urlscan.io logo urlscan.io
SecurityTrails logo

dhlshipping-60c93.firebaseapp.com Open in urlscan Pro
2620:0:890::100  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://dhlshipping-60c93.firebaseapp.com/
Submission: On July 02 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 7 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is dhlshipping-60c93.firebaseapp.com.
TLS certificate: Issued by GTS CA 1D4 on May 10th 2023. Valid for: 3 months.
This is the only time dhlshipping-60c93.firebaseapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
4 2620:0:890::100 54113 (FASTLY)
1 64.185.227.156 18450 (WEBNX)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
7 4
Apex Domain
Subdomains		 Transfer
4 firebaseapp.com
dhlshipping-60c93.firebaseapp.com
196 KB
1 ipapi.co
ipapi.co — Cisco Umbrella Rank: 15009
542 B
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2382
208 B
0 antibot.pw Failed
antibot.pw Failed
7 4
Domain Requested by
4 dhlshipping-60c93.firebaseapp.com dhlshipping-60c93.firebaseapp.com
1 ipapi.co dhlshipping-60c93.firebaseapp.com
1 api.ipify.org dhlshipping-60c93.firebaseapp.com
0 antibot.pw Failed dhlshipping-60c93.firebaseapp.com
7 4

This site contains no links.

Subject Issuer Validity Valid
firebaseapp.com
GTS CA 1D4		 2023-05-10 -
2023-08-08		 3 months crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2023-02-07 -
2024-02-18		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-04-16 -
2024-04-15		 a year crt.sh

This page contains 1 frames:

Primary Page: https://dhlshipping-60c93.firebaseapp.com/
Frame ID: E13E168A8D1A2341854C13C69CFB8A18
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Delivery

Page Statistics

7
Requests

86 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

197 kB
Transfer

937 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
dhlshipping-60c93.firebaseapp.com/ 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://dhlshipping-60c93.firebaseapp.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cd1866d908baf0a17b677d4008993d92ab8f78852baae21fb66c1d85e54d872c
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control
max-age=3600
content-encoding
br
content-length
892
content-type
text/html; charset=utf-8
date
Sun, 02 Jul 2023 10:52:20 GMT
etag
"4cdd16417867a12eefa8477f24d9d95c02dad47ed3d0934b144ac2bdb5037f52-br"
last-modified
Fri, 30 Jun 2023 08:39:17 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
x-cache-hits
1
x-served-by
cache-fra-eddf8230133-FRA
x-timer
S1688295141.523170,VS0,VE1
index-909c1bdc.js
dhlshipping-60c93.firebaseapp.com/assets/ 		488 KB
136 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://dhlshipping-60c93.firebaseapp.com/assets/index-909c1bdc.js
Requested by
Host: dhlshipping-60c93.firebaseapp.com
URL: https://dhlshipping-60c93.firebaseapp.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0bdcc58fb59e56bbdbba722c786a6c19487f2cb66190e5c528b0948fb23bd0f5
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://dhlshipping-60c93.firebaseapp.com/
Origin
https://dhlshipping-60c93.firebaseapp.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by
cache-fra-eddf8230133-FRA
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 02 Jul 2023 10:52:20 GMT
last-modified
Fri, 30 Jun 2023 08:39:17 GMT
x-timer
S1688295141.549529,VS0,VE3
etag
"f6e05fea910e719ad85e1406b0370aa10931850f612b5ac39cba397c1a4d49d4-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
139481
x-cache-hits
1
index-feaf1b54.css
dhlshipping-60c93.firebaseapp.com/assets/ 		434 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://dhlshipping-60c93.firebaseapp.com/assets/index-feaf1b54.css
Requested by
Host: dhlshipping-60c93.firebaseapp.com
URL: https://dhlshipping-60c93.firebaseapp.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
feaf1b5441ab10e40cd55d24c3ddb05dbaa646a2982c324a8c9a6a83082f21c4
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dhlshipping-60c93.firebaseapp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by
cache-fra-eddf8230133-FRA
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 02 Jul 2023 10:52:20 GMT
last-modified
Fri, 30 Jun 2023 08:39:17 GMT
x-timer
S1688295141.549879,VS0,VE3
etag
"c8bebc2f7d3fcb3693c8e54d2857d59dc915a475fdd5cd7cb9f748333b45ae28-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
54975
x-cache-hits
1
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
image/png
114223-serencontrer-messages-solid-cff8856b.png
dhlshipping-60c93.firebaseapp.com/assets/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dhlshipping-60c93.firebaseapp.com/assets/114223-serencontrer-messages-solid-cff8856b.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2620:0:890::100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cff8856b01d09b6e68b3d6b75172ea259363b4268be55229a963e86edc77e627
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://dhlshipping-60c93.firebaseapp.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-served-by
cache-fra-eddf8230081-FRA
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Sun, 02 Jul 2023 10:52:20 GMT
last-modified
Fri, 30 Jun 2023 08:39:17 GMT
x-timer
S1688295141.721457,VS0,VE2
etag
"973701d30b71d7704309abd1eb626903147c89361758d8fbcaff31b5237e5ba4-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
image/png
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
4352
x-cache-hits
1
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5c4b801e60c49235941cfc562ed465a951c937c668db31e3c1ba152513c672d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
image/png
/
api.ipify.org/ 		14 B
208 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/
Requested by
Host: dhlshipping-60c93.firebaseapp.com
URL: https://dhlshipping-60c93.firebaseapp.com/assets/index-909c1bdc.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
64.185.227.156 Los Angeles, United States, ASN18450 (WEBNX, US),
Reverse DNS
64-185-227-156.static.webnx.com
Software
nginx/1.25.1 /
Resource Hash
a9bd8f5df178624b6314a08656085102ab420a27b5bc3242ca98b7c079e6d97f

