dpd-delays.com
185.216.71.253 Malicious Activity!

Go To Rescan
Add Verdict Report

Submitted URL:
http://dpd-delays.com/
Effective URL:
https://dpd-delays.com/e/authID=EHwHc/track-your-item.php
Submission: On April 10 via api (April 10th 2023, 10:17:19 am UTC) from GB — Scanned from NL

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 185.216.71.253, located in Netherlands and belongs to AS_DELIS, US. The main domain is dpd-delays.com.
TLS certificate: Issued by R3 on April 9th 2023. Valid for: 3 months.

This is the only time dpd-delays.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DPD (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
3 12	185.216.71.253 185.216.71.253		211252 (AS_DELIS) (AS_DELIS)
9	1

12 185.216.71.253 (Netherlands) 3 redirects

ASN211252 (AS_DELIS, US)

dpd-delays.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	dpd-delays.com 3 redirects dpd-delays.com	195 KB
9	1

	Domain	Requested by
12	dpd-delays.com	3 redirects dpd-delays.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
dpd-delays.com R3	`2023-04-09` - `2023-07-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dpd-delays.com/e/authID=EHwHc/track-your-item.php
Frame ID: 9BDDEC061637928F9E87B83D20648544
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://dpd-delays.com/ HTTP 302
https://dpd-delays.com/e/authID=EHwHc HTTP 301
https://dpd-delays.com/e/authID=EHwHc/ HTTP 302
https://dpd-delays.com/e/authID=EHwHc/track-your-item.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

