![](/screenshots/278b539a-c2ce-4117-8da2-1a87a61edff0.png)
global-alloname412231223.codeanyapp.com
Open in
urlscan Pro
45.55.112.74
Malicious Activity!
Public Scan
Effective URL: https://global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/index.php
Submission: On December 23 via api from IE — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 19th 2023. Valid for: 3 months.
This is the only time global-alloname412231223.codeanyapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 34.120.223.236 34.120.223.236 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 | 2a00:1450:400... 2a00:1450:4001:831::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
5 | 151.101.194.132 151.101.194.132 | 54113 (FASTLY) (FASTLY) | |
2 | 2a00:1450:400... 2a00:1450:4001:813::2003 | 15169 (GOOGLE) (GOOGLE) | |
11 | 45.55.112.74 45.55.112.74 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
2 | 2606:4700::68... 2606:4700::6810:5914 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
25 | 8 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 236.223.120.34.bc.googleusercontent.com
b.uscreen.io |
ASN54113 (FASTLY, US)
assets-gke.uscreencdn.com | |
alpha.uscreencdn.com |
ASN14061 (DIGITALOCEAN-ASN, US)
global-alloname412231223.codeanyapp.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
codeanyapp.com
global-alloname412231223.codeanyapp.com |
2 MB |
5 |
uscreencdn.com
assets-gke.uscreencdn.com — Cisco Umbrella Rank: 217477 alpha.uscreencdn.com — Cisco Umbrella Rank: 165183 |
186 KB |
3 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 29 ajax.googleapis.com — Cisco Umbrella Rank: 340 |
9 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 313 |
98 KB |
2 |
gstatic.com
fonts.gstatic.com |
65 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2842 |
7 KB |
1 |
uscreen.io
b.uscreen.io |
26 KB |
25 | 7 |
Domain | Requested by | |
---|---|---|
11 | global-alloname412231223.codeanyapp.com |
b.uscreen.io
global-alloname412231223.codeanyapp.com |
3 | assets-gke.uscreencdn.com |
b.uscreen.io
|
2 | cdn.jsdelivr.net |
global-alloname412231223.codeanyapp.com
cdn.jsdelivr.net |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | alpha.uscreencdn.com |
b.uscreen.io
|
2 | fonts.googleapis.com |
b.uscreen.io
ajax.googleapis.com |
1 | stackpath.bootstrapcdn.com |
global-alloname412231223.codeanyapp.com
|
1 | ajax.googleapis.com |
b.uscreen.io
|
1 | b.uscreen.io | |
25 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
uscreen.io GTS CA 1D4 |
2023-11-12 - 2024-02-10 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
*.uscreencdn.com R3 |
2023-12-02 - 2024-03-01 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
codeanyapp.com R3 |
2023-10-19 - 2024-01-17 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2023-11-30 - 2024-02-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/index.php
Frame ID: D261EC851E9B78A73B27DBF140868ACE
Requests: 25 HTTP requests in this frame
Screenshot
![](/screenshots/278b539a-c2ce-4117-8da2-1a87a61edff0.png)
Page Title
Login to Customer Portals and Tools | DHL |Page URL History Show full URLs
- https://b.uscreen.io/pages/d-h-l/ Page URL
- https://global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/index.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- googleapis\.com/.+webfont
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://b.uscreen.io/pages/d-h-l/ Page URL
- https://global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
b.uscreen.io/pages/d-h-l/ |
24 KB 26 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfont.js
ajax.googleapis.com/ajax/libs/webfont/1.5.10/ |
17 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tailwind-styles-7ed9f2df6941f15b8e36.css
assets-gke.uscreencdn.com/packs/css/ |
138 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
page_builder-styles-27d85245f2feacbc8cdf.css
assets-gke.uscreencdn.com/packs/css/ |
20 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
page_builder-0eac04244f9b8814fa5d.js
assets-gke.uscreencdn.com/packs/js/ |
556 KB 152 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
assets%2Fpage-builder%2Fdhl-logo.1703095754.PNG
alpha.uscreencdn.com/150xnull/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v13/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
assets%2Fpage-builder%2Fdhl-logo.1703095798.PNG
alpha.uscreencdn.com/150xnull/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 519 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
QdVUSTchPBm7nuUeVf70viFl.woff2
fonts.gstatic.com/s/questrial/v18/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.php
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/ |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ |
64 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.css
