urlscan.io logo urlscan.io
SecurityTrails logo

midlandodessa.attorney Open in urlscan Pro
2606:4700:3034::681b:bfee  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com
Effective URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0...
Submission Tags: @ipnigh
Submission: On March 26 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3034::681b:bfee, located in United States and belongs to CLOUDFLARENET, US. The main domain is midlandodessa.attorney.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on March 6th 2020. Valid for: 7 months.
This is the only time midlandodessa.attorney was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
14 2606:4700:303... 13335 (CLOUDFLAR...)
14 1
Apex Domain
Subdomains		 Transfer
14 midlandodessa.attorney
midlandodessa.attorney
359 KB
14 1
Domain Requested by
14 midlandodessa.attorney midlandodessa.attorney
14 1

This site contains links to these domains. Also see Links.

Domain
www.whatsmyip.us
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2020-03-06 -
2020-10-09		 7 months crt.sh

This page contains 1 frames:

Primary Page: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Frame ID: 854CF9FA9122F804B0A9B214794DCC21
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com Page URL
  2. https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHt... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

359 kB
Transfer

432 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com Page URL
  2. https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
index.php
midlandodessa.attorney/save/io/io/ 		528 B
568 B 		Document
General
Check archive.org
Download Go to
Full URL
https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eab4bdb367dc89cff30c01cfa11a1982338f1d5e0b636297194601c21692e628

Request headers

:method
GET
:authority
midlandodessa.attorney
:scheme
https
:path
/save/io/io/index.php?email=jitralada.le@patkol.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
date
Thu, 26 Mar 2020 00:23:54 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d81d63fc9f737da9b55e3dc145f8d29391585182233; expires=Sat, 25-Apr-20 00:23:53 GMT; path=/; domain=.midlandodessa.attorney; HttpOnly; SameSite=Lax; Secure
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
579cb9c179dd1f11-FRA
content-encoding
br
hl.jpg
midlandodessa.attorney/save/io/io/img/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://midlandodessa.attorney/save/io/io/img/hl.jpg
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1623225d55c29bd8661b2329e207d51286142a931725c573505c0bfa5c2198a

Request headers

Referer
https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 00:23:54 GMT
cf-cache-status
HIT
last-modified
Sun, 22 Jan 2017 17:49:34 GMT
server
cloudflare
age
587
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
579cb9c5f82f1f11-FRA
content-length
2512
bar.gif
midlandodessa.attorney/save/io/io/img/ 		189 KB
189 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://midlandodessa.attorney/save/io/io/img/bar.gif
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84a75ad61d0404ae29810295acffc370e195b64227a5445c30613ea316bdafdc

Request headers

Referer
https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 00:23:54 GMT
cf-cache-status
HIT
last-modified
Thu, 21 Apr 2016 16:05:34 GMT
server
cloudflare
age
587
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
579cb9c5f8301f11-FRA
content-length
193653
Primary Request u.php
midlandodessa.attorney/save/io/io/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
deb936dd133fd5e746786dce25a0ff88c9f00e5a653ce7f4deaca1724326ddc7

Request headers

:method
GET
:authority
midlandodessa.attorney
:scheme
https
:path
/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
referer
https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=d81d63fc9f737da9b55e3dc145f8d29391585182233
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://midlandodessa.attorney/save/io/io/index.php?email=jitralada.le@patkol.com

Response headers

status
200
date
Thu, 26 Mar 2020 00:23:57 GMT
content-type
text/html; charset=UTF-8
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
579cb9d2a9b01f11-FRA
content-encoding
br
facebox.css
midlandodessa.attorney/save/io/io/ 		947 B
422 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://midlandodessa.attorney/save/io/io/facebox.css
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0bdb168471bdcd990dee0b5c8d38b7da9350d9b96373c86eb8ccbb92ac41f63

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 23 Jan 2017 00:42:12 GMT
server
cloudflare
age
587
cf-polished
origSize=1168
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=14400
cf-ray
579cb9d63e451f11-FRA
cf-bgj
minify
jquery-1.6.2.min.js
midlandodessa.attorney/save/io/io/javascript/ 		89 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://midlandodessa.attorney/save/io/io/javascript/jquery-1.6.2.min.js
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 22 Jan 2017 17:49:36 GMT
server
cloudflare
age
587
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=14400
cf-ray
579cb9d63e461f11-FRA
facebox.js
midlandodessa.attorney/save/io/io/javascript/facebox/src/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://midlandodessa.attorney/save/io/io/javascript/facebox/src/facebox.js
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a40cfc752b638c4c1057b5d16064df740745e12fe4037c7396214e11d167082