Request headers

Accept
application/json, text/plain, */*
Referer
https://dhlshipping-60c93.firebaseapp.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Sun, 02 Jul 2023 10:52:22 GMT
Server
nginx/1.25.1
Connection
keep-alive
Content-Length
14
Vary
Origin
Content-Type
text/plain
country_code
ipapi.co/217.114.218.24/ 		2 B
542 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ipapi.co/217.114.218.24/country_code
Requested by
Host: dhlshipping-60c93.firebaseapp.com
URL: https://dhlshipping-60c93.firebaseapp.com/assets/index-909c1bdc.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:20::681a:82c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6814ef46f686990cf4e946f966167b0507e1d642c44e51f61bffb0bba2d4672b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept
application/json, text/plain, */*
Referer
https://dhlshipping-60c93.firebaseapp.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 02 Jul 2023 10:52:22 GMT
x-content-type-options
nosniff
referrer-policy
same-origin
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Host, origin
allow
GET, OPTIONS, HEAD, OPTIONS, POST
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://dhlshipping-60c93.firebaseapp.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pPU0WemPxTBN8uOmcfuqRKCs8C7Cl7AU1zU9vh%2FwS1sXh6GyC3cn8hkl2juUhfXL3Q4eb9j%2BCeM6WMunWDZYLTVL5RiwXOWBDsVxVH903vHy0BiUKPFBFaimfmbDGfSr0nC6KkCg"}],"group":"cf-nel","max_age":604800}
x-frame-options
DENY
cf-ray
7e0656c21b3d2c7e-FRA
content-length
2
v2-manager
antibot.pw/api/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
antibot.pw
URL
https://antibot.pw/api/v2-manager?ip=217.114.218.24&keyname=&apikey=&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/114.0.5735.198%20Safari/537.36

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

0 Cookies

2 Console Messages

Source Level URL
Text
javascript error URL: https://dhlshipping-60c93.firebaseapp.com/
Message:
Access to XMLHttpRequest at 'https://antibot.pw/api/v2-manager?ip=217.114.218.24&keyname=&apikey=&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/114.0.5735.198%20Safari/537.36' from origin 'https://dhlshipping-60c93.firebaseapp.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://antibot.pw/api/v2-manager?ip=217.114.218.24&keyname=&apikey=&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/114.0.5735.198%20Safari/537.36
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload