Submitted URL: https://snip.ly/NZ_DHLcustoms-duties/
Effective URL: https://skm.mk/wp-content/dutydhl.html
Submission: On January 16 via api from IE — Scanned from DE

Summary

This website contacted 6 IPs in 4 countries across 7 domains to perform 11 HTTP transactions. The main IP is 87.120.9.99, located in Bulgaria and belongs to DATICUM, BG. The main domain is skm.mk.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 10th 2023. Valid for: 3 months.
This is the only time skm.mk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 87.120.9.99 47748 (DATICUM)
2 5 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 52.18.123.117 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
3 2606:4700::68... 13335 (CLOUDFLAR...)
11 6
Apex Domain
Subdomains
Transfer
5 todaybagg.com
todaybagg.com
11 KB
3 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225
104 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 28
2 KB
1 usabilla.com
w.usabilla.com — Cisco Umbrella Rank: 4649
16 KB
1 skm.mk
skm.mk
317 KB
1 snip.ly
snip.ly — Cisco Umbrella Rank: 483317
537 B
0 rootxone.me Failed
ww25.rootxone.me Failed
11 7
Domain Requested by
5 todaybagg.com 2 redirects skm.mk
todaybagg.com
3 cdnjs.cloudflare.com todaybagg.com
cdnjs.cloudflare.com
2 fonts.googleapis.com todaybagg.com
1 w.usabilla.com srcdoc
1 skm.mk
1 snip.ly 1 redirects
0 ww25.rootxone.me Failed todaybagg.com
11 7
Subject Issuer Validity Valid
skm.mk
cPanel, Inc. Certification Authority
2023-12-10 -
2024-03-09
3 months crt.sh
todaybagg.com
E1
2023-12-04 -
2024-03-03
3 months crt.sh
w.usabilla.com
Amazon RSA 2048 M02
2023-12-12 -
2025-01-09
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-12-11 -
2024-03-04
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh

This page contains 4 frames:

Primary Page: https://skm.mk/wp-content/dutydhl.html
Frame ID: F39719C7CB06528D1CAD358AD9B37A95
Requests: 22 HTTP requests in this frame

Frame: https://todaybagg.com/3da0e/1/16026/
Frame ID: 77A615463A41CF484C9C2DD5C2DA3FCD
Requests: 10 HTTP requests in this frame

Frame: data://truncated
Frame ID: 067CB43E5286256EAE3D287C675CD0D7
Requests: 1 HTTP requests in this frame

Frame: https://w.usabilla.com/b2d2adfa16cf.js?lv=1
Frame ID: 5339CA43D6C48530EC35730D589A365B
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Customer Service - DHL - New ZealandBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

  1. https://snip.ly/NZ_DHLcustoms-duties/ HTTP 302
    https://skm.mk/wp-content/dutydhl.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • googleapis\.com/.+webfont

Page Statistics

11
Requests

91 %
HTTPS

67 %
IPv6

7
Domains

7
Subdomains

6
IPs

4
Countries

620 kB
Transfer

1790 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://snip.ly/NZ_DHLcustoms-duties/ HTTP 302
    https://skm.mk/wp-content/dutydhl.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://todaybagg.com/3da0e/index.php HTTP 302
  • https://todaybagg.com/3da0e/1/index.php HTTP 302
  • https://todaybagg.com/3da0e/1/16026/
Request Chain 28
  • https://rootxone.me/pixel/wz3xIB32v8DPajHZ HTTP 0
  • http://ww25.rootxone.me/pixel/wz3xIB32v8DPajHZ?subid1=20240116-1708-07c4-9a41-72ae377fc620

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request dutydhl.html
skm.mk/wp-content/
Redirect Chain
  • https://snip.ly/NZ_DHLcustoms-duties/
  • https://skm.mk/wp-content/dutydhl.html
1 MB
317 KB
Document
General
Full URL
https://skm.mk/wp-content/dutydhl.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
87.120.9.99 , Bulgaria, ASN47748 (DATICUM, BG),
Reverse DNS
skm.mk
Software
LiteSpeed /
Resource Hash
7580304da8d947ce921bb2a0bc7ecab9202fc5bae80501fb0bc80f488f34b2e3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
324574
content-type
text/html
date
Tue, 16 Jan 2024 06:08:04 GMT
last-modified
Tue, 16 Jan 2024 04:47:21 GMT
server
LiteSpeed
vary
Accept-Encoding

