urlscan.io logo urlscan.io
SecurityTrails logo

babboesignal.edu-crm.com Open in urlscan Pro
185.46.59.86  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://postitviral.com/uploads/
Effective URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Submission Tags: falconsandbox
Submission: On December 14 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 15 HTTP transactions. The main IP is 185.46.59.86, located in Switzerland and belongs to ASN-METANET Routingpeering issues: noc@metanet.ch, CH. The main domain is babboesignal.edu-crm.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 10th 2020. Valid for: 2 years.
This is the only time babboesignal.edu-crm.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
8 185.46.59.86 21069 (ASN-METAN...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
4 2a00:1450:400... 15169 (GOOGLE)
15 6
1    2606:4700:3031::ac43:bb7a (United States)

ASN13335 (CLOUDFLARENET, US)
postitviral.com
8    185.46.59.86 (Switzerland)

ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH)
PTR: mc21h1304.dnh.net
babboesignal.edu-crm.com
1    2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700:3031::ac43:d645 (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
1    2a02:26f0:6c00:2b3::39ce (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
www.dhl.de
4    2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Domain Requested by
8 babboesignal.edu-crm.com babboesignal.edu-crm.com
4 fonts.gstatic.com fonts.googleapis.com
1 www.dhl.de babboesignal.edu-crm.com
1 use.fontawesome.com babboesignal.edu-crm.com
1 fonts.googleapis.com babboesignal.edu-crm.com
1 postitviral.com 1 redirects
15 6

This site contains links to these domains. Also see Links.

Domain
www.dhl.de
www.bundesregierung.de
Subject Issuer Validity Valid
*.edu-crm.com
Sectigo RSA Domain Validation Secure Server CA		 2020-02-10 -
2022-02-09		 2 years crt.sh
upload.video.google.com
GTS CA 1C3		 2021-11-08 -
2022-01-31		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-07-07 -
2022-07-06		 a year crt.sh
www.dhl.de
DPDHL Global TLS CA - I5		 2021-08-11 -
2022-08-11		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2021-11-08 -
2022-01-31		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Frame ID: 4B224C4E6A86BF7B70BB1B31C50FA5A5
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Aktuelle Informationen zum Coronavirus | DHLInfo

Page URL History Show full URLs

  1. https://postitviral.com/uploads/ HTTP 301
    https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php Page URL

Page Statistics

15
Requests

100 %
HTTPS

83 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

246 kB
Transfer

1001 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://postitviral.com/uploads/ HTTP 301
    https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.php
babboesignal.edu-crm.com/images/Lieferung/versuchte/app/
Redirect Chain
  • https://postitviral.com/uploads/
  • https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
290 KB
42 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.46.59.86 , Switzerland, ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH),
Reverse DNS
mc21h1304.dnh.net
Software
nginx /
Resource Hash
98fa442ed16f51da6e09596dcb749c6a5a73ef12c850dd870c0647e4cc87171a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
nginx
date
Tue, 14 Dec 2021 22:47:09 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
content-encoding
gzip

Redirect headers

date
Tue, 14 Dec 2021 22:47:08 GMT
content-type
text/html; charset=UTF-8
location
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
x-powered-by
PHP/7.3.33
content-security-policy
upgrade-insecure-requests
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-turbo-charged-by
LiteSpeed
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Goj63rYAV6NUm3IUHFMjBg94YjcZO1fmILjVzp%2BvpSIX1jA8KsmUD5vm0eQbSmaEPm%2ByfwZga%2FUDvciWGXsiWbjR6l8LfTm4YkHyqy0m7nL3VtS5avDevYi1jWDUfjcnn1c1vzFCOdCS5gjRA%2Fg%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6bdaf8dc1ebb4321-FRA
clientlibs-head.min.90c1eb72f3d4ec8f551bc882be5276b7.css
babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/ 		519 KB
75 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/clientlibs-head.min.90c1eb72f3d4ec8f551bc882be5276b7.css
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.46.59.86 , Switzerland, ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH),
Reverse DNS
mc21h1304.dnh.net
Software
nginx /
Resource Hash
fba1d72e8ac55255867c97737e371c7542c70c2321244783c2272c1e8623ee57

