urlscan.io logo urlscan.io
SecurityTrails logo

dhlsecure-share.cf Open in urlscan Pro
2606:4700:30::6812:23f5  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u13478172.ct.sendgrid.net/wf/click?upn=8a-2BboHL2PKSZstZSnm9LArrGeiw9LUcai-2B3ecyVlTldAL9PHx1tzT5rYsUvlhT8zXTnexwOYo4EeXaP...
Effective URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight...
Submission: On October 29 via manual from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 14 HTTP transactions. The main IP is 2606:4700:30::6812:23f5, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is dhlsecure-share.cf.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on October 29th 2019. Valid for: a year.
This is the only time dhlsecure-share.cf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.123.16 11377 (SENDGRID)
1 2 169.46.89.151 36351 (SOFTLAYER)
8 2606:4700:30:... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 2001:4de0:ac1... 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
14 5
1    167.89.123.16 (United States)

ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789123x16.outbound-mail.sendgrid.net
u13478172.ct.sendgrid.net
2    169.46.89.151 (Irving, United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: 97.59.2ea9.ip4.static.sl-reverse.com
dhlsecure.us-south.cf.appdomain.cloud
8    2606:4700:30::6812:23f5 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
dhlsecure-share.cf
1    2606:4700::6813:c397 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com
3    2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
maxcdn.bootstrapcdn.com
1    2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
Domain Requested by
8 dhlsecure-share.cf dhlsecure-share.cf
3 maxcdn.bootstrapcdn.com dhlsecure-share.cf
2 dhlsecure.us-south.cf.appdomain.cloud 1 redirects
1 ajax.googleapis.com dhlsecure-share.cf
1 cdnjs.cloudflare.com dhlsecure-share.cf
1 u13478172.ct.sendgrid.net 1 redirects
14 6

This site contains no links.

Subject Issuer Validity Valid
*.us-south.cf.appdomain.cloud
DigiCert SHA2 Secure Server CA		 2019-09-24 -
2020-09-28		 a year crt.sh
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2019-10-29 -
2020-10-09		 a year crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-08-10 -
2020-02-16		 6 months crt.sh
*.bootstrapcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2019-09-14 -
2020-10-13		 a year crt.sh
*.googleapis.com
GTS CA 1O1		 2019-10-10 -
2020-01-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 5D8CB840186D98F93A2D1F022C59D857
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://u13478172.ct.sendgrid.net/wf/click?upn=8a-2BboHL2PKSZstZSnm9LArrGeiw9LUcai-2B3ecyVlTldAL9PHx1tzT5rYsUv... HTTP 302
    https://dhlsecure.us-south.cf.appdomain.cloud/ HTTP 302
    https://dhlsecure.us-south.cf.appdomain.cloud/qwhuda4giukr47ivdo25nzqo.php?login=&13InboxLightaspxn.1774256418&fid.4.12528... Page URL
  2. https://dhlsecure-share.cf/tracking/ Page URL
  3. https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

