![](/screenshots/6611f9e7-b3f3-4482-a050-1137df787931.png)
dhl.guards-payment.online
Open in
urlscan Pro
185.106.93.21
Malicious Activity!
Public Scan
Effective URL: https://dhl.guards-payment.online/93895829847
Submission: On September 28 via api from IE — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 21st 2022. Valid for: 3 months.
This is the only time dhl.guards-payment.online was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 45.130.41.48 45.130.41.48 | 198610 (BEGET-AS) (BEGET-AS) | |
21 | 185.106.93.21 185.106.93.21 | 211409 (GALAXY-AS) (GALAXY-AS) | |
5 | 2a00:1450:400... 2a00:1450:400d:80d::2003 | 15169 (GOOGLE) (GOOGLE) | |
28 | 4 |
ASN211409 (GALAXY-AS, RU)
dhl.guards-payment.online |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
guards-payment.online
dhl.guards-payment.online |
676 KB |
5 |
gstatic.com
fonts.gstatic.com |
47 KB |
2 |
hide.su
1 redirects
hide.su |
609 B |
28 | 3 |
Domain | Requested by | |
---|---|---|
21 | dhl.guards-payment.online |
hide.su
dhl.guards-payment.online |
5 | fonts.gstatic.com | |
2 | hide.su | 1 redirects |
28 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
hide.su R3 |
2022-09-07 - 2022-12-06 |
3 months | crt.sh |
guards-payment.online R3 |
2022-09-21 - 2022-12-20 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-09-05 - 2022-11-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dhl.guards-payment.online/93895829847
Frame ID: 76777C6D4741D01CA3776512F762B5FE
Requests: 28 HTTP requests in this frame
Screenshot
![](/screenshots/6611f9e7-b3f3-4482-a050-1137df787931.png)
Page Title
Dámské lyže ElanPage URL History Show full URLs
- https://hide.su/lhqV/ Page URL
-
https://hide.su/lhqV/
HTTP 301
https://dhl.guards-payment.online/93895829847 Page URL
Detected technologies
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://hide.su/lhqV/ Page URL
-
https://hide.su/lhqV/
HTTP 301
https://dhl.guards-payment.online/93895829847 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
hide.su/lhqV/ |
274 B 408 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
93895829847
dhl.guards-payment.online/ Redirect Chain
|
28 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runtime.f840c88428174622.js
dhl.guards-payment.online/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfills.2ca2558b5505e406.js
dhl.guards-payment.online/ |
44 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.de300e680fc99604.js
dhl.guards-payment.online/ |
680 KB 174 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.319ec47afc3920b5.css
dhl.guards-payment.online/ |
221 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
order
dhl.guards-payment.online/api/93895829847/ |
847 B 793 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id
dhl.guards-payment.online/api/1474413/order/ |
856 B 756 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
54.aabcd248587c3bfd.js
dhl.guards-payment.online/ |
129 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
794.efbbd9bebbb7fa30.js
dhl.guards-payment.online/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
664.3619ba8cdfab3bdb.js
dhl.guards-payment.online/ |
23 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
86.0aa8dc169be6b701.js
dhl.guards-payment.online/ |
64 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
716.26935f154f3b0cd1.js
dhl.guards-payment.online/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
882.6378134f24099c3a.js
dhl.guards-payment.online/ |
2 MB 288 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
633.68bb816814dd6596.js
dhl.guards-payment.online/ |
46 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dhl-logo.svg
dhl.guards-payment.online/assets/img/platform/logo/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
matIcons.5e9662d3e238812b.woff2
dhl.guards-payment.online/ |
111 KB 111 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cs.json
dhl.guards-payment.online/assets/i18n/ |
13 KB 4 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
truck.svg
dhl.guards-payment.online/assets/img/ui-icon/ |
958 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v30/ |
11 KB 11 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOkCnqEu92Fr1Mu51xIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v30/ |
12 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fChc4AMP6lbBP.woff2
