b1u.980.mytemp.website
Open in
urlscan Pro
107.180.117.50
Malicious Activity!
Public Scan
Effective URL: https://b1u.980.mytemp.website/hold/pack/home.php?newtoken=
Submission: On September 10 via api from US — Scanned from US
Summary
TLS certificate: Issued by b1u.980.mytemp.website on July 14th 2024. Valid for: a year.
This is the only time b1u.980.mytemp.website was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 16 | 107.180.117.50 107.180.117.50 | 398101 (GO-DADDY-...) (GO-DADDY-COM-LLC) | |
1 | 104.21.234.144 104.21.234.144 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 135.181.58.223 135.181.58.223 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 2 | 23.44.136.27 23.44.136.27 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 23.44.111.7 23.44.111.7 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
4 | 173.222.142.162 173.222.142.162 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
26 | 6 |
ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 50.117.180.107.host.secureserver.net
b1u.980.mytemp.website |
ASN24940 (HETZNER-AS, DE)
PTR: white.hostingcolor.com
dispatching-centre.lasamericascargo.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-44-136-27.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-44-111-7.deploy.static.akamaitechnologies.com
events.api.secureserver.net |
ASN16625 (AKAMAI-AS, US)
PTR: a173-222-142-162.deploy.static.akamaitechnologies.com
csp.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
mytemp.website
1 redirects
b1u.980.mytemp.website |
80 KB |
6 |
secureserver.net
events.api.secureserver.net — Cisco Umbrella Rank: 20700 csp.secureserver.net — Cisco Umbrella Rank: 20670 |
574 B |
3 |
lasamericascargo.com
dispatching-centre.lasamericascargo.com |
37 KB |
2 |
wsimg.com
1 redirects
img1.wsimg.com — Cisco Umbrella Rank: 15358 |
21 KB |
1 |
lr-in.com
cdn.lr-in.com — Cisco Umbrella Rank: 52298 |
177 KB |
26 | 5 |
Domain | Requested by | |
---|---|---|
16 | b1u.980.mytemp.website |
1 redirects
b1u.980.mytemp.website
|
4 | csp.secureserver.net |
img1.wsimg.com
|
3 | dispatching-centre.lasamericascargo.com |
b1u.980.mytemp.website
|
2 | events.api.secureserver.net |
img1.wsimg.com
|
2 | img1.wsimg.com |
1 redirects
b1u.980.mytemp.website
|
1 | cdn.lr-in.com |
b1u.980.mytemp.website
|
26 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
b1u.980.mytemp.website b1u.980.mytemp.website |
2024-07-14 - 2025-07-14 |
a year | crt.sh |
lr-in.com WE1 |
2024-09-02 - 2024-12-01 |
3 months | crt.sh |
dispatching-centre.lasamericascargo.com cPanel, Inc. Certification Authority |
2024-07-23 - 2024-10-21 |
3 months | crt.sh |
*.api.secureserver.net Starfield Secure Certificate Authority - G2 |
2024-07-15 - 2025-08-16 |
a year | crt.sh |
*.secureserver.net Starfield Secure Certificate Authority - G2 |
2023-10-10 - 2024-11-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://b1u.980.mytemp.website/hold/pack/home.php?newtoken=
Frame ID: DAD7E8ACEDE8C222B2A91C9938BEBF46
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
Verification | DHLPage URL History Show full URLs
-
http://b1u.980.mytemp.website/hold/pack/
HTTP 307
https://b1u.980.mytemp.website/hold/pack/ HTTP 302
https://b1u.980.mytemp.website/hold/pack/home.php?newtoken= Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://b1u.980.mytemp.website/hold/pack/
HTTP 307
https://b1u.980.mytemp.website/hold/pack/ HTTP 302
https://b1u.980.mytemp.website/hold/pack/home.php?newtoken= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 301
- https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.php
b1u.980.mytemp.website/hold/pack/ Redirect Chain
|
75 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
b1u.980.mytemp.website/hold/pack/assets/ |
405 KB 49 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logger-1.min.js
cdn.lr-in.com/ |
882 KB 177 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
