eky.06e.mywebsitetransfer.com
Open in
urlscan Pro
92.205.173.72
Malicious Activity!
Public Scan
Effective URL: https://eky.06e.mywebsitetransfer.com/dh/packet/home.php?newtoken=
Submission: On June 13 via api from IE — Scanned from DE
Summary
TLS certificate: Issued by eky.06e.mywebsitetransfer.com on April 8th 2024. Valid for: a year.
This is the only time eky.06e.mywebsitetransfer.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 172.64.148.75 172.64.148.75 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 16 | 92.205.173.72 92.205.173.72 | 21499 (GODADDY-SXB) (GODADDY-SXB) | |
1 | 104.21.234.144 104.21.234.144 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 135.181.58.223 135.181.58.223 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 2 | 23.73.4.98 23.73.4.98 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2a02:26f0:350... 2a02:26f0:3500:18::1724:a292 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
4 | 2a02:26f0:350... 2a02:26f0:3500:899::228b | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
26 | 6 |
ASN13335 (CLOUDFLARENET, US)
myworkspace329eb.myclickfunnels.com |
ASN21499 (GODADDY-SXB, DE)
PTR: 72.173.205.92.host.secureserver.net
eky.06e.mywebsitetransfer.com |
ASN24940 (HETZNER-AS, DE)
PTR: white.hostingcolor.com
dispatching-centre.lasamericascargo.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-73-4-98.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN20940 (AKAMAI-ASN1, NL)
events.api.secureserver.net |
ASN20940 (AKAMAI-ASN1, NL)
csp.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
mywebsitetransfer.com
1 redirects
eky.06e.mywebsitetransfer.com |
80 KB |
6 |
secureserver.net
events.api.secureserver.net — Cisco Umbrella Rank: 14127 csp.secureserver.net — Cisco Umbrella Rank: 14267 |
584 B |
3 |
lasamericascargo.com
dispatching-centre.lasamericascargo.com |
37 KB |
2 |
wsimg.com
1 redirects
img1.wsimg.com — Cisco Umbrella Rank: 11055 |
21 KB |
1 |
lr-in.com
cdn.lr-in.com — Cisco Umbrella Rank: 31782 |
168 KB |
1 |
myclickfunnels.com
1 redirects
myworkspace329eb.myclickfunnels.com |
1 KB |
26 | 6 |
Domain | Requested by | |
---|---|---|
16 | eky.06e.mywebsitetransfer.com |
1 redirects
eky.06e.mywebsitetransfer.com
|
4 | csp.secureserver.net |
img1.wsimg.com
|
3 | dispatching-centre.lasamericascargo.com |
eky.06e.mywebsitetransfer.com
|
2 | events.api.secureserver.net |
img1.wsimg.com
|
2 | img1.wsimg.com |
1 redirects
eky.06e.mywebsitetransfer.com
|
1 | cdn.lr-in.com |
eky.06e.mywebsitetransfer.com
|
1 | myworkspace329eb.myclickfunnels.com | 1 redirects |
26 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
eky.06e.mywebsitetransfer.com eky.06e.mywebsitetransfer.com |
2024-04-08 - 2025-04-08 |
a year | crt.sh |
lr-in.com E1 |
2024-05-07 - 2024-08-05 |
3 months | crt.sh |
dispatching-centre.lasamericascargo.com cPanel, Inc. Certification Authority |
2024-05-08 - 2024-08-06 |
3 months | crt.sh |
*.api.secureserver.net Starfield Secure Certificate Authority - G2 |
2023-07-10 - 2024-08-10 |
a year | crt.sh |
*.secureserver.net Starfield Secure Certificate Authority - G2 |
2023-10-10 - 2024-11-10 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://eky.06e.mywebsitetransfer.com/dh/packet/home.php?newtoken=
Frame ID: C3C19BF917FC82DE89C806980E54E457
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
