![](/screenshots/e285622a-131a-4f17-9141-208a069ae5bd.png)
dhl.e-ouo.com
Open in
urlscan Pro
2603:1020:201:e::2d
Malicious Activity!
Public Scan
Effective URL: https://dhl.e-ouo.com/JAIF2J/?82476
Submission: On July 17 via manual from LB — Scanned from DE
Summary
TLS certificate: Issued by R3 on July 11th 2023. Valid for: 3 months.
This is the only time dhl.e-ouo.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3035::6815:2dd1 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 2 | 2606:4700:303... 2606:4700:3033::ac43:db2d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 5 | 2603:1020:201... 2603:1020:201:e::2d | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
4 | 2 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dhl.e-ouo.com | |
laso.rousakn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
e-ouo.com
dhl.e-ouo.com |
3 MB |
3 |
e-uiu.com
3 redirects
e-uiu.com |
1 KB |
2 |
rousakn.com
1 redirects
laso.rousakn.com |
2 MB |
4 | 3 |
Domain | Requested by | |
---|---|---|
3 | dhl.e-ouo.com |
dhl.e-ouo.com
|
3 | e-uiu.com | 3 redirects |
2 | laso.rousakn.com |
1 redirects
dhl.e-ouo.com
|
4 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
developer.d |
www.d |
www.youtube.com |
www.facebook.com |
www.linkedin.com |
www.instagram.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
dhl.e-ouo.com R3 |
2023-07-11 - 2023-10-09 |
3 months | crt.sh |
laso.rousakn.com R3 |
2023-07-11 - 2023-10-09 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://dhl.e-ouo.com/JAIF2J/?82476
Frame ID: 061F83B273A3FE851A43D4975673878F
Requests: 11 HTTP requests in this frame
Frame:
https://laso.rousakn.com/BAKR2J/ALL/27019/
Frame ID: 24E45D3FF1BF99EBA9B2D536114C0622
Requests: 5 HTTP requests in this frame
Screenshot
![](/screenshots/e285622a-131a-4f17-9141-208a069ae5bd.png)
Page Title
D.H.LPage URL History Show full URLs
-
http://e-uiu.com/BA6DH
HTTP 301
https://e-uiu.com/BA6DH HTTP 301
https://e-uiu.com/BA6DH/ HTTP 302
https://dhl.e-ouo.com/JAIF2J/?82476 Page URL
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Developer Portal
Search URL Search Domain Scan URL
Title: Post and Paket Deutschland
Search URL Search Domain Scan URL
Title: Visit us on
Search URL Search Domain Scan URL
Title: Visit us on
Search URL Search Domain Scan URL
Title: Visit us on
Search URL Search Domain Scan URL
Title: Visit us on
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://e-uiu.com/BA6DH
HTTP 301
https://e-uiu.com/BA6DH HTTP 301
https://e-uiu.com/BA6DH/ HTTP 302
https://dhl.e-ouo.com/JAIF2J/?82476 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://laso.rousakn.com/BAKR2J/?74862 HTTP 302
- https://laso.rousakn.com/BAKR2J/ALL/27019/
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
dhl.e-ouo.com/JAIF2J/ Redirect Chain
|
1 MB 1 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
laso.rousakn.com/BAKR2J/ALL/27019/ Frame 24E4 Redirect Chain
|
2 MB 2 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
328 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dhl.e-ouo.com/JAIF2J/ |
1 MB 1 MB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
iconfont-da52a17c1b8deb953bfe.woff
dhl.e-ouo.com/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 24E4 |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 24E4 |
14 KB 14 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 24E4 |
8 KB 8 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 24E4 |
8 KB 8 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend function| savepage_ShadowLoader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
13 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dhl.e-ouo.com
e-uiu.com
laso.rousakn.com
2603:1020:201:e::2d
2606:4700:3033::ac43:db2d
2606:4700:3035::6815:2dd1
152664a596ad300f5ed06057acb22c36413c992e46f9b673e3e8888ac54407e6
2b553ffa69ee2cfbc838d508657e2c5de304bde3f4622f9e008dd5efb997a499
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
43027752f5a04142e6518a4fd8ef54e7e73cfba7820da9c03c1ad38835f04fe2
47370d5d2900fb4d949edc9199146a811c41c44d55447faa77eb5b3f99afd12b
5162de2ee844a80d76b7d7514c02ab7d5de72a5966113323d80eb56bf6ded038
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
816062d3d83936dd792095d6e512f700311e661e0dde2104e6b5496d3e904df1
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
acd3eaf2b608fb48f9915964c36772b322ad91106508c4490e2a72122db4d347
bc8627612574b691471b8927213085599b5ee48d848a018b122578c3fc5ee6b2
c32f1a0f5b093b6b2c8f5df0bf93856359769ee6bbab40975043cd133711d528
f01c2e1870fcd75ceca3b4c42c3110cb0aa4b933b562cf3d2c7ddd20ce03c7ee
f1384f72a7e17d191ca5f34b69ef53f44d32edf8ce47d35bdd84f65d14590452
f18f0977f7fafdeaad36f7e32c18c1a6462c3aa2a61ca22411aaa8008a8e1cba