khaine.nl Open in urlscan Pro
172.67.202.5 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://khaine.nl/popouiyt/gyrfd.html
Effective URL:
https://khaine.nl/popouiyt/gyrfd.html
Submission: On April 09 via api (April 9th 2024, 9:27:56 pm UTC) from US — Scanned from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 7 domains to perform 12 HTTP transactions. The main IP is 172.67.202.5, located in United States and belongs to CLOUDFLARENET, US. The main domain is khaine.nl.
TLS certificate: Issued by E1 on March 25th 2024. Valid for: 3 months.

This is the only time khaine.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 7	172.67.202.5 172.67.202.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:600... 2a04:4e42:600::649	54113 (FASTLY) (FASTLY)
1	104.131.67.145 104.131.67.145	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2 2	2606:4700::68... 2606:4700::6812:69e3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:1ac4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2600:141b:1c0... 2600:141b:1c00:1a8a::296d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2600:141b:1c0... 2600:141b:1c00:16::17c4:322	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	5

7 172.67.202.5 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

khaine.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.131.67.145 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

cdn.freebiesupply.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:69e3 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.dhlparcel.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1ac4 (United States)

ASN13335 (CLOUDFLARENET, US)

www.dhlecommerce.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:1c00:1a8a::296d (Secaucus, United States) 2 redirects

ASN20940 (AKAMAI-ASN1, NL)

www.dpdhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:1c00:16::17c4:322 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

group.dhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	khaine.nl 1 redirects khaine.nl	50 KB
2	dhl.com group.dhl.com	262 KB
2	dpdhl.com 2 redirects www.dpdhl.com	569 B
2	dhlecommerce.nl www.dhlecommerce.nl — Cisco Umbrella Rank: 531391	3 KB
2	dhlparcel.nl 2 redirects www.dhlparcel.nl — Cisco Umbrella Rank: 799771	464 B
1	freebiesupply.com cdn.freebiesupply.com — Cisco Umbrella Rank: 352681	45 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1217	33 KB
12	7

	Domain	Requested by
7	khaine.nl	1 redirects khaine.nl
2	group.dhl.com	khaine.nl
2	www.dpdhl.com	2 redirects
2	www.dhlecommerce.nl	khaine.nl
2	www.dhlparcel.nl	2 redirects
1	cdn.freebiesupply.com	khaine.nl
1	code.jquery.com	khaine.nl
12	7

This site contains no links.

Subject Issuer	Validity	Valid
khaine.nl E1	`2024-03-25` - `2024-06-23`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
cdn.freebiesupply.com R3	`2024-03-31` - `2024-06-29`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://khaine.nl/popouiyt/gyrfd.html
Frame ID: 9653736089CECFB46D558BAFCC5F5CD9
Requests: 10 HTTP requests in this frame

Frame: https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
Frame ID: 8D38DE96CBBAF1A1E11DCB3378B05AF2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DHL Express | Track Shipment

Page URL History Show full URLs

http://khaine.nl/popouiyt/gyrfd.html HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
https://khaine.nl/popouiyt/gyrfd.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

58 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

5
IPs

1
Countries

393 kB
Transfer

470 kB
Size

10
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://khaine.nl/popouiyt/gyrfd.html HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
https://khaine.nl/popouiyt/gyrfd.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://khaine.nl/popouiyt/gyrfd.html HTTP 307
https://khaine.nl/popouiyt/gyrfd.html

Request Chain 2

https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

Request Chain 7

https://www.dhlparcel.nl/themes/custom/dp_theme/images/logo.svg HTTP 301
https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg

Request Chain 8

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg HTTP 301
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg

Request Chain 9

https://www.dhlparcel.nl/themes/custom/dp_theme/favicon.ico HTTP 301
https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico

Request Chain 10

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg HTTP 301
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

