kurier-dhl.services Open in urlscan Pro
2606:4700:3035::681b:9ca3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://kurier-dhl.services/EMBFLNc1/hA0fK0b
Submission: On April 30 via manual (April 30th 2020, 2:27:39 pm UTC) from PL

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 22 HTTP transactions. The main IP is 2606:4700:3035::681b:9ca3, located in United States and belongs to CLOUDFLARENET, US. The main domain is kurier-dhl.services.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 29th 2020. Valid for: 5 months.

This is the only time kurier-dhl.services was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayU (Financial)

Domain & IP information

	IP Address		AS Autonomous System
22	2606:4700:303... 2606:4700:3035::681b:9ca3		13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	1

22 2606:4700:3035::681b:9ca3 (United States)

ASN13335 (CLOUDFLARENET, US)

kurier-dhl.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	kurier-dhl.services kurier-dhl.services	642 KB
22	1

	Domain	Requested by
22	kurier-dhl.services	kurier-dhl.services
22	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-04-29` - `2020-10-09`	5 months	crt.sh

This page contains 1 frames:

Primary Page: https://kurier-dhl.services/EMBFLNc1/hA0fK0b
Frame ID: 5E73AF8370449C21FB459578B83B80EA
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

22
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

642 kB
Transfer

740 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request hA0fK0b Show response kurier-dhl.services/EMBFLNc1/	12 KB 4 KB	797ms 742ms	Document text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `3844de7f25779f478f102a6fccf03c5bf19ad1715767a0e0e3161637aa900445` Request headers :method GET :authority kurier-dhl.services :scheme https :path /EMBFLNc1/hA0fK0b pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Thu, 30 Apr 2020 14:27:20 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d87539d0a913d3c1446735a782049f3961588256840; expires=Sat, 30-May-20 14:27:20 GMT; path=/; domain=.kurier-dhl.services; HttpOnly; SameSite=Lax PHPSESSID=94e5b46f7a19fbd372d5cd90b66eacc2; path=/ 287d66e84b40bf4c6b312cbec76248d0=212686496; expires=Thu, 30-Apr-2020 15:25:30 GMT; Max-Age=3490 a9b64bbcbb3414ff5cc2781b276a2e2a=2354936677; expires=Thu, 30-Apr-2020 15:26:32 GMT; Max-Age=3552 8d49e63bd7f1f4cc4ea6cb50105c11e6=3216446993; expires=Thu, 30-Apr-2020 15:25:01 GMT; Max-Age=3461 9a1970db2e8ed8074a696b5face627d3=699590969; expires=Thu, 30-Apr-2020 15:23:52 GMT; Max-Age=3392 05ff04dd0f63217938fc893b55ffa766=3129939379; expires=Thu, 30-Apr-2020 15:22:48 GMT; Max-Age=3328 50bc608c039842995bc3858c9fc689c7=3454435628; expires=Thu, 30-Apr-2020 15:24:24 GMT; Max-Age=3424 vary Accept-Encoding x-powered-by PHP/7.2.30 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 58c1f162fa0e64c7-FRA content-encoding br cf-request-id 026d1531de000064c71b296200000001
GET H2	200	cd2f1b5e01ee46d12500daab6d59874b0.css kurier-dhl.services/EMBFLNc1/css/	38 KB 9 KB	274ms 273ms	Stylesheet text/css	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/css/cd2f1b5e01ee46d12500daab6d59874b0.css Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `dd539ac2353f7001e3b09dd1b8a6b9c62974e9d540e8fb4c742ec544f886933f` Request headers Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:21 GMT content-encoding br cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css;charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f167acb764c7-FRA cf-request-id 026d1534cb000064c71b2ac200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	jquery.js Show response kurier-dhl.services/EMBFLNc1/	86 KB 30 KB	17ms 17ms	Script application/javascript	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/jquery.js Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a` Request headers Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 30 Apr 2020 14:27:20 GMT content-encoding br cf-cache-status HIT last-modified Fri, 06 Mar 2020 13:17:46 GMT server cloudflare age 70065 etag W/"5e624d7a-15851" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=315360000 cf-ray 58c1f167acb964c7-FRA cf-request-id 026d1534cb000064c71b2ad200000001 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	87ec9dc6366b47e8b9ff367186b51c8a.jpg kurier-dhl.services/EMBFLNc1/css/	59 KB 59 KB	254ms 253ms	Image image/jpeg	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://kurier-dhl.services/EMBFLNc1/css/87ec9dc6366b47e8b9ff367186b51c8a.jpg Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `52c061792a48b147d120775c806c9854481551ad7d1a285a7d3c4fdfc13954ac` Request headers Referer https://kurier-dhl.services/EMBFLNc1/css/cd2f1b5e01ee46d12500daab6d59874b0.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:21 GMT cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f1698e1664c7-FRA cf-request-id 026d1535f3000064c71b2ba200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	35d4c5a86c327be133e887f0b72bfa4d.png kurier-dhl.services/EMBFLNc1/css/	5 KB 5 KB	213ms 213ms	Image image/png	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://kurier-dhl.services/EMBFLNc1/css/35d4c5a86c327be133e887f0b72bfa4d.png Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `648e37584013ad5519cc8b0e809caf789331f5be9ecd056352a7a9f758c2d195` Request headers Referer https://kurier-dhl.services/EMBFLNc1/css/cd2f1b5e01ee46d12500daab6d59874b0.