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 22:47:09 GMT
content-encoding
gzip
last-modified
Tue, 14 Dec 2021 16:05:33 GMT
server
nginx
etag
W/"61b8c0cd-81bca"
vary
Accept-Encoding
content-type
text/css
erkennen.css
babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/ 		21 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/erkennen.css
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.46.59.86 , Switzerland, ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH),
Reverse DNS
mc21h1304.dnh.net
Software
nginx /
Resource Hash
1561c6fe5d4667cfe7664d0c6fcfb8158be79d1de395fea4104dffd393efeea8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 22:47:09 GMT
content-encoding
gzip
last-modified
Tue, 14 Dec 2021 16:05:33 GMT
server
nginx
etag
W/"61b8c0cd-53f8"
vary
Accept-Encoding
content-type
text/css
dhl-official.svg
babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/ 		2 KB
890 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/dhl-official.svg
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.46.59.86 , Switzerland, ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH),
Reverse DNS
mc21h1304.dnh.net
Software
nginx /
Resource Hash
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 22:47:09 GMT
content-encoding
gzip
last-modified
Tue, 14 Dec 2021 16:05:33 GMT
server
nginx
etag
W/"61b8c0cd-7f8"
vary
Accept-Encoding
content-type
image/svg+xml
sprite.svg
babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/ 		214 B
368 B 		Other
General
Check archive.org
Download Go to
Full URL
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/sprite.svg
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.46.59.86 , Switzerland, ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH),
Reverse DNS
mc21h1304.dnh.net
Software
nginx /
Resource Hash
cfa26163480e5f67434e46b990c1115006026ae05d1bbc5abab076f0b424a35d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 22:47:09 GMT
last-modified
Tue, 14 Dec 2021 16:05:33 GMT
server
nginx
etag
"d6-5d31d5bee2d9b"
content-type
image/svg+xml
x-accel-version
0.01
accept-ranges
bytes
content-length
214
css
fonts.googleapis.com/ 		8 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:300,400,500,700
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://babboesignal.edu-crm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 14 Dec 2021 22:40:29 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 14 Dec 2021 22:47:09 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 14 Dec 2021 22:47:09 GMT
all.css
use.fontawesome.com/releases/v5.5.0/css/ 		50 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v5.5.0/css/all.css
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:d645 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e4cac65c7a5ee0bd0743afefcabdd3e73854e1284ac9ac433813d6231f550f2

