livraison.skoa.li Open in urlscan Pro
2.56.247.11 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://livraison.skoa.li/
Effective URL:
https://livraison.skoa.li/dhl/info.php
Submission: On January 17 via automatic, source certstream-suspicious (January 17th 2023, 11:56:52 pm UTC) — Scanned from FR

Summary HTTP 15 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 15 HTTP transactions. The main IP is 2.56.247.11, located in Nanterre, France and belongs to SAPINET-AS, FR. The main domain is livraison.skoa.li.
TLS certificate: Issued by R3 on January 17th 2023. Valid for: 3 months.

This is the only time livraison.skoa.li was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
2 15	2.56.247.11 2.56.247.11	39421 (SAPINET-AS) (SAPINET-AS)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:806::2003	15169 (GOOGLE) (GOOGLE)
15	3

15 2.56.247.11 (Nanterre, France) 2 redirects

ASN39421 (SAPINET-AS, FR)
PTR: plesk.skoali.com

livraison.skoa.li	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:806::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	skoa.li 2 redirects livraison.skoa.li	105 KB
1	gstatic.com www.gstatic.com	2 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	1 KB
15	3

	Domain	Requested by
15	livraison.skoa.li	2 redirects livraison.skoa.li
1	www.gstatic.com	livraison.skoa.li
1	fonts.googleapis.com	livraison.skoa.li
15	3

This site contains links to these domains. Also see Links.

Domain
secure.address.check.ixwebhosting.com.cn

Subject Issuer	Validity	Valid
livraison.skoa.li R3	`2023-01-17` - `2023-04-17`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-02` - `2023-03-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-12-12` - `2023-03-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://livraison.skoa.li/dhl/info.php
Frame ID: 7D4B238D58AD8DDB279CA6508B0ECA78
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Erhalt einer Sendung | DHL Express | Adressbestätigung

Page URL History Show full URLs

https://livraison.skoa.li/ HTTP 302
https://livraison.skoa.li/dhl/ HTTP 302
https://livraison.skoa.li/dhl/info.php Page URL

Detected technologies

Cart Functionality (Ecommerce) Expand

Overall confidence: 100%
Detected patterns

<a[^>]*href=[^>]*/Checkout

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

108 kB
Transfer

438 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://secure.address.check.ixwebhosting.com.cn/delivery/checkout/receive?user_id=019849162748

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://livraison.skoa.li/ HTTP 302
https://livraison.skoa.li/dhl/ HTTP 302
https://livraison.skoa.li/dhl/info.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request info.php Show response
livraison.skoa.li/dhl/
Redirect Chain

https://livraison.skoa.li/
https://livraison.skoa.li/dhl/
https://livraison.skoa.li/dhl/info.php

29 KB
6 KB

360ms
359ms

Document
text/html

2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PHP/8.1.14 PleskLin

Resource Hash

6925b5ef815afe857f55824f4b6f5839a9caf97c83c3aeb84cd83e539cb0832d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language: fr-FR,fr;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 6200
content-type: text/html; charset=UTF-8
date: Tue, 17 Jan 2023 23:56:47 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=15768000; includeSubDomains
vary: Accept-Encoding
x-powered-by: PHP/8.1.14 PleskLin

Redirect headers

content-type: text/html; charset=UTF-8
date: Tue, 17 Jan 2023 23:56:47 GMT
location: info.php
server: nginx
strict-transport-security: max-age=15768000; includeSubDomains
x-powered-by: PHP/8.1.14 PleskLin

GET
H2 200 bootstrap.min.css
livraison.skoa.li/dhl/files/no1/ 159 KB
20 KB 114ms
113ms Stylesheet
text/css 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/files/no1/bootstrap.min.css

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PleskLin

Resource Hash

b0071cd7ccef32768966b353e2ff09d13e07ab31148944e5545803232c2341e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://livraison.skoa.li/dhl/info.php
Origin: https://livraison.skoa.li
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br
last-modified: Tue, 17 Jan 2023 23:48:43 GMT
server: nginx
etag: W/"63c733db-27bcc"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 font-awesome.min.css
livraison.skoa.li/dhl/files/no1/ 30 KB
7 KB 47ms
46ms Stylesheet
text/css 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/files/no1/font-awesome.min.css

