www.deliveryexpress-parcel.com
Open in
urlscan Pro
213.226.123.65
Malicious Activity!
Public Scan
Effective URL: https://www.deliveryexpress-parcel.com/dhl.php?UID=646f8ed1401df646f8ed1401e2646f8ed1401e3646f8ed1401e4
Submission: On May 25 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by R3 on May 25th 2023. Valid for: 3 months.
This is the only time www.deliveryexpress-parcel.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 12 | 213.226.123.65 213.226.123.65 | 49943 (ITRESHENI...) (ITRESHENIYA-AS) | |
20 | 2 |
ASN49943 (ITRESHENIYA-AS, RU)
www.deliveryexpress-parcel.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
deliveryexpress-parcel.com
2 redirects
www.deliveryexpress-parcel.com |
436 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
20 | 2 |
Domain | Requested by | |
---|---|---|
12 | www.deliveryexpress-parcel.com |
2 redirects
www.deliveryexpress-parcel.com
|
0 | scrapbook Failed |
www.deliveryexpress-parcel.com
|
0 | eofcbnmajmjmplflapaojjnihcjkigck Failed |
www.deliveryexpress-parcel.com
|
20 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
deliveryexpress-parcel.com R3 |
2023-05-25 - 2023-08-23 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://www.deliveryexpress-parcel.com/dhl.php?UID=646f8ed1401df646f8ed1401e2646f8ed1401e3646f8ed1401e4
Frame ID: D7BF31AFABE7D898E6A4BDF5C0EB7B3A
Requests: 18 HTTP requests in this frame
Frame:
https://www.deliveryexpress-parcel.com/index_2.html
Frame ID: BF97C93CD3295630848BF93B1AD1B71A
Requests: 1 HTTP requests in this frame
Frame:
https://www.deliveryexpress-parcel.com/index_1.html
Frame ID: 57F15E73C1483FB441066D90D6D7C66A
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
DHLPage URL History Show full URLs
-
https://www.deliveryexpress-parcel.com/
HTTP 302
https://www.deliveryexpress-parcel.com/dhl.php HTTP 302
https://www.deliveryexpress-parcel.com/dhl.php?UID=646f8ed1401df646f8ed1401e2646f8ed1401e3646f8ed1401e4 Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.deliveryexpress-parcel.com/
HTTP 302
https://www.deliveryexpress-parcel.com/dhl.php HTTP 302
https://www.deliveryexpress-parcel.com/dhl.php?UID=646f8ed1401df646f8ed1401e2646f8ed1401e3646f8ed1401e4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
dhl.php
www.deliveryexpress-parcel.com/ Redirect Chain
|
186 KB 38 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
www.deliveryexpress-parcel.com/ |
428 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
www.deliveryexpress-parcel.com/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fonts.css
eofcbnmajmjmplflapaojjnihcjkigck/common/ui/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
www.deliveryexpress-parcel.com/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.png
www.deliveryexpress-parcel.com/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
foo.png
scrapbook:download:error:https://dhl-del-ondemand.com/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
roboto-latin-400-normal.woff2
scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fontsource/roboto/files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
roboto-all-400-normal.woff
scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fontsource/roboto/files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index_2.html
www.deliveryexpress-parcel.com/ Frame BF97 |
176 B 289 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
webfa-brands-400.woff2
scrapbook:download:error:https://dhl-del-ondemand.com/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont.woff2
www.deliveryexpress-parcel.com/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
webfa-solid-900.woff2
scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index_1.html
www.deliveryexpress-parcel.com/ Frame 57F1 |
97 B 239 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
webfa-brands-400.woff
scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
webfa-solid-900.woff
scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
webfa-brands-400.ttf
scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
webfa-solid-900.ttf
scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-fa-brands-400.woff2
www.deliveryexpress-parcel.com/ |
105 KB 105 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-fa-solid-900.woff2
www.deliveryexpress-parcel.com/ |
147 KB 147 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- eofcbnmajmjmplflapaojjnihcjkigck
- URL
- chrome-extension://eofcbnmajmjmplflapaojjnihcjkigck/common/ui/fonts/fonts.css
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:https://dhl-del-ondemand.com/images/foo.png
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fontsource/roboto/files/roboto-latin-400-normal.woff2?4673b4537a84c7f7a130799aa6af329b
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fontsource/roboto/files/roboto-all-400-normal.woff?376ea5d93f71583052f65de4e0c6a92c
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:https://dhl-del-ondemand.com/css/fonts/webfa-brands-400.woff2?d878b0a6a1144760244ff0665888404c
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.woff2?1551f4f60c37af51121f106501f69b80
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/webfa-brands-400.woff?2285773e6b4b172f07d9b777c81b0775
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.woff?eeccf4f66002c6f2ba24d3d22f2434c2
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/webfa-brands-400.ttf?527940b104eb2ea366c8630f3f038603
- Domain
- scrapbook
- URL
- urn:scrapbook:download:error:https://dhl-del-ondemand.com/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.ttf?be9ee23c0c6390141475d519c2c5fb8f
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 boolean| credentialless1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.deliveryexpress-parcel.com/ | Name: PHPSESSID Value: h2rlmrba03suhhi9k11m5npo6s |
18 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
eofcbnmajmjmplflapaojjnihcjkigck
scrapbook
www.deliveryexpress-parcel.com
eofcbnmajmjmplflapaojjnihcjkigck
scrapbook
213.226.123.65
1494e2691e1c13a3f35cbc3e1b56c5187c10ffe220d1fdc58d99494a666244d4
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3de2c358acd98dd93f54af55a7d89ae64cca5757d76fb95ae74db8bd63389bdd
3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756
4f04c94b287d7dfdfad36e60915eefbef7127a073546e6c21512b5052c6ac48d
72f138dcdaf6cc3f7a5d91e2e9b7cb43a561a4963397d93bf44a1c51fbf21031
9b7e75f538939a8a701287d17a93761402362459d51199ba7f9393524e98ab17
c1d5409eecb402a99f10718b06c266ba314d9e25f0b56c6fd063699334b8be6d
e666a99faaa3e45b319f3d3be65efa211de3e9b7edee8e9b3b12035bf96c5fd2
ef0bc747d66e15373ad212493cb6b86daa907b62ea9350f3e1521ec8a613aff8