dhl-news.com Open in urlscan Pro
104.17.143.204 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Submission: On August 24 via api (August 24th 2023, 12:46:06 am UTC) from US — Scanned from US

Summary HTTP 15 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 104.17.143.204, located in and belongs to CLOUDFLARENET, US. The main domain is dhl-news.com.
TLS certificate: Issued by GTS CA 1P5 on July 22nd 2023. Valid for: 3 months.

This is the only time dhl-news.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 7	104.17.143.204 104.17.143.204	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2606:4700::68... 2606:4700::6811:1e3d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	3

7 104.17.143.204 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dhl-news.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6811:1e3d (United States)

ASN13335 (CLOUDFLARENET, US)

i.emlfiles.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	dhl-news.com 1 redirects dhl-news.com	11 KB
5	emlfiles.com i.emlfiles.com — Cisco Umbrella Rank: 95152	24 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 231	94 KB
15	3

	Domain	Requested by
7	dhl-news.com	1 redirects dhl-news.com
5	i.emlfiles.com	dhl-news.com
4	cdnjs.cloudflare.com	dhl-news.com
15	3

This site contains links to these domains. Also see Links.

Domain
www.dhl.com

Subject Issuer	Validity	Valid
dhl-news.com GTS CA 1P5	`2023-07-22` - `2023-10-20`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
i.emlfiles.com GTS CA 1P5	`2023-07-22` - `2023-10-20`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Frame ID: 87BD89EE1EFF1C338F9788220DD62AD5
Requests: 13 HTTP requests in this frame

Frame: https://dhl-news.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/313d8a27/invisible.js
Frame ID: E9DC123F7F9A2678C926D146392BFB4D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Unsubscribe

Detected technologies

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

\.aspx?(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

15
Requests

93 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

129 kB
Transfer

417 kB
Size

3
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://www.dhl.com/en/contact_center.html
Title: Contact Us

Search URL Search Domain Scan URL

URL: http://www.dhl.com/en/legal.html#privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://www.dhl.com/en/express.html
Title: Homepage

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12

https://dhl-news.com/cdn-cgi/challenge-platform/scripts/invisible.js HTTP 302
https://dhl-news.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/313d8a27/invisible.js

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request uns.aspx Show response
dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/ 9 KB
3 KB 853ms
502ms Document
text/html 104.17.143.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.143.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2d306de1b6c979c3ff0d7fd8bb045fb3aebe7876955638411f50636a1a56bdc3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7fb793699e6136b1-YYZ
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 24 Aug 2023 00:46:01 GMT
server: cloudflare

GET
H2 200 style.css
dhl-news.com/css/ 2 KB
990 B 323ms
321ms Stylesheet
text/css 104.17.143.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dhl-news.com/css/style.css
Requested by: Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.143.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 534a53b07a3a7b809d41c9ea6825f28bff6a880bef70e1ad6b40a4b6d7267843

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Wed, 16 Aug 2023 14:50:26 GMT
server: cloudflare
etag: W/"1d9d050fde8ecce"
vary: Accept-Encoding
content-type: text/css
cf-ray: 7fb7936ccad836b1-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 NewStyleBeta.css
dhl-news.com/css/ 11 KB
3 KB 338ms
337ms Stylesheet
text/css 104.17.143.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dhl-news.com/css/NewStyleBeta.css
Requested by: Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.143.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8176db7503729593d2c4f21dd198778970999f3bcffadc5044ecf32a76f476d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Wed, 16 Aug 2023 14:50:26 GMT
server: cloudflare
etag: W/"1d9d050fde8cede"
vary: Accept-Encoding
content-type: text/css
cf-ray: 7fb7936ccada36b1-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 268ms
33ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2438735
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27967
last-modified: Thu, 22 Jun 2023 11:06:06 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942b1e-6d3f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FVohjhzk%2FDEIWbH%2Bab0XFWyviXVVUnAGhJmMiZIY15zLuGUZGdfuph3P9kPYi56EX2IQCfNxe%2FPHt1OkiJzHX5eiKuSXOypqLmdCvzuBo24nuJ7ibFOQCECKCcMpWOjwDeYogGr47t%2FntYDtQd%2Bo4n54"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7fb7936e4c2c4bc9-BUF
expires: Tue, 13 Aug 2024 00:46:01 GMT

GET
H2 200 jquery-ui.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/ 248 KB
56 KB 272ms
36ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js