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PleskLin

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://livraison.skoa.li/dhl/info.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br
last-modified: Tue, 17 Jan 2023 23:48:47 GMT
server: nginx
etag: W/"63c733df-7918"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 jquery-1.11.1.min.js.t%C3%A9l%C3%A9chargement Show response
livraison.skoa.li/dhl/files/no1/ 94 KB
32 KB 80ms
79ms Script
application/javascript 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/files/no1/jquery-1.11.1.min.js.t%C3%A9l%C3%A9chargement

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PleskLin

Resource Hash

540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://livraison.skoa.li/dhl/info.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br
last-modified: Tue, 17 Jan 2023 23:48:48 GMT
server: nginx
etag: W/"63c733e0-1762a"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 core.css
livraison.skoa.li/dhl/files/no1/ 4 KB
1 KB 50ms
49ms Stylesheet
text/css 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/files/no1/core.css

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PleskLin

Resource Hash

eee29e4819608a72d1c3918d82f94381b0cf5cf348e0f47e9e03aa701374b8ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://livraison.skoa.li/dhl/info.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br
last-modified: Tue, 17 Jan 2023 23:48:45 GMT
server: nginx
etag: W/"63c733dd-10ee"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 translateelement.css
livraison.skoa.li/dhl/files/no1/ 18 KB
3 KB 114ms
113ms Stylesheet
text/css 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/files/no1/translateelement.css

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PleskLin

Resource Hash

5d0a6e3bc914db376bf187c380750b197c317e1bf40fab9ad959ad5facd8f9ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://livraison.skoa.li/dhl/info.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br
last-modified: Tue, 17 Jan 2023 23:48:49 GMT
server: nginx
etag: W/"63c733e1-4924"
x-powered-by: PleskLin
content-type: text/css

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
1 KB 91ms
34ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Mulish:wght@200;300;400;500;600;700;800;900&display=swa

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

69e6a6a8afbb574449299879548ab2847e112efe7e247392d764dd4e02702503

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://livraison.skoa.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 17 Jan 2023 23:56:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 17 Jan 2023 23:21:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 17 Jan 2023 23:56:47 GMT

GET
H2 200 dhl-logo.png
livraison.skoa.li/dhl/files/no1/ 8 KB
8 KB 118ms
117ms Image
image/png 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://livraison.skoa.li/dhl/files/no1/dhl-logo.png

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PleskLin

Resource Hash

d7795b6034cbc93fc0632df895294a248644faa373ff8654553f81c137972ae8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://livraison.skoa.li/dhl/info.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
last-modified: Tue, 17 Jan 2023 23:48:46 GMT
server: nginx
etag: "63c733de-2079"
x-powered-by: PleskLin
content-type: image/png
accept-ranges: bytes
content-length: 8313

GET
H2 200 1625790534535.png
livraison.skoa.li/dhl/files/no1/ 4 KB
4 KB 100ms
100ms Image
image/png 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://livraison.skoa.li/dhl/files/no1/1625790534535.png

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PleskLin

Resource Hash

5c4b801e60c49235941cfc562ed465a951c937c668db31e3c1ba152513c672d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://livraison.skoa.li/dhl/info.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
last-modified: Tue, 17 Jan 2023 23:48:40 GMT
server: nginx
etag: "63c733d8-f26"
x-powered-by: PleskLin
content-type: image/png
accept-ranges: bytes
content-length: 3878

GET
H2 200 bootstrap.bundle.min.js.t%C3%A9l%C3%A9chargement Show response
livraison.skoa.li/dhl/files/no1/ 77 KB
21 KB 117ms
116ms Script
application/javascript 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/files/no1/bootstrap.bundle.min.js.t%C3%A9l%C3%A9chargement

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PleskLin

Resource Hash

e5a12b84f9543d5ba3231837c2f2467563405aa66a582b6fc400985f85df49ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://livraison.skoa.li/dhl/info.php
Origin: https://livraison.skoa.li
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br
last-modified: Tue, 17 Jan 2023 23:48:42 GMT
server: nginx
etag: W/"63c733da-13417"
x-powered-by: PleskLin
content-type: application/javascript

GET
H2 200 translate_24dp.png
livraison.skoa.li/dhl/files/no1/ 846 B
1 KB 99ms
99ms Image
image/png 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://livraison.skoa.li/dhl/files/no1/translate_24dp.png

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/info.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx / PleskLin

Resource Hash

5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://livraison.skoa.li/dhl/info.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
last-modified: Tue, 17 Jan 2023 23:48:50 GMT
server: nginx
x-accel-version: 0.01
etag: "34e-5f27e5776426c"
x-powered-by: PleskLin
content-type: image/png
accept-ranges: bytes
content-length: 846

