support-service-express-96166a.ingress-erytho.easywp.com Open in urlscan Pro
63.250.43.133  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request home.php Show response support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/	4 KB 2 KB	493ms 161ms	Document text/html	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash 979845f0a513ccb05e8ff42080132fae4bfef693e212a1819097e251109473a5 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority support-service-express-96166a.ingress-erytho.easywp.com :scheme https :path /dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx date Wed, 20 Oct 2021 22:30:47 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding x-frame-options SAMEORIGIN x-content-type-options nosniff x-xss-protection 1; mode=block cache-control public referrer-policy strict-origin-when-cross-origin content-encoding gzip x-cacheable YES age 9869 x-cache HIT accept-ranges bytes content-length 1814 strict-transport-security max-age=15768000
GET H2	200	style.css support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/	244 KB 73 KB	161ms 160ms	Stylesheet text/css	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/style.css Requested by Host: support-service-express-96166a.ingress-erytho.easywp.com URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash d79ec35dc8277aff48adaf9df3ddd5b3e18ac7013e8c374510624ae37cdfba31 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /dhl-t/dh/style.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority support-service-express-96166a.ingress-erytho.easywp.com referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 22:25:39 GMT content-encoding gzip x-content-type-options nosniff x-cacheable YES age 10177 x-cache HIT vary Accept-Encoding content-length 73698 x-xss-protection 1; mode=block last-modified Wed, 20 Oct 2021 10:32:33 GMT server nginx x-frame-options SAMEORIGIN etag W/"616ff041-3ce78" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type text/css cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	cc.css support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/	5 KB 2 KB	470ms 469ms	Stylesheet text/css	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/cc.css Requested by Host: support-service-express-96166a.ingress-erytho.easywp.com URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash c1bf237574102e2f75a34a4ab790747a8cc47b8da4f3ca7ae18e4a520ec76e2f Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /dhl-t/dh/cc.css pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority support-service-express-96166a.ingress-erytho.easywp.com referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 22:25:40 GMT content-encoding gzip x-content-type-options nosniff x-cacheable YES age 10177 x-cache HIT vary Accept-Encoding content-length 1542 x-xss-protection 1; mode=block last-modified Wed, 20 Oct 2021 10:32:33 GMT server nginx x-frame-options SAMEORIGIN etag W/"616ff041-15cf" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type text/css cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	lg.svg support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/	2 KB 1 KB	469ms 468ms	Image image/svg+xml	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/lg.svg Requested by Host: support-service-express-96166a.ingress-erytho.easywp.com URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /dhl-t/dh/lg.svg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority support-service-express-96166a.ingress-erytho.easywp.com referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 22:25:40 GMT content-encoding gzip x-content-type-options nosniff x-cacheable YES age 10176 x-cache HIT vary Accept-Encoding content-length 729 x-xss-protection 1; mode=block last-modified Wed, 20 Oct 2021 10:32:33 GMT server nginx x-frame-options SAMEORIGIN etag W/"616ff041-7f8" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type image/svg+xml cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	pub.jpg support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/	80 KB 81 KB	469ms 469ms	Image image/jpeg	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/pub.jpg Requested by Host: support-service-express-96166a.ingress-erytho.easywp.com URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /dhl-t/dh/pub.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority support-service-express-96166a.ingress-erytho.easywp.com referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 22:25:40 GMT x-content-type-options nosniff x-cacheable YES age 10176 x-cache HIT content-length 82133 x-xss-protection 1; mode=block last-modified Wed, 20 Oct 2021 10:32:33 GMT server nginx x-frame-options SAMEORIGIN etag "616ff041-140d5" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type image/jpeg cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	pubr.gif support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/	8 KB 9 KB	626ms 625ms	Image image/gif	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/pubr.gif Requested by Host: support-service-express-96166a.ingress-erytho.easywp.com URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash 38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6 Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /dhl-t/dh/pubr.gif pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority support-service-express-96166a.ingress-erytho.easywp.com referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 22:25:40 GMT x-content-type-options nosniff x-cacheable YES age 10176 x-cache HIT content-length 8344 x-xss-protection 1; mode=block