Security Scan Report: d33wubrfki0l68.cloudfront.net

Submitted: Completed: publiccompleted
This website contacted 6 IPs in 1 country across 4 domains to perform 7 HTTP transactions. The main domain is cloudfront.net and was registered 18 years ago.

Submitted URL: https://d33wubrfki0l68.cloudfront.net/2cc66cdc-df86-4819-b72b-5a410d6abfe5/dhl123.html

AI Security Verdict

Confirmed Scam

Confidence: 93%

10
Risk Score

Fake DHL Express login page on a CloudFront bucket path, harvesting email and password. Brand impersonation plus credential form — classic phishing. Do not enter credentials.

Risk Factors (5)
Credential-harvesting login form (email + password) on a CloudFront-hosted page
Impersonation of the DHL Express brand on a non-DHL, non-official domain
Cloud-storage shared tenant with unknown actual page creation date; apex age not attributable
Domain not ranked in Cisco Umbrella top 1M despite claiming a major logistics brand
Single-source threat-intel phishing report on the primary domain
Domain age information unavailable

Details

Page Title

DHL EXpress

Scan Type

public

Domain Name Analysis

The domain name 'd33wubrfki0l68.cloudfront.net' uses the network infrastructure generic top-level domain (.net) with subdomain 'd33wubrfki0l68'. Count 10 characters in 'cloudfront' with three vowels and 7 consonants. Tokenizing the label suggests 2 words: cloud, front. The median word length lands at five characters. No strong language cues emerged from the frequency lists.

Screenshot

an) 5<s/2 DHL Express Commerce Features Integrations Support About us DHL EXPRESS DHL Express --; Enter your credentials to proceed | Email address [Signin] SELL EVERYWHERE SHIP FROM ONE PLACE...

Page Load Overview

0.62s
Total Load Time
1.6 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:99 chars
Detector Agreement:100%

Website Classification

Primary Category

technology software76% confidence
Type: webapp
Method: ml+structural+ocr_tiebreaker

All Detected Categories

technology software
76%
e-commerce shopping
74%

Detected Features

Login Form

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
218.64.16.66Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
118.64.16.43Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
1142.250.154.95Google · CDNUnited States
AS15169Google LLC
1188.114.97.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.110.94Google · CDNUnited States
AS15169Google LLC
1188.114.96.3Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
76--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T196E1930665A715923503C47877D333813225C003EC0AD8657BDD63AC9FDAE81AEB2BCE

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

192:77vCxEMD2NF2HYN9OkuUQJcYeQ76Dm8vZ9DN:yp4d0eFDDN

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:6841:IIWKbgAAIOAAwaUCsFoARKAAJHkBYEAOhDEBxToAHaADQFABm0igAGgGIQRKIDBIFlOwpBAFYEMKEV8AAALSAKIpBWqSQZhA

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00b4b9b9f3f9f0f0
Perceptual Hash:cf9b6690b4590967
Difference Hash:ad65633347636367
Wavelet Hash:00b4b899fbf8f0f0
Color Hash:N/A

Scan History

Scan history not available

Unable to load historical scan data