khaine.nl Open in urlscan Pro
172.67.202.5 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://khaine.nl/popouiyt/gyrfd.html
Effective URL:
https://khaine.nl/popouiyt/gyrfd.html
Submission: On April 09 via api (April 9th 2024, 9:27:51 pm UTC) from US — Scanned from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 7 domains to perform 12 HTTP transactions. The main IP is 172.67.202.5, located in United States and belongs to CLOUDFLARENET, US. The main domain is khaine.nl.
TLS certificate: Issued by E1 on March 25th 2024. Valid for: 3 months.

This is the only time khaine.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 7	172.67.202.5 172.67.202.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
1	104.131.67.145 104.131.67.145	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2 2	2606:4700::68... 2606:4700::6812:69e3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:1ac4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2600:141b:1c0... 2600:141b:1c00:1a8a::296d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2600:141b:1c0... 2600:141b:1c00:16::17c4:322	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	5

7 172.67.202.5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

khaine.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.131.67.145 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

cdn.freebiesupply.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:69e3 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.dhlparcel.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1ac4 (United States)

ASN13335 (CLOUDFLARENET, US)

www.dhlecommerce.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:1c00:1a8a::296d (Secaucus, United States) 2 redirects

ASN20940 (AKAMAI-ASN1, NL)

www.dpdhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:1c00:16::17c4:322 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

group.dhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	khaine.nl 1 redirects khaine.nl	27 KB
2	dhl.com group.dhl.com	262 KB
2	dpdhl.com 2 redirects www.dpdhl.com	569 B
2	dhlecommerce.nl www.dhlecommerce.nl — Cisco Umbrella Rank: 531391	3 KB
2	dhlparcel.nl 2 redirects www.dhlparcel.nl — Cisco Umbrella Rank: 799771	465 B
1	freebiesupply.com cdn.freebiesupply.com — Cisco Umbrella Rank: 352681	45 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1217	33 KB
12	7

	Domain	Requested by
7	khaine.nl	1 redirects khaine.nl
2	group.dhl.com	khaine.nl
2	www.dpdhl.com	2 redirects
2	www.dhlecommerce.nl	khaine.nl
2	www.dhlparcel.nl	2 redirects
1	cdn.freebiesupply.com	khaine.nl
1	code.jquery.com	khaine.nl
12	7

This site contains no links.

Subject Issuer	Validity	Valid
khaine.nl E1	`2024-03-25` - `2024-06-23`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
cdn.freebiesupply.com R3	`2024-03-31` - `2024-06-29`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://khaine.nl/popouiyt/gyrfd.html
Frame ID: 3D0DCB44467D59609BF490CF6E2F4527
Requests: 10 HTTP requests in this frame

Frame: https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
Frame ID: B9F4A21B371525A990D1E468D8BD2384
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DHL Express | Track Shipment

Page URL History Show full URLs

http://khaine.nl/popouiyt/gyrfd.html HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
https://khaine.nl/popouiyt/gyrfd.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

58 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

5
IPs

1
Countries

370 kB
Transfer

448 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://khaine.nl/popouiyt/gyrfd.html HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
https://khaine.nl/popouiyt/gyrfd.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://khaine.nl/popouiyt/gyrfd.html HTTP 307
https://khaine.nl/popouiyt/gyrfd.html

Request Chain 2

https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

Request Chain 7

https://www.dhlparcel.nl/themes/custom/dp_theme/images/logo.svg HTTP 301
https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg

Request Chain 8

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg HTTP 301
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg

Request Chain 9

https://www.dhlparcel.nl/themes/custom/dp_theme/favicon.ico HTTP 301
https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico

Request Chain 10

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg HTTP 301
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

503

gyrfd.html Show response
khaine.nl/popouiyt/
Redirect Chain

http://khaine.nl/popouiyt/gyrfd.html
https://khaine.nl/popouiyt/gyrfd.html

7 KB
8 KB

508ms
457ms

Document
text/html

172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/popouiyt/gyrfd.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cadaa278a2c743498b1086afb3442d44c427c009986e69f288907edc8e1e2146

Security Headers

Name	Value
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 871d953a2d9a36bf-YYZ
content-type: text/html; charset=utf-8
date: Tue, 09 Apr 2024 21:27:45 GMT
expires: 0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R2%2BNwe7SED4ER9pIOVmLwaEw6ru2ZzWjR12ztZLH7UQfrvi4zWqo3U3uYlho0dkWTM4aqW%2Bss5zXYjtKl6xWdY91llLLry614KUOTL8tVurZcoH5MwUPQqtrK74%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block 1; mode=block

Redirect headers

Location: https://khaine.nl/popouiyt/gyrfd.html
Non-Authoritative-Reason: HttpsUpgrades

POST
H3 204 gyrfd.html
khaine.nl/popouiyt/ 0
832 B 245ms
244ms XHR
text/plain 172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/popouiyt/gyrfd.html

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
X-Requested-TimeStamp-Expire
zDfxNUUquvfMLKSViaM8TtPbrW0: 28282432
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
X-Requested-TimeStamp-Combination
X-Requested-Type-Combination: GET
Content-type: application/x-www-form-urlencoded
X-Requested-Type: GET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://khaine.nl/popouiyt/gyrfd.html
X-Requested-with: XMLHttpRequest
X-Requested-TimeStamp
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:27:45 GMT
x-server-powered-by: Engintron
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vuXW3UEpoD15wxS%2BybcCR%2BISmAWDSDX6w8jW6NIp0lI1xoIdO3%2FRoAWFZvvDN3Bj6b3pohiatiqGplEW6lV1MPGe3Kkzuo23BkPfVOnM7nQ8HQwwsZU8zykaLJ0%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 871d953d4b5336bf-YYZ
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block, 1; mode=block
expires: 0

GET
H3

200

main.js Show response
khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/ Frame B9F4
Redirect Chain

https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

8 KB
4 KB

33ms
32ms

Script
application/javascript

172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

Protocol

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87804c16118325f48922086f2d14260bdd4720eee876db0206da21ec9e500e4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Apr 2024 21:27:45 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3PSJ%2F4cGgCu29CIej9e6LHaxbsMCvMwZoZRetqbK4l4RnS6Ln6rbzpyJ41t5NXcx%2F6nrDVE3YqfkI0hm6KKoL3tVF6IiEjDHg5JE%2B8wRfS8C4knk040Q1cI89w%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 871d953d7baf36bf-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 09 Apr 2024 21:27:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8g2G4feUP3V%2FL5d73Erl4MM99Knf9cPQNYzenLo6fH1Sewf97lNHqV3tx1ahyTFMdXM2EOzMC%2BAk32h3uE6K9wpaAKPOUXIzEfevnVlXbTGdOAM5oVWIUcF64KM%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 871d953d4b5736bf-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 503 favicon.ico
khaine.nl/ 6 KB
7 KB 251ms
251ms Other
text/html 172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://khaine.nl/popouiyt/gyrfd.html
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:27:45 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T0fWon%2FRG25XeetPyZA6M6cfUrY0hu5C9E27ugymOvgYhVvQnZVbCY%2FninyiCTzI1pTqUxnrBDGB7LaI%2BDoTcH1L47qT%2FSVCiB6O6dopRJNMi3SKwjvWECk0PqU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 871d953d4b6536bf-YYZ
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block, 1; mode=block
expires: 0

POST
H3 200 871d953a2d9a36bf Show response
khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame B9F4 0
574 B 41ms
40ms XHR
text/plain 172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/871d953a2d9a36bf
Requested by: Host: khaine.nl
URL: https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 09 Apr 2024 21:27:45 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ImgUQ7jLdPkjM1bMH6mfM6VYs26LNDZ7xb8NIqkaWe6q0jviMeqeWSQpbUxgLwV40r3QHQ2nD1KwKADpxXRfkgGYhawKa5%2BPEENIpydIKfuvdJFWtXttCAaPdWc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 871d953e2ce136bf-YYZ
alt-svc: h3=":443"; ma=86400

