r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash cfec3d7283a9b66d2be426ce54d210f3
808c1feb1ba918951d1928c1f6bfc0c253262774
1bad6c06aa3e88dcbc125fc98a6cb753eb2b18d2c8dd61da21d12209aeeda3f9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1BAD6C06AA3E88DCBC125FC98A6CB753EB2B18D2C8DD61DA21D12209AEEDA3F9"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9643
Expires: Mon, 05 Dec 2022 05:06:10 GMT
Date: Mon, 05 Dec 2022 02:25:27 GMT
Connection: keep-alive
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash fb2c0697c6d9a96a5411dd2952947458
79e57f831ec396bbdaa5bfe9472a05e6c9fb31f4
3fd7edcc349ab4402f62e54a142be6b4cecf0e7ee3f431d3168bdf0643ba4d92
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2610
Cache-Control: max-age=118160
Content-Type: application/ocsp-response
Date: Mon, 05 Dec 2022 02:25:27 GMT
Etag: "638c76f5-1d7"
Expires: Tue, 06 Dec 2022 11:14:47 GMT
Last-Modified: Sun, 04 Dec 2022 10:31:17 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 471
firefox.settings.services.mozilla.com/v1/
34.102.187.140200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 05 Dec 2022 02:20:11 GMT
cache-control: public,max-age=3600
content-type: application/json
age: 317
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 1ea206ac3c440825741687351f8c6e4e
2f38dafd8c43dcce2411a0590bc5c02cd6286735
7d7232c8c91bcd18161ba2c9d23e3bff159604e058bd5b3fc1c7fcbcd03a7ee3
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7D7232C8C91BCD18161BA2C9D23E3BFF159604E058BD5B3FC1C7FCBCD03A7EE3"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10740
Expires: Mon, 05 Dec 2022 05:24:28 GMT
Date: Mon, 05 Dec 2022 02:25:28 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 9ebddc2b260d081ebbefee47c037cb28
492bad62a7ca6a74738921ef5ae6f0be5edebf39
74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: MXVAdAxtdkWkhZ8ZhSXMg7K1aBqokL2nEO3sHIoFUXxb/2Dzc0P0Y4PtZqXCeZejofzFR41mxzs=
x-amz-request-id: WK6609A4G295GAJT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 05 Dec 2022 01:47:47 GMT
age: 2261
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
dmegwqxnml.ctraltdel.world/vnafvra97w?q=5562946343&id=u2.2
31.41.244.107302 Found 0 B URL HTTP/1.1 dmegwqxnml.ctraltdel.world/vnafvra97w?q=5562946343&id=u2.2
IP 31.41.244.107:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
quad9 Sinkholed
GET /vnafvra97w?q=5562946343&id=u2.2 HTTP/1.1
Host: dmegwqxnml.ctraltdel.world
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Server: nginx/1.14.0 (Ubuntu)
Date: Mon, 05 Dec 2022 02:25:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Set-Cookie: 7a7f440a28621ec901c1138bbc50817e=0; expires=Tue, 06-Dec-2022 02:25:27 GMT; Max-Age=86400; path=/; secure; HttpOnly; SameSite=None
Location: https://dhl.tracking.mli.cloud/verfolgung/ef96b2a4cca611ecaebeb178?page=u2.2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 05 Dec 2022 02:25:28 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
34.102.187.140200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 34.102.187.140:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 05 Dec 2022 02:11:19 GMT
cache-control: public,max-age=3600
age: 849
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 31b129c94a90b1e695b21395cb54e378
a3cae46b48d469cc61ab0581303bcd5f5b654db9
fac3f681be358a20f78958dff10c89b7a91365c5114c81246c1bc34c1362ba1e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2596
Cache-Control: max-age=113079
Content-Type: application/ocsp-response
Date: Mon, 05 Dec 2022 02:25:28 GMT
Etag: "638c632b-1d7"
Expires: Tue, 06 Dec 2022 09:50:07 GMT
Last-Modified: Sun, 04 Dec 2022 09:06:51 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 471
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 4d5c8c1574f278765f886ea5f1f3c485
1067231c087b52dc964f7cd28b846e23c63c73c4
76b2634b9fdb7c5cad809ff0ea33e6511503e086a7e8e3ba068e61c07f0f850e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "76B2634B9FDB7C5CAD809FF0EA33E6511503E086A7E8E3BA068E61C07F0F850E"
Last-Modified: Sun, 04 Dec 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Mon, 05 Dec 2022 08:25:28 GMT
Date: Mon, 05 Dec 2022 02:25:28 GMT
Connection: keep-alive
push.services.mozilla.com/
35.164.183.116101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 35.164.183.116:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: JLzWiOxrDCIQhp6ZoOoAnQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 8EZs2KkpMJhd8kPID8L5R+jqHGM=
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive
r3.o.lencr.org/
23.36.77.32200 OK 503 B IP 23.36.77.32:0
ASN #20940 Akamai International B.V.
