companyplaces.be Open in urlscan Pro
185.3.216.213 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://companyplaces.be/wp-admin/css/de/dhl/index.php
Effective URL:
https://companyplaces.be/wp-admin/css/de/dhl/index.php
Submission: On January 18 via api (January 18th 2021, 10:25:57 am UTC) from IE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 185.3.216.213, located in Belgium and belongs to LEVEL27-AS, BE. The main domain is companyplaces.be.
TLS certificate: Issued by R3 on January 1st 2021. Valid for: 3 months.

This is the only time companyplaces.be was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
1 10	185.3.216.213 185.3.216.213		59943 (LEVEL27-AS) (LEVEL27-AS)
9	1

10 185.3.216.213 (Belgium) 1 redirects

ASN59943 (LEVEL27-AS, BE)
PTR: web49.level27.eu

companyplaces.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	companyplaces.be 1 redirects companyplaces.be	224 KB
9	1

	Domain	Requested by
10	companyplaces.be	1 redirects companyplaces.be
9	1

This site contains no links.

Subject Issuer	Validity	Valid
companyplaces.be R3	`2021-01-01` - `2021-04-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://companyplaces.be/wp-admin/css/de/dhl/index.php
Frame ID: 4FBF96E0C500B2E180D91CFB595EFEE6
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://companyplaces.be/wp-admin/css/de/dhl/index.php HTTP 301
https://companyplaces.be/wp-admin/css/de/dhl/index.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