Requested by

Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

28ce75d953678c4942df47a11707a15e3c756021cf89090e3e6aa7ad6b6971c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2434361
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57152
last-modified: Thu, 22 Jun 2023 11:06:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942b1f-df40"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xVx3AwQQPh4HhhTObkawpCC%2Fcgp52E1HbOZMgyvbPBhA3%2BkjbQdOKQByfguEYBGy5QBW9UDbn4CIL67OChRqQwe1rb7wGVgjypetxyUiooG2nfO%2F%2Fky5VBCK8oq0t1BH6szk0uk1tDW9SPOd07pMlYfy"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7fb7936e4c2d4bc9-BUF
expires: Tue, 13 Aug 2024 00:46:01 GMT

GET
H2 200 3620131_shadowleft.png
i.emlfiles.com/cmpimg/9/2/7/7/1/files/ 2 KB
2 KB 338ms
229ms Image
image/png 2606:4700::6811:1e3d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.emlfiles.com/cmpimg/9/2/7/7/1/files/3620131_shadowleft.png
Requested by: Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:1e3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59a7427c031567615b1f8b8a7b4e60ec39dc98c3702e664733d4059242216450

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
x-amz-version-id: null
cf-cache-status: MISS
last-modified: Fri, 02 Aug 2013 09:46:01 GMT
server: cloudflare
x-amz-request-id: 8SD27VS4997Z4F11
etag: "522c6963a03225416527c194bcbaed10"
vary: Accept-Encoding
content-type: image/png
accept-ranges: bytes
cf-ray: 7fb7936fd8e44bcf-BUF
alt-svc: h3=":443"; ma=86400
content-length: 1738
x-amz-id-2: DhmSqvrUTFxAAoeq3qIH01MwxwK0PR5VvGvLvxHkF2+08rWswf/Zw9pZAxDMuh8BED0S6cLeX5o=

GET
H2 200 5041974_dhl_logo.png
i.emlfiles.com/cmpimg/9/2/7/7/1/files/ 1 KB
2 KB 342ms
233ms Image
image/png 2606:4700::6811:1e3d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.emlfiles.com/cmpimg/9/2/7/7/1/files/5041974_dhl_logo.png
Requested by: Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:1e3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0966917b398d714db1a57d6876ba69d752899f5575a1dc6badc010ef4407db2a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
x-amz-version-id: null
cf-cache-status: MISS
last-modified: Tue, 29 Jul 2014 08:52:24 GMT
server: cloudflare
x-amz-request-id: 8SD9HXVQ7Z678XYM
etag: "670b3e8dd3ffb99be205299f3eb94936"
vary: Accept-Encoding
content-type: image/png
accept-ranges: bytes
cf-ray: 7fb7936fd8e54bcf-BUF
alt-svc: h3=":443"; ma=86400
content-length: 1458
x-amz-id-2: Oz8+uRf56zn+bWb1LTGsnljPkH0r55iKPhwNpxqeZpx+owSXtmpDrJxMLPLtzD6d2ltYCtkOgds=

GET
H3 200 spacer.gif
dhl-news.com/images/ 43 B
210 B 330ms
329ms Image
image/gif 104.17.143.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dhl-news.com/images/spacer.gif
Requested by: Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.143.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
cf-cache-status: REVALIDATED
last-modified: Wed, 16 Aug 2023 14:50:26 GMT
server: cloudflare
etag: "1d9d050fde8e52b"
vary: Accept-Encoding
content-type: image/gif
accept-ranges: bytes
cf-ray: 7fb7936f29e538e1-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43

GET
H2 200 jquery.validate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.3/ 24 KB
7 KB 34ms
33ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.19.3/jquery.validate.min.js

Requested by

Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c0cc637858d6503cba9262f8be75740c29e853605a153a7bde46a6e2e367eb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1962881
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6996
last-modified: Thu, 22 Jun 2023 11:06:02 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942b1a-1b54"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CeZbi5KsR%2FVUk%2B3U3w82pBF52AfxTGz709sGWo1IYzTDiJtj%2FyGglHQYowv9%2FWirniNRxMNM1RC447ChBEmi950CCItutlSA45IjeugF6PLEXWDxtUUrCGlPxYEyHcq8v6yksdmKD5C4duoAodPjsyqv"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7fb7936edc324bc9-BUF
expires: Tue, 13 Aug 2024 00:46:02 GMT