GET
H3 200 Primary Request gyrfd.html Show response
khaine.nl/popouiyt/ 17 KB
6 KB 295ms
295ms Document
text/html 172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/popouiyt/gyrfd.html

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

736e85b6a5214e90e34aff6811b89d65e4e19d640d18a14119f2bd893aa047fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Referer: https://khaine.nl/popouiyt/gyrfd.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 871d953ede0a36bf-YYZ
content-encoding: br
content-type: text/html
date: Tue, 09 Apr 2024 21:27:46 GMT
last-modified: Mon, 08 Apr 2024 11:11:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OlLwmee3G%2BloCOKvsw4kFdJ805z37bgm1FjoYpU2sOwvbVrAdRq8GsTbBHFwEhoqD%2BiOOsmRbINvWqeudkckM%2BRPyN3omH0%2B%2BdH%2FKNYzTsM5YsWvrkRtgF5qt4k%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff nosniff
x-nginx-upstream-cache-status: EXPIRED
x-server-powered-by: Engintron
x-xss-protection: 1; mode=block 1; mode=block

GET
H2 200 jquery-1.11.1.min.js Show response
code.jquery.com/ 94 KB
33 KB 75ms
22ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.1.min.js
Requested by: Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://khaine.nl/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 09 Apr 2024 21:27:46 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 17895862
x-cache: HIT, HIT
content-length: 33202
x-served-by: cache-lga21922-LGA, cache-nyc-kteb1890043-NYC
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1712698066.098364,VS0,VE0
etag: W/"28feccc0-1762a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 34, 820

GET
H/1.1 200
OK dhl-1-logo-png-transparent.png
cdn.freebiesupply.com/logos/large/2x/ 45 KB
45 KB 99ms
44ms Image
image/png 104.131.67.145
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.freebiesupply.com/logos/large/2x/dhl-1-logo-png-transparent.png
Requested by: Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.131.67.145 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 7f8a7411080898c5e0e9a1b99c27c4c0951d558c6948a8f5cd712364f85e9bc7

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://khaine.nl/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 09 Apr 2024 21:27:46 GMT
Last-Modified: Fri, 09 Mar 2018 21:42:13 GMT
Server: nginx
x-amz-request-id: 28614FAD7B274E59
ETag: "c254c6e963469ddf999da53d10109dea"
X-Cache-Status: HIT
Content-Type: image/png
Cache-Control: max-age=15552000, public, no-transform
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 45805
x-amz-id-2: XZbIpmPf9PFo2XVF7tEO9Qr7mSd4FG4AA+Rw98IEpb27+/GWXHNMfBTBVGvb4Conea/CEiMQ2Lc=
Expires: Sun, 06 Oct 2024 21:27:46 GMT

GET
H2

200

logo.svg
www.dhlecommerce.nl/themes/custom/dp_theme/images/
Redirect Chain

https://www.dhlparcel.nl/themes/custom/dp_theme/images/logo.svg
https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg

3 KB
1 KB

544ms
41ms

Image
image/svg+xml

2606:4700::6812:1ac4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Server

2606:4700::6812:1ac4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a62bf08fcdd300ef2c47e160b8d0a9f2dcb2fd9278af0a4e52cc716deb8a14c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Apr 2024 21:27:46 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 08:02:34 GMT
server: cloudflare
age: 12
etag: W/"c72-614b3f21dba80"
vary: Accept-Encoding
content-type: image/svg+xml
content-encoding: br
cf-ray: 871d9544fe604bc9-BUF

