klandrylaw.com
Open in
urlscan Pro
209.124.75.167
Malicious Activity!
Public Scan
Effective URL: https://klandrylaw.com/0092561425/112009864521/shipping/dhl/dhlshipping/wwwhl1e2phscq0tdrlem6xfr.php?rand=13InboxLighta...
Submission: On June 12 via manual from EG
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 27th 2019. Valid for: 3 months.
This is the only time klandrylaw.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 163.cn (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 3 | 209.124.75.167 209.124.75.167 | 55293 (A2HOSTING) (A2HOSTING - A2 Hosting) | |
1 | 75.119.201.111 75.119.201.111 | 26347 (DREAMHOST-AS) (DREAMHOST-AS - New Dream Network) | |
1 | 2a0b:4d07:102::1 2a0b:4d07:102::1 | 44239 (PROINITY ...) (PROINITY PROINITY) | |
1 | 208.91.197.238 208.91.197.238 | 40034 (CONFLUENC...) (CONFLUENCE-NETWORK-INC - Confluence Networks Inc) | |
2 | 2620:11a:e002... 2620:11a:e002:fa00::204 | 22300 (WIKIA) (WIKIA - Wikia) | |
2 | 103.129.252.34 103.129.252.34 | 137263 (NETEASE-A...) (NETEASE-AS-AP NETEASE HONG KONG LIMITED) | |
1 | 66.63.181.73 66.63.181.73 | 8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:81a::2001 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 2 | 54.191.193.138 54.191.193.138 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
12 | 10 |
ASN55293 (A2HOSTING - A2 Hosting, Inc., US)
PTR: server.digitmark.info
klandrylaw.com |
ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US)
PTR: apache2-igloo.gigantic.dreamhost.com
www.adefi.webliant.net |
ASN40034 (CONFLUENCE-NETWORK-INC - Confluence Networks Inc, VG)
invprofit.com |
ASN22300 (WIKIA - Wikia, Inc., US)
vignette2.wikia.nocookie.net | |
vignette3.wikia.nocookie.net |
ASN8100 (ASN-QUADRANET-GLOBAL - QuadraNet Enterprises LLC, US)
PTR: ohio.serversfarm.com
www.rbccollege.ac.in |
ASN15169 (GOOGLE - Google LLC, US)
lh4.ggpht.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-191-193-138.us-west-2.compute.amazonaws.com
discountshop.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
klandrylaw.com
2 redirects
klandrylaw.com |
2 KB |
2 |
discountshop.com
1 redirects
discountshop.com |
22 KB |
2 |
127.net
mimg.127.net |
14 KB |
2 |
nocookie.net
vignette2.wikia.nocookie.net vignette3.wikia.nocookie.net |
18 KB |
1 |
ggpht.com
lh4.ggpht.com |
417 KB |
1 |
rbccollege.ac.in
www.rbccollege.ac.in |
9 KB |
1 |
invprofit.com
invprofit.com |
|
1 |
iconfinder.com
cdn1.iconfinder.com |
5 KB |
1 |
webliant.net
www.adefi.webliant.net |
1 KB |
0 |
valkiriya54.ru
Failed
valkiriya54.ru Failed |
|
12 | 10 |
Domain | Requested by | |
---|---|---|
3 | klandrylaw.com | 2 redirects |
2 | discountshop.com |
1 redirects
klandrylaw.com
|
2 | mimg.127.net |
klandrylaw.com
|
1 | lh4.ggpht.com |
klandrylaw.com
|
1 | vignette3.wikia.nocookie.net |
klandrylaw.com
|
1 | www.rbccollege.ac.in |
klandrylaw.com
|
1 | vignette2.wikia.nocookie.net |
klandrylaw.com
|
1 | invprofit.com |
klandrylaw.com
|
1 | cdn1.iconfinder.com |
klandrylaw.com
|
1 | www.adefi.webliant.net |
klandrylaw.com
|
0 | valkiriya54.ru Failed |
klandrylaw.com
|
12 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
klandrylaw.com Let's Encrypt Authority X3 |
2019-05-27 - 2019-08-25 |
3 months | crt.sh |
1970-01-01 - 1970-01-01 |
a few seconds | crt.sh | |
*.iconfinder.com Sectigo RSA Domain Validation Secure Server CA |
2019-03-26 - 2021-03-25 |
2 years | crt.sh |
*.discountshop.com COMODO RSA Organization Validation Secure Server CA |
2017-01-25 - 2020-04-22 |
3 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://klandrylaw.com/0092561425/112009864521/shipping/dhl/dhlshipping/wwwhl1e2phscq0tdrlem6xfr.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=khaskh@gmail.com&emailID=khaskh&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 76D45BF7E537C9F3BE6314388D072C59
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://klandrylaw.com/00015623908/logistics/dhl/index.php?email=khaskh@gmail.com
