parcel.evri.phgida.com.tr
Open in
urlscan Pro
77.95.113.16
Malicious Activity!
Public Scan
Effective URL: https://parcel.evri.phgida.com.tr/etrackmyparcel?reff=99d98e0f1abebed68e4a86ae9a571881
Submission: On November 27 via manual from GB — Scanned from DE
Summary
TLS certificate: Issued by R3 on November 26th 2023. Valid for: 3 months.
This is the only time parcel.evri.phgida.com.tr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Hermes (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.222.191.119 52.222.191.119 | 16509 (AMAZON-02) (AMAZON-02) | |
2 2 | 45.155.127.11 45.155.127.11 | 42724 (TALIDO) (TALIDO) | |
1 8 | 77.95.113.16 77.95.113.16 | 51713 (WHG-LON) (WHG-LON) | |
7 | 1 |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-191-119.ham50.r.cloudfront.net
qrco.de |
ASN42724 (TALIDO, TR)
PTR: hostingtr57.sunucucozumleri.com
hgconcept.com.tr |
ASN51713 (WHG-LON, GB)
PTR: s687.lon1.mysecurecloudhost.com
parcel.evri.phgida.com.tr |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
phgida.com.tr
1 redirects
parcel.evri.phgida.com.tr |
132 KB |
2 |
hgconcept.com.tr
2 redirects
hgconcept.com.tr |
339 B |
1 |
qrco.de
1 redirects
qrco.de — Cisco Umbrella Rank: 71546 |
338 B |
7 | 3 |
Domain | Requested by | |
---|---|---|
8 | parcel.evri.phgida.com.tr |
1 redirects
parcel.evri.phgida.com.tr
|
2 | hgconcept.com.tr | 2 redirects |
1 | qrco.de | 1 redirects |
7 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
parcel.evri.phgida.com.tr R3 |
2023-11-26 - 2024-02-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://parcel.evri.phgida.com.tr/etrackmyparcel?reff=99d98e0f1abebed68e4a86ae9a571881
Frame ID: DCE700C8C2622AC962C3009975CCC626
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Evri - The New Hermes | Cheap Parcel Delivery & Courier ServicePage URL History Show full URLs
-
https://qrco.de/SD854ds8S74D674d8498SD478s74d98
HTTP 302
https://hgconcept.com.tr/asset HTTP 301
https://hgconcept.com.tr/asset/ HTTP 302
https://parcel.evri.phgida.com.tr/parcel HTTP 307
https://parcel.evri.phgida.com.tr/etrackmyparcel?reff=99d98e0f1abebed68e4a86ae9a571881 Page URL
Detected technologies
Nuxt.js (JavaScript Frameworks) ExpandDetected patterns
- <div [^>]*id="__nuxt"
Vue.js (JavaScript Frameworks) Expand
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://qrco.de/SD854ds8S74D674d8498SD478s74d98
HTTP 302
https://hgconcept.com.tr/asset HTTP 301
https://hgconcept.com.tr/asset/ HTTP 302
https://parcel.evri.phgida.com.tr/parcel HTTP 307
https://parcel.evri.phgida.com.tr/etrackmyparcel?reff=99d98e0f1abebed68e4a86ae9a571881 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
etrackmyparcel
parcel.evri.phgida.com.tr/ Redirect Chain
|
32 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
d_main.css
parcel.evri.phgida.com.tr/assets/css/ |
20 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
evri-heart.svg
parcel.evri.phgida.com.tr/assets/img/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.js
parcel.evri.phgida.com.tr/assets/js/ |
266 KB 75 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
misc.js
parcel.evri.phgida.com.tr/assets/js/ |
16 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
poppins-regular-webfont.7930357.woff2
parcel.evri.phgida.com.tr/assets/fonts/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
poppins-semibold-webfont.392d12d.woff2
parcel.evri.phgida.com.tr/assets/fonts/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Hermes (Transportation)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery object| $jscomp1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
parcel.evri.phgida.com.tr/ | Name: cookie_profiles Value: c49a1f24da2f62b208a1a4e8da19fe9d9d74cc9f |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
hgconcept.com.tr
parcel.evri.phgida.com.tr
qrco.de
45.155.127.11
52.222.191.119
77.95.113.16
067b66273ba2a156d2f6ca5529e4aeb9949408e47e06bd2d38e2093edc3bbab1
475575a56670c4ab3f05ca4b001674bbea9e6cbacaf9e0c0f2527a1aacdb9731
5805b5c786e9d2a4ef962597ae6f2ad133b015b182ab5ff0747e1ae373a20c26
6c072d5390b0af0f25e23f3113ecd39b85222a73eabe923e3b24ce933677895e
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff
9ef8445f3db0cdaddeaac7cb3adb4ef761f316f971b34aaf50f6c30a81c0d9e0
aa903e3df20c956da57c84343f89a9d72c52c9dd4a69463cdeb332af7d8f1e64