dhldelivery.de Open in urlscan Pro
192.161.165.46 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://dhldelivery.de/wry1/
Submission: On June 01 via api (June 1st 2022, 9:00:57 pm UTC) from IE — Scanned from DE

Summary HTTP 18 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 18 HTTP transactions. The main IP is 192.161.165.46, located in Los Angeles, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is dhldelivery.de.
TLS certificate: Issued by R3 on May 15th 2022. Valid for: 3 months.

This is the only time dhldelivery.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
16	192.161.165.46 192.161.165.46	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
2	2a02:26f0:350... 2a02:26f0:3500:991::39ce	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
18	2

16 192.161.165.46 (Los Angeles, United States)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: unassigned.quadranet.com

dhldelivery.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:991::39ce (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.dhl.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	dhldelivery.de dhldelivery.de	507 KB
2	dhl.de www.dhl.de — Cisco Umbrella Rank: 53314	11 KB
18	2

	Domain	Requested by
16	dhldelivery.de	dhldelivery.de
2	www.dhl.de	dhldelivery.de
18	2

This site contains links to these domains. Also see Links.

Domain
www.dhl.de
www.dhl.com
www.dpdhl.de
www.deutschepost.de
www.facebook.com
twitter.com
www.instagram.com
www.youtube.com
www.linkedin.com
www.xing.com

Subject Issuer	Validity	Valid
www.dhldelivery.de R3	`2022-05-15` - `2022-08-13`	3 months	crt.sh
www.dhl.de DPDHL Global TLS CA - I5	`2021-08-11` - `2022-08-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://dhldelivery.de/wry1/
Frame ID: 79072F2FF0F9DC57B4F05B2E56E38E96
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DHL Online Frankierung | DHLarrow-downarrow-link-leftarrow-link-rightarrow-upbig_arrow_lbig_arrow_rcheckclose-boldclose-thindownloadShapeexternal_linkfacebookglobegoogleplusinfolinkarrowlinkedinShapeloginiconmonstr-menu-1minusplayplusprintsearchsharetimett-clearancedelaytt-currentlocationtt-deliveredtt-departedtt-exceptiontt-intransittt-locationtt-manifestrecievedtt-notificationtt-pleasecontacttt-podtt-shippercontactedtt-startvimeoweiboyoutubetwitterlogged-inarrow-down-02arrow-up-02instagramxingdhl-alert-inversenewsletter

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

Page Statistics

18
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

518 kB
Transfer

1583 kB
Size

1
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.dhl.de/dhl-geschaeftskunde-werden
Title: Kunde werden

Search URL Search Domain Scan URL

URL: http://www.dhl.com/
Title: DHL.com

Search URL Search Domain Scan URL

URL: http://www.dpdhl.de/
Title: Deutsche Post DHL Group

Search URL Search Domain Scan URL

URL: http://www.dpdhl.de/karriere
Title: Karriere

Search URL Search Domain Scan URL

URL: http://www.dpdhl.de/presse
Title: Presse

Search URL Search Domain Scan URL

URL: http://www.dpdhl.de/investoren
Title: Investoren

Search URL Search Domain Scan URL

URL: https://www.deutschepost.de/de/n/nachhaltigkeit.html
Title: Nachhaltigkeit

Search URL Search Domain Scan URL

URL: https://www.facebook.com/DHLPaket/

Search URL Search Domain Scan URL

URL: https://twitter.com/DHLPaket

Search URL Search Domain Scan URL

URL: https://www.instagram.com/dhl_global/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/dhl

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/dhl

Search URL Search Domain Scan URL

URL: https://www.xing.com/companies/deutschepostag

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
dhldelivery.de/wry1/ 127 KB
41 KB 619ms
286ms Document
text/html 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 3f6bfa38a8b5508f07fefa75fee96aa597115aea2d0656d2f72d9defbc6a2b20

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache
content-encoding: gzip
content-type: text/html
date: Wed, 01 Jun 2022 21:01:23 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 app.4744d71a.css
dhldelivery.de/css/ 754 KB
115 KB 164ms
164ms Stylesheet
text/css 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/css/app.4744d71a.css
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 4aaf63de23b86a6574949f46a9d186d8e17de38afce3167f277443654691a215