Hash 83e0936435ad95a15c9ec5ff9520f4fe
a8225ee0d8ae117f977f7ff817c342c62e91b5a9
ef0f5b2ab2055446d4ea8b738f605c3bf835cf72e872d6a9c9a6c9b2917737e7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F206a2aa2-193a-45ee-9210-82fa22154882.jpeg
34.120.237.76200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F206a2aa2-193a-45ee-9210-82fa22154882.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash fe33ecc20db57514c51c90694efebb16
e00b8b1bc1f98df439a264d1cd881e1021d7fdd5
9b0e56806a9f4e7458b58c29ec2050faebcded4ff1c4ef430733171ddae68cb7
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F206a2aa2-193a-45ee-9210-82fa22154882.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7396
x-amzn-requestid: c7621897-64ac-4eb2-b25a-f9ea2e7059a7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cjKVyFr5IAMF8QQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638abdbe-4383156307fcd0da5022d553;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 03:08:46 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: tyEtTMK1H4Sl1eKyySi7qu2CJokOzMaLj0fLriYd01UWNCyS44zC5g==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 05:07:02 GMT
age: 76708
etag: "e00b8b1bc1f98df439a264d1cd881e1021d7fdd5"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb6034ca-f8c1-4979-8165-5f755e5d12a1.jpeg
34.120.237.76200 OK 6.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb6034ca-f8c1-4979-8165-5f755e5d12a1.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 3c36448c65274ebbe1eb21e3bf02385e
e03cf1c7c2ec15b3cc50d9c54bebbf81aa08cf28
6f17788a394f1305755805a1b92117b1c1a03a1e3a075cb97a0da5184d574553
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb6034ca-f8c1-4979-8165-5f755e5d12a1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 6430
x-amzn-requestid: ae2ec151-d383-4554-9ac2-3d204701251c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_ttFDKoAMFp0A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d1324-15aebb1a06253068472a6ab0;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:40 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: kYXmy10msfeWdDYgvq0PXyGpy9UJyQkSLAhR_Q5PQMllJPXOOTnalw==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:45:53 GMT
age: 16777
etag: "e03cf1c7c2ec15b3cc50d9c54bebbf81aa08cf28"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc619d7d-5f58-4402-a30a-fe05dd9e2922.jpeg
34.120.237.76200 OK 14 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc619d7d-5f58-4402-a30a-fe05dd9e2922.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6079166a1ed5bac7373183f03f33b84e
b0c9391b87a4560598e43d5084dda41e267974a9
3e2faccbc3e14a10da4a433d789068cdc3fb2d3e2a04a7e2b7ea5f6f6313dcd4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc619d7d-5f58-4402-a30a-fe05dd9e2922.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13647
x-amzn-requestid: 36276b12-9e02-4d00-a100-9aa5c794fc79
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_ueEWUoAMFj7Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d1329-7abb45a85c6bc2235c25d61e;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: oXeR8DTpEoK8E-BiI7gT4JEIdVBfiimfydNYIC62_rNLlTdem9Buig==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:45:46 GMT
age: 16784
etag: "b0c9391b87a4560598e43d5084dda41e267974a9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60dcc231-abb7-48f1-8ec5-e25b31bd100b.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60dcc231-abb7-48f1-8ec5-e25b31bd100b.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 24c69d7ef356b352956d6dcbc9f5df1d
2cc31dc1c5d2d2a8b3a378dce8a1240a79acfec9
94d068620c34652cb2d24ca8b3cf962febe9606e6d3a33d937fc9d99f176edef
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60dcc231-abb7-48f1-8ec5-e25b31bd100b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10396
x-amzn-requestid: b879fd2e-b6cf-4373-b780-2d97481c45f8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cioNbH5KoAMFUsA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a8722-6add7f8e225878473b20c015;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 23:15:46 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ir97GJKaFoW6BNXCcmMqp0JSUd5JhCACyUvLh5G-0BWCDVJsqs7XhQ==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 22:03:01 GMT
age: 15749
etag: "2cc31dc1c5d2d2a8b3a378dce8a1240a79acfec9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0b3b9022-ae31-4c4b-b4aa-3d82606d5c7c.jpeg
34.120.237.76200 OK 5.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0b3b9022-ae31-4c4b-b4aa-3d82606d5c7c.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash f0402b0c3474a5bd3b1ba804528b64a8
2d47af0fb664d9fec52549bb3bdba1dfd8911bb2
7f87af77663b8bf22211e135554ada8865cdcf6499e9fcf0f3442b10ca3984e1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0b3b9022-ae31-4c4b-b4aa-3d82606d5c7c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5276
x-amzn-requestid: d337310e-59be-4268-bfd0-8cc4f2c91a11
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_soE98IAMF0aA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d131d-230591591f8fd0984c222549;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:33 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: x7xrn7E3aUdw75Br3B_GcqRhg-i5FcqG2NRMo4Pa5VhqjblbsvcgDg==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:48:15 GMT
age: 16635
etag: "2d47af0fb664d9fec52549bb3bdba1dfd8911bb2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47f316c5-1381-4b6e-9e8d-f1956258ef3e.jpeg
34.120.237.76200 OK 6.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47f316c5-1381-4b6e-9e8d-f1956258ef3e.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash a349d02cce160f72cc93f6fb6e45fa46
