khaine.nl Open in urlscan Pro
2606:4700:3033::6815:2259 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://khaine.nl/popouiyt/gyrfd.html
Effective URL:
https://khaine.nl/popouiyt/gyrfd.html
Submission: On April 09 via api (April 9th 2024, 9:28:57 pm UTC) from US — Scanned from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 1 countries across 8 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3033::6815:2259, located in United States and belongs to CLOUDFLARENET, US. The main domain is khaine.nl.
TLS certificate: Issued by E1 on March 25th 2024. Valid for: 3 months.

This is the only time khaine.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1 6	2606:4700:303... 2606:4700:3033::6815:2259	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
1	104.131.67.145 104.131.67.145	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2 2	2606:4700::68... 2606:4700::6812:6ae3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6812:1bc4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2600:141b:1c0... 2600:141b:1c00:1a81::296d	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2600:141b:1c0... 2600:141b:1c00:16::17c4:322	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	40.114.8.249 40.114.8.249	() ()
12	6

6 2606:4700:3033::6815:2259 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

khaine.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.131.67.145 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

cdn.freebiesupply.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:6ae3 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.dhlparcel.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:1bc4 (United States)

ASN13335 (CLOUDFLARENET, US)

www.dhlecommerce.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:1c00:1a81::296d (Secaucus, United States) 2 redirects

ASN20940 (AKAMAI-ASN1, NL)

www.dpdhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:1c00:16::17c4:322 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

group.dhl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.114.8.249 (None, )

ASN- ()

images-global.nhst.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	khaine.nl 1 redirects khaine.nl	20 KB
2	dhl.com group.dhl.com	262 KB
2	dpdhl.com 2 redirects www.dpdhl.com	569 B
2	dhlecommerce.nl www.dhlecommerce.nl — Cisco Umbrella Rank: 531391	3 KB
2	dhlparcel.nl 2 redirects www.dhlparcel.nl — Cisco Umbrella Rank: 799771	465 B
1	nhst.tech images-global.nhst.tech	221 KB
1	freebiesupply.com cdn.freebiesupply.com — Cisco Umbrella Rank: 352681	45 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1217	33 KB
12	8

	Domain	Requested by
6	khaine.nl	1 redirects khaine.nl
2	group.dhl.com	khaine.nl
2	www.dpdhl.com	2 redirects
2	www.dhlecommerce.nl	khaine.nl
2	www.dhlparcel.nl	2 redirects
1	images-global.nhst.tech
1	cdn.freebiesupply.com	khaine.nl
1	code.jquery.com	khaine.nl
12	8

This site contains no links.

Subject Issuer	Validity	Valid
khaine.nl E1	`2024-03-25` - `2024-06-23`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
cdn.freebiesupply.com R3	`2024-03-31` - `2024-06-29`	3 months	crt.sh
*.nhst.tech RapidSSL TLS RSA CA G1	`2023-06-27` - `2024-06-25`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://khaine.nl/popouiyt/gyrfd.html
Frame ID: A4CF9FE47062AFDBA986C1D1299551FF
Requests: 10 HTTP requests in this frame

Frame: https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
Frame ID: CE81A4D979ACC3215A624E6D8CB60FE3
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DHL Express | Track Shipment

Page URL History Show full URLs

http://khaine.nl/popouiyt/gyrfd.html HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
https://khaine.nl/popouiyt/gyrfd.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

58 %
HTTPS

75 %
IPv6

8
Domains

8
Subdomains

6
IPs

1
Countries

584 kB
Transfer

662 kB
Size

10
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://khaine.nl/popouiyt/gyrfd.html HTTP 307
https://khaine.nl/popouiyt/gyrfd.html Page URL
https://khaine.nl/popouiyt/gyrfd.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://khaine.nl/popouiyt/gyrfd.html HTTP 307
https://khaine.nl/popouiyt/gyrfd.html

Request Chain 2

https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

Request Chain 6

https://www.dhlparcel.nl/themes/custom/dp_theme/images/logo.svg HTTP 301
https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg

Request Chain 7

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg HTTP 301
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg

Request Chain 8

https://www.dhlparcel.nl/themes/custom/dp_theme/favicon.ico HTTP 301
https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico

Request Chain 9

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg HTTP 301
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