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: text/css; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 app.e54ec06c.js Show response
dhldelivery.de/js/ 98 KB
22 KB 165ms
165ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/app.e54ec06c.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: acc0c456b7bffb15566798bd855fcb91a8dacd9dde0753edf74a767997b16d0d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-vendors.d868e65f.js Show response
dhldelivery.de/js/ 407 KB
142 KB 165ms
165ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/chunk-vendors.d868e65f.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 8f113c854a899c71f73c6a4c88a77fc50518cf6453ff4e9c70e0bf229235683d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-616d1e22.940b78ff.css
dhldelivery.de/css/ 0
230 B 295ms
294ms Other
text/css 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/css/chunk-616d1e22.940b78ff.css
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
x-cache: MISS
content-type: text/css; charset=utf-8
cache-control: max-age=43200
content-length: 60
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-17874aa8.c2c326e1.js
dhldelivery.de/js/ 0
21 KB 295ms
295ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/chunk-17874aa8.c2c326e1.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-2d20916c.9758bfe4.js
dhldelivery.de/js/ 0
5 KB 296ms
295ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/chunk-2d20916c.9758bfe4.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-2fcac651.27592786.js
dhldelivery.de/js/ 0
9 KB 296ms
295ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/chunk-2fcac651.27592786.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-616d1e22.6b331fab.js
dhldelivery.de/js/ 0
3 KB 295ms
295ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/chunk-616d1e22.6b331fab.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-f6431998.48f64280.js
dhldelivery.de/js/ 0
16 KB 296ms
295ms Other
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/chunk-f6431998.48f64280.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/wry1/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-2fcac651.27592786.js Show response
dhldelivery.de/js/ 25 KB
9 KB 147ms
147ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/chunk-2fcac651.27592786.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/js/app.e54ec06c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 2eaa8462c3b4ab46960dbe7220259fe672e14da02311a7267858b8d4e4a24dc6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-f6431998.48f64280.js Show response
dhldelivery.de/js/ 43 KB
16 KB 149ms
149ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/chunk-f6431998.48f64280.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/js/app.e54ec06c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: ec939be676c2b65da233d502ac9cc41a66038f71466d1aa62d8019dc3f54f606

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 chunk-2d20916c.9758bfe4.js Show response
dhldelivery.de/js/ 16 KB
5 KB 150ms
150ms Script
application/javascript 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/js/chunk-2d20916c.9758bfe4.js
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/js/app.e54ec06c.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: cb054e4b5feb97f55c4edc27baa20a7628c529158d2c0b346cd2c9fb81117ac2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/wry1/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:23 GMT
content-encoding: gzip
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
vary: Accept-Encoding
x-cache: MISS
content-type: application/javascript; charset=utf-8
cache-control: max-age=43200
expires: Thu, 02 Jun 2022 09:01:23 GMT

GET
H2 200 dhl-official.svg
www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/icons/ 2 KB
4 KB 63ms
17ms Image
image/svg+xml 2a02:26f0:3500:991::39ce
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.de/etc.clientlibs/redesign/clientlibs/static/resources/icons/dhl-official.svg

Requested by

Host: dhldelivery.de
URL: https://dhldelivery.de/verifizieren/dieanschrift

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:991::39ce Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

IPNP /

Resource Hash

aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains
content-encoding: gzip
x-content-type-options: NOSNIFF
content-security-policy-report-only: default-src 'self' data: https://fonts.gstatic.com/ https://cdn.podigee.com/ https://main.podigee-cdn.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; img-src 'self' data: https://pixel.consentric.de/ https://c1.adform.net/ https://t23.intelliad.de/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://deutschepostag1.d3.sc.omtrdc.net/ https://deutschepostwpmdpagprod2.112.2o7.net/ https://deutschepostpostidprod.112.2o7.net/ https://deutschepostag.112.2o7.net/ https://www.gstatic.com/ https://cdn.cookielaw.org/ https://www.facebook.com/ https://www.google.com/ https://t.leadlab.click/ https://insight.adsrvr.org/ https://www.bing.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.youtube.com/ https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://maps.google.com/ https://maps.googleapis.com/ https://cookie-cdn.cookiepro.com/ https://geolocation.onetrust.com/ https://www.bing.com/ https://r.bing.com/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://dev.virtualearth.net/ https://service.force.com/ https://d.la1-c1-fra.salesforceliveagent.com/ https://d.la3-c2-fra.salesforceliveagent.com/ https://d.la1-c1cs-fra.salesforceliveagent.com/ https://meinservice.my.salesforce.com/ https://www.google.com/ https://www.gstatic.com/ https://meinservice-dhl-sites.secure.force.com/ https://static.heidelpay.com/ https://www.google-analytics.com/ https://connect.facebook.net/ https://www.googletagmanager.com/ https://cdn.tt.omtrdc.net/ https://meinservice--rqa.my.salesforce.com/ https://pay.google.com/ https://assets.braintreegateway.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; style-src 'self' 'unsafe-inline' https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.bing.com/ https://r.bing.com/ https://meinservice-dhl-sites.secure.force.com/ https://cdn.tt.omtrdc.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; frame-src 'self' https://www.youtube.com/ https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.google.com/ https://payment.heidelpay.com/ https://assets.adobedtm.com/ https://deutschepost.elaine-asp.de/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; connect-src 'self' https://geolocation.onetrust.com/ https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://privacyportal-de.onetrust.com/ https://t.leadlab.click/ https://www.bing.com/ https://meinservice--rqa.my.salesforce.com/ https://deutschepostag1.d3.sc.omtrdc.net/ https://meinservice-dhl-sites.secure.force.com/ https://pixel.consentric.de/ https://meinservice.my.salesforce.com/ https://client-analytics.braintreegateway.com/ https://api.braintreegateway.com/ https://api.sandbox.braintreegateway.com/ https://payments.braintree-api.com/ https://payments.sandbox.braintree-api.com/ https://assets.braintreegateway.com/ https://braintree-sample-merchant.herokuapp.com/ https://origin-analytics-sand.sandbox.braintree-api.com/ https://depst-salaut-prod1.pegacloud.net/ https://depst-mara-dt1-decisionhub.pegacloud.net/ https://depst-mara-stg1-decisionhub.pegacloud.net/ https://depst-mara-prod1-decisionhub.pegacloud.net/ https://payment.heidelpay.com/ https://api.heidelpay.com/ https://www.google-analytics.com/ https://insight.adsrvr.org/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; frame-ancestors 'self' https://facebook.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/; form-action 'self'; report-uri /bin/csp/report
producers: IPNP-P-CP
x-dpwn-is-secure: 1
x-dns-prefetch-control: off
content-length: 729
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: IPNP
x-frame-options: SAMEORIGIN
date: Wed, 01 Jun 2022 21:00:52 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: must-revalidate, max-age=1437
accept-ranges: bytes
expires: Wed, 01 Jun 2022 21:24:49 GMT