GET
H2 200 jquery.validate.unobtrusive.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-validation-unobtrusive/3.2.12/ 6 KB
2 KB 35ms
35ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-validation-unobtrusive/3.2.12/jquery.validate.unobtrusive.min.js

Requested by

Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1fc39d86f356a710875ddf4eb30f11ef23ac5a3f4240a183325ba361506c60cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1942960
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1951
last-modified: Thu, 22 Jun 2023 11:06:02 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942b1a-79f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sG0zeDyYRTeVAuDw5X7wE1rU645rcpk1Y85KKApCELek06%2Fxi7DWHvhqt9E1Hwbs1C62Up1EYOkvWrLqgRiEMBPaO3NSOdJvMA3z%2B9i9rheO6%2FW5MQSaw%2BfX6QwagWaCCWDHVYcNrkA8z7Zm9EUQMbOl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7fb7936eec344bc9-BUF
expires: Tue, 13 Aug 2024 00:46:02 GMT

GET
H2 200 3620135_3602259_bottomshadow.png
i.emlfiles.com/cmpimg/9/2/7/7/1/files/ 2 KB
2 KB 388ms
279ms Image
image/png 2606:4700::6811:1e3d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.emlfiles.com/cmpimg/9/2/7/7/1/files/3620135_3602259_bottomshadow.png
Requested by: Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:1e3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 981e0daef6b5540ce890a6aa9ecabb44b8f8cd126e09dda4c19f46442dea877d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
x-amz-version-id: null
cf-cache-status: MISS
last-modified: Fri, 02 Aug 2013 09:46:01 GMT
server: cloudflare
x-amz-request-id: 8SD631G94TZ96YR7
etag: "fe4c6be7b814bd8a8ba0287a158522dd"
vary: Accept-Encoding
content-type: image/png
accept-ranges: bytes
cf-ray: 7fb7936fd8e64bcf-BUF
alt-svc: h3=":443"; ma=86400
content-length: 2099
x-amz-id-2: dB141CIKnN9H2SD+OdFtTxmPikxHF3jUXYO0RFwF3AMuvcUeWdcJZ8uAX2SnbJbLqgU/kiEiKE4=

GET
H2 200 3625561_shadowrightwithoutgrey.png
i.emlfiles.com/cmpimg/9/8/8/8/7/files/ 4 KB
4 KB 348ms
239ms Image
image/png 2606:4700::6811:1e3d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.emlfiles.com/cmpimg/9/8/8/8/7/files/3625561_shadowrightwithoutgrey.png
Requested by: Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:1e3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbc753fb4b0813c902387bf6c96845df23943aa777ccc38dfb7f902967535d1d

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
x-amz-version-id: null
cf-cache-status: MISS
last-modified: Mon, 05 Aug 2013 10:50:19 GMT
server: cloudflare
x-amz-request-id: 8SDDP5170RQ9DZ72
etag: "84e5eeb70c0463bdc1e0cb10d679d75c"
vary: Accept-Encoding
content-type: image/png
accept-ranges: bytes
cf-ray: 7fb7936fd8e74bcf-BUF
alt-svc: h3=":443"; ma=86400
content-length: 3585
x-amz-id-2: RpE//J2m2sbH49QBWs7drr20VEEJia61h8kzN78MJg0jUTP8QwAN9PKqxhdm+KxM8r96r5gIFRs=

GET
H2 200 3625509_3548623_bgslice_03_withoutgrey.jpg
i.emlfiles.com/cmpimg/9/8/8/8/7/files/ 14 KB
15 KB 424ms
322ms Image
image/jpeg 2606:4700::6811:1e3d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.emlfiles.com/cmpimg/9/8/8/8/7/files/3625509_3548623_bgslice_03_withoutgrey.jpg
Requested by: Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:1e3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66b60e13bc01744f94cd2733d7dbc6fcc1c4c543e6e021a88c38e0699d3b11f7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://dhl-news.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
x-amz-version-id: null
cf-cache-status: MISS
last-modified: Mon, 05 Aug 2013 10:44:40 GMT
server: cloudflare
x-amz-request-id: 8SDD05VNZ610Z2XS
etag: "e1c54da85fba0bf6fff0af385ff3abe8"
vary: Accept-Encoding
content-type: image/jpeg
accept-ranges: bytes
cf-ray: 7fb7936fd8e84bcf-BUF
alt-svc: h3=":443"; ma=86400
content-length: 14750
x-amz-id-2: +vN/R3iFJu6Qj27LNsHH0RmuAaYOlKebWap9qeQn3qdNOTQ3NoykNXdqHH05PIuXlK168SLmnZ8=

