wordpress-930411-3229074.cloudwaysapps.com Open in urlscan Pro
159.65.52.197  Malicious Activity! Public Scan

Submitted URL: https://han.gl/vVWkxo
Effective URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Submission: On January 30 via manual from LK — Scanned from NL

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 159.65.52.197, located in London, United Kingdom and belongs to DIGITALOCEAN-ASN, US. The main domain is wordpress-930411-3229074.cloudwaysapps.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 9th 2022. Valid for: a year.
This is the only time wordpress-930411-3229074.cloudwaysapps.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 168.167.71.11 14988 (BTC-GATE1)
11 159.65.52.197 14061 (DIGITALOC...)
12 2
Apex Domain
Subdomains
Transfer
11 cloudwaysapps.com
wordpress-930411-3229074.cloudwaysapps.com
52 KB
1 jamal.co.bw
jamal.co.bw
209 B
1 han.gl
han.gl
552 B
12 3
Domain Requested by
11 wordpress-930411-3229074.cloudwaysapps.com wordpress-930411-3229074.cloudwaysapps.com
1 jamal.co.bw
1 han.gl 1 redirects
12 3

This site contains links to these domains. Also see Links.

Domain
famous-manx.w5.wpsandbox.pro
Subject Issuer Validity Valid
jamal.co.bw
R3
2023-01-22 -
2023-04-22
3 months crt.sh
*.cloudwaysapps.com
Sectigo RSA Domain Validation Secure Server CA
2022-09-09 -
2023-10-10
a year crt.sh

This page contains 1 frames:

Primary Page: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Frame ID: CA722FD5AAA636C3A390095A66E5C64C
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

INDEX

Page URL History Show full URLs

  1. https://han.gl/vVWkxo HTTP 301
    https://jamal.co.bw/reddd.php Page URL
  2. https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

52 kB
Transfer

163 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://han.gl/vVWkxo HTTP 301
    https://jamal.co.bw/reddd.php Page URL
  2. https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://han.gl/vVWkxo HTTP 301
  • https://jamal.co.bw/reddd.php

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
reddd.php
jamal.co.bw/
Redirect Chain
  • https://han.gl/vVWkxo
  • https://jamal.co.bw/reddd.php
105 B
209 B
Document
General
Full URL
https://jamal.co.bw/reddd.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
168.167.71.11 Gaborone, Botswana, ASN14988 (BTC-GATE1, BW),
Reverse DNS
Software
nginx / PHP/7.4.33 PleskLin
Resource Hash
023ea3efa09913d366f6d41e22ca1d49e41da9494b21ddf0c594471fc0a24924

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 30 Jan 2023 01:40:23 GMT
server
nginx
x-powered-by
PHP/7.4.33 PleskLin

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
79167fbbbe240bc5-AMS
content-type
text/html; charset=UTF-8
date
Mon, 30 Jan 2023 01:40:21 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://jamal.co.bw/reddd.php
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=btHoydClFoYlefjZb2fTgJmpRC6nmk5JOO7iBTfrlz4z2xnMbs3HB%2FIVIg6LBVt7BQsx9Rn6vfw9Ckte6ak5nJpIYa%2BCOWThZTudi4S1UczqTk4UAA26plwfT1e0bBac6aYe2%2FY%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
Primary Request /
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
10 KB
3 KB
Document
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
7daab6350802053dd331f5b3a4dd8fd8d3a484c21702aa05deed3bfc3c4765f1