Redirect headers

cf-cache-status
DYNAMIC
cf-ray
84642e8ade46366e-FRA
content-type
text/html; charset=utf-8
date
Tue, 16 Jan 2024 06:08:04 GMT
location
https://skm.mk/wp-content/dutydhl.html
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kRw5XPuZiQkU%2FrmfOQdW9lHk4oPQhggawMafsn5hMOJq0T9Etr6Jt%2Bi00aptXQk6nlRdEDnM2ipT%2Bn7wHxfrZl%2FZ9ajNmM7njoArOK44lxCGE9rOZfxqQVim%2Bl4oF0CQ32nCr9g%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Cookie, Origin
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
35 KB
35 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
395ba249406c5ca7b18bd6f3cf61c847a47420dd9d49d1d27364b50cb8d6c4e0

Request headers

Referer
Origin
https://skm.mk
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/
49 KB
49 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e1917f3f441759897a890df008553e1199f556f45af468eccd5adb562714764f

Request headers

Referer
Origin
https://skm.mk
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
font/woff2
/
todaybagg.com/3da0e/1/16026/ Frame 77A6
Redirect Chain
  • https://todaybagg.com/3da0e/index.php
  • https://todaybagg.com/3da0e/1/index.php
  • https://todaybagg.com/3da0e/1/16026/
17 KB
5 KB
Document
General
Full URL
https://todaybagg.com/3da0e/1/16026/
Requested by
Host: skm.mk
URL: https://skm.mk/wp-content/dutydhl.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93d15cf30f64e7e770bb64476daa149e5b88122c33ad796d116c3ecae5dda5d0

Request headers

Referer
https://skm.mk/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
84642e95e97b1c8b-FRA
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 16 Jan 2024 06:08:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4zqK7R1kk33WjmT7LLSaGhCrh8X8wvaDAj0nOCr6GPhgpQWSJu6bH5sdKIV8JPJgWz3NO%2BifT0PlCAXBmOc1i3ZY9HkwoiIGsjkrTxBI17%2F2%2Fltsfpx%2B2CrnwfVpeb1kOGRwmkpFJ9u7D7vh"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
84642e94992779b9-LHR
content-type
text/html; charset=UTF-8
date
Tue, 16 Jan 2024 06:08:06 GMT
location
https://todaybagg.com/3da0e/1/16026/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GkeKm9kmlZOyIcFYaulcovstlyabyr4hEMcUM5oUbpS4Hmk2ohAx0P2g3aUA7Wqj7G%2BQqYZpBW0kalEGO%2FNzyliPz%2FMS4MDG5RYjKzWbHphps4OXW2edOPK87TqDwFE17KL%2Bf2f7fKoQm5X6"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
truncated
/
666 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
44ed9ab6b908ba0fe43c5d32273507f3f7afd8ffd6841e8d41c4cb37ea00fb28

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5f8e1437511b5ec484e9fd0c9ccb2c2c2a2ea2869c0f20018e6883caf6bcf1cd

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c76cd749286368eae683545cc8baf06a3141ca845097984d146438ba13db6e06

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
90fb9be0fae070f08d943401c91c851f70f58ceaf874f4e75aeed2ac3c5a38da

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
acd3eaf2b608fb48f9915964c36772b322ad91106508c4490e2a72122db4d347

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
43027752f5a04142e6518a4fd8ef54e7e73cfba7820da9c03c1ad38835f04fe2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c32f1a0f5b093b6b2c8f5df0bf93856359769ee6bbab40975043cd133711d528

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f01c2e1870fcd75ceca3b4c42c3110cb0aa4b933b562cf3d2c7ddd20ce03c7ee

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
12 KB
12 KB
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1fe7a0fba85601f1158e762795f7e935b4225b5c851793240be9562aadc8c35

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee8edf2528eafed88d2540a7a79163c9eec8844e22e5f273d37cd6f8351f6e0f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
408 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b58c6561202de2fd55031738c80f93790978fa53c48b19126fc4631a52c066dd

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
574 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8263962da699d760429e4e6d93c2c6145b0e188b3e6c8081a57f2e827c42f7af

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4ac70daeddeff4fb1b841dd2366ffda2cc7f2c05342bafd66317d11b69eaf589

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
434 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f4838bb499f4abf7a1cdc433d169ef1e716aaeb4b9c407ee469d3a76de95a21