503

gyrfd.html Show response
khaine.nl/popouiyt/
Redirect Chain

http://khaine.nl/popouiyt/gyrfd.html
https://khaine.nl/popouiyt/gyrfd.html

19 KB
20 KB

533ms
458ms

Document
text/html

172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/popouiyt/gyrfd.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f5cc35a16d97981a1bb5ee5649fb5b96af311ad1791f92fe8cf55b73738f46e

Security Headers

Name	Value
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 871d9553bec66c87-MIA
content-type: text/html; charset=utf-8
date: Tue, 09 Apr 2024 21:27:49 GMT
expires: 0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pKd1mUIHzKomcHkYK0kzUtksRYr5px7gOSH1H1XsH4scOW2G4F8ZwegoQ018XEjvtOtdgqkNGmKEEOeaTJ%2BD4p3oKNn%2BSn11nREaTUP%2FzzQ3m9%2BF3709WeqJcIg%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block 1; mode=block

Redirect headers

Location: https://khaine.nl/popouiyt/gyrfd.html
Non-Authoritative-Reason: HttpsUpgrades

POST
H3 204 gyrfd.html
khaine.nl/popouiyt/ 0
829 B 245ms
244ms XHR
text/plain 172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/popouiyt/gyrfd.html

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
X-Requested-TimeStamp-Expire
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
X-Requested-TimeStamp-Combination
X-Requested-Type-Combination: GET
Content-type: application/x-www-form-urlencoded
X-Requested-Type: GET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
jn94tl5pvJNSJtb8nXPzt-UHJE: 28282432
Referer: https://khaine.nl/popouiyt/gyrfd.html
X-Requested-with: XMLHttpRequest
X-Requested-TimeStamp
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:27:49 GMT
x-server-powered-by: Engintron
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jXleJRcCPzdMqd%2BqeRKYXHHrHwhggCQ6u1E43kUNRy1xhzW%2Fs5JOq9FsBcvLqC0oAFqXswfhFlDkC1kpLyRetVNhK36SFd0oVmlNPmQNS7N9kVw74ugH%2FpJ1oV0%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 871d95580fb36c87-MIA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block, 1; mode=block
expires: 0

GET
H3

200

main.js Show response
khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/ Frame 8D38
Redirect Chain

https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

8 KB
4 KB

41ms
41ms

Script
application/javascript

172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

Protocol

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c7556e8c2066fe885ed58e24601b25c82b747589dc17900051bc9cb98053329

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Apr 2024 21:27:49 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nsNYxPt9NV6N3clQn2Iu%2BQlZf7gDYAcHChWyzgNZziPtBMiCo8b%2F79n4LR3lcbTJ34YfjuNpMLL2ocD53Qp0IxaYor4E2BIt6UN7neu6IPcswbZQ6vmvZvaDxQ4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 871d955848fa6c87-MIA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 09 Apr 2024 21:27:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f3qmGYxV0U0DJkKj8DNNg9Pbia24gfFDYnaKDpTCPKQQNQkG2iarR4y0of1B4nbYEmtkRrSbc2zwvGii6oPMIuThieSkm%2FWw3%2Be0S6ub4Dxz%2BPuOxjM%2BivLdDDo%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
cache-control: max-age=300, public
cf-ray: 871d95580fb96c87-MIA
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 503 favicon.ico
khaine.nl/ 18 KB
18 KB 451ms
450ms Other
text/html 172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://khaine.nl/popouiyt/gyrfd.html
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:27:50 GMT
x-content-type-options: nosniff, nosniff
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HMmfqBtYB0VI6Ofj3kdzY%2FQq7FmTDBanB0PiPHQDqj42gNft75J0rhEw5yHHOwiKc4ba42FKv9sKkxfn%2BAP3S5F%2Bdc353gdGJy4%2BixbcMeQeHfdP9%2BowTOoiWAc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 871d95580fc66c87-MIA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block, 1; mode=block
expires: 0

