mohangroups.in
Open in
urlscan Pro
157.245.98.52
Malicious Activity!
Public Scan
Effective URL: https://mohangroups.in/wp-content/themes/new/F004f19441/home.php?web=succes&local=_&id=37343383
Submission: On April 01 via api from DK
Summary
TLS certificate: Issued by R3 on February 23rd 2021. Valid for: 3 months.
This is the only time mohangroups.in was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 45.8.126.10 45.8.126.10 | 35112 (GBNHOST-AS) (GBNHOST-AS) | |
1 | 46.105.201.240 46.105.201.240 | 16276 (OVH) (OVH) | |
1 | 192.99.13.63 192.99.13.63 | 16276 (OVH) (OVH) | |
2 5 | 157.245.98.52 157.245.98.52 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
22 | 2a02:26f0:710... 2a02:26f0:7100:281::b24 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
37 | 6 |
ASN35112 (GBNHOST-AS, RU)
PTR: ozelazzam.example.com
gresestesrpouly.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
dhl.com
del.dhl.com |
516 KB |
5 |
mohangroups.in
2 redirects
mohangroups.in |
89 KB |
2 |
histats.com
s10.histats.com s4.histats.com |
5 KB |
2 |
gresestesrpouly.com
1 redirects
gresestesrpouly.com |
1 KB |
37 | 4 |
Domain | Requested by | |
---|---|---|
22 | del.dhl.com |
mohangroups.in
del.dhl.com |
5 | mohangroups.in |
2 redirects
gresestesrpouly.com
mohangroups.in del.dhl.com |
2 | gresestesrpouly.com | 1 redirects |
1 | s4.histats.com |
s10.histats.com
|
1 | s10.histats.com |
gresestesrpouly.com
|
37 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.logistics.dhl |
Subject Issuer | Validity | Valid | |
---|---|---|---|
gresestesrpouly.com cPanel, Inc. Certification Authority |
2021-03-28 - 2021-06-26 |
3 months | crt.sh |
histats.com R3 |
2021-02-22 - 2021-05-23 |
3 months | crt.sh |
mohangroups.in R3 |
2021-02-23 - 2021-05-24 |
3 months | crt.sh |
*.dhl.com DigiCert SHA2 Secure Server CA |
2021-02-16 - 2022-02-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://mohangroups.in/wp-content/themes/new/F004f19441/home.php?web=succes&local=_&id=37343383
Frame ID: A8969CA5F19CE322F22D9EE9AA84DD14
Requests: 37 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://gresestesrpouly.com/cgi-bin/telus.net/fm7
HTTP 301
https://gresestesrpouly.com/cgi-bin/telus.net/fm7/ Page URL
-
https://mohangroups.in/wp-content/themes/new/
HTTP 302
https://mohangroups.in/wp-content/themes/new/F004f19441/index.php?valid=true&id=66349298 HTTP 302
https://mohangroups.in/wp-content/themes/new/F004f19441/home.php?web=succes&local=_&id=37343383 Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: here
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://gresestesrpouly.com/cgi-bin/telus.net/fm7
HTTP 301
https://gresestesrpouly.com/cgi-bin/telus.net/fm7/ Page URL
-
https://mohangroups.in/wp-content/themes/new/
HTTP 302
https://mohangroups.in/wp-content/themes/new/F004f19441/index.php?valid=true&id=66349298 HTTP 302
https://mohangroups.in/wp-content/themes/new/F004f19441/home.php?web=succes&local=_&id=37343383 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://gresestesrpouly.com/cgi-bin/telus.net/fm7 HTTP 301
- https://gresestesrpouly.com/cgi-bin/telus.net/fm7/
37 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
gresestesrpouly.com/cgi-bin/telus.net/fm7/ Redirect Chain
|
814 B 1002 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js15_as.js
s10.histats.com/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.php
s4.histats.com/stats/ |
50 B 184 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
Primary Request
home.php
mohangroups.in/wp-content/themes/new/F004f19441/ Redirect Chain
|
40 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shipment-options.css
del.dhl.com/prg/res/ |
234 KB 41 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shipment-options.js
del.dhl.com/prg/res/ |
413 KB 119 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jsf.js.xhtml
del.dhl.com/prg/javax.faces.resource/ |
42 KB 42 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.css.xhtml
del.dhl.com/prg/javax.faces.resource/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
util.js.xhtml
del.dhl.com/prg/javax.faces.resource/util/ |