GET
H3

200

invisible.js Show response
dhl-news.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/313d8a27/ Frame E9DC
Redirect Chain

https://dhl-news.com/cdn-cgi/challenge-platform/scripts/invisible.js
https://dhl-news.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/313d8a27/invisible.js

7 KB
4 KB

31ms
31ms

Script
application/javascript

104.17.143.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dhl-news.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/313d8a27/invisible.js

Requested by

Host: dhl-news.com
URL: https://dhl-news.com/9WA-7HLGX-F2511850E6167CB1R7X1LEEF19BF74D3837C3D/uns.aspx

Protocol

Server

104.17.143.204 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e08ae04d777c4fee94cd11433d2ac72c044afc9765bd3feb3afe334bd0c37eba

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 7fb7936f9a9238e1-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Thu, 24 Aug 2023 00:46:02 GMT
content-encoding: gzip
server: cloudflare
vary: accept-encoding
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/313d8a27/invisible.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 7fb7936f5a3338e1-YYZ
alt-svc: h3=":443"; ma=86400

POST
H3 200 7fb793699e6136b1 Show response
dhl-news.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame E9DC 0
290 B 43ms
42ms XHR
text/plain 104.17.143.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dhl-news.com/cdn-cgi/challenge-platform/h/g/cv/result/7fb793699e6136b1
Requested by: Host: dhl-news.com
URL: https://dhl-news.com/cdn-cgi/challenge-platform/scripts/invisible.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.143.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.110 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 24 Aug 2023 00:46:02 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 7fb79370bc3838e1-YYZ
alt-svc: h3=":443"; ma=86400
content-type: text/plain; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.dhl-news.com/	1970-01-20 14:13:59	Name: __cf_bm Value: 1XBeirBKgIvW3HrAXw5lWnpqUrzeRQ19HO2XjdJoBrc-1692837961-0-AWwrDBgDTT56mAXpfCfuB6N0XqhhGk52Mv8sQ3x8wSB6IBSk2146ANEjnSwoKtilDKEg2vOx6JG68JSFe82VY9Q=
dhl-news.com/	1970-01-20 14:15:20	Name: __cflb Value: 0H28vbka3Tp63XFuYsqHHrawjcNu2NcL3DzEk2j7saL
.dhl-news.com/	1970-01-20 22:59:33	Name: cf_clearance Value: qYZAGMP3bJK44aYfDL7qduJzXuMBF8fRE34_9uh45aA-1692837962-0-1-cfb52e89.8fa541a1.ae9248ab-0.2.1692837962

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
dhl-news.com
i.emlfiles.com
104.17.143.204
2606:4700::6811:190e
2606:4700::6811:1e3d
0966917b398d714db1a57d6876ba69d752899f5575a1dc6badc010ef4407db2a
1fc39d86f356a710875ddf4eb30f11ef23ac5a3f4240a183325ba361506c60cc
28ce75d953678c4942df47a11707a15e3c756021cf89090e3e6aa7ad6b6971c3
2d306de1b6c979c3ff0d7fd8bb045fb3aebe7876955638411f50636a1a56bdc3
4c0cc637858d6503cba9262f8be75740c29e853605a153a7bde46a6e2e367eb0
534a53b07a3a7b809d41c9ea6825f28bff6a880bef70e1ad6b40a4b6d7267843
59a7427c031567615b1f8b8a7b4e60ec39dc98c3702e664733d4059242216450
66b60e13bc01744f94cd2733d7dbc6fcc1c4c543e6e021a88c38e0699d3b11f7
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
981e0daef6b5540ce890a6aa9ecabb44b8f8cd126e09dda4c19f46442dea877d
bbc753fb4b0813c902387bf6c96845df23943aa777ccc38dfb7f902967535d1d
e08ae04d777c4fee94cd11433d2ac72c044afc9765bd3feb3afe334bd0c37eba
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8176db7503729593d2c4f21dd198778970999f3bcffadc5044ecf32a76f476d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

dhl-news.com Open in urlscan Pro 104.17.143.204 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

93 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

129 kBTransfer

417 kBSize

3 Cookies

3 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

3 Cookies

Indicators

dhl-news.com Open in urlscan Pro
104.17.143.204 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

93 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

129 kB
Transfer

417 kB
Size

3
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!