Redirect headers

date: Tue, 09 Apr 2024 21:27:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
vary: Accept-Encoding
location: https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg
cache-control: max-age=3600
cf-ray: 871d95415f3e4bc7-BUF
expires: Tue, 09 Apr 2024 22:27:46 GMT

GET
H2

200

freight-volvo-1-1592x896.web.796.448.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/
Redirect Chain

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg

90 KB
90 KB

1052ms
557ms

Image
image/jpeg

2600:141b:1c00:16::17c4:322
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Server

2600:141b:1c00:16::17c4:322 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

9ecffc589fabf1eddb43842acfbff00c31fbf44245108bbbca289863af0b06c1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
date: Tue, 09 Apr 2024 21:27:47 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains
x-akamai-cache: Miss from child, RefreshHit from parent
content-length: 91709
pragma: no-cache
referrer-policy: same-origin
last-modified: Sat, 23 Mar 2024 15:02:11 GMT
etag: "1663d-61455399f0387"
x-frame-options: DENY
content-type: image/jpeg
cache-control: max-age=0, no-cache
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Tue, 09 Apr 2024 21:27:47 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:27:46 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
server: AkamaiGHost
location: https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg
cache-control: max-age=0, no-cache
x-akamai-cache: Redirect from child
content-length: 0
expires: Tue, 09 Apr 2024 21:27:46 GMT

GET
H2

200

favicon.ico
www.dhlecommerce.nl/themes/custom/dp_theme/
Redirect Chain

https://www.dhlparcel.nl/themes/custom/dp_theme/favicon.ico
https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico

7 KB
2 KB

39ms
39ms

Other
image/vnd.microsoft.icon

2606:4700::6812:1ac4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico

Protocol

Server

2606:4700::6812:1ac4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6804c64aa3c5ed0b33ea0127c00d7d5af5bcca300162e009ce80de5032618cb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Apr 2024 21:27:47 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 08:02:34 GMT
server: cloudflare
age: 11
etag: W/"1cee-614b3f21dba80"
vary: Accept-Encoding
content-type: image/vnd.microsoft.icon
content-encoding: br
cf-ray: 871d954c6a4c4bc9-BUF

Redirect headers

date: Tue, 09 Apr 2024 21:27:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
vary: Accept-Encoding
location: https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico
cache-control: max-age=3600
cf-ray: 871d954c1bee4bc7-BUF
expires: Tue, 09 Apr 2024 22:27:47 GMT

GET
H2

200

freight-volvo-2-1592x896.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/
Redirect Chain

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg

171 KB
172 KB

606ms
606ms

Image
image/jpeg

2600:141b:1c00:16::17c4:322
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg

Protocol

Server

2600:141b:1c00:16::17c4:322 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f449ce762ddce439c1eeeb45cd4ef484fa90dd58e9de00d41d9e7953e211be11

