eslemployer.com - urlscan.io

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 104.28.6.16, located in San Francisco, United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is eslemployer.com.

This is the only time eslemployer.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	104.28.6.16 104.28.6.16	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	104.28.7.16 104.28.7.16	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	216.58.214.110 216.58.214.110	15169 (GOOGLE) (GOOGLE - Google LLC)
4	4

1 104.28.6.16 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

eslemployer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.28.7.16 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

eslemployer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.214.110 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s05-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	google-analytics.com www.google-analytics.com	14 KB
2	eslemployer.com eslemployer.com	85 KB
4	2

	Domain	Requested by
2	www.google-analytics.com	eslemployer.com
2	eslemployer.com	eslemployer.com
4	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://eslemployer.com/pas/dhl%20new/index2.html
Frame ID: 37913BE4BCCBB398FC8C687D63C2D400
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

4
IPs

1
Countries

99 kB
Transfer

327 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://www.google-analytics.com/analytics.js HTTP 307
https://www.google-analytics.com/analytics.js

Request Chain 2

http://www.google-analytics.com/r/collect?v=1&_v=j66&a=410806773&t=pageview&_s=1&dl=http%3A%2F%2Feslemployer.com%2Fpas%2Fdhl%2520new%2Findex2.html&ul=en-us&de=UTF-8&dt=DHL%20%7C%20Tracking%20System&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1350504047&gjid=1695204384&cid=1367721795.1523383962&tid=UA-46867713-1&_gid=408369087.1523383962&_r=1&z=700601948 HTTP 307
https://www.google-analytics.com/r/collect?v=1&_v=j66&a=410806773&t=pageview&_s=1&dl=http%3A%2F%2Feslemployer.com%2Fpas%2Fdhl%2520new%2Findex2.html&ul=en-us&de=UTF-8&dt=DHL%20%7C%20Tracking%20System&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1350504047&gjid=1695204384&cid=1367721795.1523383962&tid=UA-46867713-1&_gid=408369087.1523383962&_r=1&z=700601948

4 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set index2.html Show response
eslemployer.com/pas/dhl%20new/ 197 KB
82 KB 238ms
226ms Document
text/html 104.28.6.16
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://eslemployer.com/pas/dhl%20new/index2.html
Protocol: HTTP/1.1
Server: 104.28.6.16 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 132ae0c9afd39c4ab44d625777fe6be64606576106aeab8c02816b8ae52edc8a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: eslemployer.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 10 Apr 2018 18:12:42 GMT
Content-Encoding: gzip
Last-Modified: Fri, 02 Mar 2018 05:48:14 GMT
Server: cloudflare
Transfer-Encoding: chunked
Content-Type: text/html
Set-Cookie: __cfduid=d0a1cbd95b5410715ea1f74849152fc791523383961; expires=Wed, 10-Apr-19 18:12:41 GMT; path=/; domain=.eslemployer.com; HttpOnly
Connection: keep-alive
CF-RAY: 40972ee142969d0e-AMS

GET
H/1.1 200
OK c2kgMt9ja9bXu62fLkR6YuL9eyA.js Show response
eslemployer.com/cdn-cgi/apps/head/ 6 KB
3 KB 42ms
19ms Script
application/javascript 104.28.7.16
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://eslemployer.com/cdn-cgi/apps/head/c2kgMt9ja9bXu62fLkR6YuL9eyA.js
Requested by: Host: eslemployer.com
URL: http://eslemployer.com/pas/dhl%20new/index2.html
Protocol: HTTP/1.1
Server: 104.28.7.16 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc24debf9d79093a460a612307ec96603d1b3877319f1242c3eb175565f42787

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: eslemployer.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: */*
Referer: http://eslemployer.com/pas/dhl%20new/index2.html
Cookie: __cfduid=d0a1cbd95b5410715ea1f74849152fc791523383961
Connection: keep-alive
Cache-Control: no-cache
Referer: http://eslemployer.com/pas/dhl%20new/index2.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 10 Apr 2018 18:12:42 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
x-amz-request-id: 54CE033FC4363BD1
CF-RAY: 40972ee2d7a52c66-AMS
Connection: keep-alive
Content-Length: 2027
x-amz-id-2: ODoKqI9Qo2wrLJyAVgedm2wymwaPm11oDdS4xojXzocMFqUngoPBkJ/dew1DSKNfLyliXOjyE5I=
Last-Modified: Thu, 20 Jul 2017 16:00:28 GMT
Server: cloudflare
ETag: "30d8e820e8b0919b834b209514001060"
Vary: Accept-Encoding
x-amz-version-id: feTvqjSyNVLosZLOXGTeWLkKhhfrU0SB
Cache-Control: public, max-age=31536000
Content-Type: application/javascript; charset=utf-8
Expires: Wed, 10 Apr 2019 18:12:42 GMT

