service-hand-dhl.com Open in urlscan Pro
103.11.190.155 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bit.ly/2Kaj2SQ
Effective URL:
http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/
Submission: On August 03 via api (August 3rd 2019, 8:48:56 am UTC) from BE

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 18 HTTP transactions. The main IP is 103.11.190.155, located in Singapore and belongs to VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG. The main domain is service-hand-dhl.com.

This is the only time service-hand-dhl.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	395224 (BITLY-AS) (BITLY-AS - Bitly Inc)
2	119.31.233.73 119.31.233.73	58621 (VODIEN-AS...) (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd)
1 1	2606:4700:20:... 2606:4700:20::6819:1715	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
11	103.11.190.155 103.11.190.155	58621 (VODIEN-AS...) (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd)
18	3

1 67.199.248.10 (United States) 1 redirects

ASN395224 (BITLY-AS - Bitly Inc, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 119.31.233.73 (Singapore)

ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG)
PTR: web138.vodien.com

nameofdhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::6819:1715 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

is.gd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 103.11.190.155 (Singapore)

ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG)
PTR: web107.vodien.com

service-hand-dhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	service-hand-dhl.com service-hand-dhl.com	365 KB
2	nameofdhl.com nameofdhl.com	3 MB
1	is.gd 1 redirects is.gd	337 B
1	bit.ly 1 redirects bit.ly	395 B
18	4

	Domain	Requested by
11	service-hand-dhl.com	service-hand-dhl.com
2	nameofdhl.com	nameofdhl.com
1	is.gd	1 redirects
1	bit.ly	1 redirects
18	4

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 1 frames:

Primary Page: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/
Frame ID: D30262E8AB4EFE6754F3817C75F237E6
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://bit.ly/2Kaj2SQ HTTP 301
http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/ Page URL
https://is.gd/3ENHK2 HTTP 301
http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

18
Requests

0 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

3106 kB
Transfer

3108 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bit.ly/2Kaj2SQ HTTP 301
http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/ Page URL
https://is.gd/3ENHK2 HTTP 301
http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://bit.ly/2Kaj2SQ HTTP 301
http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/