POST
H3 200 871d9553bec66c87 Show response
khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 8D38 0
578 B 55ms
54ms XHR
text/plain 172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/871d9553bec66c87
Requested by: Host: khaine.nl
URL: https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 09 Apr 2024 21:27:49 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SXsvq29XM7gx%2FdKerO4wDWU6sgAXkugea%2FsB%2By5r3HR7ZQYduMHbtvaLgJ3SHT6JgkjyMDEPG3fO7QZ9nPQIfBJxhWipxGUty3TUqxKl2tudIlmALtaqzOIVTx0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 871d95591c8c6c87-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 Primary Request gyrfd.html Show response
khaine.nl/popouiyt/ 17 KB
6 KB 309ms
308ms Document
text/html 172.67.202.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/popouiyt/gyrfd.html

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.202.5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

736e85b6a5214e90e34aff6811b89d65e4e19d640d18a14119f2bd893aa047fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Referer: https://khaine.nl/popouiyt/gyrfd.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 871d95599ef26c87-MIA
content-encoding: br
content-type: text/html
date: Tue, 09 Apr 2024 21:27:50 GMT
last-modified: Mon, 08 Apr 2024 11:11:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ezgvm4gJH0ClLTc1H%2Bge9j4KJbtd2d8R9PeJ0oi8BTrRnvMXwUAHtY5w6dchqinAKA8ZHei7T7NKhPjK4Hp0co%2F3%2FPYsxsG%2F8h412e%2F5bKqvtiv4msCTRs61BO4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff nosniff
x-nginx-upstream-cache-status: EXPIRED
x-server-powered-by: Engintron
x-xss-protection: 1; mode=block 1; mode=block

GET
H2 200 jquery-1.11.1.min.js Show response
code.jquery.com/ 94 KB
33 KB 333ms
34ms Script
application/javascript 2a04:4e42:600::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.1.min.js
Requested by: Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://khaine.nl/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 09 Apr 2024 21:27:50 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 17895867
x-cache: HIT, HIT
content-length: 33202
x-served-by: cache-lga21922-LGA, cache-mia-kmia1760021-MIA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1712698071.632086,VS0,VE0
etag: W/"28feccc0-1762a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 42, 4333

GET
H/1.1 200
OK dhl-1-logo-png-transparent.png
cdn.freebiesupply.com/logos/large/2x/ 45 KB
45 KB 426ms
127ms Image
image/png 104.131.67.145
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.freebiesupply.com/logos/large/2x/dhl-1-logo-png-transparent.png
Requested by: Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.131.67.145 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 7f8a7411080898c5e0e9a1b99c27c4c0951d558c6948a8f5cd712364f85e9bc7

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://khaine.nl/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 09 Apr 2024 21:27:50 GMT
Last-Modified: Fri, 09 Mar 2018 21:42:13 GMT
Server: nginx
x-amz-request-id: 28614FAD7B274E59
ETag: "c254c6e963469ddf999da53d10109dea"
X-Cache-Status: HIT
Content-Type: image/png
Cache-Control: max-age=15552000, public, no-transform
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 45805
x-amz-id-2: XZbIpmPf9PFo2XVF7tEO9Qr7mSd4FG4AA+Rw98IEpb27+/GWXHNMfBTBVGvb4Conea/CEiMQ2Lc=
Expires: Sun, 06 Oct 2024 21:27:50 GMT

GET
H2

200

logo.svg
www.dhlecommerce.nl/themes/custom/dp_theme/images/
Redirect Chain

https://www.dhlparcel.nl/themes/custom/dp_theme/images/logo.svg
https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg

3 KB
1 KB

194ms
42ms

Image
image/svg+xml

2606:4700::6812:1ac4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Server

2606:4700::6812:1ac4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a62bf08fcdd300ef2c47e160b8d0a9f2dcb2fd9278af0a4e52cc716deb8a14c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Apr 2024 21:27:50 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 08:02:34 GMT
server: cloudflare
age: 2476
etag: W/"c72-614b3f21dba80"
vary: Accept-Encoding
content-type: image/svg+xml
content-encoding: br
cf-ray: 871d955d68a54c02-MIA