503

gyrfd.html Show response
khaine.nl/popouiyt/
Redirect Chain

http://khaine.nl/popouiyt/gyrfd.html
https://khaine.nl/popouiyt/gyrfd.html

8 KB
8 KB

471ms
458ms

Document
text/html

2606:4700:3033::6815:2259
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/popouiyt/gyrfd.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2259 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1eb3da356056592204315891275514f3fad755742fcca640a347df7f9fc4b05

Security Headers

Name	Value
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status: DYNAMIC
cf-ray: 871d96b10fde8c11-EWR
content-type: text/html; charset=utf-8
date: Tue, 09 Apr 2024 21:28:45 GMT
expires: 0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lFczavdxmTEiNBWyQZkfI3QuqkOvk24cfrmPm9Xcesu0zvyW%2FZkW78brdBGz6kbPnq0%2B4y1Wjkv2mK0aa1hl6B4csWWh065IPyTUB0tF78YO%2BLw6%2BICwDktw2CmFGtzU2bAjGTiFmwM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-content-type-options: nosniff nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block 1; mode=block

Redirect headers

Location: https://khaine.nl/popouiyt/gyrfd.html
Non-Authoritative-Reason: HttpsUpgrades

POST
H3 204 gyrfd.html
khaine.nl/popouiyt/ 0
840 B 234ms
233ms XHR
text/plain 2606:4700:3033::6815:2259
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/popouiyt/gyrfd.html

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2259 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
X-Requested-TimeStamp-Expire
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
X-Requested-TimeStamp-Combination
X-Requested-Type-Combination: GET
tb59kJF0LQONfb0SlkptaL7a3tU: 28282432
Content-type: application/x-www-form-urlencoded
X-Requested-Type: GET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Referer: https://khaine.nl/popouiyt/gyrfd.html
X-Requested-with: XMLHttpRequest
X-Requested-TimeStamp
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:28:45 GMT
x-server-powered-by: Engintron
x-content-type-options: nosniff, nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W4y63I45uIAWRYj22TvXR7qewgJ07etYzMMMzDhQ6pBcSqxIBWOpZQZHKlzZVfQ0WNkEaMgR2euLGYKvCwrjNsNMU4RB8VnvZlZUG85rvd7QIxZNIjlWt2ECccEVLllScG%2BN5ipZat4%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 871d96b42bd18c11-EWR
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block, 1; mode=block
expires: 0

GET
H3

200

main.js Show response
khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/ Frame CE81
Redirect Chain

https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

8 KB
4 KB

26ms
26ms

Script
application/javascript

2606:4700:3033::6815:2259
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js

Protocol

Server

2606:4700:3033::6815:2259 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5f5b097deed8247618405acceac54ca77772282954a4a33a08d4e97517ab81c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Apr 2024 21:28:45 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f8qYWCU9e55JrSnKR4egD3xhL8Jw5Zl%2Bl3CV1pMvuLBvOTFqWcomfaALqLsBY2dDPubKDjwo13f%2FSkaJEyabPx8PSTyvv6FS1lUtgNMq%2BW3nn0uEPH85c2vLVplCFI0rRgMUirDVq9w%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 871d96b43bf48c11-EWR
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 09 Apr 2024 21:28:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FpAlDW2plE2JeoQPHQzh%2FETBYHujA%2BfhTNlCgWsIuEkbp3duK5dd2loMxSb7RwtzP3XaOZxZiz6q3HegdD7HqonXO%2F1A88Y6V%2Bz57r6w4F6UeQBtPs6PIqudlAIuNNHVLTO3sG3MAHA%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/bcc5fb0a8815/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 871d96b42bd28c11-EWR
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H3 200 871d96b10fde8c11 Show response
khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame CE81 0
589 B 26ms
25ms XHR
text/plain 2606:4700:3033::6815:2259
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://khaine.nl/cdn-cgi/challenge-platform/h/b/jsd/r/871d96b10fde8c11
Requested by: Host: khaine.nl
URL: https://khaine.nl/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:2259 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 09 Apr 2024 21:28:45 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TVhM1inf527aU3MX0TDhTGOnfYQn9v%2F%2FVdg2gOkWn5hw8BhDM8OP5ZbJEeZJtpvvFWnRPtzE8zHY7swOQD9lRx3b4E95FWg0VNCNwaaO9kOY12aN893%2BaVUvdm4lhgOGegoPapFDTJU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 871d96b4dce68c11-EWR
alt-svc: h3=":443"; ma=86400

GET
H3 200 Primary Request gyrfd.html Show response
khaine.nl/popouiyt/ 17 KB
6 KB 236ms
236ms Document
text/html 2606:4700:3033::6815:2259
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://khaine.nl/popouiyt/gyrfd.html