18 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/ Redirect Chain http://bit.ly/2Kaj2SQ http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/	554 B 681 B	1658ms 205ms	Document text/html	119.31.233.73 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Full URL http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/ Protocol HTTP/1.1 Server 119.31.233.73 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web138.vodien.com Software Apache / Resource Hash `7e14734e5ff91310b8f1dbf9634435213cb8d45e73e28b55e68366fecc440502` Request headers Host nameofdhl.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:38 GMT Server Apache Upgrade h2 Connection Upgrade, Keep-Alive Last-Modified Sat, 03 Aug 2019 03:44:05 GMT Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 371 Keep-Alive timeout=1, max=32 Content-Type text/html Redirect headers Server nginx Date Sat, 03 Aug 2019 08:48:37 GMT Content-Type text/html; charset=utf-8 Content-Length 161 Connection keep-alive Cache-Control private, max-age=90 Location http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/ Set-Cookie _bit=j738MB-ea63c5f80d3b893897-00n; Domain=bit.ly; Expires=Thu, 30 Jan 2020 08:48:37 GMT
GET H/1.1	200 OK	dribble_dhl_01.gif nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/images/	3 MB 3 MB	191ms 191ms	Image image/gif	119.31.233.73 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/images/dribble_dhl_01.gif Requested by Host: nameofdhl.com URL: http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/ Protocol HTTP/1.1 Security , , Server 119.31.233.73 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web138.vodien.com Software Apache / Resource Hash `3522cfdd78e07253a03280c62d99d241b45588b2bc2cd31427e452ca30fec2d3` Request headers Referer http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:38 GMT Last-Modified Wed, 31 Jul 2019 23:28:42 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=31 Content-Length 2805910
GET H/1.1	200 OK	Primary Request / Show response service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Redirect Chain https://is.gd/3ENHK2 http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/	8 KB 3 KB	1285ms 989ms	Document text/html	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `179c29c8472ea3301f5a3aa7340f350f61eb4935813a062056a82ec45740bcae` Request headers Host service-hand-dhl.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Referer http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/ Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Referer http://nameofdhl.com/348943N5049348DE4/SERVICE-EXPRESS/DHL6SEDE0343853KCJ/ Response headers Date Sat, 03 Aug 2019 08:48:45 GMT Server Apache Upgrade h2 Connection Upgrade, Keep-Alive Last-Modified Fri, 02 Aug 2019 02:44:28 GMT Accept-Ranges none Vary Accept-Encoding Content-Encoding gzip Content-Length 2668 Keep-Alive timeout=5, max=64 Content-Type text/html Redirect headers status 301 date Sat, 03 Aug 2019 08:48:45 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d732e074e763dfb877c1d1e68fd407bc51564822125; expires=Sun, 02-Aug-20 08:48:45 GMT; path=/; domain=.is.gd; HttpOnly; Secure location http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 500708c9bfb6c2ae-FRA
GET H/1.1	200 OK	dhl%20log.png service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	11 KB 11 KB	376ms 375ms	Image image/png	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/dhl%20log.png Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `a66000c1651aca6725f6042c8dbe8da7e896c13fcd68844250766383076ef269` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:46 GMT Last-Modified Wed, 31 Jul 2019 21:56:44 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=63 Content-Length 11114
GET H/1.1	200 OK	de997315-842a-4789-b076-0703749f270c.jpg service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	174 KB 174 KB	382ms 382ms	Image image/jpeg	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/de997315-842a-4789-b076-0703749f270c.jpg Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `017bcd16a103e293d7419f934d603c9e5082b7d5bcf576ef1329bd052d80bcf2` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:46 GMT Last-Modified Wed, 31 Jul 2019 21:58:00 GMT Server Apache Upgrade h2 Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/jpeg Keep-Alive timeout=5, max=64 Content-Length 177823
GET		blank.gif service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	0 0

GET		fer.png service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	0 0

GET		barre.png service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	0 0

GET		barie.png service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	0 0

GET H/1.1	200 OK	shape182692271.gif service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	3 KB 3 KB	665ms 308ms	Image image/gif	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/shape182692271.gif Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `0233b55985d8a6c0957c4318d71d073f20e59ef9d8d98f6a4adbf7caf3311754` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:46 GMT Last-Modified Thu, 01 Aug 2019 02:17:50 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=62 Content-Length 2672
GET H/1.1	200 OK	shape182720133.gif service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	2 KB 2 KB	3516ms 2387ms	Image image/gif	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/shape182720133.gif Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `55164e7912880ef7c90968c7a1f63af5688846d22d12a0fdcb25ee82ecbd210e` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:47 GMT Last-Modified Thu, 01 Aug 2019 02:17:50 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=63 Content-Length 1746
GET H/1.1	200 OK	gd.png service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	110 KB 110 KB	1427ms 759ms	Image image/png	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/gd.png Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `8e0e4a06e7b11d4249a1cc78b9ba31d3ed148cecd0fedfd1aeef2e6733635f99` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:47 GMT Last-Modified Wed, 31 Jul 2019 22:14:30 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=61 Content-Length 112397
GET H/1.1	200 OK	fry.png service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	18 KB 18 KB	4177ms 216ms	Image image/png	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/fry.png Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `d4efc40a7fb6c507c96d3f95f8a2ac5c0b3fae0db388aa33b487c0ce21855a4c` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:50 GMT Last-Modified Wed, 31 Jul 2019 22:17:52 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=60 Content-Length 18358
GET H/1.1	200 OK	1401983760942.jpg service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	39 KB 39 KB	3743ms 226ms	Image image/jpeg	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/1401983760942.jpg Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `a3574bd00c48e234757e7b3e5bcb221d44804992adda7c70b05c7e7d8b2cf32c` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:50 GMT Last-Modified Wed, 31 Jul 2019 22:20:10 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=62 Content-Length 40181
GET H/1.1	200 OK	arrow.gif service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	94 B 334 B	3959ms 214ms	Image image/gif	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/arrow.gif Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `4416e230b4085ddbf4422df832b85b4523436bd728e0ea4db4debce24adbbfaf` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:50 GMT Last-Modified Wed, 31 Jul 2019 21:59:00 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=61 Content-Length 94
GET H/1.1	200 OK	shape183918642.gif service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	3 KB 3 KB	4397ms 218ms	Image image/gif	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/shape183918642.gif Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `ce18740bd4386a35a49aeb1b5e3ff8bfd96f12eaeae12600372a60ebe4fc3113` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:50 GMT Last-Modified Thu, 01 Aug 2019 02:17:28 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=59 Content-Length 2634
GET H/1.1	200 OK	track.png service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	954 B 1 KB	4612ms 220ms	Image image/png	103.11.190.155 VODIEN-AS-AP-LOC2...
General Check archive.org Show headers Download Go to Show image Full URL http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/track.png Requested by Host: service-hand-dhl.com URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ Protocol HTTP/1.1 Security , , Server 103.11.190.155 , Singapore, ASN58621 (VODIEN-AS-AP-LOC2 Vodien Internet Solutions Pte Ltd, SG), Reverse DNS web107.vodien.com Software Apache / Resource Hash `61dff63a1d515c7eebad46c7eafa5a61ba14ceee2e0a0466dd4e970a2ed3b08b` Request headers Referer http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 03 Aug 2019 08:48:51 GMT Last-Modified Wed, 31 Jul 2019 22:42:44 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=58 Content-Length 954
GET		vfe.png service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: service-hand-dhl.com
URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/blank.gif