Verification | DHLPage URL History Show full URLs
-
https://myworkspace329eb.myclickfunnels.com/news/
HTTP 302
http://eky.06e.mywebsitetransfer.com/dh/packet/ HTTP 307
https://eky.06e.mywebsitetransfer.com/dh/packet/ HTTP 302
https://eky.06e.mywebsitetransfer.com/dh/packet/home.php?newtoken= Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Ahoy (Analytics) Expand
Detected patterns
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://myworkspace329eb.myclickfunnels.com/news/
HTTP 302
http://eky.06e.mywebsitetransfer.com/dh/packet/ HTTP 307
https://eky.06e.mywebsitetransfer.com/dh/packet/ HTTP 302
https://eky.06e.mywebsitetransfer.com/dh/packet/home.php?newtoken= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- https://img1.wsimg.com/traffic-assets/js/tccl.min.js HTTP 301
- https://img1.wsimg.com/signals/js/clients/scc-c2/scc-c2.min.js
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
home.php
eky.06e.mywebsitetransfer.com/dh/packet/ Redirect Chain
|
76 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.css
eky.06e.mywebsitetransfer.com/dh/packet/assets/ |
405 KB 49 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logger-1.min.js
cdn.lr-in.com/ |
845 KB 168 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
eky.06e.mywebsitetransfer.com/dh/packet/assets/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
col.png
eky.06e.mywebsitetransfer.com/dh/packet/assets/ |
682 B 758 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pak.png
eky.06e.mywebsitetransfer.com/dh/packet/assets/ |
380 B 433 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clan.png
eky.06e.mywebsitetransfer.com/dh/packet/assets/ |
475 B 529 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
alert.png
eky.06e.mywebsitetransfer.com/dh/packet/assets/ |
469 B 523 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
foo.png
eky.06e.mywebsitetransfer.com/dh/packet/assets/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
eky.06e.mywebsitetransfer.com/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
session-recorder.js
eky.06e.mywebsitetransfer.com/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
card.js
dispatching-centre.lasamericascargo.com/js/ |
57 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
intlTelInput.js
dispatching-centre.lasamericascargo.com/js/ |
87 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scc-c2.min.js
img1.wsimg.com/signals/js/clients/scc-c2/ Redirect Chain
|
105 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roboto-latin-400-normal.woff2
eky.06e.mywebsitetransfer.com/fonts/vendor/@fontsource/roboto/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfa-solid-900.woff2
eky.06e.mywebsitetransfer.com/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roboto-all-400-normal.woff
eky.06e.mywebsitetransfer.com/fonts/vendor/@fontsource/roboto/files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfa-solid-900.woff
eky.06e.mywebsitetransfer.com/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfa-solid-900.ttf
eky.06e.mywebsitetransfer.com/fonts/vendor/@fortawesome/fontawesome-free/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 292 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
event
events.api.secureserver.net/t/1/tl/ |
43 B 292 B |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.gif
dispatching-centre.lasamericascargo.com/images/ |
