![](/screenshots/459df67e-9f5a-4d44-ab5b-4daa91752f7b.png)
dovidschick.com
Open in
urlscan Pro
34.86.145.60
Malicious Activity!
Public Scan
Effective URL: https://dovidschick.com/wp-content/rrr/access.php?id=8f6f1d2dd422c9-13da07bc-d47168da-d6a00a787fb679
Submission: On March 23 via automatic, source certstream-suspicious — Scanned from ES
Summary
TLS certificate: Issued by R3 on March 10th 2022. Valid for: 3 months.
This is the only time dovidschick.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 192.64.117.200 192.64.117.200 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 10 | 34.86.145.60 34.86.145.60 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a06:98c1:312... 2a06:98c1:3121::7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6810:7daf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:82b::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:803::2003 | 15169 (GOOGLE) (GOOGLE) | |
15 | 6 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server304-1.web-hosting.com
www.dhl-es.paquete-com.online |
ASN15169 (GOOGLE, US)
PTR: 60.145.86.34.bc.googleusercontent.com
dovidschick.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
dovidschick.com
1 redirects
dovidschick.com |
151 KB |
2 |
unpkg.com
unpkg.com — Cisco Umbrella Rank: 821 |
6 KB |
1 |
gstatic.com
fonts.gstatic.com |
26 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 194 |
28 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35 |
966 B |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 828 |
12 KB |
1 |
paquete-com.online
1 redirects
www.dhl-es.paquete-com.online |
229 B |
15 | 7 |
Domain | Requested by | |
---|---|---|
10 | dovidschick.com |
1 redirects
dovidschick.com
cdnjs.cloudflare.com |
2 | unpkg.com |
dovidschick.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | cdnjs.cloudflare.com |
dovidschick.com
|
1 | fonts.googleapis.com |
dovidschick.com
|
1 | use.fontawesome.com |
dovidschick.com
|
1 | www.dhl-es.paquete-com.online | 1 redirects |
15 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dovidschick.com R3 |
2022-03-10 - 2022-06-08 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-07 - 2022-07-06 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-02-28 - 2022-05-23 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-03-17 - 2022-06-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dovidschick.com/wp-content/rrr/access.php?id=8f6f1d2dd422c9-13da07bc-d47168da-d6a00a787fb679
Frame ID: EAE728477AC3BA36F051250F2260098B
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/459df67e-9f5a-4d44-ab5b-4daa91752f7b.png)
Page Title
Support ChatPage URL History Show full URLs
-
https://www.dhl-es.paquete-com.online/
HTTP 302
https://dovidschick.com/wp-content/rrr/ HTTP 302
https://dovidschick.com/wp-content/rrr/access.php?id=8f6f1d2dd422c9-13da07bc-d47168da-d6a00a787fb679 Page URL
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Pure CSS.png)
Detected patterns
- <link[^>]+(?:([\d.])+/)?pure(?:-min)?\.css
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.dhl-es.paquete-com.online/
HTTP 302
https://dovidschick.com/wp-content/rrr/ HTTP 302
https://dovidschick.com/wp-content/rrr/access.php?id=8f6f1d2dd422c9-13da07bc-d47168da-d6a00a787fb679 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
access.php
dovidschick.com/wp-content/rrr/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
product.png
dovidschick.com/wp-content/rrr/images/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.7.2/css/ |
53 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pure-min.css
unpkg.com/purecss@1.0.0/build/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
grids-responsive-min.css
unpkg.com/purecss@1.0.0/build/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
2 KB 966 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
dovidschick.com/wp-content/rrr/css/ |
5 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
primarylogo.png
dovidschick.com/wp-content/rrr/images/ |
120 KB 120 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
thumb.png
dovidschick.com/wp-content/rrr/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ |
87 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.js
dovidschick.com/wp-content/rrr/js/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.js
dovidschick.com/wp-content/rrr/undefined/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
thumb.png
dovidschick.com/wp-content/rrr/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKtdSZaM9iE8KbpRA_hK1QN.woff2
fonts.gstatic.com/s/quicksand/v28/ |
25 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
thumb.png
dovidschick.com/wp-content/rrr/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| $ function| jQuery object| chatConfig function| loaderShow function| messageStart number| loadTime function| choose function| redirectThis function| showMessage function| scrollToBottom function| getUrlParameter object| prelander_script1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
dovidschick.com/ | Name: PHPSESSID Value: 495qs2jvavh8fdehkilo7coobt |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
dovidschick.com
fonts.googleapis.com
fonts.gstatic.com
unpkg.com
use.fontawesome.com
www.dhl-es.paquete-com.online
192.64.117.200
2606:4700::6810:135e
2606:4700::6810:7daf
2a00:1450:4001:803::2003
2a00:1450:4001:82b::200a
2a06:98c1:3121::7
34.86.145.60
1a77bc9cd8df8f7680ab07cf42d9aef3147f5c6fc7fe2050ccee4ea11b22c6cd
1de3dd7b0649cdb1f0734d75633fda4ab1d4b2cf10dbd485d3a8c0819da2af3c
434cc2ad4b3621f5d6631d2e30a25f1bddc2bc5ea8548236d70698b00578ffc4
619ae7019cfd0db4ba7554a24136a5172ff8e515d4c56ffb7139336bdc2966d1
62a9e74bf710eef13b81f56375fc7e24c8b91050fa9ba66a75e9a3f35aece8f5
7849b0c849bbd8755c9dd89e07ecaaeafe43658c31ec928d533a879fbd2f0946
9c099acc093abd2df85eaa34052ad36fe69b6ed16582c14aecd2928baa3b63bf
a141d0b2e12d03a1a871d6ed1f711551bc41d6a13f4fa2abbbd993122a864e9d
ae0ffdb320acadd5b5418933f679e32e5503b0973ba1649aaa371f6ffdc54ee5
aef79b40ccaf6c66e35d7a94fd17148c02429a48207b8b5300475e0e1520755e
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e