Request headers

Referer
https://babboesignal.edu-crm.com/
Origin
https://babboesignal.edu-crm.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 22:47:09 GMT
content-encoding
br
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
21964
access-control-allow-methods
GET
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id
2DEPWY5N6YH1JTKP
x-amz-id-2
4i390mU5tr02b65NDplBAUQwZfb9HVMxQ7o0jKDfEvWIwvjHalIzLp1JUbv4qkYlOWPIXXUTN2g=
last-modified
Wed, 30 Jun 2021 15:43:32 GMT
server
cloudflare
etag
W/"1cc6c92172d124fbd305ba3d8e263333"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yJp%2BdFblQkwKgH6Ol3Mw6Eo9m07Ux%2B5QqqCVkwowqBjctofPV8AgBvQ6p0FcL4Wg%2F8F%2BtsFoxZDRL1oiIKMbwVNz1j60gKx1vhhp76uBwgiAxiIoAiy3VjK%2FJnfE1q0ISb6Wvey%2FmuGg8JvXolkBHV%2F8"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31556926
cf-ray
6bdaf8ef2820691c-FRA
img.sly.1594297342494.3200.medium.png
www.dhl.de/de/privatkunden/kampagnenseiten/coronavirus/_jcr_content/par/responsivegrid/responsivepar/imagebg/image/ 		16 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.dhl.de/de/privatkunden/kampagnenseiten/coronavirus/_jcr_content/par/responsivegrid/responsivepar/imagebg/image/img.sly.1594297342494.3200.medium.png
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2b3::39ce Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
IPNP /
Resource Hash
6b9906af55fb0bd9312620de4cc41e38d2af69daaf14d96025cab75d17689a51
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://babboesignal.edu-crm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains
referrer-policy
same-origin
x-dpwn-is-secure
1
server
IPNP
date
Tue, 14 Dec 2021 22:47:09 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
must-revalidate, max-age=1588
producers
IPNP-P-CP
accept-ranges
bytes
x-dns-prefetch-control
off
content-security-policy-report-only
default-src 'self' data: https://fonts.gstatic.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; img-src 'self' data: https://pixel.consentric.de/ https://c1.adform.net/ https://t23.intelliad.de/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://deutschepostag1.d3.sc.omtrdc.net/ https://deutschepostwpmdpagprod2.112.2o7.net/ https://deutschepostpostidprod.112.2o7.net/ https://deutschepostag.112.2o7.net/ https://www.gstatic.com/ https://cdn.cookielaw.org/ https://www.facebook.com/ https://www.google.com/ https://t.leadlab.click/ https://insight.adsrvr.org/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://www.youtube.com/ https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://maps.google.com/ https://maps.googleapis.com/ https://cookie-cdn.cookiepro.com/ https://geolocation.onetrust.com/ https://www.bing.com/ https://t.ssl.ak.dynamic.tiles.virtualearth.net/ https://t1.ssl.ak.dynamic.tiles.virtualearth.net/ https://t0.ssl.ak.dynamic.tiles.virtualearth.net/ https://dev.virtualearth.net/ https://service.force.com/ https://d.la1-c1-fra.salesforceliveagent.com/ https://d.la3-c2-fra.salesforceliveagent.com/ https://d.la1-c1cs-fra.salesforceliveagent.com/ https://meinservice.my.salesforce.com/ https://www.google.com/ https://www.gstatic.com/ https://meinservice-dhl-sites.secure.force.com/ https://static.heidelpay.com/ https://www.google-analytics.com/ https://connect.facebook.net/ https://www.googletagmanager.com/ https://cdn.tt.omtrdc.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; style-src 'self' 'unsafe-inline' https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.bing.com/ https://meinservice-dhl-sites.secure.force.com/ https://cdn.tt.omtrdc.net/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; frame-src 'self' https://www.youtube.com/ https://meinservice.my.salesforce.com/ https://service.force.com/ https://www.google.com/ https://payment.heidelpay.com/ https://assets.adobedtm.com/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; connect-src 'self' https://cdn.cookielaw.org/ https://assets.adobedtm.com/ https://dpcomepost.tt.omtrdc.net/ https://privacyportal-de.onetrust.com/ https://t.leadlab.click/ https://www.bing.com/ https://meinservice--rqa.my.salesforce.com/ https://deutschepostag1.d3.sc.omtrdc.net/ https://meinservice-dhl-sites.secure.force.com/ https://pixel.consentric.de/ https://meinservice.my.salesforce.com/ https://client-analytics.braintreegateway.com/ https://api.braintreegateway.com/ https://payments.braintree-api.com/ https://depst-salaut-prod1.pegacloud.net/ https://depst-mara-dt1.pegacloud.net/ https://payment.heidelpay.com/ https://api.heidelpay.com/ https://www.google-analytics.com/ https://insight.adsrvr.org/ https://*.dhl.de/ https://*.dhl.de/ https://*.dhl.com/ https://dpm.demdex.net/ https://*.paypal.com/ https://dpcomepost.tt.omtrdc.net/; report-uri /bin/csp/report
content-length
16356
x-xss-protection
1; mode=block
expires
Tue, 14 Dec 2021 23:13:37 GMT
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
72e1803990a74d56c94fee5308837112295cba4e46ef22e0543a5eed9736f7c5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/png
match
babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/ 		0
139 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/match
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.46.59.86 , Switzerland, ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH),
Reverse DNS
mc21h1304.dnh.net
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 22:47:09 GMT
last-modified
Tue, 14 Dec 2021 16:05:33 GMT
server
nginx
etag
"0-5d31d5bedd7ab"
content-type
text/plain
x-accel-version
0.01
accept-ranges
bytes
content-length
0
dhl-group.svg
babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/ 		9 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/dhl-group.svg
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.46.59.86 , Switzerland, ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH),
Reverse DNS
mc21h1304.dnh.net
Software
nginx /
Resource Hash
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 22:47:09 GMT
content-encoding
gzip
last-modified
Tue, 14 Dec 2021 16:05:33 GMT
server
nginx
etag
W/"61b8c0cd-220b"
vary
Accept-Encoding
content-type
image/svg+xml
img.sly.1588687066524.3200.medium.png
babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/includes/img.sly.1588687066524.3200.medium.png
Requested by
Host: babboesignal.edu-crm.com
URL: https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.46.59.86 , Switzerland, ASN21069 (ASN-METANET Routingpeering issues: noc@metanet.ch, CH),
Reverse DNS
mc21h1304.dnh.net
Software
nginx /
Resource Hash
a7e87852677b8f8510d4a9c371161de0b7abdc09256bace3cc2f3be882133f32

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://babboesignal.edu-crm.com/images/Lieferung/versuchte/app/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 22:47:09 GMT
last-modified
Tue, 14 Dec 2021 16:05:33 GMT
server
nginx
accept-ranges
bytes
etag
"61b8c0cd-5be2"
content-length
23522
content-type
image/png
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://babboesignal.edu-crm.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 10 Dec 2021 13:39:48 GMT
x-content-type-options
nosniff
age
378442
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15688
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:19 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 10 Dec 2022 13:39:48 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://babboesignal.edu-crm.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 17:56:19 GMT
x-content-type-options
nosniff
age
535851
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15828
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:28 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 08 Dec 2022 17:56:19 GMT
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://babboesignal.edu-crm.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 08 Dec 2021 17:58:32 GMT
x-content-type-options
nosniff
age
535718
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15732
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:20 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 08 Dec 2022 17:58:32 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://babboesignal.edu-crm.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 14:02:00 GMT
x-content-type-options
nosniff
age
31510
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 16:13:21 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 14 Dec 2022 14:02:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

1 Cookies

Domain/Path Name / Value
www.dhl.de/ Name: akaalb_wwwdhldealb
Value: ~op=www_dhl_de_alb:wwwdhlde|~rv=45~m=wwwdhlde:0|~os=06f548fb0da0a4ee62020bebc018f01f~id=0ec728ac9d00a93652f23aa2ac4ca3d6