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:21 GMT cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control no-store, no-cache, must-revalidate accept-ranges bytes cf-ray 58c1f1698e1964c7-FRA content-length 5442 cf-request-id 026d1535f4000064c71b2bb200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	b6e12bfe0a0ab680f1f6023c217f2b01.png kurier-dhl.services/EMBFLNc1/css/	135 KB 135 KB	239ms 239ms	Image image/png	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://kurier-dhl.services/EMBFLNc1/css/b6e12bfe0a0ab680f1f6023c217f2b01.png Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `0440d3c0c9d75f5028d5bbbc1b8dc1bb53d103a09ef7beb2af373651486ad53a` Request headers Referer https://kurier-dhl.services/EMBFLNc1/css/cd2f1b5e01ee46d12500daab6d59874b0.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:21 GMT cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f1698e1a64c7-FRA cf-request-id 026d1535f4000064c71b2bc200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	55d0c517ae248ed2f44a245c4cd85311.png kurier-dhl.services/EMBFLNc1/css/	1 KB 2 KB	1329ms 1328ms	Image image/png	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://kurier-dhl.services/EMBFLNc1/css/55d0c517ae248ed2f44a245c4cd85311.png Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `93178fce965ebd6e163b82cd267092b735c5556382ed29ab1fb5a5af7f3c195d` Request headers Referer https://kurier-dhl.services/EMBFLNc1/css/cd2f1b5e01ee46d12500daab6d59874b0.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:22 GMT cf-cache-status BYPASS server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control no-store, no-cache, must-revalidate accept-ranges bytes cf-ray 58c1f1698e1b64c7-FRA content-length 1393 cf-request-id 026d1535f4000064c71b2bd200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	opensans-regular-webfont.woff kurier-dhl.services/EMBFLNc1/css/fonts/	87 KB 88 KB	13ms 12ms	Font application/font-woff	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/css/fonts/opensans-regular-webfont.woff Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9650a5ba277274205e90974e7fb4183289ca51653c33fc291ad064bf8dd998e1` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://kurier-dhl.services/EMBFLNc1/css/cd2f1b5e01ee46d12500daab6d59874b0.css Origin https://kurier-dhl.services Response headers date Thu, 30 Apr 2020 14:27:21 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Oct 2018 18:37:28 GMT server cloudflare age 19 etag W/"15de8-578c16db2aa00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/font-woff status 200 cache-control max-age=14400 cf-ray 58c1f1699e1e64c7-FRA cf-request-id 026d1535fa000064c71b2be200000001
GET H2	200	opensans-light-webfont.woff kurier-dhl.services/EMBFLNc1/css/fonts/	84 KB 84 KB	17ms 16ms	Font application/font-woff	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/css/fonts/opensans-light-webfont.woff Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0fe491e2047389b9deb7a06fd36de7fec03af2791ec29461be02571cbebdb4ab` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://kurier-dhl.services/EMBFLNc1/css/cd2f1b5e01ee46d12500daab6d59874b0.css Origin https://kurier-dhl.services Response headers date Thu, 30 Apr 2020 14:27:21 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Oct 2018 18:36:32 GMT server cloudflare age 19 etag W/"15000-578c16a5c2c00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/font-woff status 200 cache-control max-age=14400 cf-ray 58c1f1699e2364c7-FRA cf-request-id 026d1535fe000064c71b2bf200000001
GET H2	200	opensans-semibold-webfont.woff kurier-dhl.services/EMBFLNc1/css/fonts/	89 KB 89 KB	17ms 16ms	Font application/font-woff	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/css/fonts/opensans-semibold-webfont.woff Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `431817115e31ff8604ab76a86ce6ed55d02cd5ea7332bd0ed3d15d9b5bf9aaae` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://kurier-dhl.services/EMBFLNc1/css/cd2f1b5e01ee46d12500daab6d59874b0.css Origin https://kurier-dhl.services Response headers date Thu, 30 Apr 2020 14:27:21 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Oct 2018 18:38:38 GMT server cloudflare age 19 etag W/"16420-578c171dec780" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/font-woff status 200 cache-control max-age=14400 cf-ray 58c1f1699e2664c7-FRA cf-request-id 026d1535fe000064c71b2c0200000001
GET H2	200	PFBeauSansPro-Bold.woff kurier-dhl.services/EMBFLNc1/css/fonts/	142 KB 135 KB	15ms 15ms	Font application/font-woff	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/css/fonts/PFBeauSansPro-Bold.woff Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/hA0fK0b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c8b380cdc92601f7195d0cd34c777bcdee7dcd285e110534a8cf48bfa7d8b2e8` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://kurier-dhl.services/EMBFLNc1/css/cd2f1b5e01ee46d12500daab6d59874b0.css Origin https://kurier-dhl.services Response headers date Thu, 30 Apr 2020 14:27:21 GMT content-encoding br cf-cache-status HIT last-modified Sun, 21 Oct 2018 18:35:56 GMT server cloudflare age 19 etag W/"2374c-578c16836db00" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/font-woff status 200 cache-control max-age=14400 cf-ray 58c1f1699e2864c7-FRA cf-request-id 026d1535ff000064c71b2c1200000001
