konfirmat.co.il Open in urlscan Pro
91.238.103.101  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request view_doc.html Show response konfirmat.co.il/wp-content/plugins/contact-form-7/modules/cloud/dhl/	11 KB 5 KB	180ms 56ms	Document text/html	91.238.103.101 ARILOT-AS
General Check archive.org Show headers Download Go to Full URL https://konfirmat.co.il/wp-content/plugins/contact-form-7/modules/cloud/dhl/view_doc.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.238.103.101 , Ukraine, ASN58066 (ARILOT-AS, UA), Reverse DNS isp01.realhost.com.ua Software nginx/1.16.1 / Resource Hash bb09afdc7ddb781b39db630640be3dab3a4f5832788d050bfe83b33fe13165b8 Security Headers Name Value Strict-Transport-Security max-age=31536000; Request headers :method GET :authority konfirmat.co.il :scheme https :path /wp-content/plugins/contact-form-7/modules/cloud/dhl/view_doc.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx/1.16.1 date Wed, 23 Dec 2020 01:37:28 GMT content-type text/html; charset=UTF-8 strict-transport-security max-age=31536000; content-encoding gzip
GET H/1.1	200 OK	DHL-LOGO.jpg moneyissues.ng/wp-content/uploads/2017/10/	147 KB 148 KB	163ms 50ms	Image image/jpeg	94.130.112.187 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://moneyissues.ng/wp-content/uploads/2017/10/DHL-LOGO.jpg Requested by Host: konfirmat.co.il URL: https://konfirmat.co.il/wp-content/plugins/contact-form-7/modules/cloud/dhl/view_doc.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 94.130.112.187 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS onitsha.syskay.com Software Apache / Resource Hash d330843eabc3d779c21870769f43515137ffef8e0465862e31e1f43d0843aead Request headers Referer https://konfirmat.co.il/wp-content/plugins/contact-form-7/modules/cloud/dhl/view_doc.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 23 Dec 2020 01:37:28 GMT Last-Modified Mon, 09 Oct 2017 13:36:32 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 151005
GET H2	200	1493047371_qSXqU0_dhl.jpg static.businessworld.in/article/article_extra_large_image/	187 KB 188 KB	589ms 543ms	Image image/jpeg	2606:4700:3030::6818:7da9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://static.businessworld.in/article/article_extra_large_image/1493047371_qSXqU0_dhl.jpg Requested by Host: konfirmat.co.il URL: https://konfirmat.co.il/wp-content/plugins/contact-form-7/modules/cloud/dhl/view_doc.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:3030::6818:7da9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 610d2709b5c9837526af5693d5d84e742242f780e415332877c55e4bfb4f22aa Request headers Referer https://konfirmat.co.il/wp-content/plugins/contact-form-7/modules/cloud/dhl/view_doc.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 01:37:28 GMT cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} x-amz-request-id 1AE205510B9EB49B content-length 191332 x-amz-id-2 CadCRMyOMG2WFvE4o68Uo32e4r38nevg9bfjUkxBLkfOFx3kXCKz7+Jas/VA5G2jmYD2EGY0FEI= last-modified Fri, 01 Dec 2017 10:26:01 GMT server cloudflare etag "12ebe3bbe8505c6852e5dd834cadeaef" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FQaAt7MyyTOd03lIX62mzkmnCxFo78mYnb7EUt7Uame5JRvZyZlVE9GTRGK6jDlv%2B%2BUA%2FwiQ%2FffeeOKUn3DSNbi6%2FAtdNFS%2BWDUfVA53EVNMjFYy5TkLRCq4%2B5Q%2F1XxinXzAXA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control max-age=14400 cf-request-id 072ed7888d00004a621a037000000001 accept-ranges bytes cf-ray 605e5b874fb24a62-FRA
GET H2	200	4170017974.jpg edelivery.net/files/cache/2018/09/dhl-parcel-ch-1592x896_web__796_448/	49 KB 49 KB	232ms 81ms	Image image/jpeg	35.189.108.75 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://edelivery.net/files/cache/2018/09/dhl-parcel-ch-1592x896_web__796_448/4170017974.jpg Requested by Host: konfirmat.co.il URL: https://konfirmat.co.il/wp-content/plugins/contact-form-7/modules/cloud/dhl/view_doc.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.189.108.75 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS 75.108.189.35.bc.googleusercontent.com Software nginx / Resource Hash 2d607e1847502f60fb08c471012ccfb1e22d3c6a0535588b7ca49c257e693bfc Request headers Referer https://konfirmat.co.il/wp-content/plugins/contact-form-7/modules/cloud/dhl/view_doc.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 23 Dec 2020 01:37:28 GMT last-modified Mon, 03 Sep 2018 14:11:52 GMT server nginx etag "5b8d4128-c385" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 50053

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| modal object| _0x58eb function| _0x598b function| _0x1905d4 function| _0x202c97 function| _0x180425 string| hash function| suc function| _0x50f6bd

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

edelivery.net
konfirmat.co.il
moneyissues.ng
static.businessworld.in
2606:4700:3030::6818:7da9
35.189.108.75
91.238.103.101
94.130.112.187
2d607e1847502f60fb08c471012ccfb1e22d3c6a0535588b7ca49c257e693bfc
610d2709b5c9837526af5693d5d84e742242f780e415332877c55e4bfb4f22aa
bb09afdc7ddb781b39db630640be3dab3a4f5832788d050bfe83b33fe13165b8
d330843eabc3d779c21870769f43515137ffef8e0465862e31e1f43d0843aead