a6f82481ea0a820da0f199e8f9051a4aa4013c82
ab320118577a2dcb6ab7ad904d6350e187501a94b39b71fdd70b31cbc8853b24
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47f316c5-1381-4b6e-9e8d-f1956258ef3e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6826
x-amzn-requestid: f0abdba6-14c8-4aae-ba3b-37ba0af2ff08
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_t2FsLIAMFekA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d1325-3452be066acddb554f528cc3;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:41 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: GS4yLzXiIZt-eL9T7gjbf2-vMu8i30WKPDmc2EQDxv0CELjdW1gMVA==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:46:51 GMT
age: 16719
etag: "a6f82481ea0a820da0f199e8f9051a4aa4013c82"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
dhl.tracking.mli.cloud/verfolgung/ef96b2a4cca611ecaebeb178?page=u2.2
154.56.0.125302 Found 88 B URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/ef96b2a4cca611ecaebeb178?page=u2.2
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type HTML document, ASCII text, with no line terminators
Hash 4402f69f0497f76ec31747f2810a19a9
a088adb88c94dbaf72be8b649aa0a2d1de3363de
3464b8f788523618085d8f0f3c60aa9885be22d348d298d1615973e03ada98d2
GET /verfolgung/ef96b2a4cca611ecaebeb178?page=u2.2 HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/1.1 302 Found
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:55 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 88
Connection: keep-alive
X-Powered-By: PHP/5.4.16
location: tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
154.56.0.125200 OK 121 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1304), with CRLF line terminators
Size 121 kB (120762 bytes)
Hash c40e1b6a6dd73a278291e82ddb926305
281661431524c1e4e8c73cc61fc7da31b2127d36
fa8b3db0ac661a57498e5f9c7033b953b1b97905ccabf0bca751a660e7aa2d36
GET /verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2 HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:57 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16
dhl.tracking.mli.cloud/verfolgung/css/6.css
154.56.0.125200 OK 4.3 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/css/6.css
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type ASCII text, with CRLF line terminators
Hash 8eb7809b45d4079fbaa48175f64c7441
f865a99867d1eac58a575a518996ae2e9ca1de95
00d16054bb78393fecfbeff7eed0d44e005ebe51f034c838c1f69bdfddf40b01
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/css/6.css HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Type: text/css
Content-Length: 4271
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:18:34 GMT
ETag: "10af-5edc1e53cee80"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/css/3.css
154.56.0.125200 OK 22 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/css/3.css
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type ASCII text, with CRLF line terminators
Hash c54f6668454402879168d2782296d35e
dd3c72855079f3d074cfe6fd500959874650c736
d40a85d0988ad1b83645365ac9bd5ef15ed33517733d847317f86c6ea271ad32
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/css/3.css HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Type: text/css
Content-Length: 22046
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "561e-5edc1b80ec500"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/css/5.css
154.56.0.125200 OK 48 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/css/5.css
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type ASCII text, with very long lines (661), with CRLF line terminators
Hash 67f662870fef3deea83c75f68622a1e4
45bdedb38dca005081238b4cf80fa10c90778465
8fd91a16c9b120c1f43fecdb1d40a9adf7e6dc05b69c3261c342ea76ecc50c2d
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/css/5.css HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Type: text/css
Content-Length: 48507
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "bd7b-5edc1b80ec500"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/css/2.css
154.56.0.125200 OK 48 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/css/2.css
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type ASCII text, with very long lines (661), with CRLF line terminators
Hash 68bb9d41de0ac82959f8f90c552e4948
fb4e7fd67a692ae70e6b3813fe7913f0c3800103
a0879b822817892ccecb11bc4c475d4bf3aad5e03a37a49eae46dfbdcf9e8fb3
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/css/2.css HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Type: text/css
Content-Length: 48503
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "bd77-5edc1b80ec500"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/css/1.css
154.56.0.125200 OK 54 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/css/1.css
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type ASCII text, with very long lines (23076), with CRLF line terminators
Hash c773c2e44cb33bd02d04987a8017056b
af122938b5fab20abed2fd9df00af09e66294222
a116a577d744fd0c240b7f1c1b3139cc0d61b953d36fe2b61506e379e9c8bc0a
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/css/1.css HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Type: text/css
Content-Length: 53751
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "d1f7-5edc1b80ec500"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/js/jquery-1.12.2.min.js
154.56.0.125200 OK 97 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/js/jquery-1.12.2.min.js
