![](/screenshots/6ffc7b49-0606-44db-8c69-21ac9a34800f.png)
khaine.nl
Open in
urlscan Pro
172.67.202.5
Malicious Activity!
Public Scan
Effective URL: https://khaine.nl/popouiyt/gyrfd.html
Submission: On April 09 via api from US — Scanned from US
Summary
TLS certificate: Issued by E1 on March 25th 2024. Valid for: 3 months.
This is the only time khaine.nl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 9 | 172.67.202.5 172.67.202.5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
1 | 104.131.67.145 104.131.67.145 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
2 2 | 2606:4700::68... 2606:4700::6812:6ae3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6812:1ac4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 2 | 2600:141b:1c0... 2600:141b:1c00:1a81::296d | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2600:141b:1c0... 2600:141b:1c00:2e::17d1:48cb | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
14 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
khaine.nl
2 redirects
khaine.nl |
37 KB |
2 |
dhl.com
group.dhl.com |
262 KB |
2 |
dpdhl.com
2 redirects
www.dpdhl.com |
569 B |
2 |
dhlecommerce.nl
www.dhlecommerce.nl — Cisco Umbrella Rank: 531391 |
3 KB |
2 |
dhlparcel.nl
2 redirects
www.dhlparcel.nl — Cisco Umbrella Rank: 799771 |
465 B |
1 |
freebiesupply.com
cdn.freebiesupply.com — Cisco Umbrella Rank: 352681 |
45 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1217 |
33 KB |
14 | 7 |
Domain | Requested by | |
---|---|---|
9 | khaine.nl |
2 redirects
khaine.nl
|
2 | group.dhl.com |
khaine.nl
|
2 | www.dpdhl.com | 2 redirects |
2 | www.dhlecommerce.nl |
khaine.nl
|
2 | www.dhlparcel.nl | 2 redirects |
1 | cdn.freebiesupply.com |
khaine.nl
|
1 | code.jquery.com |
khaine.nl
|
14 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
khaine.nl E1 |
2024-03-25 - 2024-06-23 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
cdn.freebiesupply.com R3 |
2024-03-31 - 2024-06-29 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://khaine.nl/popouiyt/gyrfd.html
Frame ID: 968BA9C7E97716987B6FC7492E14233C
Requests: 10 HTTP requests in this frame
Frame:
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
Frame ID: 7E776164B6E79B649B0F7B7B6C8C0EC0
Requests: 2 HTTP requests in this frame
Frame:
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
Frame ID: 01CF6D18CF7748D0F5942F3D39536489
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/6ffc7b49-0606-44db-8c69-21ac9a34800f.png)
Page Title
DHL Express | Track ShipmentPage URL History Show full URLs
-
http://khaine.nl/popouiyt/gyrfd.html
HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
- https://khaine.nl/popouiyt/gyrfd.html Page URL
Detected technologies
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://khaine.nl/popouiyt/gyrfd.html
HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
- https://khaine.nl/popouiyt/gyrfd.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://khaine.nl/popouiyt/gyrfd.html HTTP 307
- https://khaine.nl/popouiyt/gyrfd.html
- https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
- https://www.dhlparcel.nl/themes/custom/dp_theme/images/logo.svg HTTP 301
- https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg
- https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg HTTP 301
- https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg
- https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
- https://www.dhlparcel.nl/themes/custom/dp_theme/favicon.ico HTTP 301
- https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico
- https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg HTTP 301
- https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
gyrfd.html
khaine.nl/popouiyt/ Redirect Chain
|
19 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
