lucid-villani.5-78-83-47.plesk.page Open in urlscan Pro
5.78.83.47 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Submission: On April 20 via automatic, source phishtank (April 20th 2023, 7:33:07 am UTC) — Scanned from GE

Summary HTTP 14 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 5.78.83.47, located in Portland, United States and belongs to HETZNER-CLOUD3-AS, DE. The main domain is lucid-villani.5-78-83-47.plesk.page.
TLS certificate: Issued by R3 on April 17th 2023. Valid for: 3 months.

This is the only time lucid-villani.5-78-83-47.plesk.page was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
11	5.78.83.47 5.78.83.47		212317 (HETZNER-C...) (HETZNER-CLOUD3-AS)
2	104.16.88.20 104.16.88.20		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.10.207 104.18.10.207		13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	3

11 5.78.83.47 (Portland, United States)

ASN212317 (HETZNER-CLOUD3-AS, DE)
PTR: static.47.83.78.5.clients.your-server.de

lucid-villani.5-78-83-47.plesk.page	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.88.20 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	plesk.page lucid-villani.5-78-83-47.plesk.page	2 MB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 474	99 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3240	7 KB
14	3

	Domain	Requested by
11	lucid-villani.5-78-83-47.plesk.page	lucid-villani.5-78-83-47.plesk.page
2	cdn.jsdelivr.net	lucid-villani.5-78-83-47.plesk.page cdn.jsdelivr.net
1	stackpath.bootstrapcdn.com	lucid-villani.5-78-83-47.plesk.page
14	3

This site contains no links.

Subject Issuer	Validity	Valid
lucid-villani.5-78-83-47.plesk.page R3	`2023-04-17` - `2023-07-16`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Frame ID: 9E1DC0CA5CE3129068DC989603A4AD32
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login to Customer Portals and Tools | DHL |

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

2104 kB
Transfer

2178 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.php Show response
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/ 7 KB
7 KB 2592ms
1937ms Document
text/html 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 385aa3189ce803226d8dfdafd074476b0a062ab1761fc319ca24cae85a644843

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: ka-GE,ka;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-length: 7270
content-type: text/html; charset=UTF-8
date: Thu, 20 Apr 2023 07:33:00 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin

GET
H2 200 bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ 64 KB
9 KB 438ms
154ms Stylesheet
text/css 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css

Requested by

Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 07:33:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4921163
x-jsd-version: 1.5.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230101-FRA, cache-yyz4574-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"100a0-GGXd3Lt7Z9zvQlDlkMyalXSrpnM"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aWQY%2FVGQMNVRSeNtfxx1R3DaVZFkIe5MacshG3b2rH4twD%2FQXlxwmJVf7PvQVvpc4ySPNCFI4IMykooFCBDe5b%2BO0f4%2BX%2B8O%2Bb45m%2FD0n5x%2FZXgM7OFLi%2B45vyqXI1ay%2Bhw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 7babb25c2f1437e4-FRA

GET
H2 200 font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 431ms
147ms Stylesheet
text/css 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 07:33:01 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 723
age: 6754976
cdn-cachedat: 11/15/2021 21:49:00
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver: 1.0
cdn-requestpullcode: 200
server: cloudflare
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 2729ae8f2fc6c761bdc17d91cc795f58
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 7babb25c2cdf3a74-FRA
cdn-requestpullsuccess: True

GET
H2 200 bootstrap.css
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/css/ 188 KB
189 KB 605ms
605ms Stylesheet
text/css 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/css/bootstrap.css
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:00 GMT
last-modified: Sun, 27 Feb 2022 23:43:04 GMT
server: Microsoft-IIS/10.0
etag: "c9cdcc3332cd81:0"
x-powered-by: ASP.NET
content-type: text/css
accept-ranges: bytes
content-length: 193015

GET
H2 200 posta.css
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/css/ 14 KB
14 KB 386ms
386ms Stylesheet
text/css 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/css/posta.css
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 4d4c2229366643e0f0c76860971f79393833087f09b21c07ec026db6e289e801

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:00 GMT
last-modified: Thu, 29 Sep 2022 19:00:59 GMT
server: Microsoft-IIS/10.0
etag: "7e2efccf35d4d81:0"
x-powered-by: ASP.NET
content-type: text/css
accept-ranges: bytes
content-length: 14217

GET
H2 200 dhl-logo.svg
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/ 2 KB
2 KB 1105ms
1103ms Image
image/svg+xml 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/dhl-logo.svg
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:00 GMT
last-modified: Tue, 20 Sep 2022 13:33:30 GMT
server: Microsoft-IIS/10.0
etag: "56117592f5ccd81:0"
x-powered-by: ASP.NET
content-type: image/svg+xml
accept-ranges: bytes
content-length: 1603

GET
H2 200 camion.png
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/ 7 KB
7 KB 1108ms
1107ms Image
image/png 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/camion.png
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 9749654bdfcce79bc06740ed18ce854c5bc56fd419a8d59fc590777ba942105e