Redirect headers

date: Tue, 09 Apr 2024 21:27:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
vary: Accept-Encoding
location: https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg
cache-control: max-age=3600
cf-ray: 871d955c2fe2749e-MIA
expires: Tue, 09 Apr 2024 22:27:50 GMT

GET
H2

200

freight-volvo-1-1592x896.web.796.448.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/
Redirect Chain

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg

90 KB
90 KB

570ms
85ms

Image
image/jpeg

2600:141b:1c00:16::17c4:322
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Server

2600:141b:1c00:16::17c4:322 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

9ecffc589fabf1eddb43842acfbff00c31fbf44245108bbbca289863af0b06c1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
date: Tue, 09 Apr 2024 21:27:51 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains
x-akamai-cache: Hit from child
content-length: 91709
pragma: no-cache
referrer-policy: same-origin
last-modified: Sat, 23 Mar 2024 15:02:11 GMT
etag: "1663d-61455399f0387"
x-frame-options: DENY
content-type: image/jpeg
cache-control: max-age=0, no-cache
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Tue, 09 Apr 2024 21:27:51 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:27:50 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
server: AkamaiGHost
location: https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg
cache-control: max-age=0, no-cache
x-akamai-cache: Redirect from child
content-length: 0
expires: Tue, 09 Apr 2024 21:27:50 GMT

GET
H2

200

favicon.ico
www.dhlecommerce.nl/themes/custom/dp_theme/
Redirect Chain

https://www.dhlparcel.nl/themes/custom/dp_theme/favicon.ico
https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico

7 KB
2 KB

44ms
44ms

Other
image/vnd.microsoft.icon

2606:4700::6812:1ac4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico

Protocol

Server

2606:4700::6812:1ac4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6804c64aa3c5ed0b33ea0127c00d7d5af5bcca300162e009ce80de5032618cb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Apr 2024 21:27:51 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 08:02:34 GMT
server: cloudflare
age: 1089
etag: W/"1cee-614b3f21dba80"
vary: Accept-Encoding
content-type: image/vnd.microsoft.icon
content-encoding: br
cf-ray: 871d9564d8cb4c02-MIA

Redirect headers

date: Tue, 09 Apr 2024 21:27:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
vary: Accept-Encoding
location: https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico
cache-control: max-age=3600
cf-ray: 871d95647cfa749e-MIA
expires: Tue, 09 Apr 2024 22:27:51 GMT

GET
H2

200

freight-volvo-2-1592x896.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/
Redirect Chain

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg

171 KB
172 KB

86ms
85ms

Image
image/jpeg

2600:141b:1c00:16::17c4:322
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg

Protocol

Server

2600:141b:1c00:16::17c4:322 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f449ce762ddce439c1eeeb45cd4ef484fa90dd58e9de00d41d9e7953e211be11