194 kB
Transfer

252 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://dpd-delays.com/ HTTP 302
https://dpd-delays.com/e/authID=EHwHc HTTP 301
https://dpd-delays.com/e/authID=EHwHc/ HTTP 302
https://dpd-delays.com/e/authID=EHwHc/track-your-item.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request track-your-item.php Show response dpd-delays.com/e/authID=EHwHc/ Redirect Chain http://dpd-delays.com/ https://dpd-delays.com/e/authID=EHwHc https://dpd-delays.com/e/authID=EHwHc/ https://dpd-delays.com/e/authID=EHwHc/track-your-item.php	3 KB 2 KB	29ms 28ms	Document text/html	185.216.71.253 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://dpd-delays.com/e/authID=EHwHc/track-your-item.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.216.71.253 , Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software nginx / PHP/8.1.17 Resource Hash `65eff40a50945ceb48d13b8cb4fce58e359e6596b93f423811b5c8c7e3312667` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 10 Apr 2023 10:17:19 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=60 Pragma no-cache Server nginx Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By PHP/8.1.17 Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Mon, 10 Apr 2023 10:17:19 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=60 Pragma no-cache Server nginx X-Powered-By PHP/8.1.17 location https://dpd-delays.com/e/authID=EHwHc/track-your-item.php
GET H/1.1	200 OK	main2.css dpd-delays.com/e/authID=EHwHc/sources/css/	3 KB 1 KB	26ms 25ms	Stylesheet text/css	185.216.71.253 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://dpd-delays.com/e/authID=EHwHc/sources/css/main2.css Requested by Host: dpd-delays.com URL: https://dpd-delays.com/e/authID=EHwHc/track-your-item.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.216.71.253 , Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software nginx / Resource Hash `1bf55459963601ef36418b2879874b363920a7dac73cf80df4f62ca6e9db64d1` Request headers accept-language nl-NL,nl;q=0.9 Referer https://dpd-delays.com/e/authID=EHwHc/track-your-item.php User-Agent Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 Response headers Date Mon, 10 Apr 2023 10:17:19 GMT Content-Encoding gzip Last-Modified Sun, 05 Feb 2023 02:50:48 GMT Server nginx ETag W/"63df1988-dbf" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	logo.png dpd-delays.com/e/authID=EHwHc/sources/img/	21 KB 21 KB	117ms 50ms	Image image/png	185.216.71.253 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL https://dpd-delays.com/e/authID=EHwHc/sources/img/logo.png Requested by Host: dpd-delays.com URL: https://dpd-delays.com/e/authID=EHwHc/track-your-item.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.216.71.253 , Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software nginx / Resource Hash `268b37ae55b70848676c6c100f52249325e99c6d511d95ebe841ad03bc685069` Request headers accept-language nl-NL,nl;q=0.9 Referer https://dpd-delays.com/e/authID=EHwHc/track-your-item.php User-Agent Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 Response headers Date Mon, 10 Apr 2023 10:17:19 GMT Last-Modified Wed, 01 Feb 2023 04:46:40 GMT Server nginx ETag "63d9eeb0-5269" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 21097 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	claim.png dpd-delays.com/e/authID=EHwHc/sources/img/	17 KB 18 KB	102ms 51ms	Image image/png	185.216.71.253 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL https://dpd-delays.com/e/authID=EHwHc/sources/img/claim.png Requested by Host: dpd-delays.com URL: https://dpd-delays.com/e/authID=EHwHc/track-your-item.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.216.71.253 , Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software nginx / Resource Hash `863a24f0e0d23c794479143baad6d856fcbdfaec2701a67988fbd5b85b5b1218` Request headers accept-language nl-NL,nl;q=0.9 Referer https://dpd-delays.com/e/authID=EHwHc/track-your-item.php User-Agent Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 Response headers Date Mon, 10 Apr 2023 10:17:19 GMT Last-Modified Wed, 01 Feb 2023 10:43:14 GMT Server nginx ETag "63da4242-450a" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 17674 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	footerlogo.png dpd-delays.com/e/authID=EHwHc/sources/img/	3 KB 3 KB	92ms 25ms	Image image/png	185.216.71.253 AS_DELIS
General Check archive.org Show headers Download Go to Show image Full URL https://dpd-delays.com/e/authID=EHwHc/sources/img/footerlogo.png Requested by Host: dpd-delays.com URL: https://dpd-delays.com/e/authID=EHwHc/track-your-item.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.216.71.253 , Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software nginx / Resource Hash `9e72e47498366f1af8dc4972041ce63172ed73fc49553c3e729c66191e6ff2ea` Request headers accept-language nl-NL,nl;q=0.9 Referer https://dpd-delays.com/e/authID=EHwHc/track-your-item.php User-Agent Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 Response headers Date Mon, 10 Apr 2023 10:17:19 GMT Last-Modified Wed, 01 Feb 2023 13:50:56 GMT Server nginx ETag "63da6e40-b83" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 2947 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	jquery.min.js Show response dpd-delays.com/e/authID=EHwHc/sources/	87 KB 31 KB	67ms 56ms	Script application/javascript	185.216.71.253 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://dpd-delays.com/e/authID=EHwHc/sources/jquery.min.js Requested by Host: dpd-delays.com URL: https://dpd-delays.com/e/authID=EHwHc/track-your-item.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.216.71.253 , Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers accept-language nl-NL,nl;q=0.9 Referer https://dpd-delays.com/e/authID=EHwHc/track-your-item.php User-Agent Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 Response headers Date Mon, 10 Apr 2023 10:17:19 GMT Content-Encoding gzip Last-Modified Tue, 18 May 2021 09:35:26 GMT Server nginx ETag W/"60a38a5e-15d9d" Transfer-Encoding chunked Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	main.js Show response dpd-delays.com/e/authID=EHwHc/sources/	114 B 455 B	76ms 25ms	Script application/javascript	185.216.71.253 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://dpd-delays.com/e/authID=EHwHc/sources/main.js?token=d135jga4+6e0fh+9cb72i8r+K+J8I49YNw+EoObX3fGpPaAL1ZmSCS5+g7k+g+u2DaBHwFT6+M16732462672 Requested by Host: dpd-delays.com URL: https://dpd-delays.com/e/authID=EHwHc/track-your-item.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.216.71.253 , Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software nginx / Resource Hash `cecb3143f36d6cea2bc07b5d62c5b33203356ae7a7b06b37d0c6b4eeb14df32f` Request headers accept-language nl-NL,nl;q=0.9 Referer https://dpd-delays.com/e/authID=EHwHc/track-your-item.php User-Agent Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 Response headers Date Mon, 10 Apr 2023 10:17:19 GMT Last-Modified Wed, 15 Jun 2022 04:26:02 GMT Server nginx ETag "62a95f5a-72" Content-Type application/javascript Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 114 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	plutosansdpdlight-web.woff dpd-delays.com/e/authID=EHwHc/sources/fonts/	59 KB 60 KB	74ms 52ms	Font application/font-woff	185.216.71.253 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://dpd-delays.com/e/authID=EHwHc/sources/fonts/plutosansdpdlight-web.woff Requested by Host: dpd-delays.com URL: https://dpd-delays.com/e/authID=EHwHc/sources/css/main2.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.216.71.253 , Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software nginx / Resource Hash `9e462606602d426b676f2b6f9c0b6629b02f91204214898f7d4a56749c4e00d0` Request headers Referer https://dpd-delays.com/e/authID=EHwHc/sources/css/main2.css Origin https://dpd-delays.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 Response headers Date Mon, 10 Apr 2023 10:17:19 GMT Last-Modified Wed, 01 Feb 2023 12:59:16 GMT Server nginx ETag "ed6d-5f3a30401d100" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 60781
GET H/1.1	200 OK	plutosansdpdregular-web.woff dpd-delays.com/e/authID=EHwHc/sources/fonts/	59 KB 59 KB	89ms 52ms	Font application/font-woff	185.216.71.253 AS_DELIS
General Check archive.org Show headers Download Go to Full URL https://dpd-delays.com/e/authID=EHwHc/sources/fonts/plutosansdpdregular-web.woff Requested by Host: dpd-delays.com URL: https://dpd-delays.com/e/authID=EHwHc/sources/css/main2.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.216.71.253 , Netherlands, ASN211252 (AS_DELIS, US), Reverse DNS Software nginx / Resource Hash `c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3` Request headers Referer https://dpd-delays.com/e/authID=EHwHc/sources/css/main2.css Origin https://dpd-delays.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Linux; Android 10; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Mobile Safari/537.36 Response headers Date Mon, 10 Apr 2023 10:17:19 GMT Last-Modified Wed, 01 Feb 2023 12:59:36 GMT Server nginx ETag "ea8a-5f3a30532fe00" Content-Type application/font-woff Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 60042

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DPD (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			dpd-delays.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: e6omteks4b6a9im5lpg6o6g42d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dpd-delays.com
185.216.71.253
1bf55459963601ef36418b2879874b363920a7dac73cf80df4f62ca6e9db64d1
268b37ae55b70848676c6c100f52249325e99c6d511d95ebe841ad03bc685069
65eff40a50945ceb48d13b8cb4fce58e359e6596b93f423811b5c8c7e3312667
863a24f0e0d23c794479143baad6d856fcbdfaec2701a67988fbd5b85b5b1218
9e462606602d426b676f2b6f9c0b6629b02f91204214898f7d4a56749c4e00d0
9e72e47498366f1af8dc4972041ce63172ed73fc49553c3e729c66191e6ff2ea
c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3
cecb3143f36d6cea2bc07b5d62c5b33203356ae7a7b06b37d0c6b4eeb14df32f
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

dpd-delays.com Open in urlscan Pro 185.216.71.253 Malicious Activity!

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

194 kBTransfer

252 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

dpd-delays.com
185.216.71.253 Malicious Activity!

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

194 kB
Transfer

252 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!