b1u.980.mytemp.website/hold/pack/assets/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
col.png
b1u.980.mytemp.website/hold/pack/assets/ |
682 B 757 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pak.png
b1u.980.mytemp.website/hold/pack/assets/ |
380 B 433 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clan.png
b1u.980.mytemp.website/hold/pack/assets/ |
475 B 528 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
alert.png
b1u.980.mytemp.website/hold/pack/assets/ |
469 B 522 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
foo.png
b1u.980.mytemp.website/hold/pack/assets/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
b1u.980.mytemp.website/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
session-recorder.js
b1u.980.mytemp.website/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
card.js
dispatching-centre.lasamericascargo.com/js/ |
57 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
intlTelInput.js
dispatching-centre.lasamericascargo.com/js/ |
87 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scc-c2.min.js
img1.wsimg.com/signals/js/clients/scc-c2/ Redirect Chain
|
105 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roboto-latin-400-normal.woff2
b1u.980.mytemp.website/fonts/vendor/@fontsource/roboto/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfa-solid-900.woff2
b1u.980.mytemp.website/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfa-solid-900.woff
b1u.980.mytemp.website/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roboto-all-400-normal.woff
b1u.980.mytemp.website/fonts/vendor/@fontsource/roboto/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfa-solid-900.ttf
b1u.980.mytemp.website/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 287 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 287 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.gif
dispatching-centre.lasamericascargo.com/images/ |
2 KB 2 KB |
Other
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| sessionHash number| visitId string| fingerprint function| openNav function| closeNav object| regeneratorRuntime object| __SDKCONFIG__ function| _LRLogger function| card function| Payment function| Card object| intlTelInputGlobals function| intlTelInput function| getRandomInt object| _trfd object| _tcclInternal object| _expDataLayer object| _signalsDataLayer object| scc-c2 object| _trfq4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
b1u.980.mytemp.website/ | Name: PHPSESSID Value: dohkqnho7tlue6jvp76svjnuov |
|
.mytemp.website/ | Name: _tccl_visitor Value: ef313cec-b32d-4dda-8d7c-f1a12be84760 |
|
.mytemp.website/ | Name: _tccl_visit Value: ef313cec-b32d-4dda-8d7c-f1a12be84760 |
|
.mytemp.website/ | Name: _scc_session Value: pc=1&C_TOUCH=2024-09-10T14:40:35.921Z |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b1u.980.mytemp.website
cdn.lr-in.com
csp.secureserver.net
dispatching-centre.lasamericascargo.com
events.api.secureserver.net
img1.wsimg.com
104.21.234.144
107.180.117.50
135.181.58.223
173.222.142.162
23.44.111.7
23.44.136.27
18c4b9b4c27233b541a47300a4ee98239e1f8dec4bbcd9fabb6bdad12ca82025
27030b68b1ffe766ca7b4885c6209dcd3570ba3ac668c2994650d816351ced20
381941fc8b5df86879d6e2fcf3392d281b796c33f430f045405a0e6af0e474b9
3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756
5e9384547cb7d8449f13f2503225b41444e8f7064c8f3918a8de0585ff366743
691ff3918fb72cddc3abf2b84af0d66e0d2875b18b032ef6864923789c7e4077
a0b9419777f544b665051cae80f11bf8ff9f925072a9f062a3d82c383e6cdfde
b0dbd00f3650fa6b931e678a9d8f79a405d23c7adf111ab91b1a01a0e7109807
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b36e63b78f7ab077c9f74269deec4010ae803b687b27ca13e6aa58712520bb84
b8b7e6c193f0b11bece8c12b305cbf15130bc99b32ae92426eb747a3da3264d6
cae9d5adf2b0220c74a93b644c26d53e27c3a87f9b5d3fe57d06442e808074a2
eaa97311feac6d31e443ea0c08935619c9b253119c68191f2bb52f600b3d583a
eb6ca62c1e5d64c52be3ffa63c298dcda2483c04c4b17d1bfe605d134e52f91b