GET
H2 200 dhl-group.svg
www.dhl.de/content/dam/images/ 9 KB
7 KB 69ms
24ms Image
image/svg+xml 2a02:26f0:3500:991::39ce
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhl.de/content/dam/images/dhl-group.svg

Requested by

Host: dhldelivery.de
URL: https://dhldelivery.de/verifizieren/dieanschrift

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:991::39ce Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

IPNP /

Resource Hash

55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains
X-Content-Type-Options	NOSNIFF
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://dhldelivery.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains
content-encoding: gzip
x-content-type-options: NOSNIFF
content-security-policy-report-only: default-src 'self' data: https://fonts.gstatic.com/ https://cdn.podigee.com/ https://main.podigee-cdn.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; img-src 'self' data: https://pixel.consentric.de/ https://c1.adform.net/ https://t23.intelliad.de/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://deutschepostag1.d3.sc.omtrdc.net/ https://deutschepostwpmdpagprod2.112.2o7.net/ https://deutschepostpostidprod.112.2o7.net/ https://deutschepostag.112.2o7.net/ https://www.gstatic.com/ https://cdn.cookielaw.org/ https://www.facebook.com/ https://www.google.com/ https://t.leadlab.click/ https://insight.adsrvr.org/ https://www.bing.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.youtube.com/ https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://maps.google.com/ https://maps.googleapis.com/ https://cookie-cdn.cookiepro.com/ https://geolocation.onetrust.com/ https://www.bing.com/ https://r.bing.com/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://dev.virtualearth.net/ https://service.force.com/ https://d.la1-c1-fra.salesforceliveagent.com/ https://d.la3-c2-fra.salesforceliveagent.com/ https://d.la1-c1cs-fra.salesforceliveagent.com/ https://meinservice.my.salesforce.com/ https://www.google.com/ https://www.gstatic.com/ https://meinservice-dhl-sites.secure.force.com/ https://static.heidelpay.com/ https://www.google-analytics.com/ https://connect.facebook.net/ https://www.googletagmanager.com/ https://cdn.tt.omtrdc.net/ https://meinservice--rqa.my.salesforce.com/ https://pay.google.com/ https://assets.braintreegateway.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; style-src 'self' 'unsafe-inline' https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.bing.com/ https://r.bing.com/ https://meinservice-dhl-sites.secure.force.com/ https://cdn.tt.omtrdc.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; frame-src 'self' https://www.youtube.com/ https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.google.com/ https://payment.heidelpay.com/ https://assets.adobedtm.com/ https://deutschepost.elaine-asp.de/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; connect-src 'self' https://geolocation.onetrust.com/ https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://privacyportal-de.onetrust.com/ https://t.leadlab.click/ https://www.bing.com/ https://meinservice--rqa.my.salesforce.com/ https://deutschepostag1.d3.sc.omtrdc.net/ https://meinservice-dhl-sites.secure.force.com/ https://pixel.consentric.de/ https://meinservice.my.salesforce.com/ https://client-analytics.braintreegateway.com/ https://api.braintreegateway.com/ https://api.sandbox.braintreegateway.com/ https://payments.braintree-api.com/ https://payments.sandbox.braintree-api.com/ https://assets.braintreegateway.com/ https://braintree-sample-merchant.herokuapp.com/ https://origin-analytics-sand.sandbox.braintree-api.com/ https://depst-salaut-prod1.pegacloud.net/ https://depst-mara-dt1-decisionhub.pegacloud.net/ https://depst-mara-stg1-decisionhub.pegacloud.net/ https://depst-mara-prod1-decisionhub.pegacloud.net/ https://payment.heidelpay.com/ https://api.heidelpay.com/ https://www.google-analytics.com/ https://insight.adsrvr.org/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; frame-ancestors 'self' https://facebook.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/; form-action 'self'; report-uri /bin/csp/report
producers: IPNP-P-CP
x-dpwn-is-secure: 1
x-dns-prefetch-control: off
content-length: 3240
x-xss-protection: 1; mode=block
referrer-policy: same-origin
server: IPNP
x-frame-options: SAMEORIGIN
date: Wed, 01 Jun 2022 21:00:52 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: must-revalidate, max-age=534
accept-ranges: bytes
expires: Wed, 01 Jun 2022 21:09:46 GMT

