www.reclaimheldparcl.com
Open in
urlscan Pro
81.16.28.225
Malicious Activity!
Public Scan
Effective URL: https://www.reclaimheldparcl.com/AUS/AUS/dhl/info.php
Submission: On June 22 via api from DK
Summary
TLS certificate: Issued by R3 on June 19th 2021. Valid for: 3 months.
This is the only time www.reclaimheldparcl.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Swiss Post (Transportation) DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 204.236.211.143 204.236.211.143 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 67.199.248.10 67.199.248.10 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
3 17 | 81.16.28.225 81.16.28.225 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::2004 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:831::2003 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:813::2004 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:811::2003 | 15169 (GOOGLE) (GOOGLE) | |
24 | 5 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-204-236-211-143.compute-1.amazonaws.com
t.dripemail2.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
reclaimheldparcl.com
3 redirects
www.reclaimheldparcl.com |
144 KB |
6 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
324 KB |
4 |
google.com
www.google.com |
36 KB |
1 |
bit.ly
1 redirects
bit.ly |
260 B |
1 |
dripemail2.com
1 redirects
t.dripemail2.com |
80 B |
24 | 5 |
Domain | Requested by | |
---|---|---|
17 | www.reclaimheldparcl.com |
3 redirects
www.reclaimheldparcl.com
|
4 | www.gstatic.com |
www.google.com
www.gstatic.com |
4 | www.google.com |
www.reclaimheldparcl.com
www.gstatic.com www.google.com |
2 | fonts.gstatic.com |
www.google.com
|
1 | bit.ly | 1 redirects |
1 | t.dripemail2.com | 1 redirects |
24 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
reclaimheldparcl.com R3 |
2021-06-19 - 2021-09-17 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2021-05-24 - 2021-08-16 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-05-31 - 2021-08-23 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2021-05-24 - 2021-08-16 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.reclaimheldparcl.com/AUS/AUS/dhl/info.php
Frame ID: 0A7882922340FE5C76C6FA0328274512
Requests: 16 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdAJksbAAAAAAC5z-G9TuWL43op6-qech0izqoh&co=aHR0cHM6Ly93d3cucmVjbGFpbWhlbGRwYXJjbC5jb206NDQz&hl=en&v=FDTCuNjXhn1sV0lk31aK53uB&size=invisible&cb=v4zpkz31p4ff
Frame ID: C2AE413BB6C53F2D563970FF3576BDBB
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiMjEwNjUxOSIsImRlbGl2ZXJ5X2lkIjoia21hMHNsdDQwbHEyYTlpY2...
HTTP 307
https://bit.ly/2UrMJpV?__s=xjsq1lei4yjehpgfcy19 HTTP 301
https://www.reclaimheldparcl.com/AUS/AUS HTTP 301
https://www.reclaimheldparcl.com/AUS/AUS/ Page URL
-
https://www.reclaimheldparcl.com/AUS/AUS/dhl
HTTP 301
https://www.reclaimheldparcl.com/AUS/AUS/dhl/ HTTP 302
https://www.reclaimheldparcl.com/AUS/AUS/dhl/info.php Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiMjEwNjUxOSIsImRlbGl2ZXJ5X2lkIjoia21hMHNsdDQwbHEyYTlpY2tqb2oiLCJ1cmwiOiJodHRwczovL2JpdC5seS8yVXJNSnBWP19fcz14anNxMWxlaTR5amVocGdmY3kxOSJ9
HTTP 307
https://bit.ly/2UrMJpV?__s=xjsq1lei4yjehpgfcy19 HTTP 301
https://www.reclaimheldparcl.com/AUS/AUS HTTP 301
https://www.reclaimheldparcl.com/AUS/AUS/ Page URL
-
https://www.reclaimheldparcl.com/AUS/AUS/dhl
HTTP 301
https://www.reclaimheldparcl.com/AUS/AUS/dhl/ HTTP 302
https://www.reclaimheldparcl.com/AUS/AUS/dhl/info.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiMjEwNjUxOSIsImRlbGl2ZXJ5X2lkIjoia21hMHNsdDQwbHEyYTlpY2tqb2oiLCJ1cmwiOiJodHRwczovL2JpdC5seS8yVXJNSnBWP19fcz14anNxMWxlaTR5amVocGdmY3kxOSJ9 HTTP 307
- https://bit.ly/2UrMJpV?__s=xjsq1lei4yjehpgfcy19 HTTP 301
- https://www.reclaimheldparcl.com/AUS/AUS HTTP 301
- https://www.reclaimheldparcl.com/AUS/AUS/
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3-Q050 |
/
www.reclaimheldparcl.com/AUS/AUS/ Redirect Chain
|
730 B 518 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
850 B 990 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/ |