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type ASCII text, with very long lines (32029)
Hash bdc2b7efb1faf219d65edfe253a103e9
4921529fc15b8133f2fe65b3bebf53d1e9ef8579
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/js/jquery-1.12.2.min.js HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Type: application/javascript
Content-Length: 97244
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "17bdc-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/visa.svg
154.56.0.125200 OK 4.6 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/visa.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1577)
Hash 09d8b96a0853e0bc8cec7c677c0da93b
a6aebdb9c339cac93762338353517b67e23f1903
a60079ce89803190740ddcf6e03eace0492b8f73ec57ffb4132b72a9736b68fe
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/visa.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Type: image/svg+xml
Content-Length: 4586
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "11ea-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/rating-play-store.svg
154.56.0.125200 OK 904 B URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/rating-play-store.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (512)
Hash 19a24c818ad0e0eab9418b77ff8e7c1c
3787691d98fd4b9f494664274a641226e33c1588
a6b35b6b7cabb9d33c2e1d6afef2d5f546a2fd3912f5f3e96495cd64218b9251
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/rating-play-store.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Type: image/svg+xml
Content-Length: 904
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "388-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/amex.svg
154.56.0.125200 OK 734 B URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/amex.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (565)
Hash 1c003076f46fc215f19de22568f3b5a1
112caa9374e6c1d0f8325cdcf2bde5b073f0f1ad
b64feafef2104c77f092f2bbfa526bad76e17fb053591284984e86a28ed721a2
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/amex.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Type: image/svg+xml
Content-Length: 734
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "2de-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/paypal.svg
154.56.0.125200 OK 3.4 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/paypal.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (3369), with no line terminators
Hash 4ac4e26be0277fab62f57835bca7ee1e
edef7e834db1d63bd5290adf1f0308522cced7e0
5e9402048b0efae8235057fc5db4276b0472c9a42c59c0b759e059ffbdafb32b
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/paypal.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Type: image/svg+xml
Content-Length: 3369
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "d29-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/dhl-official.svg
154.56.0.125200 OK 2.0 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/dhl-official.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (2040), with no line terminators
Hash d5a053f0005dd58489a461f599b5a508
ba71dd77800ef3d410beb8282d790642bec8193b
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/dhl-official.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Type: image/svg+xml
Content-Length: 2040
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "7f8-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/1.png
154.56.0.125200 OK 108 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/1.png
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type PNG image data, 366 x 206, 8-bit/color RGB, non-interlaced\012- data
Size 108 kB (108508 bytes)
Hash 634c39f2a51e26d2ac85598a2103e16d
1badf4773207d7238f8808f1bd42e355dd4b3a01
afcc3febb5b047b9f7d691e6e92c2239c2feee6cdb5e56a910e8a9e62387d430
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/1.png HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Type: image/png
Content-Length: 108508
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1a7dc-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/phplib/ajax.php?id=ef96b2a4cca611ecaebeb178
154.56.0.125200 OK 0 B URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/phplib/ajax.php?id=ef96b2a4cca611ecaebeb178
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
POST /verfolgung/phplib/ajax.php?id=ef96b2a4cca611ecaebeb178 HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 17
Origin: https://dhl.tracking.mli.cloud
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Set-Cookie: PHPSESSID=kjkuvh1aerlo5avnm7aghkgnb1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
dhl.tracking.mli.cloud/verfolgung/img/sprite.svg
154.56.0.125200 OK 41 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/sprite.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (28844), with CRLF line terminators
Hash cebbc77896c22e29f2a223a9efe685e3
ab3e7dc74207c4bb1f45a712d334c3d3ef8bdce8
07908237900ec13b078abee11041a05af9a7c8930a9a0e1c7d85f2c5f8ca9425
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/sprite.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Type: image/svg+xml
Content-Length: 41430
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "a1d6-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/fonts/delivery-bd.woff2
154.56.0.125200 OK 34 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/fonts/delivery-bd.woff2
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type Web Open Font Format (Version 2), TrueType, length 33840, version 1.0\012- data
Hash 682ea1d6962cd47974cd715fa3b80b4a
