nasle4.com Open in urlscan Pro
2606:4700:3036::ac43:c08a  Malicious Activity! Public Scan

URL: https://nasle4.com/wp-includes/block-supports/support.php
Submission: On October 19 via automatic, source openphish — Scanned from DE

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3036::ac43:c08a, located in United States and belongs to CLOUDFLARENET, US. The main domain is nasle4.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 3rd 2022. Valid for: a year.
This is the only time nasle4.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 34.242.77.172 16509 (AMAZON-02)
8 4
Apex Domain
Subdomains
Transfer
1 usabilla.com
w.usabilla.com — Cisco Umbrella Rank: 3625
16 KB
1 zacksource.click
zacksource.click
1 nasle4.com
nasle4.com
2 MB
8 3
Domain Requested by
1 w.usabilla.com srcdoc
1 zacksource.click nasle4.com
1 nasle4.com
8 3
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-06-03 -
2023-06-02
a year crt.sh
w.usabilla.com
Amazon
2022-02-10 -
2023-03-11
a year crt.sh

This page contains 3 frames:

Primary Page: https://nasle4.com/wp-includes/block-supports/support.php
Frame ID: 078C8B297E41B00D8AB2B97F30842965
Requests: 18 HTTP requests in this frame

Frame: https://zacksource.click/chbani/hello/users/
Frame ID: 591EBE4542D75AC880CEF2E30B28B761
Requests: 1 HTTP requests in this frame

Frame: https://w.usabilla.com/b2d2adfa16cf.js?lv=1
Frame ID: 9A2A7785C019FED16834DAB7AB8894A6
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Global Logistics - International Shipping | DHL Home | United States of AmericaBack ButtonSearch IconFilter Icon

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

8
Requests

38 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

2208 kB
Transfer

5428 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request support.php
nasle4.com/wp-includes/block-supports/
3 MB
2 MB
Document
General
Full URL
https://nasle4.com/wp-includes/block-supports/support.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:c08a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6781eff2f7ef7c39301b652091f701f614b91209752a79027685bb4b78697d9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
75c6532accd490ee-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Wed, 19 Oct 2022 03:11:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k6fyfn%2F4smH3lrZGi%2FcXnQXtjoMRM%2B%2BRrh42p2xRyGO0JPGbRSBf%2FAoiXCHsQpcPG8sfSvxNjt3disVBnd2Z8wQsZ31Cm8r3xiWTmD6PrxYbzza0sQsTG1NyY0gkQIPD%2BdUv3Ldf%2B2fY"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
truncated
/
40 KB
40 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5af5c3746b03792640b9cafdabddfb2c5407f72988e128541a88fa439607d940

Request headers

Referer
Origin
https://nasle4.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
40 KB
40 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19d0bda83ecbc986620468801adf000c77c3c38398650903c63fac8dcbac4383

Request headers

Referer
Origin
https://nasle4.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/
41 KB
41 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
28ef8eb4855c358648f24cd9be624f9b9c636a2d9331dece905ce7b58c4b21c9

Request headers

Referer
Origin
https://nasle4.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
application/font-woff
/
zacksource.click/chbani/hello/users/ Frame 591E
0
0
Document
General
Full URL
https://zacksource.click/chbani/hello/users/
Requested by
Host: nasle4.com
URL: https://nasle4.com/wp-includes/block-supports/support.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://nasle4.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
75c6533199c99125-FRA
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 19 Oct 2022 03:11:11 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X%2Bw1Qq6RuXjFclPz66sxOLtIfVBYhN7RK7KvQs8NsDi0DWzsV7%2FjcC1lcDRjMdWXBTNi%2FyVDF7MZ9Eu1GlT2dKA2xdesEYeh3A5L%2Bry49jU7n416Or0ZrjjyKNNnj%2FNRP93v%2Bti4V4W8JYFt6rRG"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7b7e4adb65aa53b1bc731f15511c53d5beb73f187d5c5f35f19ebbfaf0decbbd

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0b9219c0bb4070af4eca3f58737b60adf42ed3867bef6fbf9bf935ffa210d02f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fa27d936d088620b27debb4c2a3da24d27346505d247a56d098ae56e3a2da07a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b5335e0b117f099169020346db0d11cba41d56ff38935733e6987f09bd7ebbf5

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
46098468df2bec8cb50790597de30d089ecd7dcc77432b6a08b9e3ff1a7d7802

