urlscan.io logo urlscan.io
SecurityTrails logo

www.glenwoodgolf.com Open in urlscan Pro
192.185.16.50  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
Submission: On July 28 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 192.185.16.50, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is www.glenwoodgolf.com.
This is the only time www.glenwoodgolf.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 192.185.16.50 46606 (UNIFIEDLA...)
4 104.109.82.214 20940 (AKAMAI-ASN1)
16 3
Apex Domain
Subdomains		 Transfer
4 dhl.com
myaccount.dhl.com Failed
22 KB
1 glenwoodgolf.com
www.glenwoodgolf.com
16 KB
16 2
Domain Requested by
4 myaccount.dhl.com www.glenwoodgolf.com
1 www.glenwoodgolf.com
16 2

This site contains no links.

Subject Issuer Validity Valid
www.mydhl.com
DigiCert SHA2 Secure Server CA		 2018-08-23 -
2020-02-21		 a year crt.sh

This page contains 1 frames:

Primary Page: http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
Frame ID: 3E41242EE6D07FE4D885EF9E3609D868
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
  • script /jquery-ui.*\.js/i
Overall confidence: 100%
Detected patterns
  • script /jquery-ui.*\.js/i

Page Statistics

16
Requests

25 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

38 kB
Transfer

81 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request computeLoadIllustration.html
www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/ 		59 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
Protocol
HTTP/1.1
Server
192.185.16.50 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
asjministries.org
Software
Apache /
Resource Hash
e2e1d7969aa808a6e647543e05213c8e051144246162d4227be704a63c2b72cf

Request headers

Host
www.glenwoodgolf.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Sun, 28 Jul 2019 08:05:25 GMT
Server
Apache
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Last-Modified
Wed, 24 Apr 2019 06:07:56 GMT
Accept-Ranges
none
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
15760
Keep-Alive
timeout=5, max=75
Content-Type
text/html
StyleSheet_moz.css
myaccount.dhl.com/MyAccount/common/ 		0
0
general_moz.css
myaccount.dhl.com/MyAccount/common/ 		0
0
jquery.min.js
myaccount.dhl.com/MyAccount/js/ 		0
0
jquery-ui.css
myaccount.dhl.com/MyAccount/js/ 		0
0
jquery-ui.js
myaccount.dhl.com/MyAccount/js/ 		0
0
jquery.tablesorter.min.js
myaccount.dhl.com/MyAccount/js/tablesorter/ 		0
0
picnet.table.filter.min.js
myaccount.dhl.com/MyAccount/js/tablefilter/ 		0
0
jquery.bt.min.js
myaccount.dhl.com/MyAccount/js/ 		0
0
jHtmlArea-0.7.5.min.js
myaccount.dhl.com/MyAccount/js/jhtmlarea/scripts/ 		0
0
jHtmlArea.css
myaccount.dhl.com/MyAccount/js/jhtmlarea/style/ 		0
0
jHtmlArea.Editor.css
myaccount.dhl.com/MyAccount/js/jhtmlarea/style/ 		0
0
DHLlogo.gif
myaccount.dhl.com/MyAccount/images/ 		840 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myaccount.dhl.com/MyAccount/images/DHLlogo.gif
Requested by
Host: www.glenwoodgolf.com
URL: http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.82.214 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-82-214.deploy.static.akamaitechnologies.com
Software
/ Servlet/3.0 JSP/2.2
Resource Hash
688876df3eceada75deffe7e228f5a0c360c00656b064bb83c87439b55ba066f

Request headers

Referer
http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Sun, 28 Jul 2019 08:05:32 GMT
Last-Modified
Mon, 03 Sep 2018 06:12:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
X-Powered-By
Servlet/3.0 JSP/2.2
Content-Length
840
Content-Type
image/gif
Middle.JPG
myaccount.dhl.com/MyAccount/images/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myaccount.dhl.com/MyAccount/images/Middle.JPG
Requested by
Host: www.glenwoodgolf.com
URL: http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.82.214 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-82-214.deploy.static.akamaitechnologies.com
Software
/ Servlet/3.0 JSP/2.2
Resource Hash
3dbe0f4a2bf44be87ce4f5a8758e5b49147753067239a79f7f444ede4fb35bd4

