| |  47.251.24.196 | 301 Moved Permanently | 0 B |
URL User Request GET HTTP/1.1IP47.251.24.196:80 ASN#45102 Alibaba US Technology Co., Ltd.
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. |
GET / HTTP/1.1
Host: 21ovpo.ttu.cc
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Fri, 10 May 2024 15:26:17 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.0.33 mod_perl/2.0.11 Perl/v5.16.3
X-Powered-By: PHP/7.0.33
Location: https://dhl-parcel.20-240-220-64.cprapid.com
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
|
|
| dhl-parcel.20-240-220-64.cprapid.com/ |  20.240.220.64 | | 117 kB |
URL dhl-parcel.20-240-220-64.cprapid.com/ IP20.240.220.64:0 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
File typeHTML document, Unicode text, UTF-8 text, with very long lines (10129), with CRLF line terminators Size117 kB (117024 bytes) Hash7714e7b0de5d7a6d3dc0df04cf1b3554 f80ae6e3e4290edc272e67b3974d4c535e9ede7a 09a6a519ac84b1f3b157bcea0601c09bfbc28e317022d7d25fbfeb21ecc83802
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
GET / HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:18 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
|
|
| dhl-parcel.20-240-220-64.cprapid.com/files/engine.js | 20.240.220.64 | | 16 kB |
URL dhl-parcel.20-240-220-64.cprapid.com/files/engine.js IP20.240.220.64:0 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
File typeJavaScript source, ASCII text Hash1725e9260afd41819d150220eff332fb d8276ad5444118e5099fc758b451aee5aa61797b 8e25f17acdde06dbc2c1f63f7a579b3578902c7f018c2fd3c93f632af16ecd30
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
GET /files/engine.js HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:18 GMT
Server: Apache
Last-Modified: Wed, 08 May 2024 11:30:20 GMT
Accept-Ranges: bytes
Content-Length: 16512
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/javascript
|
|
| unpkg.com/@alpinejs/mask@3.13.10/dist/cdn.min.js |  104.17.248.203 | | 1.8 kB |
URL unpkg.com/@alpinejs/mask@3.13.10/dist/cdn.min.js IP104.17.248.203:0
File typeJavaScript source, ASCII text, with very long lines (2167) Hashe36ee2e1dd7afa02202b11f93856f577 92edcba0853efd66c33a6fd4fd4d7dc368e5d1f1 2f7002451d78511fa76aaea453e83b29e339b93a533c238fd0de4f3be367c24f
GET /@alpinejs/mask@3.13.10/dist/cdn.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 15:26:18 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "878-ku3LoIU+/WbDOm/U/U19w2jl0fE"
via: 1.1 fly.io
fly-request-id: 01HWR0Q480XWR52YGVNAF5P12G-arn
cf-cache-status: HIT
age: 856762
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 881af2669b335696-OSL
X-Firefox-Spdy: h2
|
|
| unpkg.com/@alpinejs/mask@3.x.x/dist/cdn.min.js | 104.17.248.203 | | 568 B |
URL unpkg.com/@alpinejs/mask@3.x.x/dist/cdn.min.js IP104.17.248.203:0
File typeASCII text, with no line terminators Hash8f6b7f3c32b11b34fbccad962af01b05 a8df8411715ddb9edf950cecc993567240fee5ac eb62b8fac31051be97ed0dab015fd50ec4f77da9ddd6060c0243a1c7ab800f76
GET /@alpinejs/mask@3.x.x/dist/cdn.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 10 May 2024 15:26:18 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=600, max-age=60
location: /@alpinejs/mask@3.13.10/dist/cdn.min.js
vary: Accept, Accept-Encoding
content-encoding: br
via: 1.1 fly.io
fly-request-id: 01HXHHM3BFNK8VAK8JA2H6Q7KZ-arn
cf-cache-status: HIT
age: 176
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 881af2666af35696-OSL
X-Firefox-Spdy: h2
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:19 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
| dhl-parcel.20-240-220-64.cprapid.com/img/favicon.ico | 20.240.220.64 | | 7.4 kB |
URL dhl-parcel.20-240-220-64.cprapid.com/img/favicon.ico IP20.240.220.64:0 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
File typeMS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel Hashbbba65f5c0e656750df8c649749447c8 107d1dc536e768776a10d20b362e253ec684832a c4caa8b38ca6962dfeaa34445597ba59d691d60633f4dda63630f27738c06497
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
GET /img/favicon.ico HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:19 GMT