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2259 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

736e85b6a5214e90e34aff6811b89d65e4e19d640d18a14119f2bd893aa047fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff nosniff
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Referer: https://khaine.nl/popouiyt/gyrfd.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 871d96b5add98c11-EWR
content-encoding: br
content-type: text/html
date: Tue, 09 Apr 2024 21:28:45 GMT
last-modified: Mon, 08 Apr 2024 11:11:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iHSbfJ5hGJK5zw2Z%2FCl08SL1PvmUZFi021kwZfjgkpchTxTXrxT8jJF58CK8%2BOjaeSEA2G7hyVpEejUHaqbyxpCStyPU1PVLz8rKeBcp5Dw11oN6SA%2BGv0H%2BGmC%2BGTyQktf2yUw1PIc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff nosniff
x-nginx-upstream-cache-status: HIT
x-server-powered-by: Engintron
x-xss-protection: 1; mode=block 1; mode=block

GET
H2 200 jquery-1.11.1.min.js Show response
code.jquery.com/ 94 KB
33 KB 26ms
3ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.1.min.js
Requested by: Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://khaine.nl/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 09 Apr 2024 21:28:45 GMT
content-encoding: gzip
via: 1.1 varnish
age: 17895922
x-cache: HIT
content-length: 33202
x-served-by: cache-lga21933-LGA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1712698126.970003,VS0,VE0
etag: W/"28feccc0-1762a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 4550

GET
H/1.1 200
OK dhl-1-logo-png-transparent.png
cdn.freebiesupply.com/logos/large/2x/ 45 KB
45 KB 24ms
6ms Image
image/png 104.131.67.145
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.freebiesupply.com/logos/large/2x/dhl-1-logo-png-transparent.png
Requested by: Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.131.67.145 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 7f8a7411080898c5e0e9a1b99c27c4c0951d558c6948a8f5cd712364f85e9bc7

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://khaine.nl/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 09 Apr 2024 21:28:45 GMT
Last-Modified: Fri, 09 Mar 2018 21:42:13 GMT
Server: nginx
x-amz-request-id: 28614FAD7B274E59
ETag: "c254c6e963469ddf999da53d10109dea"
X-Cache-Status: HIT
Content-Type: image/png
Cache-Control: max-age=15552000, public, no-transform
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 45805
x-amz-id-2: XZbIpmPf9PFo2XVF7tEO9Qr7mSd4FG4AA+Rw98IEpb27+/GWXHNMfBTBVGvb4Conea/CEiMQ2Lc=
Expires: Sun, 06 Oct 2024 21:28:45 GMT

GET
H2

200

logo.svg
www.dhlecommerce.nl/themes/custom/dp_theme/images/
Redirect Chain

https://www.dhlparcel.nl/themes/custom/dp_theme/images/logo.svg
https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg

3 KB
1 KB

37ms
18ms

Image
image/svg+xml

2606:4700::6812:1bc4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Server

2606:4700::6812:1bc4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a62bf08fcdd300ef2c47e160b8d0a9f2dcb2fd9278af0a4e52cc716deb8a14c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Apr 2024 21:28:46 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 08:02:34 GMT
server: cloudflare
age: 2379
etag: W/"c72-614b3f21dba80"
vary: Accept-Encoding
content-type: image/svg+xml
content-encoding: br
cf-ray: 871d96b78cbb8cdc-EWR

Redirect headers

date: Tue, 09 Apr 2024 21:28:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
vary: Accept-Encoding
location: https://www.dhlecommerce.nl/themes/custom/dp_theme/images/logo.svg
cache-control: max-age=3600
cf-ray: 871d96b74a8d43b0-EWR
expires: Tue, 09 Apr 2024 22:28:45 GMT

GET
H2

200

freight-volvo-1-1592x896.web.796.448.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/
Redirect Chain

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg

90 KB
90 KB

35ms
17ms

Image
image/jpeg

2600:141b:1c00:16::17c4:322
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg

Requested by

Host: khaine.nl
URL: https://khaine.nl/popouiyt/gyrfd.html

Protocol

Server

2600:141b:1c00:16::17c4:322 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