GET
H2 200 delivery-cdblk.774e0efb.woff2
dhldelivery.de/fonts/ 36 KB
36 KB 150ms
149ms Font
font/woff2 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/fonts/delivery-cdblk.774e0efb.woff2
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/css/app.4744d71a.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1

Request headers

Referer: https://dhldelivery.de/css/app.4744d71a.css
Origin: https://dhldelivery.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:24 GMT
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
x-cache: MISS
content-type: font/woff2
cache-control: max-age=43200
content-length: 36652
expires: Thu, 02 Jun 2022 09:01:24 GMT

GET
H2 200 delivery-rg.1a05a4d2.woff2
dhldelivery.de/fonts/ 33 KB
33 KB 150ms
150ms Font
font/woff2 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/fonts/delivery-rg.1a05a4d2.woff2
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/css/app.4744d71a.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7

Request headers

Referer: https://dhldelivery.de/css/app.4744d71a.css
Origin: https://dhldelivery.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:24 GMT
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
x-cache: MISS
content-type: font/woff2
cache-control: max-age=43200
content-length: 33580
expires: Thu, 02 Jun 2022 09:01:24 GMT

GET
H2 200 delivery-bd.682ea1d6.woff2
dhldelivery.de/fonts/ 33 KB
33 KB 150ms
150ms Font
font/woff2 192.161.165.46
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://dhldelivery.de/fonts/delivery-bd.682ea1d6.woff2
Requested by: Host: dhldelivery.de
URL: https://dhldelivery.de/css/app.4744d71a.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.161.165.46 Los Angeles, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS: unassigned.quadranet.com
Software: nginx /
Resource Hash: 4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f

Request headers

Referer: https://dhldelivery.de/css/app.4744d71a.css
Origin: https://dhldelivery.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 01 Jun 2022 21:01:24 GMT
last-modified: Sat, 14 May 2022 14:59:00 GMT
server: nginx
x-cache: MISS
content-type: font/woff2
cache-control: max-age=43200
content-length: 33840
expires: Thu, 02 Jun 2022 09:01:24 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.dhl.de/	1969-12-31 23:59:59	Name: akaalb_wwwdhldealb Value: ~op=www_dhl_de_alb:wwwdhlde\|~rv=75~m=wwwdhlde:0\|~os=06f548fb0da0a4ee62020bebc018f01f~id=45bfe75109a9df28de0b4e4334447907

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dhldelivery.de
www.dhl.de
192.161.165.46
2a02:26f0:3500:991::39ce
2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7
2eaa8462c3b4ab46960dbe7220259fe672e14da02311a7267858b8d4e4a24dc6
3f6bfa38a8b5508f07fefa75fee96aa597115aea2d0656d2f72d9defbc6a2b20
4aaf63de23b86a6574949f46a9d186d8e17de38afce3167f277443654691a215
4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114
8f113c854a899c71f73c6a4c88a77fc50518cf6453ff4e9c70e0bf229235683d
acc0c456b7bffb15566798bd855fcb91a8dacd9dde0753edf74a767997b16d0d
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
cb054e4b5feb97f55c4edc27baa20a7628c529158d2c0b346cd2c9fb81117ac2
ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec939be676c2b65da233d502ac9cc41a66038f71466d1aa62d8019dc3f54f606

dhldelivery.de Open in urlscan Pro 192.161.165.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

518 kBTransfer

1583 kBSize

1 Cookies

13 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

38 JavaScript Global Variables

1 Cookies

Indicators

dhldelivery.de Open in urlscan Pro
192.161.165.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

518 kB
Transfer

1583 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!