Request headers

Referer
https://jamal.co.bw/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

accept-ranges
bytes
age
3618
content-encoding
gzip
content-length
3093
content-type
text/html
date
Mon, 30 Jan 2023 01:40:23 GMT
etag
"278f-5f36d13662faf-gzip"
last-modified
Sun, 29 Jan 2023 20:38:06 GMT
securitas_autorized_country
br,co,us,ca,pt,es,ch,fr,ma
server
nginx
vary
Accept-Encoding
x-cache
HIT
x-robots-tag
noindex, nofollow
bootstrap.css
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
118 KB
19 KB
Stylesheet
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/bootstrap.css
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
content-encoding
gzip
last-modified
Sun, 29 Jan 2023 20:38:05 GMT
server
nginx
etag
W/"63d6d92d-1d970"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
x-robots-tag
noindex, nofollow
style.css
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
9 KB
3 KB
Stylesheet
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/style.css
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
ba4ea27222c6fafb3eb5f825c7b6b13b3d7a32b34016f87cfb8fa4d886c4a9fd

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
content-encoding
gzip
last-modified
Sun, 29 Jan 2023 20:38:06 GMT
server
nginx
etag
W/"63d6d92e-24b5"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
x-robots-tag
noindex, nofollow
logo.svg
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
2 KB
912 B
Image
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/logo.svg
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
content-encoding
gzip
last-modified
Sun, 29 Jan 2023 20:38:06 GMT
server
nginx
etag
W/"63d6d92e-643"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=31536000
x-robots-tag
noindex, nofollow
cardtype_ss.png
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
7 KB
8 KB
Image
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/cardtype_ss.png
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
a5ca115514cbfc52924374b62761d7f0d1f8e510d08b32905f75b66b3a37b1e1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
last-modified
Sun, 29 Jan 2023 20:38:05 GMT
server
nginx
etag
"63d6d92d-1dbd"
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
7613
card.png
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
399 B
575 B
Image
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/card.png
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
39459e2db25db3f30b853a7b510629f766994c88eb2af780e77d4ffa71287ee0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
last-modified
Sun, 29 Jan 2023 20:38:05 GMT
server
nginx
etag
"63d6d92d-18f"
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
399
Exclamation.png
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
481 B
656 B
Image
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/Exclamation.png
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
f35b4d8168065dde839d4ebb2bb3747b2734acdf3c85e0c28a163daa97c76d39

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
last-modified
Sun, 29 Jan 2023 20:38:05 GMT
server
nginx
etag
"63d6d92d-1e1"
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
481
3D_VISA.png
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
4 KB
4 KB
Image
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/3D_VISA.png
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
1818f0c2ef6a363e915bd4c6c2c2cbeef0fcf60ff2da3e79cfe0d1c3bc9ff86b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
last-modified
Sun, 29 Jan 2023 20:38:05 GMT
server
nginx
etag
"63d6d92d-1005"
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
4101
3D_MASTER.png
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
3 KB
3 KB
Image
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/3D_MASTER.png
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
203dffbf9fb647ad3576ebc57c4005c1a0cb07cc740a911585b6ba70c8d20892

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
last-modified
Sun, 29 Jan 2023 20:38:05 GMT
server
nginx
etag
"63d6d92d-c1a"
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
3098
3D_JCB.png
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
3 KB
3 KB
Image
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/3D_JCB.png
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
eacf2b196015c40a02cf7849c614daaca5205159d7ac234ad90ea47fbb714041

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
last-modified
Sun, 29 Jan 2023 20:38:05 GMT
server
nginx
etag
"63d6d92d-be2"
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
3042
twca_ssl.png
wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/
6 KB
6 KB
Image
General
Full URL
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/files/twca_ssl.png
Requested by
Host: wordpress-930411-3229074.cloudwaysapps.com
URL: https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
159.65.52.197 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
930411.cloudwaysapps.com
Software
nginx /
Resource Hash
4a1d51361e6bfabde052f3b64166d7ab532241e0c634162ccd6220c76759642a

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://wordpress-930411-3229074.cloudwaysapps.com/dhlit/dhl/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Mon, 30 Jan 2023 01:40:23 GMT
last-modified
Sun, 29 Jan 2023 20:38:06 GMT
server
nginx
etag
"63d6d92e-173d"
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
5949

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

1 Cookies

Domain/Path Name / Value
han.gl/ Name: PHPSESSID
Value: 0uh4a1el6el0cln3l41ivt6htv