2 KB 2 KB |
Other
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
eventbus
csp.secureserver.net/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage string| sessionHash number| visitId string| fingerprint function| openNav function| closeNav object| regeneratorRuntime object| __SDKCONFIG__ function| _LRLogger function| card function| Payment function| Card object| intlTelInputGlobals function| intlTelInput function| getRandomInt object| _trfd object| _tcclInternal object| _expDataLayer object| _signalsDataLayer object| scc-c2 object| _trfq9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
myworkspace329eb.myclickfunnels.com/ | Name: ahoy_visitor Value: e27462ac-1830-4f23-8909-b789494e940c |
|
myworkspace329eb.myclickfunnels.com/ | Name: ahoy_visit Value: f571ec50-333b-4f68-992d-366dfa7b29f7 |
|
.myclickfunnels.com/ | Name: _cf_session Value: PlYrScVIXBKs2UyGGneKr8W5YaqR%2Fu%2B7eYxmTONeIJ0A3IiGucd3FLbSCO%2BSmKSJF9kDfUWOJTpx6zJUQxnh4YOuFM6E9g0yCA3hdHclbBr4WEGnhffmWSpd8jC%2FO7i6Y0x9L0ouMAi5dLqOjhdcfW65p2RUSDTQW0ZqHvcZIMuNA9SgQy9vqDwfpDFR2K8OFD20O259hvgjUvj50tjtr4YH3MSMpIArsth3t9Ztvj5eRQ70Gc6pnv6rr%2Bl7PtqNS6CfmeiIVVmYN8Sc6Y0ceSmTE%2BuRf1UD2GfwJILFuX0c7ZyhnGiDNUqnchYVeXQBHNQKz%2B2MlRj%2Bd4k%2Frpq3KGhLVj5FrbKfTeXsSo09itBvagLRgI%2B%2BJoOsTs98ipeMg3j6CwaT88H%2B%2F%2BHRapDNLnVMburaa74LHL4hkoubka%2FNfkpyspI8ocJtFg%3D%3D--faTCRkOWGStop%2FSk--LnZmQLurxg1v9nPYIHuaYQ%3D%3D |
|
.myclickfunnels.com/ | Name: __cf_bm Value: f.x4eZAhxLPGKuec2xkg3RZLcY2UChmCyGDN5_gIAFc-1718312631-1.0.1.1-Tj3xLkZ42FbE.NxzVFdN5JF_SJYYrKVRYBMi09V5v3QUrvGk4qrZTbmLDMl_BYO0gwGq54U_YhqiBjwnMHdmBQ |
|
.myclickfunnels.com/ | Name: _cfuvid Value: YIdvri0_YdTRZ7BWaZuA0b8l_L304AMRi5XglFYPwWI-1718312631048-0.0.1.1-604800000 |
|
eky.06e.mywebsitetransfer.com/ | Name: PHPSESSID Value: kui1tr6u1bg7e2hgnfir6go3ro |
|
.mywebsitetransfer.com/ | Name: _tccl_visitor Value: d05c7507-aa82-4d1a-9a27-5625ae3a9eaa |
|
.mywebsitetransfer.com/ | Name: _tccl_visit Value: d05c7507-aa82-4d1a-9a27-5625ae3a9eaa |
|
.mywebsitetransfer.com/ | Name: _scc_session Value: pc=1&C_TOUCH=2024-06-13T21:03:52.044Z |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.lr-in.com
csp.secureserver.net
dispatching-centre.lasamericascargo.com
eky.06e.mywebsitetransfer.com
events.api.secureserver.net
img1.wsimg.com
myworkspace329eb.myclickfunnels.com
104.21.234.144
135.181.58.223
172.64.148.75
23.73.4.98
2a02:26f0:3500:18::1724:a292
2a02:26f0:3500:899::228b
92.205.173.72
18c4b9b4c27233b541a47300a4ee98239e1f8dec4bbcd9fabb6bdad12ca82025
3796ae4bcbc7494e0405fb861a9fc34066e3c706c0e07cae27c9ecf1eef25123
381941fc8b5df86879d6e2fcf3392d281b796c33f430f045405a0e6af0e474b9
3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756
691ff3918fb72cddc3abf2b84af0d66e0d2875b18b032ef6864923789c7e4077
8f7092c94ef904c57584706cdb5f1fd9fe1efce52ce3105e99b9a7def487f09f
a0b9419777f544b665051cae80f11bf8ff9f925072a9f062a3d82c383e6cdfde
b0dbd00f3650fa6b931e678a9d8f79a405d23c7adf111ab91b1a01a0e7109807
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b36e63b78f7ab077c9f74269deec4010ae803b687b27ca13e6aa58712520bb84
b8b7e6c193f0b11bece8c12b305cbf15130bc99b32ae92426eb747a3da3264d6
cae9d5adf2b0220c74a93b644c26d53e27c3a87f9b5d3fe57d06442e808074a2
e152bda14a4228961ca159738723716a988997a558a8afcb2be2d1f3adba7814
eb6ca62c1e5d64c52be3ffa63c298dcda2483c04c4b17d1bfe605d134e52f91b