![](/screenshots/b669af16-d983-4352-9074-835304886d88.png)
khaine.nl
Open in
urlscan Pro
172.67.202.5
Malicious Activity!
Public Scan
Effective URL: https://khaine.nl/popouiyt/gyrfd.html
Submission: On April 09 via api from US — Scanned from US
Summary
TLS certificate: Issued by E1 on March 25th 2024. Valid for: 3 months.
This is the only time khaine.nl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 9 | 172.67.202.5 172.67.202.5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
1 | 104.131.67.145 104.131.67.145 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
2 2 | 2606:4700::68... 2606:4700::6812:6ae3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6812:1ac4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 2 | 2600:141b:1c0... 2600:141b:1c00:1a8a::296d | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2600:141b:1c0... 2600:141b:1c00:18::17c8:58ad | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
14 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
khaine.nl
2 redirects
khaine.nl |
55 KB |
2 |
dhl.com
group.dhl.com |
262 KB |
2 |
dpdhl.com
2 redirects
www.dpdhl.com |
569 B |
2 |
dhlecommerce.nl
www.dhlecommerce.nl — Cisco Umbrella Rank: 531391 |
3 KB |
2 |
dhlparcel.nl
2 redirects
www.dhlparcel.nl — Cisco Umbrella Rank: 799771 |
466 B |
1 |
freebiesupply.com
cdn.freebiesupply.com — Cisco Umbrella Rank: 352681 |
45 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1217 |
33 KB |
14 | 7 |
Domain | Requested by | |
---|---|---|
9 | khaine.nl |
2 redirects
khaine.nl
|
2 | group.dhl.com |
khaine.nl
|
2 | www.dpdhl.com | 2 redirects |
2 | www.dhlecommerce.nl |
khaine.nl
|
2 | www.dhlparcel.nl | 2 redirects |
1 | cdn.freebiesupply.com |
khaine.nl
|
1 | code.jquery.com |
khaine.nl
|
14 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
khaine.nl E1 |
2024-03-25 - 2024-06-23 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
cdn.freebiesupply.com R3 |
2024-03-31 - 2024-06-29 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://khaine.nl/popouiyt/gyrfd.html
Frame ID: D70C35D09E8FF8DE0884F2A59211A00A
Requests: 10 HTTP requests in this frame
Frame:
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
Frame ID: 17F4B16EE84FF5C417A6C7BF48ECA9F5
Requests: 2 HTTP requests in this frame
Frame:
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
Frame ID: 48458F736CD0BA247E91D96E68F14FA5
Requests: 2 HTTP requests in this frame
Screenshot
![](/screenshots/b669af16-d983-4352-9074-835304886d88.png)
Page Title
DHL Express | Track ShipmentPage URL History Show full URLs
-
http://khaine.nl/popouiyt/gyrfd.html
HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
- https://khaine.nl/popouiyt/gyrfd.html Page URL
Detected technologies
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://khaine.nl/popouiyt/gyrfd.html
HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
- https://khaine.nl/popouiyt/gyrfd.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://khaine.nl/popouiyt/gyrfd.html HTTP 307
- https://khaine.nl/popouiyt/gyrfd.html
- https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
- https://www.dhlparcel.nl/themes/custom/dp_theme/images/logo.svg HTTP 301
- https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg
- https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg HTTP 301
- https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg
- https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
- https://www.dhlparcel.nl/themes/custom/dp_theme/favicon.ico HTTP 301
- https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico
- https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg HTTP 301
- https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
gyrfd.html
khaine.nl/popouiyt/ Redirect Chain
|
19 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
gyrfd.html
khaine.nl/popouiyt/ |
0 826 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/ Frame 17F4 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
khaine.nl/ |
18 KB 18 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
871d94fd08ee7477
khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 17F4 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
gyrfd.html
khaine.nl/popouiyt/ |
18 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.11.1.min.js
code.jquery.com/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dhl-1-logo-png-transparent.png
cdn.freebiesupply.com/logos/large/2x/ |
45 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
www.dhlecommerce.nl/themes/custom/dp_theme/images/ Redirect Chain
|
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
freight-volvo-1-1592x896.web.796.448.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/ Redirect Chain
|
90 KB 90 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/ Frame 4845 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
871d950cc8037477
khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 4845 |
0 579 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
www.dhlecommerce.nl/themes/custom/dp_theme/ Redirect Chain
|
7 KB 2 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
freight-volvo-2-1592x896.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/ Redirect Chain
|
171 KB 172 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- khaine.nl
- URL
- https://khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/871d94fd08ee7477
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery object| _0x2e40 function| _0x16cec4 object| images function| backgroundChanger function| _0x3146 number| count function| valDating object| erp string| em number| tmp9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
khaine.nl/ | Name: WgMHMpyNaJQt8P0wwud7AKI0n-Y Value: iCqYiwsxNnyr7MfvmZdLPeKbIT8 |
|
khaine.nl/ | Name: QesA6synThavVcsuaUY8L-JEEoI Value: 1712698055 |
|
khaine.nl/ | Name: VU77ZEDjikisprbuo64FFR4XISI Value: 1712784455 |
|
khaine.nl/ | Name: wlaPfHH_i82VdTG6U1AS1S62-1I Value: lUKf5nlD5h1VwhwiKQeQXkzvwy0 |
|
khaine.nl/ | Name: l-PJIOPBd-FnLCpHtyNPu1KQwh8 Value: PG42hYlJ2TiXchqsCXy0DyybYS8 |
|
khaine.nl/ | Name: llcwG-GdYPeMTCGV0JRL7LvsgXs Value: 1712698056 |
|
khaine.nl/ | Name: jRnT53BbOGbbeVskIBxoIfAsjrI Value: 1712784456 |
|
khaine.nl/ | Name: 1PQIYzrKgVo9g1fiEz7n2nHHMzE Value: YUscEXR4pudep3K1nM7R2a0YJ_g |
|
.dhlparcel.nl/ | Name: _cfuvid Value: b9.I36SxwLemxxsTSClDQdeB_KlSPRTE1DqSF.DgbpY-1712698058331-0.0.1.1-604800000 |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.freebiesupply.com
code.jquery.com
group.dhl.com
khaine.nl
www.dhlecommerce.nl
www.dhlparcel.nl
www.dpdhl.com
khaine.nl
104.131.67.145
172.67.202.5
2600:141b:1c00:18::17c8:58ad
2600:141b:1c00:1a8a::296d
2606:4700::6812:1ac4
2606:4700::6812:6ae3
2a04:4e42::649
1dcc50d1f9f4b103e2add0dfdff627e7a988de5ce42563a894082382821df45d
319f639544c06b0299a948176501e194829dcbc4f559fe53933d8b65e892a311
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
6804c64aa3c5ed0b33ea0127c00d7d5af5bcca300162e009ce80de5032618cb6
7f8a7411080898c5e0e9a1b99c27c4c0951d558c6948a8f5cd712364f85e9bc7
9ecffc589fabf1eddb43842acfbff00c31fbf44245108bbbca289863af0b06c1
a62bf08fcdd300ef2c47e160b8d0a9f2dcb2fd9278af0a4e52cc716deb8a14c3
a80761493ca2555e26b53d7fb11c129e8620bfaf3d340a30bddfa1cce464fc61
dfc77c2c4637704715c953e52cfb9652f434d04419d2aeded6ffa79fcb6d210b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f449ce762ddce439c1eeeb45cd4ef484fa90dd58e9de00d41d9e7953e211be11