166 KB 167 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ajaxUtil.js.xhtml
del.dhl.com/prg/javax.faces.resource/util/ |
29 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
icon-close.png
mohangroups.in/prg/img/ |
64 KB 64 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dhl_logo.svg
del.dhl.com/prg/img/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
phone_icon.svg
del.dhl.com/prg/img/ |
1 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pace.min.js
del.dhl.com/prg/js/libs/ |
12 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dpdhl_logo.svg
del.dhl.com/prg/img/ |
9 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
confirmation.js.xhtml
del.dhl.com/prg/javax.faces.resource/window/ |
10 KB 11 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
floatingIconMessage.js.xhtml
del.dhl.com/prg/javax.faces.resource/validation/ |
4 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
validatorUtil.js.xhtml
del.dhl.com/prg/javax.faces.resource/validation/ |
16 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
integerConverterValidator.js.xhtml
del.dhl.com/prg/javax.faces.resource/validation/ |
1008 B 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading.gif.xhtml
del.dhl.com/prg/javax.faces.resource/ |
5 KB 6 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
menu-bg.jpg
del.dhl.com/prg/img/ |
24 KB 24 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-black-schdlv.svg
del.dhl.com/prg/img/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-black-sigrel.svg
del.dhl.com/prg/img/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-black-nghbor.svg
del.dhl.com/prg/img/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-black-svpdlv.svg
del.dhl.com/prg/img/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-black-altadr.svg
del.dhl.com/prg/img/ |
534 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-black-vachld.svg
del.dhl.com/prg/img/ |
5 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Delivery_W_Rg.woff2
del.dhl.com/prg/css/fonts/delivery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
Delivery_W_Bd.woff2
del.dhl.com/prg/css/fonts/delivery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
dhlicons.woff
del.dhl.com/prg/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
Delivery_W_CdLt.woff2
del.dhl.com/prg/css/fonts/delivery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
Delivery_W_CdBlk.woff2
del.dhl.com/prg/css/fonts/delivery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
shipment-options.xhtml
mohangroups.in/prg/ |
87 KB 15 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Delivery_W_CdLt.woff
del.dhl.com/prg/css/fonts/delivery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
Delivery_W_Bd.woff
del.dhl.com/prg/css/fonts/delivery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
Delivery_W_CdBlk.woff
del.dhl.com/prg/css/fonts/delivery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
Delivery_W_Rg.woff
del.dhl.com/prg/css/fonts/delivery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- del.dhl.com
- URL
- https://del.dhl.com/prg/css/fonts/delivery/Delivery_W_Rg.woff2
- Domain
- del.dhl.com
- URL
- https://del.dhl.com/prg/css/fonts/delivery/Delivery_W_Bd.woff2
- Domain
- del.dhl.com
- URL
- https://del.dhl.com/prg/css/fonts/dhlicons.woff
- Domain
- del.dhl.com
- URL
- https://del.dhl.com/prg/css/fonts/delivery/Delivery_W_CdLt.woff2
- Domain
- del.dhl.com
- URL
- https://del.dhl.com/prg/css/fonts/delivery/Delivery_W_CdBlk.woff2
- Domain
- del.dhl.com
- URL
- https://del.dhl.com/prg/css/fonts/delivery/Delivery_W_CdLt.woff
- Domain
- del.dhl.com
- URL
- https://del.dhl.com/prg/css/fonts/delivery/Delivery_W_Bd.woff
- Domain
- del.dhl.com
- URL
- https://del.dhl.com/prg/css/fonts/delivery/Delivery_W_CdBlk.woff
- Domain
- del.dhl.com
- URL