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:00 GMT
last-modified: Tue, 20 Sep 2022 14:55:53 GMT
server: Microsoft-IIS/10.0
etag: "cae386141cdd81:0"
x-powered-by: ASP.NET
content-type: image/png
accept-ranges: bytes
content-length: 6755

GET
H2 200 group.svg
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/ 12 KB
12 KB 1129ms
1128ms Image
image/svg+xml 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/group.svg
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:00 GMT
last-modified: Fri, 23 Sep 2022 15:05:46 GMT
server: Microsoft-IIS/10.0
etag: "7cb2aaf55dcfd81:0"
x-powered-by: ASP.NET
content-type: image/svg+xml
accept-ranges: bytes
content-length: 11968

GET
H2 200 socio.png
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/ 1 KB
1 KB 1129ms
1129ms Image
image/png 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/socio.png
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 39b5e1fdc845a00e044f1d5136d4d365e319d79caae542b2abef7e9a7eb7d786

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:00 GMT
last-modified: Fri, 23 Sep 2022 15:19:29 GMT
server: Microsoft-IIS/10.0
etag: "da17c1df5fcfd81:0"
x-powered-by: ASP.NET
content-type: image/png
accept-ranges: bytes
content-length: 1292

GET
H2 200 jquery-3.5.1.min.js Show response
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/js/ 87 KB
88 KB 1074ms
1073ms Script
application/javascript 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/js/jquery-3.5.1.min.js
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:00 GMT
last-modified: Fri, 29 Jan 2021 00:36:18 GMT
server: Microsoft-IIS/10.0
etag: "311c87c2d6f5d61:0"
x-powered-by: ASP.NET
content-type: application/javascript
accept-ranges: bytes
content-length: 89476

GET
H2 200 jquery.mask.js Show response
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/js/ 23 KB
23 KB 1103ms
1102ms Script
application/javascript 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/js/jquery.mask.js
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:00 GMT
last-modified: Tue, 24 Mar 2020 14:30:47 GMT
server: Microsoft-IIS/10.0
etag: "80c5f1cee81d61:0"
x-powered-by: ASP.NET
content-type: application/javascript
accept-ranges: bytes
content-length: 23176

GET
H2 200 titiza.png
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/ 2 MB
2 MB 318ms
317ms Image
image/png 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/image/titiza.png
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/css/posta.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: bf90771220c51af99c6e15274dc84ee40078e8ddde71a823ad6ee98569a57733

Request headers

accept-language: ka-GE,ka;q=0.9
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/css/posta.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:02 GMT
last-modified: Tue, 20 Sep 2022 14:23:56 GMT
server: Microsoft-IIS/10.0
etag: "e77ef09dfcccd81:0"
x-powered-by: ASP.NET
content-type: image/png
accept-ranges: bytes
content-length: 1694457

GET
H3 200 bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/ 88 KB
89 KB 304ms
160ms Font
font/woff2 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css
Origin: https://lucid-villani.5-78-83-47.plesk.page
accept-language: ka-GE,ka;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 07:33:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4921144
x-jsd-version: 1.5.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 90528
x-served-by: cache-fra19135-FRA, cache-jnb7020-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"161a0-RkmHeGigBozlCxBdDSojXoAQyY8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wafF8I1oF4KN9FkSYZ29g%2Bm2%2FJpMzniVxrDIk2%2BiyHZdQClmIZPMPXBJjgXwlGWCMD6QeIfsbc9X07aNfKGenyDP%2B4sbCWzIAdvDsVPfdF9XGcf%2Fefpkb11nE5RCFeCJJwU%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7babb2622924bb83-FRA

POST
H2 200 spy.php Show response
lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/ 0
51 B 934ms
933ms XHR
text/html 5.78.83.47
HETZNER-CLOUD3-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/spy.php
Requested by: Host: lucid-villani.5-78-83-47.plesk.page
URL: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/js/jquery-3.5.1.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 5.78.83.47 Portland, United States, ASN212317 (HETZNER-CLOUD3-AS, DE),
Reverse DNS: static.47.83.78.5.clients.your-server.de
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: */*
Referer: https://lucid-villani.5-78-83-47.plesk.page/DHL-QATAR/index.php
X-Requested-With: XMLHttpRequest
accept-language: ka-GE,ka;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 20 Apr 2023 07:33:02 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
content-length: 0
content-type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery boolean| abort

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lucid-villani.5-78-83-47.plesk.page/	1969-12-31 23:59:59	Name: PHPSESSID Value: msoenieec05adq8oii0cigo6ug

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
lucid-villani.5-78-83-47.plesk.page
stackpath.bootstrapcdn.com
104.16.88.20
104.18.10.207
5.78.83.47
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
385aa3189ce803226d8dfdafd074476b0a062ab1761fc319ca24cae85a644843
39b5e1fdc845a00e044f1d5136d4d365e319d79caae542b2abef7e9a7eb7d786
3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef
4d4c2229366643e0f0c76860971f79393833087f09b21c07ec026db6e289e801
5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
9749654bdfcce79bc06740ed18ce854c5bc56fd419a8d59fc590777ba942105e
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
bf90771220c51af99c6e15274dc84ee40078e8ddde71a823ad6ee98569a57733
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d