darolfeiz.ir
Open in
urlscan Pro
2606:4700:3030::681c:1bb9
Malicious Activity!
Public Scan
Effective URL: https://darolfeiz.ir/wp-admin/content/bin/images/courier/login/?lang=en_EN
Submission: On December 07 via manual from SG
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on November 26th 2020. Valid for: 3 months.
This is the only time darolfeiz.ir was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation) Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.123.122 167.89.123.122 | 11377 (SENDGRID) (SENDGRID) | |
2 31 | 2606:4700:303... 2606:4700:3030::681c:1bb9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3034::ac43:837d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.23.37 152.199.23.37 | 15133 (EDGECAST) (EDGECAST) | |
31 | 3 |
ASN11377 (SENDGRID, US)
PTR: o16789123x122.outbound-mail.sendgrid.net
u19148427.ct.sendgrid.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
31 |
darolfeiz.ir
2 redirects
darolfeiz.ir |
453 KB |
1 |
msftauth.net
aadcdn.msftauth.net |
2 KB |
1 |
azarim.ir
azarim.ir |
|
1 |
sendgrid.net
1 redirects
u19148427.ct.sendgrid.net |
292 B |
31 | 4 |
Domain | Requested by | |
---|---|---|
31 | darolfeiz.ir |
2 redirects
darolfeiz.ir
|
1 | aadcdn.msftauth.net |
darolfeiz.ir
|
1 | azarim.ir |
darolfeiz.ir
|
1 | u19148427.ct.sendgrid.net | 1 redirects |
31 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.darolfeiz.ir Let's Encrypt Authority X3 |
2020-11-26 - 2021-02-24 |
3 months | crt.sh |
*.azarim.ir Let's Encrypt Authority X3 |
2020-11-26 - 2021-02-24 |
3 months | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2020-07-09 - 2021-07-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://darolfeiz.ir/wp-admin/content/bin/images/courier/login/?lang=en_EN
Frame ID: FC66B05BE33367786D16EDB2E039E3AA
Requests: 31 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://u19148427.ct.sendgrid.net/ls/click?upn=8i5HC4F9vFXxcfpkmV8FRn-2BsWyiA14KHkSF-2FRXNvYdTp70UlCU-2BJZbjVY...
HTTP 302
https://darolfeiz.ir/wp-admin/content/bin/images/courier/?email=john.mcmurdo@sasktel.com HTTP 302
https://darolfeiz.ir/wp-admin/content/bin/images/courier/login/?lang=en_EN Page URL
Detected technologies
Python (Programming Languages) ExpandDetected patterns
- html /(?:powered by <a[^>]+>Django ?([\d.]+)?<\/a>|<input[^>]*name=["']csrfmiddlewaretoken["'][^>]*>)/i
Django (Web Frameworks) Expand
Detected patterns
- html /(?:powered by <a[^>]+>Django ?([\d.]+)?<\/a>|<input[^>]*name=["']csrfmiddlewaretoken["'][^>]*>)/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u19148427.ct.sendgrid.net/ls/click?upn=8i5HC4F9vFXxcfpkmV8FRn-2BsWyiA14KHkSF-2FRXNvYdTp70UlCU-2BJZbjVYtEf-2BdGqJwvRQUrhb3jvVRwtxgDtf4mGsukKco8QVVvZU67nB3oiuDV-2BQnHSAgDGcQSo0WTf8tSvJS4Cq9GWSzEvb2S1GQ-3D-3DjX5w_0ujZrnHxNsgxW-2Fk2gJr-2Fkq88SH-2FsPENMEteXUe5FHDmbWm5J5N2Yc9J0kdqH9rQF2r4LggzzFWtAkUEjIC0qAiU4PiX5cgqDQbvCr8VjB9JCsUJSdkDxddQi-2BCp8TJ8gFbyDkU-2F1oGvnBLBFgZ7K7QzlwgmQwo4npItim3o9wmIcv0AxuUigHkQSRUhzhOHLK0bNPapDgIVKO0FsB-2B-2FgcnAH7I1S5CrQTvlctxIuNL8-3D
HTTP 302
https://darolfeiz.ir/wp-admin/content/bin/images/courier/?email=john.mcmurdo@sasktel.com HTTP 302
https://darolfeiz.ir/wp-admin/content/bin/images/courier/login/?lang=en_EN Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- https://darolfeiz.ir/wp-admin/content/bin/images/courier/login/css/generic-custom.d9464c862f8c.css HTTP 301
- https://azarim.ir/
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
darolfeiz.ir/wp-admin/content/bin/images/courier/login/ Redirect Chain
|
12 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chosen.min.5271f4ef175c.css
darolfeiz.ir/wp-admin/content/bin/images/courier/login/css/ |
11 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
reset.1147fbed2713.css
darolfeiz.ir/wp-admin/content/bin/images/courier/login/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
generic.fff90d6ae9fe.css
darolfeiz.ir/wp-admin/content/bin/images/courier/login/css/ |
57 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
azarim.ir/ Redirect Chain
|
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
layout.0f3533924280.css
darolfeiz.ir/wp-admin/content/bin/images/courier/login/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.66941a72b30a.css
darolfeiz.ir/wp-admin/content/bin/images/courier/login/css/ |
22 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dhl-modal.61a12f8793c3.css
darolfeiz.ir/wp-admin/content/bin/images/courier/login/css/ |
1002 B 615 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dhl.749b06c85447.gif
darolfeiz.ir/wp-admin/content/bin/images/courier/login/images/ |
443 B 740 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/ests/2.1/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webmail-logo.svg
darolfeiz.ir/wp-admin/content/bin/images/courier/login/images/ |
5 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bossmail.gif
darolfeiz.ir/wp-admin/content/bin/images/courier/login/images/ |
3 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
darolfeiz.ir/wp-admin/content/bin/images/courier/login/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
deutsche_post_dhl.41e385956b77.png