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
date: Tue, 09 Apr 2024 21:27:50 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains
x-akamai-cache: Miss from child, RefreshHit from parent
content-length: 175534
pragma: no-cache
referrer-policy: same-origin
last-modified: Sat, 23 Mar 2024 18:59:34 GMT
etag: "2adae-614588a8efe8d"
x-frame-options: DENY
content-type: image/jpeg
cache-control: max-age=0, no-cache
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Tue, 09 Apr 2024 21:27:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:27:50 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
server: AkamaiGHost
location: https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg
cache-control: max-age=0, no-cache
x-akamai-cache: Redirect from child
content-length: 0
expires: Tue, 09 Apr 2024 21:27:50 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
khaine.nl/	1970-01-20 19:46:24	Name: OXnFyKwkD4sUkmTXTX5Tc-o2tp8 Value: LAsPh9cx3yEZPI3_SYc03Zd926s
khaine.nl/	1970-01-20 19:46:24	Name: yAoBKXiR0UVUmhzFKA77KMj7zN0 Value: 1712698064
khaine.nl/	1970-01-20 19:46:24	Name: 2Gf6v26Md4_CQzEAuI7fek1d_KE Value: 1712784464
khaine.nl/	1970-01-20 19:46:24	Name: -N6ayFCjssNLo0QLlyZnUm2nGVk Value: FEqo0Hx1rDPzQAW1y8oTxMuvvcU
khaine.nl/	1970-01-20 19:46:24	Name: RCSgWFVEFK_0KlEx6c9_CQeqoDQ Value: mRTYwVWxTRKVUANBV3BQHbv8QWQ
khaine.nl/	1970-01-20 19:46:24	Name: w3Opge5GMHptuUxwgHHTYR2QNUM Value: wgGOROji18s3pjQ28rxZefwF0S8
.khaine.nl/	1970-01-21 04:30:34	Name: cf_clearance Value: k5NYb1brL7sgmzb77RAPSeLvDbdwnzimcEg8zUJuAQM-1712698065-1.0.1.1-5.8ERF_ivXbVH4FWIF5oa5s2oo5xzmfkd5ThYRP6yRd4xdYM79BWuBMhl1FUOCERVBc1ERyPaeMeo7RoBwsFyA
khaine.nl/	1970-01-20 19:46:24	Name: EyRlL74kRR-0hdd0InENNmMVc_8 Value: 1712698065
khaine.nl/	1970-01-20 19:46:24	Name: _ftufoCdqE6xlWWXoyY2pJV9vLQ Value: 1712784465
khaine.nl/	1970-01-20 19:46:24	Name: pWSOI_5mlgHmkXDcCZIHdbzzV2o Value: ck-UPOOwY5bQChkRG4npbIe3MFg
.dhlparcel.nl/	1969-12-31 23:59:59	Name: _cfuvid Value: e1YBrseSq9bI1k2GyLkecKD3vva.x7Y38CSoq_aRGws-1712698066144-0.0.1.1-604800000

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://khaine.nl/popouiyt/gyrfd.html Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://khaine.nl/favicon.ico Message: Failed to load resource: the server responded with a status of 503 ()
recommendation	verbose	URL: https://khaine.nl/popouiyt/gyrfd.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://khaine.nl/popouiyt/gyrfd.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://khaine.nl/popouiyt/gyrfd.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.freebiesupply.com
code.jquery.com
group.dhl.com
khaine.nl
www.dhlecommerce.nl
www.dhlparcel.nl
www.dpdhl.com
104.131.67.145
172.67.202.5
2600:141b:1c00:16::17c4:322
2600:141b:1c00:1a8a::296d
2606:4700::6812:1ac4
2606:4700::6812:69e3
2a04:4e42::649
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
6804c64aa3c5ed0b33ea0127c00d7d5af5bcca300162e009ce80de5032618cb6
736e85b6a5214e90e34aff6811b89d65e4e19d640d18a14119f2bd893aa047fd
7f8a7411080898c5e0e9a1b99c27c4c0951d558c6948a8f5cd712364f85e9bc7
87804c16118325f48922086f2d14260bdd4720eee876db0206da21ec9e500e4a
9ecffc589fabf1eddb43842acfbff00c31fbf44245108bbbca289863af0b06c1
a62bf08fcdd300ef2c47e160b8d0a9f2dcb2fd9278af0a4e52cc716deb8a14c3
cadaa278a2c743498b1086afb3442d44c427c009986e69f288907edc8e1e2146
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f449ce762ddce439c1eeeb45cd4ef484fa90dd58e9de00d41d9e7953e211be11

khaine.nl Open in urlscan Pro 172.67.202.5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

58 %HTTPS

71 %IPv6

7 Domains

7 Subdomains

5 IPs

1 Countries

370 kBTransfer

448 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

11 Cookies

5 Console Messages

Security Headers

Indicators

khaine.nl Open in urlscan Pro
172.67.202.5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

58 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

5
IPs

1
Countries

370 kB
Transfer

448 kB
Size

11
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!