Domain: service-hand-dhl.com
URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/fer.png

Domain: service-hand-dhl.com
URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/barre.png

Domain: service-hand-dhl.com
URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/barie.png

Domain: service-hand-dhl.com
URL: http://service-hand-dhl.com/status-shipment-package/tracking-number/get-coste-package/express-sending/images/vfe.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
is.gd
nameofdhl.com
service-hand-dhl.com
service-hand-dhl.com
103.11.190.155
119.31.233.73
2606:4700:20::6819:1715
67.199.248.10
017bcd16a103e293d7419f934d603c9e5082b7d5bcf576ef1329bd052d80bcf2
0233b55985d8a6c0957c4318d71d073f20e59ef9d8d98f6a4adbf7caf3311754
179c29c8472ea3301f5a3aa7340f350f61eb4935813a062056a82ec45740bcae
3522cfdd78e07253a03280c62d99d241b45588b2bc2cd31427e452ca30fec2d3
4416e230b4085ddbf4422df832b85b4523436bd728e0ea4db4debce24adbbfaf
55164e7912880ef7c90968c7a1f63af5688846d22d12a0fdcb25ee82ecbd210e
61dff63a1d515c7eebad46c7eafa5a61ba14ceee2e0a0466dd4e970a2ed3b08b
7e14734e5ff91310b8f1dbf9634435213cb8d45e73e28b55e68366fecc440502
8e0e4a06e7b11d4249a1cc78b9ba31d3ed148cecd0fedfd1aeef2e6733635f99
a3574bd00c48e234757e7b3e5bcb221d44804992adda7c70b05c7e7d8b2cf32c
a66000c1651aca6725f6042c8dbe8da7e896c13fcd68844250766383076ef269
ce18740bd4386a35a49aeb1b5e3ff8bfd96f12eaeae12600372a60ebe4fc3113
d4efc40a7fb6c507c96d3f95f8a2ac5c0b3fae0db388aa33b487c0ce21855a4c

service-hand-dhl.com Open in urlscan Pro 103.11.190.155 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

0 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

3106 kBTransfer

3108 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

0 Cookies

Indicators

service-hand-dhl.com Open in urlscan Pro
103.11.190.155 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

0 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

3106 kB
Transfer

3108 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!