206 kB
Transfer

411 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u13478172.ct.sendgrid.net/wf/click?upn=8a-2BboHL2PKSZstZSnm9LArrGeiw9LUcai-2B3ecyVlTldAL9PHx1tzT5rYsUvlhT8zXTnexwOYo4EeXaP8lW6d5w-3D-3D_Iz-2BFdicNiy-2FfbLZ6WkFDQI1wsimwNXSrVZNLJvRbvlbQewxUB8u6Xpbocoa8A92Ll3-2BwC6xRmUshJ-2Fiu-2FAgLloLv7wKTnjgvI2rvYzBrefqD8wW5zGpi7k3XIJQLWeVz8ueXgWy3nwHKV90MwuMWD-2B-2BoGBDzcTvqFqtrQcWJAhTB2gEQZ-2F2Nuybdz4T4Zr3F5L1IIwrXcoq13NOi-2F8BDmtijIlzzKnlPTJvKWpwRsg0stUCHrVvfecdR0BW12kRV75R2SiJngsaJPI6uHxyxudDwqwxR0Qx4wKihQaYO7vkytcd3VAmAIJXLp0L8L181GeGf0BarzZXAEsHNXwmM329Zbrz6i23T4pT3CJHV7sTEpWgmfPJzm-2FwiLcUpriRXJfx9WmyKKDlclpku31nSo49DAbTfCq4Up66nC2zR9LEfew-2FavzOi-2BiUUI6PWG9zNt1sGt2AU77O1ODNAWsREVR7RbymiVRFD4Aoqr1-2F4oQ3SXMREGT-2B9W8Ub162XzS5wIdy6zTISPxNleArX4mZhyNxoJ6KgvwCkZJH6SGEfkD1YJKt-2FrmAiKYCJAmLQM1SotFtdWSfUduio3SnIDI1NLNrt-2Bh2eil9-2B2zCu4ipJUJg-3D HTTP 302
    https://dhlsecure.us-south.cf.appdomain.cloud/ HTTP 302
    https://dhlsecure.us-south.cf.appdomain.cloud/qwhuda4giukr47ivdo25nzqo.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
  2. https://dhlsecure-share.cf/tracking/ Page URL
  3. https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://u13478172.ct.sendgrid.net/wf/click?upn=8a-2BboHL2PKSZstZSnm9LArrGeiw9LUcai-2B3ecyVlTldAL9PHx1tzT5rYsUvlhT8zXTnexwOYo4EeXaP8lW6d5w-3D-3D_Iz-2BFdicNiy-2FfbLZ6WkFDQI1wsimwNXSrVZNLJvRbvlbQewxUB8u6Xpbocoa8A92Ll3-2BwC6xRmUshJ-2Fiu-2FAgLloLv7wKTnjgvI2rvYzBrefqD8wW5zGpi7k3XIJQLWeVz8ueXgWy3nwHKV90MwuMWD-2B-2BoGBDzcTvqFqtrQcWJAhTB2gEQZ-2F2Nuybdz4T4Zr3F5L1IIwrXcoq13NOi-2F8BDmtijIlzzKnlPTJvKWpwRsg0stUCHrVvfecdR0BW12kRV75R2SiJngsaJPI6uHxyxudDwqwxR0Qx4wKihQaYO7vkytcd3VAmAIJXLp0L8L181GeGf0BarzZXAEsHNXwmM329Zbrz6i23T4pT3CJHV7sTEpWgmfPJzm-2FwiLcUpriRXJfx9WmyKKDlclpku31nSo49DAbTfCq4Up66nC2zR9LEfew-2FavzOi-2BiUUI6PWG9zNt1sGt2AU77O1ODNAWsREVR7RbymiVRFD4Aoqr1-2F4oQ3SXMREGT-2B9W8Ub162XzS5wIdy6zTISPxNleArX4mZhyNxoJ6KgvwCkZJH6SGEfkD1YJKt-2FrmAiKYCJAmLQM1SotFtdWSfUduio3SnIDI1NLNrt-2Bh2eil9-2B2zCu4ipJUJg-3D HTTP 302
  • https://dhlsecure.us-south.cf.appdomain.cloud/ HTTP 302
  • https://dhlsecure.us-south.cf.appdomain.cloud/qwhuda4giukr47ivdo25nzqo.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
qwhuda4giukr47ivdo25nzqo.php
dhlsecure.us-south.cf.appdomain.cloud/
Redirect Chain
  • https://u13478172.ct.sendgrid.net/wf/click?upn=8a-2BboHL2PKSZstZSnm9LArrGeiw9LUcai-2B3ecyVlTldAL9PHx1tzT5rYsUvlhT8zXTnexwOYo4EeXaP8lW6d5w-3D-3D_Iz-2BFdicNiy-2FfbLZ6WkFDQI1wsimwNXSrVZNLJvRbvlbQewxUB...
  • https://dhlsecure.us-south.cf.appdomain.cloud/
  • https://dhlsecure.us-south.cf.appdomain.cloud/qwhuda4giukr47ivdo25nzqo.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&f...
634 B
728 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dhlsecure.us-south.cf.appdomain.cloud/qwhuda4giukr47ivdo25nzqo.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
169.46.89.151 Irving, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS
97.59.2ea9.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
e74e3f220ab04811090ca0ede09ecaf2b7c6287c1bc0a4a593559a6e138473e8