Request headers

Referer
http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Sun, 28 Jul 2019 08:05:32 GMT
Last-Modified
Mon, 03 Sep 2018 06:12:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
X-Powered-By
Servlet/3.0 JSP/2.2
Content-Length
20150
Content-Type
image/jpeg
DPLogo.gif
myaccount.dhl.com/MyAccount/images/ 		863 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myaccount.dhl.com/MyAccount/images/DPLogo.gif
Requested by
Host: www.glenwoodgolf.com
URL: http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.82.214 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-82-214.deploy.static.akamaitechnologies.com
Software
/ Servlet/3.0 JSP/2.2
Resource Hash
e5c46702fb8d25395448448f0e6c75401fc73e0b654762a8c08cc27ea5514bec

Request headers

Referer
http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Sun, 28 Jul 2019 08:05:32 GMT
Last-Modified
Mon, 03 Sep 2018 06:12:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
X-Powered-By
Servlet/3.0 JSP/2.2
Content-Length
863
Content-Type
image/gif
arrow_r_r_small.gif
myaccount.dhl.com/MyAccount/images/ 		57 B
285 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myaccount.dhl.com/MyAccount/images/arrow_r_r_small.gif
Requested by
Host: www.glenwoodgolf.com
URL: http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.82.214 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-82-214.deploy.static.akamaitechnologies.com
Software
/ Servlet/3.0 JSP/2.2
Resource Hash
1e54b2ca043587b99e9ccb869d88d3b90ddaec68940fda348df75e6e4e312990

Request headers

Referer
http://www.glenwoodgolf.com/wp-content/ngg/23.92.220.40/computeLoadIllustration.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36

Response headers

Date
Sun, 28 Jul 2019 08:05:32 GMT
Last-Modified
Mon, 03 Sep 2018 06:12:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
X-Powered-By
Servlet/3.0 JSP/2.2
Content-Length
57
Content-Type
image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/common/StyleSheet_moz.css?v=1
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/common/general_moz.css?v=1
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/js/jquery.min.js?v=1
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/js/jquery-ui.css?v=1
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/js/jquery-ui.js?v=1
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/js/tablesorter/jquery.tablesorter.min.js
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/js/tablefilter/picnet.table.filter.min.js
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/js/jquery.bt.min.js?v=1
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/js/jhtmlarea/scripts/jHtmlArea-0.7.5.min.js
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/js/jhtmlarea/style/jHtmlArea.css
Domain
myaccount.dhl.com
URL
https://myaccount.dhl.com/MyAccount/js/jhtmlarea/style/jHtmlArea.Editor.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

80 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| childWindow function| fngetdate function| fnLogout function| fnSubmitOnEnter function| trimZeroes function| fnPrint function| fnMainFramePrint function| fnCancelButton function| fnCancel function| fnTrim function| fnTrimWhiteSpaces function| fnLookup function| fnOpenPopupWindow function| fnOpenPopupNewWindow function| fnOpenPopupHelpWindow function| fnIsValidAlphaNumeric function| fnIsValidAlphaNumericWithAsteriks function| fnIsCorrectLength function| fnIsValidNameWithAsterix function| fnTimeCheck function| isGreater function| isGreaterOrEqual function| isGreaterOrEqualToZero function| fnDayTimeCheck function| fnSizeLimitCheck function| isBetweenCheck function| isCharInArray function| isGreaterTime function| isGreaterOrEqualTime function| fnConfirm function| fnConfirmMultiple function| fnClearSpace function| fnWeightUOMCheck function| getItem function| toggleItem function| fnDimensionUOMCheck function| Change function| fnDelete function| fnDateValidateStrDDMMYYYY function| fnDateValidate function| fnMonthCheck function| fnDayCheck function| getDaysInMonth function| fnIsLeapYear function| createMessage function| deleteMessage function| openCustomerPopup function| openAgreementPopup function| openAccountGroupPopup function| getPreviousPageName function| ValidateNumeric function| ValidateDecimal function| ValidateAlphaNumeric function| fnValidateEmail function| Validate_String function| fnIsValidData function| fnIsValidPhoneNumber function| fnValidateAccountNumber function| disableStatuses function| blankStatus number| submit boolean| count function| fnSubmit function| validate function| fnReadCookie function| checkCookies function| fnSetCookie function| deleteCookie function| fnEnter function| fnReset function| swapImage function| fnreset function| init function| fnChange function| NewWindow function| fnOnLoad object| focusControl

0 Cookies