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
835 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9052646c2c6dc5d46a8f62426d346c5efe6e9d48c43354dc199fed163fd2c77

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
38 KB
38 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cc7e06c636c1a0f35b48fa225bcb26074813aae2a45b47b21e7a8b067535126e

Request headers

Referer
Origin
https://skm.mk
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/
36 KB
36 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
89e44c501d749d18e1d02a99a78dff933409a0c035043e4e58eabe68e0cc8ede

Request headers

Referer
Origin
https://skm.mk
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ Frame 067C
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3221db8f898b88e467ebbb8ae155a37bd02087b3df197ad5c4ecead06db08cdf

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
image/png
b2d2adfa16cf.js
w.usabilla.com/ Frame 5339
68 KB
16 KB
Script
General
Full URL
https://w.usabilla.com/b2d2adfa16cf.js?lv=1
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.123.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-18-123-117.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a8c2a12f903c60cce349584e8b274b276472bc22eb693688900d7ede9aa60660

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://skm.mk/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 16 Jan 2024 06:08:05 GMT
content-encoding
gzip
x-widget-server
2.1
etag
"52b7833d4aa0244afcd940e1861b4d16"
content-type
text/javascript
cache-control
public,max-age=0
content-length
15945
css
fonts.googleapis.com/ Frame 77A6
2 KB
847 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Lato:400,100,300
Requested by
Host: todaybagg.com
URL: https://todaybagg.com/3da0e/1/16026/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c2d845ac2c75798a817fd86c2f3be63e5fc503748dfae940dec92b60d2a9f18a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://todaybagg.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 16 Jan 2024 06:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 16 Jan 2024 06:08:06 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 16 Jan 2024 06:08:06 GMT
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ Frame 77A6
37 KB
6 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Requested by
Host: todaybagg.com
URL: https://todaybagg.com/3da0e/1/16026/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://todaybagg.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Tue, 16 Jan 2024 06:08:06 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
3814177
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5884
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-9226"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0AJi3sToCPdo0m9zV38IgfaluXKI5bwqk%2FLfRMCJPrft1rPm1i5S0ruMDL%2B379r2foo86o3rCncCojaYQLSlpZs8P82Uf0i2NVMdA9weN%2Bw%2Bm58MkJuOxuVp6ZnzxxIyEHa5P%2BiG0Hge9xUTChR1zY39"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
84642e967d1271ca-FRA
expires
Sun, 05 Jan 2025 06:08:06 GMT
zocial.css
cdnjs.cloudflare.com/ajax/libs/css-social-buttons/1.2.0/css/ Frame 77A6
44 KB
22 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/css-social-buttons/1.2.0/css/zocial.css
Requested by
Host: todaybagg.com
URL: https://todaybagg.com/3da0e/1/16026/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bf8d41c2e2250b2f0b431531871178d57cd9af1f42bbe121c90b51fd66a1dff2
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://todaybagg.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Tue, 16 Jan 2024 06:08:06 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
945915
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
21543
last-modified
Mon, 04 May 2020 16:09:17 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e2d-ae99"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=quft5muji2S0VNRs%2FxXtIVdVoZ43RWcfitwjBYi3xnTeo4r19U942B4%2Bc3CbzY2mZP6KXDG1NYmvomImFqEJLtdn%2Fd2VvjXLbo6QwKUvvNPJjMbrgyGgj42R06MbhmuT3goW6%2BnfOTHFSc4e2u%2FwARBP"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
84642e967d1071ca-FRA
expires
Sun, 05 Jan 2025 06:08:06 GMT
style.css
todaybagg.com/3da0e/sourcexone/xonecss/ Frame 77A6
18 KB
5 KB
Stylesheet
General
Full URL
https://todaybagg.com/3da0e/sourcexone/xonecss/style.css
Requested by
Host: todaybagg.com
URL: https://todaybagg.com/3da0e/1/16026/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a34fb4112dac269525802264dfe989c4bfce795635799fcc2f8726c0e2fb496f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://todaybagg.com/3da0e/1/16026/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Tue, 16 Jan 2024 06:08:06 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Mon, 15 Jan 2024 13:45:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"4771-60efc398162c9-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=01K8l%2FOLqxuX3e9rk9O1NjRCVvpBjqsKKEzGSq%2BCwkiTcTld%2BoiwtHciyNMXFIthjg9zKoqd9aJQ064N58tWxvLZQjTx2kDYbJzZFbuihh4OnP8djT%2BDBqMTJ9aBm5NrqQ6gEqrMywKp5hyr"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
84642e9669da1c8b-FRA
alt-svc
h3=":443"; ma=86400
content-length
4184
wz3xIB32v8DPajHZ
ww25.rootxone.me/pixel/ Frame 77A6
Redirect Chain
  • https://rootxone.me/pixel/wz3xIB32v8DPajHZ
  • http://ww25.rootxone.me/pixel/wz3xIB32v8DPajHZ?subid1=20240116-1708-07c4-9a41-72ae377fc620
0
0