GET
S

200

analytics.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/analytics.js
https://www.google-analytics.com/analytics.js

35 KB
14 KB

9ms
8ms

Script
text/javascript

216.58.214.110
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: eslemployer.com
URL: http://eslemployer.com/pas/dhl%20new/index2.html

Protocol

SPDY

Server

216.58.214.110 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s05-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://eslemployer.com/pas/dhl%20new/index2.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 13 Nov 2017 20:19:12 GMT
server: Golfe2
age: 5434
date: Tue, 10 Apr 2018 16:42:08 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
content-length: 14597
expires: Tue, 10 Apr 2018 18:42:08 GMT

Redirect headers

Location: https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason: HSTS

GET
S

200

collect
www.google-analytics.com/r/
Redirect Chain

http://www.google-analytics.com/r/collect?v=1&_v=j66&a=410806773&t=pageview&_s=1&dl=http%3A%2F%2Feslemployer.com%2Fpas%2Fdhl%2520new%2Findex2.html&ul=en-us&de=UTF-8&dt=DHL%20%7C%20Tracking%20System...
https://www.google-analytics.com/r/collect?v=1&_v=j66&a=410806773&t=pageview&_s=1&dl=http%3A%2F%2Feslemployer.com%2Fpas%2Fdhl%2520new%2Findex2.html&ul=en-us&de=UTF-8&dt=DHL%20%7C%20Tracking%20Syste...

35 B
111 B

13ms
13ms

Image
image/gif

216.58.214.110
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j66&a=410806773&t=pageview&_s=1&dl=http%3A%2F%2Feslemployer.com%2Fpas%2Fdhl%2520new%2Findex2.html&ul=en-us&de=UTF-8&dt=DHL%20%7C%20Tracking%20System&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1350504047&gjid=1695204384&cid=1367721795.1523383962&tid=UA-46867713-1&_gid=408369087.1523383962&_r=1&z=700601948

Requested by

Host: eslemployer.com
URL: http://eslemployer.com/pas/dhl%20new/index2.html

Protocol

SPDY

Server

216.58.214.110 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s05-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://eslemployer.com/pas/dhl%20new/index2.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Apr 2018 18:12:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://www.google-analytics.com/r/collect?v=1&_v=j66&a=410806773&t=pageview&_s=1&dl=http%3A%2F%2Feslemployer.com%2Fpas%2Fdhl%2520new%2Findex2.html&ul=en-us&de=UTF-8&dt=DHL%20%7C%20Tracking%20System&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1350504047&gjid=1695204384&cid=1367721795.1523383962&tid=UA-46867713-1&_gid=408369087.1523383962&_r=1&z=700601948
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 55 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e7daf828ab92681934468b4d7fe32b16686b819f7d79079dd55b6b969541c93

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 35 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ffcc6dc74417e3a4b2d600ddeb06cc55a11ba5e3c55577dbb328d9d913ea8d5c

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.eslemployer.com/	1970-01-18 15:11:10	Name: _gid Value: GA1.2.408369087.1523383962
.eslemployer.com/	1970-01-19 08:40:55	Name: _ga Value: GA1.2.1367721795.1523383962
.eslemployer.com/	1970-01-18 15:09:44	Name: _gat Value: 1
.eslemployer.com/	1970-01-18 23:55:19	Name: __cfduid Value: d0a1cbd95b5410715ea1f74849152fc791523383961

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

eslemployer.com
www.google-analytics.com
104.28.6.16
104.28.7.16
216.58.214.110
132ae0c9afd39c4ab44d625777fe6be64606576106aeab8c02816b8ae52edc8a
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9e7daf828ab92681934468b4d7fe32b16686b819f7d79079dd55b6b969541c93
cc24debf9d79093a460a612307ec96603d1b3877319f1242c3eb175565f42787
f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7
ffcc6dc74417e3a4b2d600ddeb06cc55a11ba5e3c55577dbb328d9d913ea8d5c

eslemployer.com Open in urlscan Pro 104.28.6.16 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

4 IPs

1 Countries

99 kBTransfer

327 kBSize

4 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

4 Cookies

Indicators

eslemployer.com Open in urlscan Pro
104.28.6.16 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

4
IPs

1
Countries

99 kB
Transfer

327 kB
Size

4
Cookies

4 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!