fonts.gstatic.com/s/roboto/v30/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOkCnqEu92Fr1Mu51xGIzIXKMnyrYk.woff2
fonts.gstatic.com/s/roboto/v30/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fABc4AMP6lbBP.woff2
fonts.gstatic.com/s/roboto/v30/ |
6 KB 6 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id
dhl.guards-payment.online/api/1474413/order/ |
856 B 756 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id
dhl.guards-payment.online/api/1474413/order/ |
856 B 756 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
id
dhl.guards-payment.online/api/1474413/order/ |
856 B 756 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
id
dhl.guards-payment.online/api/1474413/order/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- dhl.guards-payment.online
- URL
- https://dhl.guards-payment.online/api/1474413/order/id
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)148 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| webpackChunkangApp function| Zone function| __zone_symbol__Promise function| __zone_symbol__fetch function| __zone_symbol__legacyPatch function| __zone_symbol__queueMicrotask function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| __zone_symbol__ononabortpatched boolean| __zone_symbol__ononanimationendpatched boolean| __zone_symbol__ononanimationiterationpatched boolean| __zone_symbol__ononauxclickpatched boolean| __zone_symbol__ononbeforeinputpatched boolean| __zone_symbol__ononblurpatched boolean| __zone_symbol__ononcancelpatched boolean| __zone_symbol__ononcanplaypatched boolean| __zone_symbol__ononcanplaythroughpatched boolean| __zone_symbol__ononchangepatched boolean| __zone_symbol__ononcuechangepatched boolean| __zone_symbol__ononclickpatched boolean| __zone_symbol__ononclosepatched boolean| __zone_symbol__ononcontextmenupatched boolean| __zone_symbol__onondblclickpatched boolean| __zone_symbol__onondragpatched boolean| __zone_symbol__onondragendpatched boolean| __zone_symbol__onondragenterpatched boolean| __zone_symbol__onondragleavepatched boolean| __zone_symbol__onondragoverpatched boolean| __zone_symbol__onondroppatched boolean| __zone_symbol__onondurationchangepatched boolean| __zone_symbol__ononemptiedpatched boolean| __zone_symbol__ononendedpatched boolean| __zone_symbol__ononerrorpatched boolean| __zone_symbol__ononfocuspatched boolean| __zone_symbol__onongotpointercapturepatched boolean| __zone_symbol__ononinputpatched boolean| __zone_symbol__ononinvalidpatched boolean| __zone_symbol__ononkeydownpatched boolean| __zone_symbol__ononkeypresspatched boolean| __zone_symbol__ononkeyuppatched boolean| __zone_symbol__ononloadpatched boolean| __zone_symbol__ononloadstartpatched boolean| __zone_symbol__ononloadeddatapatched boolean| __zone_symbol__ononloadedmetadatapatched boolean| __zone_symbol__ononlostpointercapturepatched boolean| __zone_symbol__ononmousedownpatched boolean| __zone_symbol__ononmouseenterpatched boolean| __zone_symbol__ononmouseleavepatched boolean| __zone_symbol__ononmousemovepatched boolean| __zone_symbol__ononmouseoutpatched boolean| __zone_symbol__ononmouseoverpatched boolean| __zone_symbol__ononmouseuppatched boolean| __zone_symbol__ononmousewheelpatched boolean| __zone_symbol__ononpausepatched boolean| __zone_symbol__ononplaypatched boolean| __zone_symbol__ononplayingpatched boolean| __zone_symbol__ononpointercancelpatched boolean| __zone_symbol__ononpointerdownpatched boolean| __zone_symbol__ononpointerenterpatched boolean| __zone_symbol__ononpointerleavepatched boolean| __zone_symbol__ononpointermovepatched boolean| __zone_symbol__ononpointeroverpatched boolean| __zone_symbol__ononpointeruppatched boolean| __zone_symbol__ononprogresspatched boolean| __zone_symbol__ononratechangepatched boolean| __zone_symbol__ononresetpatched boolean| __zone_symbol__ononresizepatched boolean| __zone_symbol__ononscrollpatched boolean| __zone_symbol__ononseekedpatched boolean| __zone_symbol__ononseekingpatched boolean| __zone_symbol__ononselectpatched boolean| __zone_symbol__ononselectionchangepatched boolean| __zone_symbol__ononselectstartpatched boolean| __zone_symbol__ononstalledpatched boolean| __zone_symbol__ononsubmitpatched boolean| __zone_symbol__ononsuspendpatched boolean| __zone_symbol__onontimeupdatepatched