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 276 B	267ms 267ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:23 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f1760d8964c7-FRA cf-request-id 026d153dc4000064c71b308200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 196 B	232ms 232ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:24 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f17c496164c7-FRA cf-request-id 026d1541ab000064c71b34f200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 105 B	130ms 129ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:25 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f1828d6864c7-FRA cf-request-id 026d154593000064c71b37a200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 105 B	125ms 125ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:26 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f188c98364c7-FRA cf-request-id 026d15497a000064c71b3ab200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 105 B	176ms 176ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:27 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f18f0d1a64c7-FRA cf-request-id 026d154d62000064c71b3d8200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 105 B	120ms 119ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:28 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f19548d464c7-FRA cf-request-id 026d15514a000064c71b016200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 257 B	240ms 239ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:29 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f19b8cbf64c7-FRA cf-request-id 026d155532000064c71b038200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 105 B	150ms 150ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:30 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f1a1c8d364c7-FRA cf-request-id 026d15591b000064c71b059200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 105 B	160ms 159ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:31 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f1a80cf964c7-FRA cf-request-id 026d155d02000064c71b081200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 105 B	251ms 251ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:32 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f1ae495564c7-FRA cf-request-id 026d1560ea000064c71b0ad200000001 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H2	200	online.php Show response kurier-dhl.services/EMBFLNc1/	0 258 B	131ms 131ms	XHR text/html	2606:4700:3035::681b:9ca3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://kurier-dhl.services/EMBFLNc1/online.php Requested by Host: kurier-dhl.services URL: https://kurier-dhl.services/EMBFLNc1/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::681b:9ca3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.2.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept / Referer https://kurier-dhl.services/EMBFLNc1/hA0fK0b X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 30 Apr 2020 14:27:33 GMT content-encoding br cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/7.2.30 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type text/html; charset=UTF-8 status 200 cache-control no-store, no-cache, must-revalidate cf-ray 58c1f1b48e1d64c7-FRA cf-request-id 026d1564d2000064c71b115200000001 expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayU (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kurier-dhl.services
2606:4700:3035::681b:9ca3
0440d3c0c9d75f5028d5bbbc1b8dc1bb53d103a09ef7beb2af373651486ad53a
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0fe491e2047389b9deb7a06fd36de7fec03af2791ec29461be02571cbebdb4ab
3844de7f25779f478f102a6fccf03c5bf19ad1715767a0e0e3161637aa900445
431817115e31ff8604ab76a86ce6ed55d02cd5ea7332bd0ed3d15d9b5bf9aaae
52c061792a48b147d120775c806c9854481551ad7d1a285a7d3c4fdfc13954ac
648e37584013ad5519cc8b0e809caf789331f5be9ecd056352a7a9f758c2d195
93178fce965ebd6e163b82cd267092b735c5556382ed29ab1fb5a5af7f3c195d
9650a5ba277274205e90974e7fb4183289ca51653c33fc291ad064bf8dd998e1
c8b380cdc92601f7195d0cd34c777bcdee7dcd285e110534a8cf48bfa7d8b2e8
dd539ac2353f7001e3b09dd1b8a6b9c62974e9d540e8fb4c742ec544f886933f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

kurier-dhl.services Open in urlscan Pro 2606:4700:3035::681b:9ca3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

22 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

642 kBTransfer

740 kBSize

0 Cookies

0 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

kurier-dhl.services Open in urlscan Pro
2606:4700:3035::681b:9ca3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

642 kB
Transfer

740 kB
Size

0
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!