Server: Apache
Last-Modified: Wed, 08 May 2024 11:30:20 GMT
Accept-Ranges: bytes
Content-Length: 7406
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: image/x-icon
|
|
| unpkg.com/alpinejs@3.13.10/dist/cdn.min.js | 104.17.248.203 | | 20 kB |
URL unpkg.com/alpinejs@3.13.10/dist/cdn.min.js IP104.17.248.203:0
File typeJavaScript source, ASCII text, with very long lines (39233) Hash48edb119e6ee7a0e4de109f8445a94a2 6195f8ec0a2449a1beaa41990f803b7e58a6961b fb9b146b7fbd1bbf251fb3ef464f2e7c5d33a4a83aeb0fcf21e92ca6a9558c4b
GET /alpinejs@3.13.10/dist/cdn.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 15:26:18 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "adec-YZX47AokSaG+qkGZD4A7flimlhs"
via: 1.1 fly.io
fly-request-id: 01HWQWR6KD3RYVR31TMWK0JV9W-arn
cf-cache-status: HIT
age: 860922
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 881af2669b345696-OSL
X-Firefox-Spdy: h2
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:23 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:25 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
| cdn.tailwindcss.com/3.4.3 | 172.67.41.16 | 200 OK | 119 kB |
URL GET HTTP/2cdn.tailwindcss.com/3.4.3 IP172.67.41.16:443
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerCloudflare, Inc. Subjecttailwindcss.com Fingerprint5F:87:FB:92:D4:93:DA:09:E3:5B:EF:92:CE:2F:47:18:3A:8A:C7:49 ValidityTue, 07 Nov 2023 00:00:00 GMT - Tue, 05 Nov 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (52292) Size119 kB (119001 bytes) Hash4bdcdace639cc6c0f08a15c295482172 6fa7ad6e87d8b19bff7e2bd0becf87d87d57be31 d2c35bf03246b0634bb22cbdc74962c8368e5e13b656e7f3cc10029da79d2e5c
GET /3.4.3 HTTP/1.1
Host: cdn.tailwindcss.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 10 May 2024 15:26:18 GMT
content-type: text/javascript
cache-control: max-age=31536000
content-encoding: br
strict-transport-security: max-age=63072000
x-vercel-cache: MISS
x-vercel-id: cle1::iad1::rn74h-1711569125689-ef02b3caf33b
last-modified: Wed, 27 Mar 2024 19:52:06 GMT
cf-cache-status: HIT
age: 846866
vary: Accept-Encoding
server: cloudflare
cf-ray: 881af266aee556c6-OSL
X-Firefox-Spdy: h2
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:27 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:29 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:31 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:33 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=90
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:35 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=89
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:37 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=88
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
| dhl-parcel.20-240-220-64.cprapid.com/gate.php | 20.240.220.64 | 200 OK | 48 B |
URL POST HTTP/1.1dhl-parcel.20-240-220-64.cprapid.com/gate.php IP20.240.220.64:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://dhl-parcel.20-240-220-64.cprapid.com/ CertificateIssuerLet's Encrypt Subjectcpanel.dhl-parcel.20-240-220-64.cprapid.com Fingerprint3C:A5:F1:CC:F8:32:4F:0B:C9:C1:27:59:90:4C:8E:48:95:A7:05:93 ValidityWed, 08 May 2024 14:29:38 GMT - Tue, 06 Aug 2024 14:29:37 GMT
Hash0a40dbe0ebedec6df5187223293035f9 7628c3d60fbc763002e4a8090c90267d169d4e22 d45e227c3b794ace485cf3271f57f0ce2ac1687bf964613320b7cf1918bb7a61
| Analyzer | Verdict | Alert |
|---|
| OpenPhish | phishing | DHL Airways, Inc. | | PhishTank | phishing | DHL | | Quad9 DNS | malicious | Sinkholed |
POST /gate.php HTTP/1.1
Host: dhl-parcel.20-240-220-64.cprapid.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dhl-parcel.20-240-220-64.cprapid.com/
content-type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 11
Origin: https://dhl-parcel.20-240-220-64.cprapid.com
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=8cca5d01bf09644842431eb9ca48e5d4
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 10 May 2024 15:26:39 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=87
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/json
|
|
0.0.0.0