Request headers

Host
dhlsecure.us-south.cf.appdomain.cloud
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

X-Backside-Transport
OK OK
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Tue, 29 Oct 2019 12:15:55 GMT
Server
Apache
Vary
Accept-Encoding
X-Global-Transaction-ID
dccbb8d45db82d7ba0054539

Redirect headers

X-Backside-Transport
OK OK
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Date
Tue, 29 Oct 2019 12:15:55 GMT
Location
qwhuda4giukr47ivdo25nzqo.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
Server
Apache
X-Global-Transaction-ID
dccbb8d45db82d7bd3ef9b0d
/
dhlsecure-share.cf/tracking/ 		363 B
539 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dhlsecure-share.cf/tracking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6812:23f5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/7.3.10
Resource Hash
07775982ca8ac107c4e474a363025259b24b2e7414b5c06e779c5ee9f411219b

Request headers

:method
GET
:authority
dhlsecure-share.cf
:scheme
https
:path
/tracking/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode
navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
referer
https://dhlsecure.us-south.cf.appdomain.cloud/qwhuda4giukr47ivdo25nzqo.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode
navigate
Referer
https://dhlsecure.us-south.cf.appdomain.cloud/qwhuda4giukr47ivdo25nzqo.php?login=&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4

Response headers

status
200
date
Tue, 29 Oct 2019 12:15:56 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=db364ebddd1c9a370399efcdd365ff09b1572351355; expires=Wed, 28-Oct-20 12:15:55 GMT; path=/; domain=.dhlsecure-share.cf; HttpOnly
x-powered-by
PHP/7.3.10
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
52d513e67e51cba8-VIE
content-encoding
br
Primary Request db.php
dhlsecure-share.cf/tracking/ 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6812:23f5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/7.3.10
Resource Hash
f35b52f3dfa9ae4150c416aceee7518dfe106305eeb63e6f73addb84046372e3

Request headers

:method
GET
:authority
dhlsecure-share.cf
:scheme
https
:path
/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
sec-fetch-mode
navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
same-origin
referer
https://dhlsecure-share.cf/tracking/
accept-encoding
gzip, deflate, br
cookie
__cfduid=db364ebddd1c9a370399efcdd365ff09b1572351355
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36
Sec-Fetch-Mode
navigate
Referer
https://dhlsecure-share.cf/tracking/

Response headers

status
200
date
Tue, 29 Oct 2019 12:15:56 GMT
content-type
text/html; charset=UTF-8
x-powered-by
PHP/7.3.10
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
52d513e7fcc7cba8-VIE
content-encoding
br
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
16985297
status
200
alt-svc
h3-23=":443"; ma=86400
served-in-seconds
0.001
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:19:12 GMT
server
cloudflare
etag
W/"5afd4910-7918"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
52d513e8d89e8c80-VIE
expires
Sun, 18 Oct 2020 12:15:56 GMT
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		118 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
/
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:34:07 GMT
status
200
etag
"1544639647"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
19740
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.0/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.2.0/jquery.min.js
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
2405bdf4c255a4904671bcc4b97938033d39b3f5f20dd068985a8d94cde273e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 22 Oct 2019 03:42:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
635622
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
30281
x-xss-protection
0
last-modified
Tue, 21 Mar 2017 18:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 21 Oct 2020 03:42:14 GMT
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
/
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:33:51 GMT
status
200
etag
"1544639631"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
9832
dhl_logo.gif
dhlsecure-share.cf/tracking/images/ 		443 B
591 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dhlsecure-share.cf/tracking/images/dhl_logo.gif
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6812:23f5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f680b51b19fc3c5befd02bd9d0d4e88c2722a5210157e4ef68933c5ba352109