341 KB 133 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
anchor
www.google.com/recaptcha/api2/ Frame C2AE |
38 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/ Frame C2AE |
52 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
recaptcha__en.js
www.gstatic.com/recaptcha/releases/FDTCuNjXhn1sV0lk31aK53uB/ Frame C2AE |
341 KB 133 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame C2AE |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame C2AE |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame C2AE |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
webworker.js
www.google.com/recaptcha/api2/ Frame C2AE |
102 B 132 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-29 |
reload
www.google.com/recaptcha/api2/ Frame C2AE |
28 KB 16 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
Primary Request
info.php
www.reclaimheldparcl.com/AUS/AUS/dhl/ Redirect Chain
|
24 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
main.css
www.reclaimheldparcl.com/AUS/AUS/dhl/files/css/ |
529 KB 84 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
jquery.js
www.reclaimheldparcl.com/AUS/AUS/dhl/files/js/ |
85 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
dhl-logo.svg
www.reclaimheldparcl.com/AUS/AUS/dhl/files/img/ |
2 KB 715 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
glo.svg
www.reclaimheldparcl.com/AUS/AUS/dhl/files/img/ |
1 KB 630 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
glo-footer-logo.svg
www.reclaimheldparcl.com/AUS/AUS/dhl/files/img/ |
12 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
5132a7ca80ea9e18ec8cecc618cf5a0b.woff
www.reclaimheldparcl.com/AUS/AUS/dhl/files/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
arrow.svg
www.reclaimheldparcl.com/AUS/AUS/dhl/files/img/ |
311 B 243 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
c2d3739d2debffea340a58b7b8ab3c61.woff
www.reclaimheldparcl.com/AUS/AUS/dhl/files/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
d2c082a9f78e61ea7ccefecaca4da8a3.woff
www.reclaimheldparcl.com/AUS/AUS/dhl/files/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
lod.gif
www.reclaimheldparcl.com/AUS/AUS/dhl/files/img/ |
17 KB 17 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
03f859bf58e4d37841070de34be7d978.woff
www.reclaimheldparcl.com/AUS/AUS/dhl/files/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
e39bd2e2657ce5dd6f9c33df18529233.woff
www.reclaimheldparcl.com/AUS/AUS/dhl/files/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Swiss Post (Transportation) DHL (Transportation)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery undefined| request1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.reclaimheldparcl.com/ | Name: PHPSESSID Value: 5d52e12b6441eff9471cdb2f806679fc |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
fonts.gstatic.com
t.dripemail2.com
www.google.com
www.gstatic.com
www.reclaimheldparcl.com
204.236.211.143
2a00:1450:4001:811::2003
2a00:1450:4001:813::2004
2a00:1450:4001:827::2004
2a00:1450:4001:831::2003
67.199.248.10
81.16.28.225
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
2deefd752d0d838a84f4e550d6a6055dbf21806ce45024af042696f443912130
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5d8eccebdd94742f04c8b3f8757b1e9f8ee5a2c2a67c702cd863f43c783e512c
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
7ab6a25b3bfe17a0705d5017781df867ba5ccb3238943115697016ffd35e19e0
7b7e4adb65aa53b1bc731f15511c53d5beb73f187d5c5f35f19ebbfaf0decbbd
8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6
8646ac3db68480bf7d99da7314d6946074387a33f50db30abe95633479cd3559
99106ebe02e02d0f40b6d198fdd3429d2f2a75279b1409dc0955fcce1a5c2f79
c64512c48f56cf04a9a28a1dbede98dcf5742344997ada0b81eedd27daa06e6e
ce6a239fde88d8fb01c7a10d6f7b27d1bc23f5462d02f5ebb4927479fa32a302
d2af8c93b873d0a919ddb3933ac2ec1b247ed2069d74f75803eb10f42e84c714
d8748acb2eead2bb284ccec7029faaa404c1f2bda9cbeae2d777b9033e473a9d
d97797426d717621d5059e293ea468c8a463a3e8e7d89a5d90ac38eaa174ed64