last-modified Wed, 20 Oct 2021 10:32:33 GMT server nginx x-frame-options SAMEORIGIN etag "616ff041-2098" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type image/gif cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	imask.min.js Show response cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/	45 KB 11 KB	34ms 18ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/imask/3.4.0/imask.min.js Requested by Host: support-service-express-96166a.ingress-erytho.easywp.com URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://support-service-express-96166a.ingress-erytho.easywp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 21 Oct 2021 01:15:17 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 4860435 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 10899 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:11 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e9f-b217" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9hN6%2B1gNL3fwGCGCL7VTAK6rlNmKAdUB62SN4w9DDRb2n6%2BACZ9fqEJGqVcv6t2SJMPJ8cf8k1vHag%2FHgdWjTW62Wh3JtfpGc5H3UaVOd0WkWtAsSQdlOsO85wck4V8ftwlk6yAoDrEV%2FSBd40aXW0OC"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6a16a247bb4c698b-FRA expires Tue, 11 Oct 2022 01:15:17 GMT
GET H2	200	script.js Show response support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/	96 KB 38 KB	627ms 626ms	Script application/javascript	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/script.js Requested by Host: support-service-express-96166a.ingress-erytho.easywp.com URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash 4b29570ccd4eb182097a77750e4594c53b889aa7c606ffa0da191ea0bcc82fea Security Headers Name Value Strict-Transport-Security max-age=15768000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :path /dhl-t/dh/script.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority support-service-express-96166a.ingress-erytho.easywp.com referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 20 Oct 2021 22:25:40 GMT content-encoding gzip x-content-type-options nosniff x-cacheable YES age 10177 x-cache HIT vary Accept-Encoding content-length 37829 x-xss-protection 1; mode=block last-modified Wed, 20 Oct 2021 10:32:33 GMT server nginx x-frame-options SAMEORIGIN etag W/"616ff041-17e3b" strict-transport-security max-age=15768000 access-control-allow-methods GET, POST, OPTIONS, DELETE, PUT content-type application/javascript cache-control max-age=315360000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers User-Agent,Keep-Alive,Content-Type expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	404	style.js support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/	0 0	773ms 771ms	Script text/html	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/style.js Requested by Host: support-service-express-96166a.ingress-erytho.easywp.com URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers :path /dhl-t/dh/style.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority support-service-express-96166a.ingress-erytho.easywp.com referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 21 Oct 2021 01:15:17 GMT content-encoding gzip server nginx age 0 vary Accept-Encoding x-cache MISS content-type text/html strict-transport-security max-age=15768000
GET DATA	200 OK	truncated /	17 KB 17 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171 Request headers Referer Origin https://support-service-express-96166a.ingress-erytho.easywp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type application/font-woff2;charset=utf-8
GET H2	404	style.js support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/	0 0	159ms 159ms	Script text/html	63.250.43.133 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/style.js Requested by Host: support-service-express-96166a.ingress-erytho.easywp.com URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.250.43.133 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS ingress-erytho.easywp.com Software nginx / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers :path /dhl-t/dh/style.js pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority support-service-express-96166a.ingress-erytho.easywp.com referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/home.php?ip=51.68.59.201&countryCode=FR&OS=Windows%207 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 21 Oct 2021 01:15:17 GMT content-encoding gzip server nginx age 0 vary Accept-Encoding x-cache MISS content-type text/html strict-transport-security max-age=15768000

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| __core-js_shared__ object| core function| IMask function| onReady function| setVisible

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/style.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://support-service-express-96166a.ingress-erytho.easywp.com/dhl-t/dh/style.js Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
support-service-express-96166a.ingress-erytho.easywp.com
2606:4700::6810:125e
63.250.43.133
38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6
4b29570ccd4eb182097a77750e4594c53b889aa7c606ffa0da191ea0bcc82fea
79b6bfed5b8e93eafbc4b6cc1aeb1a66256446899c27bfb099fc336fb59d3171
8b76b3502583edddf22df0b9c6ee640053a2cdfeaa113ceff3ea9b61d1f6410d
979845f0a513ccb05e8ff42080132fae4bfef693e212a1819097e251109473a5
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
c1bf237574102e2f75a34a4ab790747a8cc47b8da4f3ca7ae18e4a520ec76e2f
d79ec35dc8277aff48adaf9df3ddd5b3e18ac7013e8c374510624ae37cdfba31
fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5