GET
H2 404 fontawesome-webfont.woff2
livraison.skoa.li/dhl/files/fonts/ 0
0 38ms
37ms Font
text/html 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/files/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/files/no1/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://livraison.skoa.li/dhl/files/no1/font-awesome.min.css
Origin: https://livraison.skoa.li
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br
last-modified: Sun, 15 Jan 2023 00:44:10 GMT
server: nginx
etag: W/"328-5f242c3d429d5"
content-type: text/html

GET
H2 200 translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 2 KB
2 KB 136ms
38ms Image
image/png 2a00:1450:400d:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/branding/product/2x/translate_24dp.png

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/files/no1/translateelement.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:806::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: fr-FR,fr;q=0.9
Referer: https://livraison.skoa.li/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:53:19 GMT
x-content-type-options: nosniff
age: 209
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1842
x-xss-protection: 0
last-modified: Thu, 14 Oct 2021 09:08:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 17 Jan 2024 23:53:19 GMT

GET
H2 404 fontawesome-webfont.woff
livraison.skoa.li/dhl/files/fonts/ 0
0 38ms
38ms Font
text/html 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/files/fonts/fontawesome-webfont.woff?v=4.7.0

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/files/no1/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://livraison.skoa.li/dhl/files/no1/font-awesome.min.css
Origin: https://livraison.skoa.li
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:47 GMT
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br
last-modified: Sun, 15 Jan 2023 00:44:10 GMT
server: nginx
etag: W/"328-5f242c3d429d5"
content-type: text/html

GET
H2 404 fontawesome-webfont.ttf
livraison.skoa.li/dhl/files/fonts/ 0
0 38ms
38ms Font
text/html 2.56.247.11
SAPINET-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://livraison.skoa.li/dhl/files/fonts/fontawesome-webfont.ttf?v=4.7.0

Requested by

Host: livraison.skoa.li
URL: https://livraison.skoa.li/dhl/files/no1/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.56.247.11 Nanterre, France, ASN39421 (SAPINET-AS, FR),

Reverse DNS

plesk.skoali.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Request headers

Referer: https://livraison.skoa.li/dhl/files/no1/font-awesome.min.css
Origin: https://livraison.skoa.li
accept-language: fr-FR,fr;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date: Tue, 17 Jan 2023 23:56:48 GMT
strict-transport-security: max-age=15768000; includeSubDomains
content-encoding: br
last-modified: Sun, 15 Jan 2023 00:44:10 GMT
server: nginx
etag: W/"328-5f242c3d429d5"
content-type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			livraison.skoa.li/	1969-12-31 23:59:59	Name: PHPSESSID Value: kkv1iksjrcqelpj1nhvc3nk05o

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://livraison.skoa.li/dhl/files/fonts/fontawesome-webfont.woff2?v=4.7.0 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://livraison.skoa.li/dhl/files/fonts/fontawesome-webfont.woff?v=4.7.0 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://livraison.skoa.li/dhl/files/fonts/fontawesome-webfont.ttf?v=4.7.0 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
livraison.skoa.li
www.gstatic.com
2.56.247.11
2a00:1450:4001:80b::200a
2a00:1450:400d:806::2003
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99
5c4b801e60c49235941cfc562ed465a951c937c668db31e3c1ba152513c672d3
5d0a6e3bc914db376bf187c380750b197c317e1bf40fab9ad959ad5facd8f9ed
6925b5ef815afe857f55824f4b6f5839a9caf97c83c3aeb84cd83e539cb0832d
69e6a6a8afbb574449299879548ab2847e112efe7e247392d764dd4e02702503
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
b0071cd7ccef32768966b353e2ff09d13e07ab31148944e5545803232c2341e9
d7795b6034cbc93fc0632df895294a248644faa373ff8654553f81c137972ae8
e5a12b84f9543d5ba3231837c2f2467563405aa66a582b6fc400985f85df49ad
eee29e4819608a72d1c3918d82f94381b0cf5cf348e0f47e9e03aa701374b8ea

livraison.skoa.li Open in urlscan Pro 2.56.247.11 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

108 kBTransfer

438 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

3 Console Messages

Security Headers

Indicators

livraison.skoa.li Open in urlscan Pro
2.56.247.11 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

108 kB
Transfer

438 kB
Size

1
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!