find.findcheckout.com
Open in
urlscan Pro
104.21.24.94
Malicious Activity!
Public Scan
Submission: On November 27 via api from US — Scanned from US
Summary
TLS certificate: Issued by E1 on October 4th 2023. Valid for: 3 months.
This is the only time find.findcheckout.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 17 | 104.21.24.94 104.21.24.94 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.16.56.101 104.16.56.101 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
18 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
findcheckout.com
1 redirects
find.findcheckout.com |
822 KB |
1 |
cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 899 |
7 KB |
18 | 2 |
Domain | Requested by | |
---|---|---|
17 | find.findcheckout.com |
1 redirects
find.findcheckout.com
static.cloudflareinsights.com |
1 | static.cloudflareinsights.com |
find.findcheckout.com
|
18 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
secure.mysearchforgold.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
findcheckout.com E1 |
2023-10-04 - 2024-01-02 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-10 - 2024-04-09 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://find.findcheckout.com/pt/dhltrack/?p=200&cep=67UAFHX_e3tOypu3asYpW-vmPePYgFIbLNVnwssgmu3m4fTvZjSP-mFNvLq7Qgz89alSPnqDYLzL_MbMw-1JXDyldT5-06EG2QwqdMWIvzo93vQyqOZN8j0WGthx9Y62_dDIQr_Ryui1HGvZRi2ITP1K0GjRhSFHJAYKKizfLg5A8SvdA0yYnNEjolM6tJwunJ7doOHNmco5YTJeMrbRGGEbF072vJnXQxjCv0bX5l5PwbdWR73qXKfV0qKD_M0pccnB_xzpVPhHDC3IjFo6brIg9McB3AcL9VcpyppqN-bSJVUJTo5d4imGDMKuNCekpyQMbJh
Frame ID: A363261A384A506161E62764C25F86DF
Requests: 16 HTTP requests in this frame
Frame:
https://find.findcheckout.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Frame ID: 603E70E5A104C90223F8C3B7BB4076E8
Requests: 2 HTTP requests in this frame
Screenshot
Detected technologies
Cloudflare Browser Insights (Analytics) ExpandDetected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Modernizr (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Introduzir informações de envio
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 14- https://find.findcheckout.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://find.findcheckout.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
find.findcheckout.com/pt/dhltrack/ |
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Poppins-Regular.ttf
find.findcheckout.com/pt/dhltrack/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
find.findcheckout.com/pt/dhltrack/css/ |
39 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
find.findcheckout.com/pt/dhltrack/css/ |
21 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr.js
find.findcheckout.com/pt/dhltrack/js/lib/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
find.findcheckout.com/pt/dhltrack/js/lib/ |
85 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
svg4everybody.min.js
find.findcheckout.com/pt/dhltrack/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
init.js
find.findcheckout.com/pt/dhltrack/js/ |
2 KB 870 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
find.findcheckout.com/pt/dhltrack/js/ |
543 B 668 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-dhl.png
find.findcheckout.com/pt/dhltrack/images/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
box.png
find.findcheckout.com/pt/dhltrack/images/ |
44 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v84a3a4012de94ce1a686ba8c167c359c1696973893317
static.cloudflareinsights.com/beacon.min.js/ |
20 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons.svg
find.findcheckout.com/pt/dhltrack/icons/ |
7 KB 2 KB |
Other
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dhl_hands_cutter_aotw.jpg
find.findcheckout.com/pt/dhltrack/images/ |
624 KB 625 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont.woff2
find.findcheckout.com/pt/dhltrack/fonts/ |
75 KB 76 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
find.findcheckout.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/ Frame 603E Redirect Chain
|
7 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rum
find.findcheckout.com/cdn-cgi/ |
0 171 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
82cb682ccb0a8ccd
find.findcheckout.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 603E |
0 481 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- find.findcheckout.com
- URL
- https://find.findcheckout.com/pt/dhltrack/fonts/Poppins-Regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| documentPictureInPicture object| html5 object| Modernizr function| $ function| jQuery function| svg4everybody object| __cfBeacon1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.findcheckout.com/ | Name: cf_clearance Value: Qn33h.0jO0L32kG3jhCl3cXlpM_7RZcZLxSaYL6rwIY-1701098970-0-1-2ff5ebc.c57838e5.55fe015c-0.2.1701098970 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | sameorigin |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
find.findcheckout.com
static.cloudflareinsights.com
find.findcheckout.com
104.16.56.101
104.21.24.94
13ed792d1208cb794c7eecefa59932a73bd6342d00f28d996e208bb6c8cfb764
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
18e448e4dcb3c5648bcaaaad7b9df2040b6113cb828fa7f242cd5e538bf6a846
21ef2f5a1f3de7d2dc0d0a82decf5c201644a8b06fb01f62c9b64b39b86af306
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
453fc9ef16bea9e93c1bca5dd859d3ebf4650264fa24a7f24eb447eae37bd393
590e2796f2345351966ce7398f8bf3bcbae960f7e0e85a8f25ee77393cbdb69a
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
82f24da560f5bf620073cbda3aa1f1f07270f11ff94a171baf70bdd78768eaa0
9137b33ceb0e8b966c5942abeff0ff11670e36afe176b73480fc24e7f214632d
aaa4a98000f280d8d1b54f8fb20e8888a59acdffe43bbcca7686b66712453590
d657f5f4559dc7ca2114aa5c0b19d4da699bbcc7590e497a01f52b9967d4423d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4561272e04a813c56426fe19011232a726a203374210d0e39642774ac15c1ac
e4f623b9f2d0a55357a49e78b0679630c9272b872533be11148dfa34a3321d9a
f40090d3bc7733ac91c8e840367ac85a25ac323ce4bb9e9d8313b88f86ebf55a