Overview

URLdmegwqxnml.ctraltdel.world/vnafvra97w?q=5562946343&id=u2.2
IP 31.41.244.107 (Russia)
ASN#0
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-12-05 02:25:39 UTC
StatusLoading report..
IDS alerts0
Blocklist alert1
urlquery alerts
49
Phishing - DHL
Tags None

Domain Summary (9)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
dhl.tracking.mli.cloud (26) 0 2022-12-04 05:14:56 UTC 2022-12-04 18:36:15 UTC 154.56.0.125 Unknown ranking
ocsp.digicert.com (2) 86 2012-05-21 07:02:23 UTC 2020-05-02 20:58:10 UTC 93.184.220.29
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-12-04 17:12:40 UTC 34.102.187.140
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-12-04 17:12:39 UTC 34.117.237.239
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2020-05-03 10:09:39 UTC 35.164.183.116
r3.o.lencr.org (8) 344 No data No data 23.36.77.32
content-signature-2.cdn.mozilla.net (1) 1152 No data No data 34.160.144.191
dmegwqxnml.ctraltdel.world (1) 0 2022-12-04 23:25:05 UTC 2022-12-04 23:25:05 UTC 31.41.244.107 Unknown ranking
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-21 23:36:00 UTC 2020-02-19 04:43:25 UTC 34.120.237.76

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
Scan Date Severity Indicator Comment
2022-12-05 2 ctraltdel.world Sinkholed


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 31.41.244.107
Date UQ / IDS / BL URL IP
2023-02-06 02:46:52 +0000 53 - 0 - 20 xjvjfedmpx.bestlandingpagebuilder.review/vnaf (...) 31.41.244.107
2023-02-05 08:33:42 +0000 0 - 0 - 1 mdayjvovia.rib4fsrch.club/vnafvra97w?q=408517 (...) 31.41.244.107
2023-02-04 01:29:47 +0000 51 - 0 - 21 de.tracking-1932.codebreakerschool.co.uk/dlog (...) 31.41.244.107
2023-02-03 07:01:12 +0000 53 - 1 - 19 nxzjevmykp.rafiki.asia/vnafvra97w?q=667232019 (...) 31.41.244.107
2023-01-31 10:36:48 +0000 0 - 0 - 2 yqwdgjlhup.sgdixon.co.uk/ 31.41.244.107


Last 5 reports on ASN:
Date UQ / IDS / BL URL IP
2023-02-09 05:19:35 +0000 0 - 0 - 1 www.services.chance-impression.net/bb/VF1cIFt (...) 45.145.179.238
2023-02-09 05:18:52 +0000 0 - 0 - 1 www.marketing.dailydisclosure.net/bb/VF1cIGRV (...) 45.145.176.248
2023-02-09 05:12:02 +0000 0 - 0 - 1 www.connected.widely-considered.net/bb/ZmRmUy (...) 45.145.177.213
2023-02-09 05:11:45 +0000 0 - 0 - 1 www.connected.widely-considered.net/bb/VF1cIF (...) 45.145.177.213
2023-02-09 05:08:15 +0000 0 - 0 - 1 www.marketing.open-transfer.com/unsub_verific (...) 45.145.177.66


Last 1 reports on domain: ctraltdel.world
Date UQ / IDS / BL URL IP
2022-12-05 02:25:39 +0000 49 - 0 - 1 dmegwqxnml.ctraltdel.world/vnafvra97w?q=55629 (...) 31.41.244.107


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-02-06 11:48:08 +0000 53 - 0 - 17 tracking-75452.laforma.co.za/tracking/trackin (...) 185.38.142.20
2023-02-06 02:46:52 +0000 53 - 0 - 20 xjvjfedmpx.bestlandingpagebuilder.review/vnaf (...) 31.41.244.107
2023-02-04 21:48:55 +0000 53 - 0 - 20 tracking-75403.laforma.co.za/verfolgung/ef070 (...) 185.38.142.20
2023-02-04 01:29:47 +0000 51 - 0 - 21 de.tracking-1932.codebreakerschool.co.uk/dlog (...) 31.41.244.107
2023-02-03 07:01:12 +0000 53 - 1 - 19 nxzjevmykp.rafiki.asia/vnafvra97w?q=667232019 (...) 31.41.244.107

JavaScript

Executed Scripts (4)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (48)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "1BAD6C06AA3E88DCBC125FC98A6CB753EB2B18D2C8DD61DA21D12209AEEDA3F9"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9643
Expires: Mon, 05 Dec 2022 05:06:10 GMT
Date: Mon, 05 Dec 2022 02:25:27 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2610
Cache-Control: max-age=118160
Date: Mon, 05 Dec 2022 02:25:27 GMT
Etag: "638c76f5-1d7"
Expires: Tue, 06 Dec 2022 11:14:47 GMT
Last-Modified: Sun, 04 Dec 2022 10:31:17 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Backoff, Content-Length, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 05 Dec 2022 02:20:11 GMT
cache-control: public,max-age=3600
age: 317
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    14cd9a0afb6ba9a763651d5112760d1e
Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "7D7232C8C91BCD18161BA2C9D23E3BFF159604E058BD5B3FC1C7FCBCD03A7EE3"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10740
Expires: Mon, 05 Dec 2022 05:24:28 GMT
Date: Mon, 05 Dec 2022 02:25:28 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: MXVAdAxtdkWkhZ8ZhSXMg7K1aBqokL2nEO3sHIoFUXxb/2Dzc0P0Y4PtZqXCeZejofzFR41mxzs=
x-amz-request-id: WK6609A4G295GAJT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 05 Dec 2022 01:47:47 GMT
age: 2261
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /vnafvra97w?q=5562946343&id=u2.2 HTTP/1.1 
Host: dmegwqxnml.ctraltdel.world
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         31.41.244.107
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx/1.14.0 (Ubuntu)
Date: Mon, 05 Dec 2022 02:25:28 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Set-Cookie: 7a7f440a28621ec901c1138bbc50817e=0; expires=Tue, 06-Dec-2022 02:25:27 GMT; Max-Age=86400; path=/; secure; HttpOnly; SameSite=None
Location: https://dhl.tracking.mli.cloud/verfolgung/ef96b2a4cca611ecaebeb178?page=u2.2