- https://del.dhl.com/prg/css/fonts/delivery/Delivery_W_Rg.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)60 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| dhleAndroidId boolean| dhleEnabled object| oddDynamicManifest object| logger object| sender string| contextPath function| svg function| LimtCharacters function| scrollToElement function| disableButton function| showProgress function| highlightInput function| setModalMaxHeight function| initAddressAutocomplete function| changeBlankTargetToSelf function| isiOS function| isAndroid function| isInFrame function| isExternalLink function| initDropdownBox function| getServicePoints function| setDisableSVPDlv function| removePlaceholder function| isShowOverrideWarning function| isShowAdhocWarning function| updateSVPDel function| updatePage function| startProgressBar function| queryGSPL function| updateRedirectPage function| redirectPage function| $ function| jQuery object| respond undefined| log undefined| remote object| paceOptions object| jsf object| mojarra function| O$ function| OpenFaces object| Pace boolean| _of_loadedLibrary:/prg/res/shipment-options.js?v=20200925 boolean| _of_loadedLibrary:/prg/javax.faces.resource/jsf.js.xhtml?ln=javax.faces&v=20200925 boolean| _of_loadedLibrary:/prg/javax.faces.resource/util/util.js.xhtml?ln=openfaces&v=20200925 boolean| _of_loadedLibrary:/prg/javax.faces.resource/util/ajaxUtil.js.xhtml?ln=openfaces&v=20200925 boolean| _of_loadedLibrary:/prg/js/libs/pace.min.js boolean| _of_loadedLibrary:/prg/javax.faces.resource/window/confirmation.js.xhtml?ln=openfaces&v=20200925 boolean| _of_loadedLibrary:/prg/javax.faces.resource/validation/floatingIconMessage.js.xhtml?ln=openfaces&v=20200925 boolean| _of_loadedLibrary:/prg/javax.faces.resource/validation/validatorUtil.js.xhtml?ln=openfaces&v=20200925 boolean| _of_loadedLibrary:/prg/javax.faces.resource/validation/integerConverterValidator.js.xhtml?ln=openfaces&v=202009253 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mohangroups.in/ | Name: yith_wcwl_session_69e85f2d79434f2cfd020284da863492 Value: %7B%22session_id%22%3A%22da4b9d1efdd6e7ac8ac00d3357f74564%22%2C%22session_expiration%22%3A1619846891%2C%22session_expiring%22%3A1619843291%2C%22cookie_hash%22%3A%22c0d7c878182bdf144b72f73537b013e3%22%7D |
|
mohangroups.in/ | Name: PHPSESSID Value: kahvbietgsal8ua19l2t3i0btc |
|
mohangroups.in/wp-content/themes/new/F004f19441 | Name: loglevel Value: DEBUG |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
del.dhl.com
gresestesrpouly.com
mohangroups.in
s10.histats.com
s4.histats.com
del.dhl.com
157.245.98.52
192.99.13.63
2a02:26f0:7100:281::b24
45.8.126.10
46.105.201.240
04b3b425e3a877246f574b6b38e66409a1533c882314a3cbbdcf5eab8ffcf659
0caf37e94b975e1c41e5535f2712bbc517c75ca7642541aeee38c5ccd9613d89
1288fdc29785fb9484b0ef2195dbff7e8468e0d083cea18c71350d2a74fbeeb8
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
35011fd24ec7298bacbfc0fb9c1e24ac749bf538c2d14c18017a163bba51673d
360eed2ee48cd3706ae81eb278f06f53844825ec154843f73e5a32798c10d398
440fc9fd35402c59b16882f49a436c183ceb2471249d5100ad2bb78df350c8b8
45af8725d4c802afdf0f487ee6662a9b7c1bbe71c7a737421cca87edae0d02fa
4c166a63303efbaf0778827515df1b5334628f1b40ad22f6ccc772dd6091c1c0
53fcb03363b275f2b2006c286664d674f391bf7a8ca2bbfc5f541d39b7136a12
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114
579a10a2485055e988338be054f866cbe713c8510442130cbda0ce11ced6c49f
593618d973776f0cd4c6047898f4448ec35f2ab616a7bb2001dd10681cb36bbc
619b96b5618146959fab7028b041f15b31520340aec73126e2acb408249c6305
67b5d9567261b4d3cb3fec3d1270376e8152035bba744049e0193408abc36490
6fb2d7146c54fbd6bc1b318fb2637be445f9cbef6559da1d76140b9c5fe8ebe0
70d1b09d28405ce9d19aa57e9452096617814870525e079ec6d5c6ef77399df4
834298161ac262f0d4d0585b316794e49990fcdeb5afece3c9124656a29c6cb7
91ff9f694bad9abebe6f18e4be3adedfe625ba381aa483395465170bf18322d0
af558ed2622ba66522eb1ea4c802b5726f5f1fd5cc31a7f02ca5c3791e212a27
bde387320ba94fa31dcb837df22800ee488cce9c95e805438e9b9219683aa60e
c69348a1a9b88f0c78275732cd1ca8fff6c443fe2d4c5430a30c626200099586
c783c738b2830bc7490a7ace756f7b3675d6b63a9cef6c37796d4904fd1f8d49
c93e58f52991a3a487233adb3759b947d71297cbaa98f025ca96f885565a5b40
db3b77de721f84c5480108f47296e5c123232fbb5993e40b4650f363418b5499
e9d3ffb5e8a2c6800eea30819e2d4b1973a57976c71ede1213c6c0629fbde839
f449a9da38779706499ca609615f22e36d8c4519c113f53e232b4f2bf3438e59
f5edbac9f3b1ef761b698b9eb53b7eca7f4017821179b555888adc47398abdca