stepbar.css
todaybagg.com/3da0e/sourcexone/xonecss/ Frame 77A6
3 KB
1 KB
Stylesheet
General
Full URL
https://todaybagg.com/3da0e/sourcexone/xonecss/stepbar.css
Requested by
Host: todaybagg.com
URL: https://todaybagg.com/3da0e/1/16026/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a1a0917eca00cbcf2fd9f9c97031af5035645e18718f8e6ba239bf69314bc081

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://todaybagg.com/3da0e/1/16026/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Tue, 16 Jan 2024 06:08:06 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Mon, 15 Jan 2024 13:45:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"db8-60efc398162c9-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mdLhC2FSDyER11GmRN0bSWLEuDtwuwE0rcAkGpeiI%2BJXwvc6metnrVDTM2A2joU2UyHR9H8Y%2F8XUMqzc5J9mjFqnE8qvRFXWJ6xxogF6XXULXiwvQGRDRUlD4OvZYZfqrTf9Wt3Vg66Zg%2FQ0"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
84642e9669db1c8b-FRA
alt-svc
h3=":443"; ma=86400
content-length
994
css
fonts.googleapis.com/ Frame 77A6
17 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Source+Code+Pro:400,500,600,700|Source+Sans+Pro:400,600,700&display=swap
Requested by
Host: todaybagg.com
URL: https://todaybagg.com/3da0e/sourcexone/xonecss/style.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b8172166dbe776ffa12da60505a6324a609efce59a5eff460b7b9d579e2db30b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://todaybagg.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 16 Jan 2024 06:08:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 16 Jan 2024 06:04:42 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 16 Jan 2024 06:08:06 GMT
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ Frame 77A6
75 KB
76 KB
Font
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Origin
https://todaybagg.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Tue, 16 Jan 2024 06:08:06 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
3321567
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
77160
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-12d68"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7seMQ1oOHMrUe%2FK04tZbHm2EkePOJaH6X3OQHASHDOHbupbyPWWaRDdUlWiEH3ENYWfT%2BVum1ABrKVy814TDXWHUV3jNf3aCSPoXjJyD6dKD%2FYN%2BFUEz4Q%2FK%2BmAC2tnHacs%2BMLTzBmt92VfkzYY7Wb4k"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
84642e979a9d3630-FRA
expires
Sun, 05 Jan 2025 06:08:06 GMT
truncated
/ Frame 77A6
9 B
9 B
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9

Request headers

Referer
Origin
https://todaybagg.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

Content-Type
text/plain

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ww25.rootxone.me
URL
http://ww25.rootxone.me/pixel/wz3xIB32v8DPajHZ?subid1=20240116-1708-07c4-9a41-72ae377fc620

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 function| savepage_ShadowLoader

1 Cookies

Domain/Path Name / Value
snip.ly/ Name: sessionid
Value: w239iaaerimt45mqjtimecw3sq4n7n6g