boolean| __zone_symbol__ononvolumechangepatched boolean| __zone_symbol__onontransitioncancelpatched boolean| __zone_symbol__onontransitionendpatched boolean| __zone_symbol__ononwaitingpatched boolean| __zone_symbol__ononwheelpatched boolean| __zone_symbol__onontogglepatched boolean| __zone_symbol__ononafterprintpatched boolean| __zone_symbol__ononappinstalledpatched boolean| __zone_symbol__ononbeforeinstallpromptpatched boolean| __zone_symbol__ononbeforeprintpatched boolean| __zone_symbol__ononbeforeunloadpatched boolean| __zone_symbol__onondevicemotionpatched boolean| __zone_symbol__onondeviceorientationpatched boolean| __zone_symbol__onondeviceorientationabsolutepatched boolean| __zone_symbol__ononhashchangepatched boolean| __zone_symbol__ononlanguagechangepatched boolean| __zone_symbol__ononmessagepatched boolean| __zone_symbol__ononofflinepatched boolean| __zone_symbol__onononlinepatched boolean| __zone_symbol__ononpageshowpatched boolean| __zone_symbol__ononpagehidepatched boolean| __zone_symbol__ononpopstatepatched boolean| __zone_symbol__ononrejectionhandledpatched boolean| __zone_symbol__ononstoragepatched boolean| __zone_symbol__ononunhandledrejectionpatched boolean| __zone_symbol__ononunloadpatched boolean| __zone_symbol__onondragstartpatched boolean| __zone_symbol__ononanimationstartpatched boolean| __zone_symbol__ononsearchpatched boolean| __zone_symbol__onontransitionrunpatched boolean| __zone_symbol__onontransitionstartpatched boolean| __zone_symbol__ononwebkitanimationendpatched boolean| __zone_symbol__ononwebkitanimationiterationpatched boolean| __zone_symbol__ononwebkitanimationstartpatched boolean| __zone_symbol__ononwebkittransitionendpatched boolean| __zone_symbol__ononpointeroutpatched boolean| __zone_symbol__ononmessageerrorpatched object| __zone_symbol__popstatefalse object| __zone_symbol__hashchangefalse function| getAngularTestability function| getAllAngularTestabilities function| getAllAngularRootElements object| frameworkStabilizers function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener undefined| __zone_symbol__eventListeners undefined| __zone_symbol__removeAllListeners function| eventListeners function| removeAllListeners2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
hide.su/ | Name: beget Value: begetok |
|
dhl.guards-payment.online/ | Name: PHPSESSID Value: 36oequmtr7goo3cgedtpuvpfq3 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dhl.guards-payment.online
fonts.gstatic.com
hide.su
dhl.guards-payment.online
185.106.93.21
2a00:1450:400d:80d::2003
45.130.41.48
06ca34565e1f1ebe2df31c8833af58b84baeb39d7d2aaa690bbbda09816cbd94
16dd5567cbd4864357a7ee63c60b8ef9371584a91e1a5104e6cc6848afd2a449
1af0ee2e409d753adfedb8a11628be961881ad5139d1a9252fcc4984cbce5f2d
1f022168898019f8d77c58c7c02ef81750c89b709a3e3899552c1186db8e9962
21deba9ebcf707d3cbeeea7f6c1dbaf4684b62a82b68afb9e0cf6c6da16b055d
2ba6d2f2114b677353c5218767c0a4116775f60b710dbf50629c1fb8417f0f78
2d16ea91c32da144c6f27fd839caae52a983e385c570745f9aea4563b1053c04
3a6dbdffa7fa5a7e83730be473133b9d9106e5714aede8dd00ec2915c4674e81
3bfe439aa263424b5868cf77b1e06c1c510599560e7c36c2a22c6bd7a70526ad
49835b21c59b0d0202afd8ab92073d237ed60dea3dfc2dafd55b0fe23045b0e6
58e5fbaae96096f0ee474748fe07971413de47c12453a9f270884f560868bca3
6a793f006d9a4daa9706084460a9891347404fb5735a1689159c8d0ecc6d3840
8bc9bd9ed384ad7138a9fa6d997f66706e5a1aaf46094e830517b36417d77d91
8c049e3780896a1b203420df7dba08c39243e07ef7e73b0cb41df5da3a3f3cf3
8d3251f4935896ec37ada153d20d0109828ad08523127f136415355b3fca2dcf
92be951ea4e3a6d9c1dc24f0221adafae03327e22d6ef369c4c929dec4d26b72
94ac6fbddd91a662fba478cb61402bea83775909969355a5874d2f4fa1802fbd
95aecfa41fc5cc8287943526f51882cdfeeca2c815ecd42860a0b63e72371f37
bd920e994810112e2032ce1098a2e0c18a04d056d63cfc678b42bca8e94be513
c09a84facb18c8c3c2f939b8ee527577011d3b00426ff8ef46fa479df45b44af
c542e53f0ef4736fd9872c5c189eb8163d40cf9fb98ab71ef7812bb7da4cbab4
db7cfb34c6809fac119d8ad660cbd4ad86df770dc254511ffc2c2a83a4836f15
e5eee3b57a8f0e4f2383e3022e2493857c733a636f9e843277c695b96b751ab5
e7ff393b97229aad5ec38ed2dfbf10eabd2636fdbe150a6eb3185ba7111739d6
ea96b696d6b2c2273074089ff8adb43d14ea5718983e3b6c36f2fd5e53bbd9b5
f97b8511ea69c213549f2e1c1df26d81522304528335fb08c790071424cb4aba