9ecffc589fabf1eddb43842acfbff00c31fbf44245108bbbca289863af0b06c1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
date: Tue, 09 Apr 2024 21:28:46 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains
x-akamai-cache: Hit from child
content-length: 91709
pragma: no-cache
referrer-policy: same-origin
last-modified: Sat, 23 Mar 2024 15:02:11 GMT
etag: "1663d-61455399f0387"
x-frame-options: DENY
content-type: image/jpeg
cache-control: max-age=0, no-cache
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Tue, 09 Apr 2024 21:28:46 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:28:46 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
server: AkamaiGHost
location: https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-1-1592x896.web.796.448.jpg
cache-control: max-age=0, no-cache
x-akamai-cache: Redirect from child
content-length: 0
expires: Tue, 09 Apr 2024 21:28:46 GMT

GET
H2

200

favicon.ico
www.dhlecommerce.nl/themes/custom/dp_theme/
Redirect Chain

https://www.dhlparcel.nl/themes/custom/dp_theme/favicon.ico
https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico

7 KB
2 KB

15ms
15ms

Other
image/vnd.microsoft.icon

2606:4700::6812:1bc4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico

Protocol

Server

2606:4700::6812:1bc4 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6804c64aa3c5ed0b33ea0127c00d7d5af5bcca300162e009ce80de5032618cb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Apr 2024 21:28:46 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 08:02:34 GMT
server: cloudflare
age: 2378
etag: W/"1cee-614b3f21dba80"
vary: Accept-Encoding
content-type: image/vnd.microsoft.icon
content-encoding: br
cf-ray: 871d96b86e208cdc-EWR

Redirect headers

date: Tue, 09 Apr 2024 21:28:46 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
vary: Accept-Encoding
location: https://www.dhlecommerce.nl/themes/custom/dp_theme/favicon.ico
cache-control: max-age=3600
cf-ray: 871d96b82b6f43b0-EWR
expires: Tue, 09 Apr 2024 22:28:46 GMT

GET
H2

200

freight-volvo-2-1592x896.jpg
group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/
Redirect Chain

https://www.dpdhl.com/content/dam/dpdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg
https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg

171 KB
172 KB

16ms
15ms

Image
image/jpeg

2600:141b:1c00:16::17c4:322
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg

Protocol

Server

2600:141b:1c00:16::17c4:322 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f449ce762ddce439c1eeeb45cd4ef484fa90dd58e9de00d41d9e7953e211be11

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://khaine.nl/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
date: Tue, 09 Apr 2024 21:28:50 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000 ; includeSubDomains
x-akamai-cache: Hit from child
content-length: 175534
pragma: no-cache
referrer-policy: same-origin
last-modified: Sat, 23 Mar 2024 18:59:34 GMT
etag: "2adae-614588a8efe8d"
x-frame-options: DENY
content-type: image/jpeg
cache-control: max-age=0, no-cache
permissions-policy: microphone=(),camera=()
accept-ranges: bytes
expires: Tue, 09 Apr 2024 21:28:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Apr 2024 21:28:49 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains
x-content-type-options: nosniff
server: AkamaiGHost
location: https://group.dhl.com/content/dam/deutschepostdhl/en/media-relations/press-release-1592x896/2021/freight-volvo-2-1592x896.jpg
cache-control: max-age=0, no-cache
x-akamai-cache: Redirect from child
content-length: 0
expires: Tue, 09 Apr 2024 21:28:49 GMT

GET
H/1.1 200
OK 0f2521703767006c88f7c21a24cf991e
images-global.nhst.tech/image/WEdHSVZ5eU5vT01Ia25OS1duVnowOWNrSFJyVXFmRzdZOFhBcjNhZ3g4Zz0=/nhst/binary/ 221 KB
221 KB 389ms
274ms Image
image/jpg 40.114.8.249

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images-global.nhst.tech/image/WEdHSVZ5eU5vT01Ia25OS1duVnowOWNrSFJyVXFmRzdZOFhBcjNhZ3g4Zz0=/nhst/binary/0f2521703767006c88f7c21a24cf991e
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.114.8.249 -, , ASN (),
Reverse DNS
Software: / Express
Resource Hash: 25e1397babd7c81dc8946fbf3fdbf8ba9a7e3092160f4e473cc90ac59b4b15e0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://khaine.nl/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 09 Apr 2024 21:28:54 GMT
Via: 1.1 varnish (Varnish/6.0), 1.1 varnish-v4
X-CDN-Location: EUS
X-CDN-Cache: MISS
Age: 0
X-Powered-By: Express
Content-Type: image/jpg
Access-Control-Allow-Origin: *
cache-control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 225852