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
74 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
be97b87d38cc8e03e82e4a73ccef3ce4997dbdc0e5ef7259bbe2db9402522a1c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/jpeg
b2d2adfa16cf.js
w.usabilla.com/ Frame 9A2A
68 KB
16 KB
Script
General
Full URL
https://w.usabilla.com/b2d2adfa16cf.js?lv=1
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.77.172 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-77-172.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
80eb5bd83414dafe94f11cfdd7154c125f7f052d0028a086e26f91ff5bd542d3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://nasle4.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 19 Oct 2022 03:11:11 GMT
content-encoding
gzip
x-widget-server
2.1
etag
"1a77d03f6c10519ff40fe3f145fe5322"
content-type
text/javascript
cache-control
public,max-age=0
content-length
15909
truncated
/
43 KB
43 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
87c40e3961e21f759770615ae67568a3de3ec6e0735f1238a6aae062f4ea15d5

Request headers

Referer
Origin
https://nasle4.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/
99 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a18c4e93c1519e4d37cf87403af638a6eadb55a88d6930998d766f6e8a8c5020

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
71 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2414cce6ee6e5ce602c45e4bfa7aea3c7ceaa03819987aae136a93253ab344c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
511 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5aa9a388b209895cda1b780f1a8a6c0293c5ac859c4a0d766b5a39d9ea000fcc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
226 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d71854e46da18172ed3b345fd5aea960da910e6bb0a39dd12e57ee1d792b1d26

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
399 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9b0e62097bfb5f146ba1203b0664e0831a8db3df26dbb437210934c7e131650b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
300 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3a00c72d097a4ab9b0c5f078ef128cf63b39fbbe72c298f3c46b842ce0b5770d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type
image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| savepage_ShadowLoader

0 Cookies

8 Console Messages

Source Level URL
Text
other warning URL: https://nasle4.com/wp-includes/block-supports/support.php(Line 9)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://nasle4.com/wp-includes/block-supports/support.php(Line 9)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://nasle4.com/wp-includes/block-supports/support.php(Line 10)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://nasle4.com/wp-includes/block-supports/support.php(Line 11)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://nasle4.com/wp-includes/block-supports/support.php(Line 12)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: https://nasle4.com/wp-includes/block-supports/support.php(Line 13)
Message:
<link rel=preload> has an invalid `href` value
network error URL: chrome-error://chromewebdata/
Message:
Failed to load resource: the server responded with a status of 403 ()
other error URL: chrome-error://chromewebdata/
Message:
Refused to display 'https://zacksource.click/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nasle4.com
w.usabilla.com
zacksource.click
2606:4700:3036::ac43:c08a
2a06:98c1:3120::3
34.242.77.172
0b9219c0bb4070af4eca3f58737b60adf42ed3867bef6fbf9bf935ffa210d02f
19d0bda83ecbc986620468801adf000c77c3c38398650903c63fac8dcbac4383
28ef8eb4855c358648f24cd9be624f9b9c636a2d9331dece905ce7b58c4b21c9
362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419
3a00c72d097a4ab9b0c5f078ef128cf63b39fbbe72c298f3c46b842ce0b5770d
46098468df2bec8cb50790597de30d089ecd7dcc77432b6a08b9e3ff1a7d7802
5aa9a388b209895cda1b780f1a8a6c0293c5ac859c4a0d766b5a39d9ea000fcc
5af5c3746b03792640b9cafdabddfb2c5407f72988e128541a88fa439607d940
651b675695363ea33cfb24fc05c6b22b9eb862bed3b1ba3f02eb26ba6c685c5b
6781eff2f7ef7c39301b652091f701f614b91209752a79027685bb4b78697d9a
7b7e4adb65aa53b1bc731f15511c53d5beb73f187d5c5f35f19ebbfaf0decbbd
80eb5bd83414dafe94f11cfdd7154c125f7f052d0028a086e26f91ff5bd542d3
87c40e3961e21f759770615ae67568a3de3ec6e0735f1238a6aae062f4ea15d5
8c6a5dc163115fa86582734510a28061e3f7746033d5d5ddba3224bcdba1ffa8
9b0e62097bfb5f146ba1203b0664e0831a8db3df26dbb437210934c7e131650b
a18c4e93c1519e4d37cf87403af638a6eadb55a88d6930998d766f6e8a8c5020
a234843f5eeb37a67b57b5419d76dd938e2546f79619147f439fbef2199eb5af
b5335e0b117f099169020346db0d11cba41d56ff38935733e6987f09bd7ebbf5
be97b87d38cc8e03e82e4a73ccef3ce4997dbdc0e5ef7259bbe2db9402522a1c
d2414cce6ee6e5ce602c45e4bfa7aea3c7ceaa03819987aae136a93253ab344c
d71854e46da18172ed3b345fd5aea960da910e6bb0a39dd12e57ee1d792b1d26
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f83d5a4f7f47132b22bd006c11b5240dff2e24239aad5669efb7162db6a9481b
fa27d936d088620b27debb4c2a3da24d27346505d247a56d098ae56e3a2da07a