod1.pegacloud.net/ https://depst-mara-dt1-decisionhub.pegacloud.net/ https://depst-mara-stg1-decisionhub.pegacloud.net/ https://depst-mara-prod1-decisionhub.pegacloud.net/ https://payment.heidelpay.com/ https://api.heidelpay.com/ https://www.google-analytics.com/ https://insight.adsrvr.org/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; report-uri /bin/csp/report
producers: IPNP-P-CP
x-dpwn-is-secure: 1
x-dns-prefetch-control: off
content-length: 3240
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: IPNP
x-frame-options: SAMEORIGIN
date: Sun, 15 May 2022 13:06:04 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: must-revalidate, max-age=3095
accept-ranges: bytes
expires: Sun, 15 May 2022 13:57:39 GMT

GET
H2 200 delivery-cdblk.774e0efb.woff2
www.dhldelivery.de/fonts/ 36 KB
36 KB 349ms
348ms Font
font/woff2 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/fonts/delivery-cdblk.774e0efb.woff2
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/css/app.4744d71a.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1

Request headers

Referer: https://www.dhldelivery.de/css/app.4744d71a.css
Origin: https://www.dhldelivery.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:03 GMT
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
x-cache: MISS
content-type: font/woff2
cache-control: max-age=43200
content-length: 36652
expires: Mon, 16 May 2022 01:06:03 GMT

GET
H2 200 delivery-rg.1a05a4d2.woff2
www.dhldelivery.de/fonts/ 33 KB
33 KB 350ms
350ms Font
font/woff2 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/fonts/delivery-rg.1a05a4d2.woff2
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/css/app.4744d71a.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7

Request headers

Referer: https://www.dhldelivery.de/css/app.4744d71a.css
Origin: https://www.dhldelivery.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:03 GMT
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
x-cache: MISS
content-type: font/woff2
cache-control: max-age=43200
content-length: 33580
expires: Mon, 16 May 2022 01:06:03 GMT

GET
H2 200 delivery-bd.682ea1d6.woff2
www.dhldelivery.de/fonts/ 33 KB
33 KB 177ms
176ms Font
font/woff2 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://www.dhldelivery.de/fonts/delivery-bd.682ea1d6.woff2
Requested by: Host: www.dhldelivery.de
URL: https://www.dhldelivery.de/css/app.4744d71a.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f

Request headers

Referer: https://www.dhldelivery.de/css/app.4744d71a.css
Origin: https://www.dhldelivery.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Sun, 15 May 2022 13:06:03 GMT
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
x-cache: MISS
content-type: font/woff2
cache-control: max-age=43200
content-length: 33840
expires: Mon, 16 May 2022 01:06:03 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.dhl.de/	1969-12-31 23:59:59	Name: akaalb_wwwdhldealb Value: ~op=www_dhl_de_alb:wwwdhlde\|~rv=18~m=wwwdhlde:0\|~os=06f548fb0da0a4ee62020bebc018f01f~id=2d6401838c200bfe933eb48cdcce28e0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.dhl.de
www.dhldelivery.de
192.161.165.46
2a02:26f0:fb:18d::39ce
2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7
2eaa8462c3b4ab46960dbe7220259fe672e14da02311a7267858b8d4e4a24dc6
3f6bfa38a8b5508f07fefa75fee96aa597115aea2d0656d2f72d9defbc6a2b20
4aaf63de23b86a6574949f46a9d186d8e17de38afce3167f277443654691a215
4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114
8f113c854a899c71f73c6a4c88a77fc50518cf6453ff4e9c70e0bf229235683d
acc0c456b7bffb15566798bd855fcb91a8dacd9dde0753edf74a767997b16d0d
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
cb054e4b5feb97f55c4edc27baa20a7628c529158d2c0b346cd2c9fb81117ac2
ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec939be676c2b65da233d502ac9cc41a66038f71466d1aa62d8019dc3f54f606

www.dhldelivery.de Open in urlscan Pro 192.161.165.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

518 kBTransfer

1583 kBSize

1 Cookies

13 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

35 JavaScript Global Variables

1 Cookies

Indicators

www.dhldelivery.de Open in urlscan Pro
192.161.165.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

518 kB
Transfer

1583 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!