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
cf-cache-status
MISS
last-modified
Tue, 08 Oct 2019 10:12:28 GMT
server
cloudflare
etag
"1bb-5946367d15b00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
private, max-age=14400
accept-ranges
bytes
cf-ray
52d513e8d8aacba8-VIE
content-length
443
delivery.png
dhlsecure-share.cf/tracking/images/ 		66 KB
66 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dhlsecure-share.cf/tracking/images/delivery.png
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6812:23f5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bfdfe3cbd62ed49a6a790903cc605aa52c261ebe13040b61ade3883a0c8143ef

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
cf-cache-status
MISS
last-modified
Tue, 08 Oct 2019 10:12:28 GMT
server
cloudflare
etag
"106c4-5946367d15b00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
private, max-age=14400
accept-ranges
bytes
cf-ray
52d513e8d8accba8-VIE
content-length
67268
to_view.jpg
dhlsecure-share.cf/tracking/images/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dhlsecure-share.cf/tracking/images/to_view.jpg
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6812:23f5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d38a13a91114c43fad4d1a25b852b9adcb92ab9bca12a99f246af9e880b89e03

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
cf-cache-status
MISS
last-modified
Tue, 08 Oct 2019 10:12:28 GMT
server
cloudflare
etag
"50e3-5946367d15b00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
private, max-age=14400
accept-ranges
bytes
cf-ray
52d513e919e0cba8-VIE
content-length
20707
support.jpg
dhlsecure-share.cf/tracking/images/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dhlsecure-share.cf/tracking/images/support.jpg
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6812:23f5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b30b2f54d563eb40dcfcc10468926580f49972af962ecdbc665e5d2e9485fa2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
cf-cache-status
MISS
last-modified
Tue, 08 Oct 2019 10:12:28 GMT
server
cloudflare
etag
"7af0-5946367d15b00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
status
200
cache-control
private, max-age=14400
accept-ranges
bytes
cf-ray
52d513e919e2cba8-VIE
content-length
31472
.jpg
dhlsecure-share.cf/tracking/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dhlsecure-share.cf/tracking/images/.jpg
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6812:23f5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5293a758f438496d48dd36a5bb7e72af1d78f14f6c719e1fe767071ce5e8d7d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
content-encoding
br
cf-cache-status
MISS
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
accept-language,accept-charset, Accept-Encoding
content-language
en
status
404
cache-control
private, max-age=14400
cf-ray
52d513e919f4cba8-VIE
content-type
text/html; charset=utf-8
dot.png
dhlsecure-share.cf/tracking/images/ 		203 B
286 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dhlsecure-share.cf/tracking/images/dot.png
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::6812:23f5 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
67edce575ea04a1c6fedcf7054811b736a5ba3f0cfb9eb8140a6b5f422b53b03

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
cf-cache-status
MISS
last-modified
Tue, 08 Oct 2019 10:12:28 GMT
server
cloudflare
etag
"cb-5946367d15b00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
private, max-age=14400
accept-ranges
bytes
cf-ray
52d513e919f7cba8-VIE
content-length
203
glyphicons-halflings-regular.woff2
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2
Requested by
Host: dhlsecure-share.cf
URL: https://dhlsecure-share.cf/tracking/db.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
/
Resource Hash
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Request headers

Sec-Fetch-Mode
cors
Referer
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Origin
https://dhlsecure-share.cf
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36

Response headers

date
Tue, 29 Oct 2019 12:15:56 GMT
content-encoding
gzip
last-modified
Wed, 12 Dec 2018 18:36:18 GMT
status
200
etag
"1544639778"
vary
Accept-Encoding
x-cache
HIT
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
accept-ranges
bytes
timing-allow-origin
*
content-length
18056

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| drops

1 Cookies

Domain/Path Name / Value
.dhlsecure-share.cf/ Name: __cfduid
Value: db364ebddd1c9a370399efcdd365ff09b1572351355