13 Console Messages

Source Level URL
Text
other warning URL: https://skm.mk/wp-content/dutydhl.html(Line 7)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://skm.mk/wp-content/dutydhl.html(Line 8)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://skm.mk/wp-content/dutydhl.html(Line 9)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://skm.mk/wp-content/dutydhl.html(Line 10)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://skm.mk/wp-content/dutydhl.html(Line 11)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://skm.mk/wp-content/dutydhl.html(Line 12)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://todaybagg.com/3da0e/1/16026/
Message:
Failed to decode downloaded font: data:text/plain;base64,bm90IGZvdW5k
other warning URL: https://todaybagg.com/3da0e/1/16026/
Message:
OTS parsing error: invalid sfntVersion: 1852797984
other warning URL: https://todaybagg.com/3da0e/1/16026/
Message:
Failed to decode downloaded font: data:text/plain;base64,bm90IGZvdW5k
other warning URL: https://todaybagg.com/3da0e/1/16026/
Message:
OTS parsing error: invalid sfntVersion: 1852797984
other warning URL: https://todaybagg.com/3da0e/1/16026/
Message:
Failed to decode downloaded font: data:text/plain;base64,bm90IGZvdW5k
other warning URL: https://todaybagg.com/3da0e/1/16026/
Message:
OTS parsing error: invalid sfntVersion: 1852797984
security error URL: https://todaybagg.com/3da0e/1/16026/
Message:
Mixed Content: The page at 'https://skm.mk/wp-content/dutydhl.html' was loaded over HTTPS, but requested an insecure script 'http://ww25.rootxone.me/pixel/wz3xIB32v8DPajHZ?subid1=20240116-1708-07c4-9a41-72ae377fc620'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
fonts.googleapis.com
skm.mk
snip.ly
todaybagg.com
w.usabilla.com
ww25.rootxone.me
ww25.rootxone.me
2606:4700:20::ac43:49b9
2606:4700::6811:190e
2a00:1450:4001:80b::200a
2a06:98c1:3121::3
52.18.123.117
87.120.9.99
3221db8f898b88e467ebbb8ae155a37bd02087b3df197ad5c4ecead06db08cdf
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
395ba249406c5ca7b18bd6f3cf61c847a47420dd9d49d1d27364b50cb8d6c4e0
43027752f5a04142e6518a4fd8ef54e7e73cfba7820da9c03c1ad38835f04fe2
44ed9ab6b908ba0fe43c5d32273507f3f7afd8ffd6841e8d41c4cb37ea00fb28
4ac70daeddeff4fb1b841dd2366ffda2cc7f2c05342bafd66317d11b69eaf589
5f8e1437511b5ec484e9fd0c9ccb2c2c2a2ea2869c0f20018e6883caf6bcf1cd
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
7580304da8d947ce921bb2a0bc7ecab9202fc5bae80501fb0bc80f488f34b2e3
7f4838bb499f4abf7a1cdc433d169ef1e716aaeb4b9c407ee469d3a76de95a21
8263962da699d760429e4e6d93c2c6145b0e188b3e6c8081a57f2e827c42f7af
89e44c501d749d18e1d02a99a78dff933409a0c035043e4e58eabe68e0cc8ede
907ba78b4545338d3539683e63ecb51cf51c10adc9dabd86e92bd52339f298b9
90fb9be0fae070f08d943401c91c851f70f58ceaf874f4e75aeed2ac3c5a38da
93d15cf30f64e7e770bb64476daa149e5b88122c33ad796d116c3ecae5dda5d0
a1a0917eca00cbcf2fd9f9c97031af5035645e18718f8e6ba239bf69314bc081
a34fb4112dac269525802264dfe989c4bfce795635799fcc2f8726c0e2fb496f
a8c2a12f903c60cce349584e8b274b276472bc22eb693688900d7ede9aa60660
acd3eaf2b608fb48f9915964c36772b322ad91106508c4490e2a72122db4d347
b1fe7a0fba85601f1158e762795f7e935b4225b5c851793240be9562aadc8c35
b58c6561202de2fd55031738c80f93790978fa53c48b19126fc4631a52c066dd
b8172166dbe776ffa12da60505a6324a609efce59a5eff460b7b9d579e2db30b
bf8d41c2e2250b2f0b431531871178d57cd9af1f42bbe121c90b51fd66a1dff2
c2d845ac2c75798a817fd86c2f3be63e5fc503748dfae940dec92b60d2a9f18a
c32f1a0f5b093b6b2c8f5df0bf93856359769ee6bbab40975043cd133711d528
c76cd749286368eae683545cc8baf06a3141ca845097984d146438ba13db6e06
cc7e06c636c1a0f35b48fa225bcb26074813aae2a45b47b21e7a8b067535126e
d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc
d9052646c2c6dc5d46a8f62426d346c5efe6e9d48c43354dc199fed163fd2c77
e1917f3f441759897a890df008553e1199f556f45af468eccd5adb562714764f
ee8edf2528eafed88d2540a7a79163c9eec8844e22e5f273d37cd6f8351f6e0f
f01c2e1870fcd75ceca3b4c42c3110cb0aa4b933b562cf3d2c7ddd20ce03c7ee