94a563948862a70f4d1be0a3aebc3a9f7aa800a6
4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/fonts/delivery-bd.woff2 HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 33840
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "8430-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/fonts/delivery-rg.woff2
154.56.0.125200 OK 34 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/fonts/delivery-rg.woff2
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type Web Open Font Format (Version 2), TrueType, length 33580, version 1.0\012- data
Hash 1a05a4d2566dc2490cae801e9d885ec6
2fae1307a017a9afe73d351cf15932e51dc57887
2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/fonts/delivery-rg.woff2 HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 33580
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "832c-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/fonts/delivery-cdblk.woff2
154.56.0.125200 OK 37 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/fonts/delivery-cdblk.woff2
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type Web Open Font Format (Version 2), TrueType, length 36652, version 1.0\012- data
Hash 774e0efbb9da45395efa24c9ca4248de
04eab63ba86f912514fc0ea04b025b7f2df6145b
ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/fonts/delivery-cdblk.woff2 HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 36652
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "8f2c-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/dhl-ssl-logo.svg
154.56.0.125200 OK 4.5 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/dhl-ssl-logo.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (403)
Hash f0e3cb96921af370a3ce18d1a1ded9b9
1fedecbb71184bc23dfdac38ef5b27d31da7f420
dc0fa4b8eaff05882b34c64260a6f630a3398a3a77584ef2ae6297ef10353578
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/dhl-ssl-logo.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Type: image/svg+xml
Content-Length: 4470
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1176-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/mastercard.svg
154.56.0.125200 OK 15 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/mastercard.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1435)
Hash b81045f3a463d4aabc0a41fef3bc55ef
0cf6c882fac621b65b627cb39c3bbc9d669e20d3
f4551892c81a15874332cfa9639f76a41356c9ed4ca79ff682c9114aeb12563e
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/mastercard.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Type: image/svg+xml
Content-Length: 14915
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "3a43-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/giropay.svg
154.56.0.125200 OK 2.4 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/giropay.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2396), with no line terminators
Hash 9b9e19be4be87ab5a0b96cd99754747e
edc3926e9431d362d794de7388fb4d78b156c4e8
2ef06fae9ac89777a220421e87980ef61b2a914e3eb1dec5b5c06a93531a9e38
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/giropay.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Type: image/svg+xml
Content-Length: 2396
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "95c-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/sepapay.svg
154.56.0.125200 OK 12 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/sepapay.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (12024), with no line terminators
Hash 176e69bbf00a8da5fe4921dbff1a30eb
384bbdee655135ef9a290f1365902ed6c9316969
b1764022abfe9e716542e55a05b94b851e369cd75407474874a439c61f5bd982
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/sepapay.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Type: image/svg+xml
Content-Length: 12024
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "2ef8-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/icons-nepal.svg
154.56.0.125200 OK 26 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/icons-nepal.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (25753), with CRLF line terminators
Hash 953dd00cb38ca1767d1145caf35a035b
8510eeee5a546b92d2cb4413f065aa5d49d0bfdb
2691d1e5392f267802498adb1ddc58e4d8a95a5fc69de8380e0d4ae7850c2e1c
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/icons-nepal.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Type: image/svg+xml
Content-Length: 25893
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "6525-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/dhl-group.svg
154.56.0.125200 OK 8.7 kB URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/dhl-group.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
File type SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (724)
Hash 56ceadc8919cd52c7b19d6bfd2ed1a96
5716fe99efb512515553b02fc4ca7f858aa5c980
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /verfolgung/img/dhl-group.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:01 GMT
Content-Type: image/svg+xml
Content-Length: 8715
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "220b-5e89907cbf280"
Accept-Ranges: bytes
dhl.tracking.mli.cloud/verfolgung/img/icon-sprite.svg
154.56.0.125200 OK 0 B URL HTTP/1.1 dhl.tracking.mli.cloud/verfolgung/img/icon-sprite.svg
IP 154.56.0.125:0
ASN #60602 Inovare-Prim SRL
GET /verfolgung/img/icon-sprite.svg HTTP/1.1
Host: dhl.tracking.mli.cloud
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Type: image/svg+xml
Content-Length: 116511
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1c71f-5e89907cbf280"
Accept-Ranges: bytes