224 kB
Transfer

229 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://companyplaces.be/wp-admin/css/de/dhl/index.php HTTP 301
https://companyplaces.be/wp-admin/css/de/dhl/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.php Show response companyplaces.be/wp-admin/css/de/dhl/ Redirect Chain http://companyplaces.be/wp-admin/css/de/dhl/index.php https://companyplaces.be/wp-admin/css/de/dhl/index.php	8 KB 2 KB	173ms 49ms	Document text/html	185.3.216.213 LEVEL27-AS
General Check archive.org Show headers Download Go to Full URL https://companyplaces.be/wp-admin/css/de/dhl/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.3.216.213 , Belgium, ASN59943 (LEVEL27-AS, BE), Reverse DNS web49.level27.eu Software / Resource Hash `93ccc3049fe8302651457306ddb871062e90b882184979bea4ab61584397a3e6` Request headers :method GET :authority companyplaces.be :scheme https :path /wp-admin/css/de/dhl/index.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 10:25:40 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding content-encoding gzip front-end-https on Redirect headers Date Mon, 18 Jan 2021 10:25:40 GMT Content-Type text/html Content-Length 178 Connection keep-alive Location https://companyplaces.be/wp-admin/css/de/dhl/index.php
GET H2	200	logo2.jpg companyplaces.be/wp-admin/css/de/dhl/photos/	4 KB 4 KB	53ms 51ms	Image image/jpeg	185.3.216.213 LEVEL27-AS
General Check archive.org Show headers Download Go to Show image Full URL https://companyplaces.be/wp-admin/css/de/dhl/photos/logo2.jpg Requested by Host: companyplaces.be URL: https://companyplaces.be/wp-admin/css/de/dhl/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.3.216.213 , Belgium, ASN59943 (LEVEL27-AS, BE), Reverse DNS web49.level27.eu Software / Resource Hash `26933abb67839e269d8fc9d49b5ff722a1f48646776a8bdfb25e572d10996b41` Request headers Referer https://companyplaces.be/wp-admin/css/de/dhl/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 10:25:40 GMT last-modified Sat, 16 Jan 2021 11:38:46 GMT accept-ranges bytes etag "f3e-5b902ee8cd346" content-length 3902 front-end-https on content-type image/jpeg
GET H2	200	user.jpg companyplaces.be/wp-admin/css/de/dhl/photos/	882 B 1 KB	55ms 52ms	Image image/jpeg	185.3.216.213 LEVEL27-AS
General Check archive.org Show headers Download Go to Show image Full URL https://companyplaces.be/wp-admin/css/de/dhl/photos/user.jpg Requested by Host: companyplaces.be URL: https://companyplaces.be/wp-admin/css/de/dhl/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.3.216.213 , Belgium, ASN59943 (LEVEL27-AS, BE), Reverse DNS web49.level27.eu Software / Resource Hash `a01ba8776a34d2e00fb9f265d8d25351b79bd7fcc36a2447aa3b7f5baa705893` Request headers Referer https://companyplaces.be/wp-admin/css/de/dhl/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 10:25:40 GMT last-modified Sat, 16 Jan 2021 11:38:46 GMT accept-ranges bytes etag "372-5b902ee8cd346" content-length 882 front-end-https on content-type image/jpeg
GET H2	200	pass.jpg companyplaces.be/wp-admin/css/de/dhl/photos/	870 B 1015 B	55ms 53ms	Image image/jpeg	185.3.216.213 LEVEL27-AS
General Check archive.org Show headers Download Go to Show image Full URL https://companyplaces.be/wp-admin/css/de/dhl/photos/pass.jpg Requested by Host: companyplaces.be URL: https://companyplaces.be/wp-admin/css/de/dhl/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.3.216.213 , Belgium, ASN59943 (LEVEL27-AS, BE), Reverse DNS web49.level27.eu Software / Resource Hash `e31974b7ac3c5ef44883b43d4c5ede1bbcc30c7067cfd9d1583daea7b936d627` Request headers Referer https://companyplaces.be/wp-admin/css/de/dhl/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 10:25:40 GMT last-modified Sat, 16 Jan 2021 11:38:46 GMT accept-ranges bytes etag "366-5b902ee8cd346" content-length 870 front-end-https on content-type image/jpeg
GET H2	200	sidechic.png companyplaces.be/wp-admin/css/de/dhl/photos/	147 KB 147 KB	56ms 54ms	Image image/png	185.3.216.213 LEVEL27-AS
General Check archive.org Show headers Download Go to Show image Full URL https://companyplaces.be/wp-admin/css/de/dhl/photos/sidechic.png Requested by Host: companyplaces.be URL: https://companyplaces.be/wp-admin/css/de/dhl/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.3.216.213 , Belgium, ASN59943 (LEVEL27-AS, BE), Reverse DNS web49.level27.eu Software / Resource Hash `f5b9fbc426d1cbd5ac333582708411c0c97513f35f69a732bf59f7256d9824d6` Request headers Referer https://companyplaces.be/wp-admin/css/de/dhl/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 10:25:40 GMT last-modified Sat, 16 Jan 2021 11:38:46 GMT accept-ranges bytes etag "24bb4-5b902ee8cd346" content-length 150452 front-end-https on content-type image/png