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/css/ |
188 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
posta.css
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/css/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dhl-logo.svg
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/image/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
camion.png
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/image/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
group.svg
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/image/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
socio.png
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/image/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/js/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/js/ |
23 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
titiza.png
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/image/ |
2 MB 2 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/ |
88 KB 89 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
spy.php
global-alloname412231223.codeanyapp.com/CS47*****/DH-Official%20Logistic's/DH-Official%20Logistic's/ |
0 75 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery boolean| abort15 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
b.uscreen.io/ | Name: user_utm_source Value: |
|
b.uscreen.io/ | Name: user_utm_medium Value: |
|
b.uscreen.io/ | Name: user_utm_term Value: |
|
b.uscreen.io/ | Name: user_utm_content Value: |
|
b.uscreen.io/ | Name: user_utm_campaign Value: |
|
b.uscreen.io/ | Name: user_referrer Value: |
|
b.uscreen.io/ | Name: referer Value: |
|
b.uscreen.io/ | Name: country_code Value: SE |
|
b.uscreen.io/ | Name: ip_address Value: 193.32.248.248 |
|
b.uscreen.io/ | Name: agent Value: Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F120.0.6099.109+Safari%2F537.36 |
|
b.uscreen.io/ | Name: started_at Value: 2023-12-23+06%3A11%3A30+UTC |
|
b.uscreen.io/ | Name: initialized Value: true |
|
b.uscreen.io/ | Name: pixel_session Value: 2c9830d2-15ad-497f-ab7f-1511e106dbdb |
|
b.uscreen.io/ | Name: _uscreen2_session Value: eTlOTktSWFIrU2xHUkpoUGxVOW10RFpDWDlqamRqT0lQU1NNTGVYN2xOeGZTRWpJZCtLUGZCNE0yNW51ZXc3TDlLbFhzTFdHM2ZtcENvSTB2cWd3L1pLNjFtcTg3c3JualA0SG42alh1eno0dDc1dnlZdWdlN2Z0eWFGdmZhL29jTFMwRVcyTzVYT2JQWFRESFBsRTVqeXpET1B4ZEdielZCWWVoc1p5M05zPS0tTkFJNmZod3lpOUUvYmpPVkc0TUdpUT09--3a59b99de303c1bdf47e5ab423c9f12b39d88ddb |
|
global-alloname412231223.codeanyapp.com/ | Name: PHPSESSID Value: 8b286b1vcg9p26dd6datpphpth |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors 'self' https://uscreen.io https://*.uscreen.io https://www.uscreen.tv https://app.uscreen.tv/ |
Strict-Transport-Security | max-age=63072000; includeSubDomains |
X-Content-Security-Policy | frame-ancestors 'self' https://uscreen.io https://*.uscreen.io https://www.uscreen.tv https://app.uscreen.tv/ |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
alpha.uscreencdn.com
assets-gke.uscreencdn.com
b.uscreen.io
cdn.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
global-alloname412231223.codeanyapp.com
stackpath.bootstrapcdn.com
151.101.194.132
2606:4700::6810:5914
2606:4700::6812:acf
2a00:1450:4001:813::2003
2a00:1450:4001:81c::200a
2a00:1450:4001:831::200a
34.120.223.236
45.55.112.74
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334
134be4df6ac56e30aa63c23e8594dda67ab7a6e81763f82285513021bbd593f7
2d60908629436c6bc0a8b006373c76ec019389ec04c1bffffae6ff8a27a0d447
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
387e18d0ea2b7c5c81fb6d3b3446506d12626467e8216dc7b519384fa0c32203
39b5e1fdc845a00e044f1d5136d4d365e319d79caae542b2abef7e9a7eb7d786
3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef
47a8a3cac11d58041b7c0874be17d4c7f9a71fe87ec09e8dc3dbf047438346d5
4d4c2229366643e0f0c76860971f79393833087f09b21c07ec026db6e289e801
5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038
6653eff973a002a684990a22bcd9d9ff2da7e7da07bea9d4a02bb4f9c75cb3e2
6c29392caeadafdf51c857adb6e2138d4e466c9e042a8b41c44a302d58c367b6
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
9602bf489f5d34b3067fd0a3e099c182c8c468db702f880c433a863e83fcc3af
9749654bdfcce79bc06740ed18ce854c5bc56fd419a8d59fc590777ba942105e
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
a240734f03c3c7a0927877faafffb214e1e8093c564e672fd264ee4f390e0601
bf90771220c51af99c6e15274dc84ee40078e8ddde71a823ad6ee98569a57733
d48c0becd4b30579b0688c054c43a86211ff5817a4cd7e775cec39572f4e972a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f60f573f9047468e8dd5aa40c0c5ccf3a6088fb025286de208159679e2f67e2d
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fd88a03358ba14440b78c6329717bdf6ed1a9fe97c3ad4e0a0a39d31fb1ac546