urlscan.io logo urlscan.io
SecurityTrails logo

dhl-tracking-number.objective-brown.159-223-22-45.plesk.page Open in urlscan Pro
159.223.22.45  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://nextnextneststores.americommerce.com/nsd/s3r1azesssy.html/
Effective URL: https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/clients/DVuS4v.php?verification
Submission: On August 15 via api from IE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 159.223.22.45, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is dhl-tracking-number.objective-brown.159-223-22-45.plesk.page.
TLS certificate: Issued by R3 on August 14th 2023. Valid for: 3 months.
This is the only time dhl-tracking-number.objective-brown.159-223-22-45.plesk.page was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 20.203.220.150 8075 (MICROSOFT...)
1 3 159.223.22.45 14061 (DIGITALOC...)
4 4
Domain Requested by
3 dhl-tracking-number.objective-brown.159-223-22-45.plesk.page 1 redirects g-f-germ-ans.switzerlandnorth.cloudapp.azure.com
dhl-tracking-number.objective-brown.159-223-22-45.plesk.page
1 g-f-germ-ans.switzerlandnorth.cloudapp.azure.com nextnextneststores.americommerce.com
1 nextnextneststores.americommerce.com
4 3

This site contains no links.

Subject Issuer Validity Valid
americommerce.com
Cloudflare Inc ECC CA-3		 2023-03-05 -
2024-03-04		 a year crt.sh
dhl-tracking-number.objective-brown.159-223-22-45.plesk.page
R3		 2023-08-14 -
2023-11-12		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/clients/DVuS4v.php?verification
Frame ID: 2D81958B648F6C3FA9F1B8A13E75DE6C
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Verifizierung | DHL

Page URL History Show full URLs

  1. https://nextnextneststores.americommerce.com/nsd/s3r1azesssy.html/ Page URL
  2. http://g-f-germ-ans.switzerlandnorth.cloudapp.azure.com/puyt41/2/?uyyhs=poipoipo Page URL
  3. https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/?lsko=poipoee Page URL
  4. https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/index-.php?de=de HTTP 302
    https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/clients/DVuS4v.php?verification Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

4
Requests

75 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

38 kB
Transfer

124 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nextnextneststores.americommerce.com/nsd/s3r1azesssy.html/ Page URL
  2. http://g-f-germ-ans.switzerlandnorth.cloudapp.azure.com/puyt41/2/?uyyhs=poipoipo Page URL
  3. https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/?lsko=poipoee Page URL
  4. https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/index-.php?de=de HTTP 302
    https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/clients/DVuS4v.php?verification Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
nextnextneststores.americommerce.com/nsd/s3r1azesssy.html/ 		149 B
325 B 		Document
General
Check archive.org
Download Go to
Full URL
https://nextnextneststores.americommerce.com/nsd/s3r1azesssy.html/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:295d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
312febe5e359d83a393fecf235c73197f168f544839170083ee5b1a1e4cd0084

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cf-cache-status
DYNAMIC
cf-ray
7f6f886c78769a3f-FRA
content-length
149
date
Tue, 15 Aug 2023 06:55:36 GMT
p3p
CP="We do not have a P3P policy. Learn why here: https://www.americommerce.com"
server
cloudflare
/
g-f-germ-ans.switzerlandnorth.cloudapp.azure.com/puyt41/2/ 		169 B
340 B 		Document
General
Check archive.org
Download Go to
Full URL
http://g-f-germ-ans.switzerlandnorth.cloudapp.azure.com/puyt41/2/?uyyhs=poipoipo
Requested by
Host: nextnextneststores.americommerce.com
URL: https://nextnextneststores.americommerce.com/nsd/s3r1azesssy.html/
Protocol
HTTP/1.1
Server
20.203.220.150 Zurich, Switzerland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / PHP/5.6.31
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
169
Content-Type
text/html; charset=UTF-8
Date
Tue, 15 Aug 2023 06:55:36 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
PHP/5.6.31
/
dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/ 		164 B
428 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/?lsko=poipoee
Requested by
Host: g-f-germ-ans.switzerlandnorth.cloudapp.azure.com
URL: http://g-f-germ-ans.switzerlandnorth.cloudapp.azure.com/puyt41/2/?uyyhs=poipoipo
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.223.22.45 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PHP/8.0.30 PleskLin
Resource Hash

Request headers

Referer
http://g-f-germ-ans.switzerlandnorth.cloudapp.azure.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
154
content-type
text/html; charset=UTF-8
date
Tue, 15 Aug 2023 06:55:37 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.0.30 PleskLin
Primary Request DVuS4v.php
dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/clients/
Redirect Chain
  • https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/index-.php?de=de
  • https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/clients/DVuS4v.php?verification
116 KB
36 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/clients/DVuS4v.php?verification
Requested by
Host: dhl-tracking-number.objective-brown.159-223-22-45.plesk.page
URL: https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/?lsko=poipoee
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.223.22.45 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx / PHP/8.0.30 PleskLin
Resource Hash
5d07c3dedfc491ed39dc1451e39ab442ee2f4dc784ca05982cee3c738663ddb0

Request headers

Referer
https://dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/maanage/dhldess/?lsko=poipoee
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 15 Aug 2023 06:55:37 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/8.0.30 PleskLin

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 15 Aug 2023 06:55:37 GMT
location
clients/DVuS4v.php?verification#_
server
nginx
x-powered-by
PHP/8.0.30 PleskLin
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		682 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
381941fc8b5df86879d6e2fcf3392d281b796c33f430f045405a0e6af0e474b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		380 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eb6ca62c1e5d64c52be3ffa63c298dcda2483c04c4b17d1bfe605d134e52f91b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		475 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b8b7e6c193f0b11bece8c12b305cbf15130bc99b32ae92426eb747a3da3264d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		469 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b36e63b78f7ab077c9f74269deec4010ae803b687b27ca13e6aa58712520bb84

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5c4b801e60c49235941cfc562ed465a951c937c668db31e3c1ba152513c672d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
dhl-tracking-number.objective-brown.159-223-22-45.plesk.page/ Name: PHPSESSID
Value: tq8vhfviusb55gjfvm6p0u4vkj