URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Submission: On November 23 via automatic, source openphish

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 13 HTTP transactions. The main IP is 5.9.3.36, located in Germany and belongs to HETZNER-AS, DE. The main domain is dl.rlh.ir.
This is the only time dl.rlh.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Etisalat (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 14 5.9.3.36 24940 (HETZNER-AS)
13 1
Apex Domain
Subdomains
Transfer
14 rlh.ir
dl.rlh.ir
218 KB
13 1
Domain Requested by
14 dl.rlh.ir 1 redirects dl.rlh.ir
13 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Frame ID: 1E2770D7A5FD900DC7C32C88D0DA7FAC
Requests: 13 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://dl.rlh.ir/dl.rlh.acm1.eim.ae HTTP 301
    http://dl.rlh.ir/dl.rlh.acm1.eim.ae/ Page URL

Page Statistics

13
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

218 kB
Transfer

262 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://dl.rlh.ir/dl.rlh.acm1.eim.ae HTTP 301
    http://dl.rlh.ir/dl.rlh.acm1.eim.ae/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
dl.rlh.ir/dl.rlh.acm1.eim.ae/
Redirect Chain
  • http://dl.rlh.ir/dl.rlh.acm1.eim.ae
  • http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
6 KB
2 KB
Document
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
28d2381cea8ed3191ec6717125dedfa6d9b7d38028d498238928063b2787b45c

Request headers

Host
dl.rlh.ir
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Type
text/html
Last-Modified
Tue, 13 Oct 2020 22:50:12 GMT
Accept-Ranges
bytes
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
1930
Date
Mon, 23 Nov 2020 13:43:43 GMT

Redirect headers

Connection
Keep-Alive
Content-Type
text/html
Content-Length
706
Date
Mon, 23 Nov 2020 13:43:43 GMT
Location
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
login.css
dl.rlh.ir/dl.rlh.acm1.eim.ae/css/
6 KB
2 KB
Stylesheet
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/login.css
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
4da0187be603e3f0384bc24a966f191d1b45c2dbbf775b4f2c7cddd049b4dc8a

Request headers

Referer
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1749
Expires
Mon, 30 Nov 2020 13:43:43 GMT
dojo.css
dl.rlh.ir/dl.rlh.acm1.eim.ae/css/
5 KB
2 KB
Stylesheet
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/dojo.css
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
1aa40741103cc2ceb4542fbc06dbb3f1222600e85366e4f4efb4370af7878d68

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2008
Expires
Mon, 30 Nov 2020 13:43:43 GMT
dijit.css
dl.rlh.ir/dl.rlh.acm1.eim.ae/css/
33 KB
9 KB
Stylesheet
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/dijit.css
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
ecf7d9502f427f28b04679a69a895fa3eb20201784286d3406d9ab5363bfe2bb

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
8930
Expires
Mon, 30 Nov 2020 13:43:43 GMT
dijit_rtl.css
dl.rlh.ir/dl.rlh.acm1.eim.ae/css/
2 KB
930 B
Stylesheet
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/dijit_rtl.css
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
390d21b471d2a4cd63ca6d0434b42939a473732debf4ce5adbacac52af5a4e9f

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
611
Expires
Mon, 30 Nov 2020 13:43:43 GMT
Button.css
dl.rlh.ir/dl.rlh.acm1.eim.ae/css/
4 KB
2 KB
Stylesheet
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/Button.css
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
59a41a13f36ad2a9ccd2351e63165078e51bdf08823672dbf907c4b8124b2cd5

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1282
Expires
Mon, 30 Nov 2020 13:43:43 GMT
DropDownSelect.css
dl.rlh.ir/dl.rlh.acm1.eim.ae/css/
8 KB
2 KB
Stylesheet
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/DropDownSelect.css
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
56fa40d5dda9fc6e7c3dcbf0f6f07752a0ae297dacfe0afeb7b8a3233a1c930a

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1391
Expires
Mon, 30 Nov 2020 13:43:43 GMT
dojo.js
dl.rlh.ir/dl.rlh.acm1.eim.ae/css/
0
0
Script
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/dojo.js
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash

Request headers

Referer
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 13:43:43 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Connection
Keep-Alive
Content-Length
707
Content-Type
text/html
background.png
dl.rlh.ir/dl.rlh.acm1.eim.ae/images/
194 KB
194 KB
Image
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/images/background.png
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
e4574f72bcc0faf097629446e330891af258fa805dd5fff4e893e8676fb4b190

Request headers

Referer
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
198822
Expires
Mon, 30 Nov 2020 13:43:43 GMT
mail.jpg
dl.rlh.ir/dl.rlh.acm1.eim.ae/images/
2 KB
2 KB
Image
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/images/mail.jpg
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
b26e0b522fcb9c25f854e4717d6021dd3701b3718a098c0bd2597b159b13a370

Request headers

Referer
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Content-Type
image/jpeg
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1935
Expires
Mon, 30 Nov 2020 13:43:43 GMT
info.png
dl.rlh.ir/dl.rlh.acm1.eim.ae/images/
707 B
707 B
Image
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/images/info.png?3.0.0.0.1_015148
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/login.css
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
d090a4047a92954a06c1d411213d273696225e8eb2de9e795a04bdec68ced05a

Request headers

Referer
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 23 Nov 2020 13:43:43 GMT
Cache-Control
private, no-cache, no-store, must-revalidate, max-age=0
Connection
Keep-Alive
Content-Length
707
Content-Type
text/html
buttonEnabled.png
dl.rlh.ir/dl.rlh.acm1.eim.ae/css/images/
120 B
393 B
Image
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/images/buttonEnabled.png
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/Button.css
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
64f1cbe67c89a17b9eea56bc7f3152ea647d0e7ad86ae87f458ad64b447aede2

Request headers

Referer
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/css/Button.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
120
Expires
Mon, 30 Nov 2020 13:43:43 GMT
greyband.jpg
dl.rlh.ir/dl.rlh.acm1.eim.ae/images/
458 B
732 B
Image
General
Full URL
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/images/greyband.jpg
Requested by
Host: dl.rlh.ir
URL: http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
Protocol
HTTP/1.1
Server
5.9.3.36 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.36.3.9.5.clients.your-server.de
Software
/
Resource Hash
032d7b335e262e88896a199e92afeb10330cdb4296b6aa2027a68218de500444

Request headers

Referer
http://dl.rlh.ir/dl.rlh.acm1.eim.ae/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 23 Nov 2020 13:43:43 GMT
Last-Modified
Tue, 13 Oct 2020 22:50:10 GMT
Content-Type
image/jpeg
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
458
Expires
Mon, 30 Nov 2020 13:43:43 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Etisalat (Telecommunication)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

0 Cookies