darolfeiz.ir/wp-admin/content/bin/images/courier/login/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.7b89c0e044ad.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
276 KB 76 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.371d836595d0.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
174 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ba-outside-events.b60998272f4f.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
components.59b187932710.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
36 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chosen.jquery.min.bdd701128539.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
28 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
djangojs.b28203373cc1.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
date.363a92817ea8.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
25 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.56c2c8aa8bc5.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
keep-alive.f871e3f4c3b5.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
810 B 752 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.25519043f274.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
2 KB 762 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-custom.bdc3d9a694ee.js
darolfeiz.ir/wp-admin/content/bin/images/courier/login/js/ |
587 B 480 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
navigation.4e701c3891db.gif
darolfeiz.ir/wp-admin/content/bin/images/courier/login/images/ |
1 KB 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.a9311487ea85.jpg
darolfeiz.ir/wp-admin/content/bin/images/courier/login/images/ |
179 KB 179 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
alert.214edb8f2dfc.png
darolfeiz.ir/wp-admin/content/bin/images/courier/login/images/icons/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow.248ae94961cd.gif
darolfeiz.ir/wp-admin/content/bin/images/courier/login/images/icons/ |
94 B 530 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iconset1.a6a0b6a05510.woff
darolfeiz.ir/wp-admin/content/bin/images/courier/login/fonts/ |
11 KB 11 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ef9a4f38-e55d-40e8-aa22-b4510adec541.59de7b5b4a1a.woff
darolfeiz.ir/wp-admin/content/bin/images/courier/login/fonts/ |
65 KB 65 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation) Microsoft (Consumer)25 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| contentLoader function| selector object| evance object| django function| pluralidx function| gettext function| ngettext function| gettext_noop function| pgettext function| npgettext function| interpolate function| get_format function| KeepAlive string| cookie_name2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
darolfeiz.ir/ | Name: PHPSESSID Value: 34402d246024d30aa89ff5cd7b0bff90 |
|
.darolfeiz.ir/ | Name: __cfduid Value: dc5acac7ef0b924051239797dc4fa06e61607316162 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
azarim.ir
darolfeiz.ir
u19148427.ct.sendgrid.net
152.199.23.37
167.89.123.122
2606:4700:3030::681c:1bb9
2606:4700:3034::ac43:837d
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0f43d2286ec5493fecbb4f3ff8bcc7b3a1e8e11eb89e99b3188ced45d111030f
1c3f22c0b668c88a6819e5a9eb562d7bfd7502463f41fd08caaaad90640c2950
2f680b51b19fc3c5befd02bd9d0d4e88c2722a5210157e4ef68933c5ba352109
39df1f88c845df49b898cecc356df4001f3f680bb0d653416087649e5448ed25
3faa6b97d52638f5da554834ef998c26459884535e7780603d9d7ebbd3f73864
4185f2d4d2763c9f8ed395249d397d4116e91cea79986767479901a66376d9fa
4416e230b4085ddbf4422df832b85b4523436bd728e0ea4db4debce24adbbfaf
44a29ead9d312addcb0287858defc4d8619aae0d66e2bdf0cd2862402e88375c
46b3e166072543c5595902d0285483e043c15279b23f42c0b669726e1db3c85e
4deb09e8627b569f86d84706ab19dc3350fc134cd22a704ee94d33f40eac44ff
4f5e849f11b1f3d348b4f504b570ab268f89e735079d46330a80f4df498b96be
6916f4eeeb6044f11672b761854c84170caaa2de2c08eee4ab9bf14fd735b04c
717ff43f0824d3efd40edf1c4147e194b8d06b8a20adb4d31b6d17557ee107f6
7246d4be45b5e3e6bdf9e44ebc96c8b31515c99b2ec15c5adbb45cf523ce8691
8a45b7a6bf6665652784c14a16625a4dadf31d679a967ffb0aa3ada0f6e52f4a
8af6ca786eb90c8c6cde021a534147465545a10eb0fe62b264c1d392d4a6614a
8c9dad4efefe8347f87b64928171b88364bd1adecab07e52e268b1ac98ad2721
95296c3ac543422f10b113494f963b4281394ee966342f161839193099335213
998cd48cdc0414f694d0a3a299dd2beb1134769d5666c7e5567e7d20b4174ef8
9ea1b583c8f9e969af1f35ee5dbbdc6429e6446fbcc5efa3d514f6a20ba796dc
b0645279bebff12182f7c04372731e240a37b539420c160df8e3809a61759b78
b360ff45c9eadb91b1b92af5dcefbaca5a8e8c35cb99fd9597ef43a51773b4b0
c00170657afa38e6f00203b7e14f85b36185b29794c58ce299bd3980266c703a
c6828b0104c8f4bb232915cecbfc8d374698ab66ea77ca8d6eb70403f0a07287
cfebc4ec430a7f9abeb71c806b14d168d1298e4616188dc7f19b905f210a6efc
da626ba2d8569e9035200178f8a7e13e0e16946c73afad3a7a3dd75a5a86aed9
dabb1fee5896ba5faf51a537057cc17eb8bab3f128ee0dd0e07829ed85d609f4
dcb0e267b5589eb31b79950228945de36499245630c9377b7215efa45a04f64b
e0c047346df9f90a0e333ce83990508304bb2920119e87a4200126d87dd9ad59
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855