dhl-polska.crabdance.com Open in urlscan Pro
149.100.158.211  Malicious Activity! Public Scan

Submitted URL: http://urlz.fr/pgi9
Effective URL: https://dhl-polska.crabdance.com/oplata/billing.php
Submission: On January 14 via manual from PL — Scanned from FR

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 149.100.158.211, located in Vilnius, Lithuania and belongs to AS-HOSTINGER, CY. The main domain is dhl-polska.crabdance.com.
TLS certificate: Issued by R3 on January 14th 2024. Valid for: 3 months.
This is the only time dhl-polska.crabdance.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
2 2 2606:4700:303... 13335 (CLOUDFLAR...)
1 12 149.100.158.211 47583 (AS-HOSTINGER)
11 1
Apex Domain
Subdomains
Transfer
12 crabdance.com
dhl-polska.crabdance.com
299 KB
2 urlz.fr
urlz.fr — Cisco Umbrella Rank: 883614
1 KB
11 2
Domain Requested by
12 dhl-polska.crabdance.com 1 redirects dhl-polska.crabdance.com
2 urlz.fr 2 redirects
11 2

This site contains no links.

Subject Issuer Validity Valid
dhl-polska.crabdance.com
R3
2024-01-14 -
2024-04-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://dhl-polska.crabdance.com/oplata/billing.php
Frame ID: 2F787FC0EF38AB5EA6C921E842FE9B9C
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Logistyka globalna | Transport międzynarodowy | DHL | Polska

Page URL History Show full URLs

  1. http://urlz.fr/pgi9 HTTP 301
    https://urlz.fr/pgi9 HTTP 302
    https://dhl-polska.crabdance.com/oplata/ HTTP 302
    https://dhl-polska.crabdance.com/oplata/billing.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

299 kB
Transfer

364 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://urlz.fr/pgi9 HTTP 301
    https://urlz.fr/pgi9 HTTP 302
    https://dhl-polska.crabdance.com/oplata/ HTTP 302
    https://dhl-polska.crabdance.com/oplata/billing.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request billing.php
dhl-polska.crabdance.com/oplata/
Redirect Chain
  • http://urlz.fr/pgi9
  • https://urlz.fr/pgi9
  • https://dhl-polska.crabdance.com/oplata/
  • https://dhl-polska.crabdance.com/oplata/billing.php
6 KB
2 KB
Document
General
Full URL
https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
775553c1f2da11728e78555a17a180dd66355c7ea587466d4e18eccbb479c2a3
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Sun, 14 Jan 2024 17:59:20 GMT
referrer-policy
same-origin same-origin
server
nginx
vary
Accept-Encoding
x-content-type-options
nosniff nosniff
x-frame-options
SAMEORIGIN SAMEORIGIN
x-permitted-cross-domain-policies
master-only master-only
x-xss-protection
1; mode=block 1; mode=block

Redirect headers

content-type
text/html; charset=UTF-8
date
Sun, 14 Jan 2024 17:59:19 GMT
location
billing.php
referrer-policy
same-origin same-origin
server
nginx
x-content-type-options
nosniff nosniff
x-frame-options
SAMEORIGIN SAMEORIGIN
x-permitted-cross-domain-policies
master-only master-only
x-xss-protection
1; mode=block 1; mode=block
header.css
dhl-polska.crabdance.com/oplata/css/
7 KB
2 KB
Stylesheet
General
Full URL
https://dhl-polska.crabdance.com/oplata/css/header.css
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
c0e075bcb39e925fab77be33b3c4050c3cd20b05cf0cf6acd5032e1b1c7cb7dd

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/billing.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:11 GMT
server
nginx
etag
W/"65a40763-1d2d"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
dhl-logo.svg
dhl-polska.crabdance.com/oplata/images/
2 KB
860 B
Image
General
Full URL
https://dhl-polska.crabdance.com/oplata/images/dhl-logo.svg
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/billing.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:16 GMT
server
nginx
etag
W/"65a40768-643"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
searchloupe.svg
dhl-polska.crabdance.com/oplata/images/
329 B
422 B
Image
General
Full URL
https://dhl-polska.crabdance.com/oplata/images/searchloupe.svg
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
fd85293d457b5dc514838dd7d5c7c1509a7eed60e23cb32ab9303666833eb98a

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/billing.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:18 GMT
server
nginx
etag
W/"65a4076a-149"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
headermobile.JPG
dhl-polska.crabdance.com/oplata/images/
9 KB
2 KB
Image
General
Full URL
https://dhl-polska.crabdance.com/oplata/images/headermobile.JPG
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
c600aea2fa4dad3a13560e01bedf9e6c45db0571c3257d9e53e51c4f8fbbc41f

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/billing.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:21 GMT
server
nginx
etag
W/"65a4076d-2365"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
saba9m.JPG
dhl-polska.crabdance.com/oplata/images/
8 KB
1 KB
Image
General
Full URL
https://dhl-polska.crabdance.com/oplata/images/saba9m.JPG
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
d1b64fb7749d0d3c905c5244660a21f3d8e29699457f2889274c8a717742b6c5

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/billing.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:17 GMT
server
nginx
etag
W/"65a40769-1f14"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
customer.svg
dhl-polska.crabdance.com/oplata/images/
2 KB
915 B
Image
General
Full URL
https://dhl-polska.crabdance.com/oplata/images/customer.svg
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
0c3950f8653400246636960456db609af841feb691e53911e763ee282616a390

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/billing.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:15 GMT
server
nginx
etag
W/"65a40767-657"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
ssdsd.JPG
dhl-polska.crabdance.com/oplata/images/
8 KB
1 KB
Image
General
Full URL
https://dhl-polska.crabdance.com/oplata/images/ssdsd.JPG
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
7dcdd04db64c3edd7e9868c6238b622d33caee1e7bdadbf2623d801109eefef1

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/billing.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:18 GMT
server
nginx
etag
W/"65a4076a-1f0d"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
feedback.png
dhl-polska.crabdance.com/oplata/images/
2 KB
2 KB
Image
General
Full URL
https://dhl-polska.crabdance.com/oplata/images/feedback.png
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
3221db8f898b88e467ebbb8ae155a37bd02087b3df197ad5c4ecead06db08cdf

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/billing.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:18 GMT
server
nginx
etag
W/"65a4076a-629"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
socials.JPG
dhl-polska.crabdance.com/oplata/images/
9 KB
2 KB
Image
General
Full URL
https://dhl-polska.crabdance.com/oplata/images/socials.JPG
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/billing.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
1ace605596027318737abeca712c7a0d6d76f753cf82affba37c3d2f44862ae4

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/billing.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:18 GMT
server
nginx
etag
W/"65a4076a-2396"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
bedelhna.jpg
dhl-polska.crabdance.com/oplata/images/
313 KB
285 KB
Image
General
Full URL
https://dhl-polska.crabdance.com/oplata/images/bedelhna.jpg
Requested by
Host: dhl-polska.crabdance.com
URL: https://dhl-polska.crabdance.com/oplata/css/header.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
149.100.158.211 Vilnius, Lithuania, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
nginx /
Resource Hash
e97bdcfe18af48286583f57bc3a82f6c57dcbc2d2131f43ea575c90d2619db36

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://dhl-polska.crabdance.com/oplata/css/header.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Sun, 14 Jan 2024 17:59:20 GMT
content-encoding
br
last-modified
Sun, 14 Jan 2024 16:10:14 GMT
server
nginx
etag
W/"65a40766-4e248"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| redirect

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block