GET H2	200	logo.jpg companyplaces.be/wp-admin/css/de/dhl/photos/	443 B 588 B	56ms 54ms	Image image/jpeg	185.3.216.213 LEVEL27-AS
General Check archive.org Show headers Download Go to Show image Full URL https://companyplaces.be/wp-admin/css/de/dhl/photos/logo.jpg Requested by Host: companyplaces.be URL: https://companyplaces.be/wp-admin/css/de/dhl/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.3.216.213 , Belgium, ASN59943 (LEVEL27-AS, BE), Reverse DNS web49.level27.eu Software / Resource Hash `2f680b51b19fc3c5befd02bd9d0d4e88c2722a5210157e4ef68933c5ba352109` Request headers Referer https://companyplaces.be/wp-admin/css/de/dhl/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 10:25:40 GMT last-modified Sat, 16 Jan 2021 11:38:46 GMT accept-ranges bytes etag "1bb-5b902ee8cd346" content-length 443 front-end-https on content-type image/jpeg
GET H2	200	appstore.png companyplaces.be/wp-admin/css/de/dhl/photos/	6 KB 6 KB	72ms 71ms	Image image/png	185.3.216.213 LEVEL27-AS
General Check archive.org Show headers Download Go to Show image Full URL https://companyplaces.be/wp-admin/css/de/dhl/photos/appstore.png Requested by Host: companyplaces.be URL: https://companyplaces.be/wp-admin/css/de/dhl/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.3.216.213 , Belgium, ASN59943 (LEVEL27-AS, BE), Reverse DNS web49.level27.eu Software / Resource Hash `90b309d25fba95636c00eb6ce2b3e73f322f1fa35fc6b607753b451b795162e6` Request headers Referer https://companyplaces.be/wp-admin/css/de/dhl/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 10:25:40 GMT last-modified Sat, 16 Jan 2021 11:38:46 GMT accept-ranges bytes etag "167e-5b902ee8cd346" content-length 5758 front-end-https on content-type image/png
GET H2	200	playstore.jpg companyplaces.be/wp-admin/css/de/dhl/photos/	7 KB 7 KB	76ms 75ms	Image image/jpeg	185.3.216.213 LEVEL27-AS
General Check archive.org Show headers Download Go to Show image Full URL https://companyplaces.be/wp-admin/css/de/dhl/photos/playstore.jpg Requested by Host: companyplaces.be URL: https://companyplaces.be/wp-admin/css/de/dhl/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.3.216.213 , Belgium, ASN59943 (LEVEL27-AS, BE), Reverse DNS web49.level27.eu Software / Resource Hash `080bd11d5493a718327a84cfc7cfdf43b48d5f9b7081c137394e16f2fb5252dc` Request headers Referer https://companyplaces.be/wp-admin/css/de/dhl/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 10:25:40 GMT last-modified Sat, 16 Jan 2021 11:38:46 GMT accept-ranges bytes etag "1bb2-5b902ee8cd346" content-length 7090 front-end-https on content-type image/jpeg
GET H2	200	aliexpress.png companyplaces.be/wp-admin/css/de/dhl/photos/	56 KB 56 KB	140ms 139ms	Image image/png	185.3.216.213 LEVEL27-AS
General Check archive.org Show headers Download Go to Show image Full URL https://companyplaces.be/wp-admin/css/de/dhl/photos/aliexpress.png Requested by Host: companyplaces.be URL: https://companyplaces.be/wp-admin/css/de/dhl/index.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.3.216.213 , Belgium, ASN59943 (LEVEL27-AS, BE), Reverse DNS web49.level27.eu Software / Resource Hash `0eeef82957b8831d86f79b89fbedf1e85006d6a4f4eb4a12a713032f712c1d1a` Request headers Referer https://companyplaces.be/wp-admin/css/de/dhl/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 18 Jan 2021 10:25:40 GMT last-modified Sat, 16 Jan 2021 11:38:46 GMT accept-ranges bytes etag "de53-5b902ee8cd346" content-length 56915 front-end-https on content-type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

companyplaces.be
185.3.216.213
080bd11d5493a718327a84cfc7cfdf43b48d5f9b7081c137394e16f2fb5252dc
0eeef82957b8831d86f79b89fbedf1e85006d6a4f4eb4a12a713032f712c1d1a
26933abb67839e269d8fc9d49b5ff722a1f48646776a8bdfb25e572d10996b41
2f680b51b19fc3c5befd02bd9d0d4e88c2722a5210157e4ef68933c5ba352109
90b309d25fba95636c00eb6ce2b3e73f322f1fa35fc6b607753b451b795162e6
93ccc3049fe8302651457306ddb871062e90b882184979bea4ab61584397a3e6
a01ba8776a34d2e00fb9f265d8d25351b79bd7fcc36a2447aa3b7f5baa705893
e31974b7ac3c5ef44883b43d4c5ede1bbcc30c7067cfd9d1583daea7b936d627
f5b9fbc426d1cbd5ac333582708411c0c97513f35f69a732bf59f7256d9824d6

companyplaces.be Open in urlscan Pro 185.3.216.213 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

224 kBTransfer

229 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

companyplaces.be Open in urlscan Pro
185.3.216.213 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

224 kB
Transfer

229 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!