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
khaine.nl/	1970-01-20 19:46:24	Name: f1oE8__G9obq9HdpIon3dAYiTw4 Value: 6f7Afx4vmnxDrGCUgG3b_mHWwwA
khaine.nl/	1970-01-20 19:46:24	Name: E0yuJYcGe_bXMs-iQ6vF5RxM414 Value: 1712698124
khaine.nl/	1970-01-20 19:46:24	Name: QWqb2WdxtCf0CwJ5JaqhlWflRts Value: 1712784524
khaine.nl/	1970-01-20 19:46:24	Name: Ma5ID-38ejPqcsG8pruQ4Sh60RA Value: jKvRpdIc2BlX4xSc7_2l7Ynf_LI
khaine.nl/	1970-01-20 19:46:24	Name: 76uhw6dzvHN-XUrueUygtDJ8eoM Value: pu6UFa3DcsKo4-9tNRVK7qgy-QM
.khaine.nl/	1970-01-21 04:30:34	Name: cf_clearance Value: Rb1Ck_tbArHliCsC_Ks7XOjeu8aMT_stE7XOEginJOs-1712698125-1.0.1.1-JoRRvvcnzuhx0VTzHqVOE.Ihj1.cGkOKm6kNV1HBe30V1QXgGHWShmvsxjl844UGi2zn9YQlZ0AivlpWWrKSEg
khaine.nl/	1970-01-20 19:46:24	Name: q-H6Cw1HjnGIh1MmiAZ2EUZZjbE Value: 1712698125
khaine.nl/	1970-01-20 19:46:24	Name: vsYVuBhGALQxjhLCcNQrlmkTGk4 Value: 1712784525
khaine.nl/	1970-01-20 19:46:24	Name: u5reURMON8xUOZ2I2I8h28Tcnnk Value: 08geW-_Q9p6dtoZs9oqPKsEisRI
.dhlparcel.nl/	1969-12-31 23:59:59	Name: _cfuvid Value: hW0uSAqsBMtP2VpfaTpzCDqC658JRp8NNsfdmNSqv1I-1712698125982-0.0.1.1-604800000

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://khaine.nl/popouiyt/gyrfd.html Message: Failed to load resource: the server responded with a status of 503 ()
recommendation	verbose	URL: https://khaine.nl/popouiyt/gyrfd.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://khaine.nl/popouiyt/gyrfd.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://khaine.nl/popouiyt/gyrfd.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.freebiesupply.com
code.jquery.com
group.dhl.com
images-global.nhst.tech
khaine.nl
www.dhlecommerce.nl
www.dhlparcel.nl
www.dpdhl.com
104.131.67.145
2600:141b:1c00:16::17c4:322
2600:141b:1c00:1a81::296d
2606:4700:3033::6815:2259
2606:4700::6812:1bc4
2606:4700::6812:6ae3
2a04:4e42:400::649
40.114.8.249
25e1397babd7c81dc8946fbf3fdbf8ba9a7e3092160f4e473cc90ac59b4b15e0
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
5f5b097deed8247618405acceac54ca77772282954a4a33a08d4e97517ab81c9
6804c64aa3c5ed0b33ea0127c00d7d5af5bcca300162e009ce80de5032618cb6
736e85b6a5214e90e34aff6811b89d65e4e19d640d18a14119f2bd893aa047fd
7f8a7411080898c5e0e9a1b99c27c4c0951d558c6948a8f5cd712364f85e9bc7
9ecffc589fabf1eddb43842acfbff00c31fbf44245108bbbca289863af0b06c1
a62bf08fcdd300ef2c47e160b8d0a9f2dcb2fd9278af0a4e52cc716deb8a14c3
e1eb3da356056592204315891275514f3fad755742fcca640a347df7f9fc4b05
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f449ce762ddce439c1eeeb45cd4ef484fa90dd58e9de00d41d9e7953e211be11

khaine.nl Open in urlscan Pro 2606:4700:3033::6815:2259 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

58 %HTTPS

75 %IPv6

8 Domains

8 Subdomains

6 IPs

1 Countries

584 kBTransfer

662 kBSize

10 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

10 Cookies

4 Console Messages

Security Headers

Indicators

khaine.nl Open in urlscan Pro
2606:4700:3033::6815:2259 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

58 %
HTTPS

75 %
IPv6

8
Domains

8
Subdomains

6
IPs

1
Countries

584 kB
Transfer

662 kB
Size

10
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!