HTTP 302
https://klandrylaw.com/0092561425/112009864521/shipping/dhl/dhlshipping/index.php?email=%0%?rand=13... HTTP 302
https://klandrylaw.com/0092561425/112009864521/shipping/dhl/dhlshipping/wwwhl1e2phscq0tdrlem6xfr.ph... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
LiteSpeed (Web Servers) Expand
Detected patterns
- headers server /^LiteSpeed$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://klandrylaw.com/00015623908/logistics/dhl/index.php?email=khaskh@gmail.com
HTTP 302
https://klandrylaw.com/0092561425/112009864521/shipping/dhl/dhlshipping/index.php?email=%0%?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=khaskh@gmail.com&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 HTTP 302
https://klandrylaw.com/0092561425/112009864521/shipping/dhl/dhlshipping/wwwhl1e2phscq0tdrlem6xfr.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=khaskh@gmail.com&emailID=khaskh&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- http://discountshop.com/blog/wp-content/uploads/2014/05/Alibaba_Group_logo_2-433x93.png HTTP 301
- https://discountshop.com/blog/wp-content/uploads/2014/05/Alibaba_Group_logo_2-433x93.png
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
wwwhl1e2phscq0tdrlem6xfr.php
klandrylaw.com/0092561425/112009864521/shipping/dhl/dhlshipping/ Redirect Chain
|
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
DHL.png
www.adefi.webliant.net/HONGKONG/ |
897 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dhl2.jpg
valkiriya54.ru//images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
right_arrow-128.png
cdn1.iconfinder.com/data/icons/general-9/500/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
NSec_Evol_330px.gif
invprofit.com/images/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Yahoo_Logo.png
vignette2.wikia.nocookie.net/logopedia/images/3/35/ |
14 KB 15 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
163logo.gif
mimg.127.net/logo/ |
7 KB 7 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
126logo.gif
mimg.127.net/logo/ |
6 KB 7 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webmail.png
www.rbccollege.ac.in/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Hotmail_logo.png
vignette3.wikia.nocookie.net/logopedia/images/7/70/ |
2 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mail_logo_rgb_web.png
lh4.ggpht.com/_7ZYqYi4xigk/TaM87JTwNoI/AAAAAAAAH3I/o4Kc7yR9ZOQ/d/ |
416 KB 417 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Alibaba_Group_logo_2-433x93.png
discountshop.com/blog/wp-content/uploads/2014/05/ Redirect Chain
|
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- valkiriya54.ru
- URL
- http://valkiriya54.ru//images/dhl2.jpg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 163.cn (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn1.iconfinder.com
discountshop.com
invprofit.com
klandrylaw.com
lh4.ggpht.com
mimg.127.net
valkiriya54.ru
vignette2.wikia.nocookie.net
vignette3.wikia.nocookie.net
www.adefi.webliant.net
www.rbccollege.ac.in
valkiriya54.ru
103.129.252.34
208.91.197.238
209.124.75.167
2620:11a:e002:fa00::204
2a00:1450:4001:81a::2001
2a0b:4d07:102::1
54.191.193.138
66.63.181.73
75.119.201.111
05b7bb1d642f9ba65fe6aaa31a3910ada0c725e88d321fa0af01e1d39d6fef42
43cd7eeb91c5dc89efe95eb8036f51644ba0b3eba8b844d3284f58b654d80a39
4b65646e580b883fa13c46a43b399b98e7627a866f44de26bc08284628c15f38
4fd72267e95fd21ea5cff803c24b770e18b2cf50f4ae1b8ec6fefd9441ac7968
5d4e6a322ac7281a59fb70344374165762dd44c44d8c4b507170512a9cffcb28
61c21fad602f61bf2b5fa4f0e722db3822c6bfb7c557784f5dd6657208118faa
72403dbaee4ce204d4943c440a062acb01706213c507713ca958a930b64bfe86
92cc0ca298be556b6ff3a451f0b3af9d6026222fa4b833065f9181acd4094e55
935c7d909ce3601b714d239f7becf1aa23d215ee8d2a4f91d7fc3c04eaa9e498
d18e6296a534078009774d635cbf390933c93c8758e2a3a990cb9b1a3d9c7199
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855