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 22 Jan 2017 23:56:08 GMT
server
cloudflare
age
587
cf-polished
origSize=9532
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=14400
cf-ray
579cb9d64e471f11-FRA
cf-bgj
minify
jquery.watermark.js
midlandodessa.attorney/save/io/io/javascript/watermark/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://midlandodessa.attorney/save/io/io/javascript/watermark/jquery.watermark.js
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d96a8f2e31d181998debe494b2fc51570788fc7770693fc5c458103adf717af9

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 22 Jan 2017 17:49:36 GMT
server
cloudflare
age
587
cf-polished
origSize=19229
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=14400
cf-ray
579cb9d64e481f11-FRA
cf-bgj
minify
javascript1.js
midlandodessa.attorney/save/io/io/javascript/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://midlandodessa.attorney/save/io/io/javascript/javascript1.js
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
572d40545d1f5d6b7fd94e4e208eb0931d782ec9c8fa009f3a790d0533c92d51

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 23 Jan 2017 00:09:24 GMT
server
cloudflare
age
587
cf-polished
origSize=3035
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=14400
cf-ray
579cb9d64e491f11-FRA
cf-bgj
minify
hl%20image.jpg
midlandodessa.attorney/save/io/io/img/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://midlandodessa.attorney/save/io/io/img/hl%20image.jpg
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f86ea9862ff2a73d5513567d3b98dab234e1637f3401678d52fbabe3131f9f76

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
cf-cache-status
HIT
last-modified
Sun, 22 Jan 2017 17:49:34 GMT
server
cloudflare
age
586
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
579cb9d64e4a1f11-FRA
content-length
28530
hlim1.jpg
midlandodessa.attorney/save/io/io/img/ 		72 KB
72 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://midlandodessa.attorney/save/io/io/img/hlim1.jpg
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bed212ed0d3a0e3ad5efbacf3a6e93a2b3498513a7fac7d627f562d1276f2003

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
cf-cache-status
HIT
last-modified
Sun, 22 Jan 2017 17:49:34 GMT
server
cloudflare
age
586
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
579cb9d65e611f11-FRA
content-length
73681
hl.jpg
midlandodessa.attorney/save/io/io/img/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://midlandodessa.attorney/save/io/io/img/hl.jpg
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1623225d55c29bd8661b2329e207d51286142a931725c573505c0bfa5c2198a

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
cf-cache-status
HIT
last-modified
Sun, 22 Jan 2017 17:49:34 GMT
server
cloudflare
age
590
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
579cb9d65e721f11-FRA
content-length
2512
static-logo.jpg
midlandodessa.attorney/save/io/io/img/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://midlandodessa.attorney/save/io/io/img/static-logo.jpg
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd9249bcb8bf277f4db71cbc03a12f1b39b4da133e4661e3a72be3baf5303623

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
cf-cache-status
HIT
last-modified
Sun, 22 Jan 2017 17:49:36 GMT
server
cloudflare
age
586
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
579cb9d67e911f11-FRA
content-length
27243
cloudflare.min.js
midlandodessa.attorney/save/ajax.cloudflare.com/cdn-cgi/nexp/dok3v%3d919620257c/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://midlandodessa.attorney/save/ajax.cloudflare.com/cdn-cgi/nexp/dok3v%3d919620257c/cloudflare.min.js
Requested by
Host: midlandodessa.attorney
URL: https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::681b:bfee , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://midlandodessa.attorney/save/io/io/u.php?l=DHl-dTracking_=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHtoGYDw=_JeHFUq_VJOXK0QWHto=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Thu, 26 Mar 2020 00:23:57 GMT
content-encoding
gzip
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html
status
404
cf-ray
579cb9d67e941f11-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| CloudFlare function| $ function| jQuery object| jQuery16207626106966164221 function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download function| MM_reloadPage function| updateclock function| WorldClock number| zone boolean| isitlocal string| ampm object| now number| ofst number| secs number| sec number| mins number| min number| hr number| hrs string| statusampm string| hr2

1 Cookies

Domain/Path Name / Value
.midlandodessa.attorney/ Name: __cfduid
Value: d022fb63e232dfa86400fdad99091a6ef1585182237