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
date: Tue, 09 Apr 2024 21:27:54 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains
x-akamai-cache: Hit from child
content-length: 175534
pragma: no-cache
referrer-policy: same-origin
last-modified: Sat, 23 Mar 2024 18:59:34 GMT
etag: "2adae-614588a8efe8d"
x-frame-options: DENY
content-type: image/jpeg
cache-control: max-age=0, no-cache
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Tue, 09 Apr 2024 21:27:54 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:27:54 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
server: AkamaiGHost
location: https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg
cache-control: max-age=0, no-cache
x-akamai-cache: Redirect from child
content-length: 0
expires: Tue, 09 Apr 2024 21:27:54 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
khaine.nl/	1970-01-20 19:46:24	Name: 71fYEAvKeb6vAijYYu45s2PiemA Value: g63jDccXwwBABm3UZC-LyKaupZI
khaine.nl/	1970-01-20 19:46:24	Name: WcTR1E5DjC4f6fviLlMzgmEynMA Value: 1712698069
khaine.nl/	1970-01-20 19:46:24	Name: GWeyR4Jlaa8BMfsGXkxwptSR1GU Value: 1712784469
khaine.nl/	1970-01-20 19:46:24	Name: npZDxgyG6eU3OUqz2JEuzMulhRw Value: MJBADYVQS_LQB1W8Gt19vHnlX6Y
khaine.nl/	1970-01-20 19:46:24	Name: zQY9rNuAo7Z2n9AneiiluKjs_2U Value: Rp4CYg5lC58Di3o-QZVUfVSQMNw
.khaine.nl/	1970-01-21 04:30:34	Name: cf_clearance Value: c5D_BmpdXYzdM53C1aFdEMXj8P8XMLUdRsLw882JBEE-1712698069-1.0.1.1-Q2nYssbErgWIOTI8W7Y0uAzo0WODmQ8RDn9OK0KBNV50CFkocUck8xD299K.m3oqlM1XewmOHuKvLJpu.Gcq9Q
khaine.nl/	1970-01-20 19:46:24	Name: c1UvfvuQikR0pdNqbAazWODiLQA Value: 1712698069
khaine.nl/	1970-01-20 19:46:24	Name: nDu8_5HmiPw30l_AX_eP_GkA3mg Value: 1712784469
khaine.nl/	1970-01-20 19:46:24	Name: i2VaoqpqLV8sSWKL-L4l6JkhS3E Value: a-SSJyb6FZfYdqRfjQXk7jqdbXk
.dhlparcel.nl/	1969-12-31 23:59:59	Name: _cfuvid Value: qt2gAEffivmHN83mr048rpB25Us7fP3uo3MXh2IEh4U-1712698070442-0.0.1.1-604800000

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://khaine.nl/popouiyt/gyrfd.html Message: Failed to load resource: the server responded with a status of 503 ()
network	error	URL: https://khaine.nl/favicon.ico Message: Failed to load resource: the server responded with a status of 503 ()
other	warning	URL: https://khaine.nl/popouiyt/gyrfd.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
recommendation	verbose	URL: https://khaine.nl/popouiyt/gyrfd.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://khaine.nl/popouiyt/gyrfd.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.freebiesupply.com
code.jquery.com
group.dhl.com
khaine.nl
www.dhlecommerce.nl
www.dhlparcel.nl
www.dpdhl.com
104.131.67.145
172.67.202.5
2600:141b:1c00:16::17c4:322
2600:141b:1c00:1a8a::296d
2606:4700::6812:1ac4
2606:4700::6812:69e3
2a04:4e42:600::649
4f5cc35a16d97981a1bb5ee5649fb5b96af311ad1791f92fe8cf55b73738f46e
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
6804c64aa3c5ed0b33ea0127c00d7d5af5bcca300162e009ce80de5032618cb6
736e85b6a5214e90e34aff6811b89d65e4e19d640d18a14119f2bd893aa047fd
7c7556e8c2066fe885ed58e24601b25c82b747589dc17900051bc9cb98053329
7f8a7411080898c5e0e9a1b99c27c4c0951d558c6948a8f5cd712364f85e9bc7
9ecffc589fabf1eddb43842acfbff00c31fbf44245108bbbca289863af0b06c1
a62bf08fcdd300ef2c47e160b8d0a9f2dcb2fd9278af0a4e52cc716deb8a14c3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f449ce762ddce439c1eeeb45cd4ef484fa90dd58e9de00d41d9e7953e211be11

khaine.nl Open in urlscan Pro 172.67.202.5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

58 %HTTPS

71 %IPv6

7 Domains

7 Subdomains

5 IPs

1 Countries

393 kBTransfer

470 kBSize

10 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

10 Cookies

5 Console Messages

Security Headers

Indicators

khaine.nl Open in urlscan Pro
172.67.202.5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

58 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

5
IPs

1
Countries

393 kB
Transfer

470 kB
Size

10
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!