gyrfd.html
khaine.nl/popouiyt/ |
0 829 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/ Frame 7E77 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
khaine.nl/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
871d9d482d98b3ef
khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 7E77 |
0 581 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
gyrfd.html
khaine.nl/popouiyt/ |
18 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.1.min.js
code.jquery.com/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dhl-1-logo-png-transparent.png
cdn.freebiesupply.com/logos/large/2x/ |
45 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
www.dhlecommerce.nl/themes/custom/dp_theme/images/ Redirect Chain
|
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
freight-volvo-1-1592x896.web.796.448.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/ Redirect Chain
|
90 KB 90 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/ Frame 01CF Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
871d9d4e68d7b3ef
khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 01CF |
0 573 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
www.dhlecommerce.nl/themes/custom/dp_theme/ Redirect Chain
|
7 KB 2 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
freight-volvo-2-1592x896.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/ Redirect Chain
|
171 KB 172 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- khaine.nl
- URL
- https://khaine.nl/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery object| _0x2e40 function| _0x16cec4 object| images function| backgroundChanger function| _0x3146 number| count function| valDating object| erp string| em number| tmp11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
khaine.nl/ | Name: j4UIADP1WurOLmfI2cz1pd-_fzM Value: 2QtXF6RoXLtuzKoPa40Tyh07yKM |
|
khaine.nl/ | Name: _WaEoo0YFPFBwTJdnjzSlabkdro Value: 1712698386 |
|
khaine.nl/ | Name: FFlzY-hVjG45HYLrB_dkx4hIAL4 Value: 1712784786 |
|
khaine.nl/ | Name: pzVQXdamk2YfiiYHYoYL-6ktDWw Value: PyTVq0QqSOazFhelqOBWDgRNikA |
|
khaine.nl/ | Name: betf3UA0LgAkEm4Hz3hPBdfPsNk Value: O_SnJPkQ91FNT8stdSwkDZZ1Tfc |
|
khaine.nl/ | Name: mY-p-YLb0KPjZwH5cO0DfCeQ4-I Value: QTjoILgSpJae_P0Rvz1HjEd4ZxQ |
|
khaine.nl/ | Name: 1f2djwmkWFHtK9GRJ2kR-eVfDd4 Value: 1712698395 |
|
khaine.nl/ | Name: JqvEM716EqAfRur1OKv0iUYiVK0 Value: 1712784795 |
|
khaine.nl/ | Name: 7qsccyfGZUQFehpq0BUsBulEtkg Value: AKCSzlj4NlMNY7CObvNvdU1fuP0 |
|
.dhlparcel.nl/ | Name: _cfuvid Value: GHOxW1aanNN8GG5UtrPnGz99S4atw5Wt4Pn0kpeuNT8-1712698396309-0.0.1.1-604800000 |
|
.khaine.nl/ | Name: cf_clearance Value: hCuUSJDTN1a9iPR6Z76NRZ418y_ABDl_sdAZflNL7kc-1712698397-1.0.1.1-gB6PEwE1fK1sTYd1cjla5FCbiqXa4uEEjRcJu.Ar.2Hal1vKuX5wYP0L9mZyOHYJ3jJ_o3ATF91dbWGeU20L_g |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.freebiesupply.com
code.jquery.com
group.dhl.com
khaine.nl
www.dhlecommerce.nl
www.dhlparcel.nl
www.dpdhl.com
khaine.nl
104.131.67.145
172.67.202.5
2600:141b:1c00:1a81::296d
2600:141b:1c00:2e::17d1:48cb
2606:4700::6812:1ac4
2606:4700::6812:6ae3
2a04:4e42::649
4c491861545e37e837190fe94748bf13ee2cbbc9d36d8233c480bcfcda4b55a6
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
6804c64aa3c5ed0b33ea0127c00d7d5af5bcca300162e009ce80de5032618cb6
7f8a7411080898c5e0e9a1b99c27c4c0951d558c6948a8f5cd712364f85e9bc7
9ecffc589fabf1eddb43842acfbff00c31fbf44245108bbbca289863af0b06c1
a62bf08fcdd300ef2c47e160b8d0a9f2dcb2fd9278af0a4e52cc716deb8a14c3
c362ef85a0c27e82710cfb0c34487b8c70caf7c75e5e7974cdfb04ab3f5f4d22
c3ceef81f2bc803e0b42f8248ebf386e0c6ea1d6487e0844162795af9583ec99
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1018ed2d41fd0a1720daf786d1bce4695924c91db0161383158492e620a0a40
f449ce762ddce439c1eeeb45cd4ef484fa90dd58e9de00d41d9e7953e211be11