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
  Blocklists:
    - quad9: Sinkholed
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Mon, 05 Dec 2022 02:25:28 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 05 Dec 2022 02:11:19 GMT
cache-control: public,max-age=3600
age: 849
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 2596
Cache-Control: max-age=113079
Date: Mon, 05 Dec 2022 02:25:28 GMT
Etag: "638c632b-1d7"
Expires: Tue, 06 Dec 2022 09:50:07 GMT
Last-Modified: Sun, 04 Dec 2022 09:06:51 GMT
Server: ECS (ska/F70C)
X-Cache: HIT
Content-Length: 471

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "76B2634B9FDB7C5CAD809FF0EA33E6511503E086A7E8E3BA068E61C07F0F850E"
Last-Modified: Sun, 04 Dec 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Mon, 05 Dec 2022 08:25:28 GMT
Date: Mon, 05 Dec 2022 02:25:28 GMT
Connection: keep-alive

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: JLzWiOxrDCIQhp6ZoOoAnQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         35.164.183.116
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 8EZs2KkpMJhd8kPID8L5R+jqHGM=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "EF0F5B2AB2055446D4EA8B738F605C3BF835CF72E872D6A9C9A6C9B2917737E7"
Last-Modified: Sat, 03 Dec 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3359
Expires: Mon, 05 Dec 2022 03:21:29 GMT
Date: Mon, 05 Dec 2022 02:25:30 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F206a2aa2-193a-45ee-9210-82fa22154882.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 7396
x-amzn-requestid: c7621897-64ac-4eb2-b25a-f9ea2e7059a7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cjKVyFr5IAMF8QQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638abdbe-4383156307fcd0da5022d553;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 03:08:46 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: tyEtTMK1H4Sl1eKyySi7qu2CJokOzMaLj0fLriYd01UWNCyS44zC5g==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 05:07:02 GMT
age: 76708
etag: "e00b8b1bc1f98df439a264d1cd881e1021d7fdd5"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7396
Md5:    fe33ecc20db57514c51c90694efebb16
Sha1:   e00b8b1bc1f98df439a264d1cd881e1021d7fdd5
Sha256: 9b0e56806a9f4e7458b58c29ec2050faebcded4ff1c4ef430733171ddae68cb7
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb6034ca-f8c1-4979-8165-5f755e5d12a1.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6430
x-amzn-requestid: ae2ec151-d383-4554-9ac2-3d204701251c
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_ttFDKoAMFp0A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d1324-15aebb1a06253068472a6ab0;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:40 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: kYXmy10msfeWdDYgvq0PXyGpy9UJyQkSLAhR_Q5PQMllJPXOOTnalw==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:45:53 GMT
age: 16777
etag: "e03cf1c7c2ec15b3cc50d9c54bebbf81aa08cf28"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6430
Md5:    3c36448c65274ebbe1eb21e3bf02385e
Sha1:   e03cf1c7c2ec15b3cc50d9c54bebbf81aa08cf28
Sha256: 6f17788a394f1305755805a1b92117b1c1a03a1e3a075cb97a0da5184d574553
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdc619d7d-5f58-4402-a30a-fe05dd9e2922.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 13647
x-amzn-requestid: 36276b12-9e02-4d00-a100-9aa5c794fc79
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_ueEWUoAMFj7Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d1329-7abb45a85c6bc2235c25d61e;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:45 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: oXeR8DTpEoK8E-BiI7gT4JEIdVBfiimfydNYIC62_rNLlTdem9Buig==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:45:46 GMT
age: 16784
etag: "b0c9391b87a4560598e43d5084dda41e267974a9"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   13647
Md5:    6079166a1ed5bac7373183f03f33b84e
Sha1:   b0c9391b87a4560598e43d5084dda41e267974a9
Sha256: 3e2faccbc3e14a10da4a433d789068cdc3fb2d3e2a04a7e2b7ea5f6f6313dcd4
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60dcc231-abb7-48f1-8ec5-e25b31bd100b.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 10396
x-amzn-requestid: b879fd2e-b6cf-4373-b780-2d97481c45f8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cioNbH5KoAMFUsA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a8722-6add7f8e225878473b20c015;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 23:15:46 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ir97GJKaFoW6BNXCcmMqp0JSUd5JhCACyUvLh5G-0BWCDVJsqs7XhQ==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 22:03:01 GMT
age: 15749
etag: "2cc31dc1c5d2d2a8b3a378dce8a1240a79acfec9"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10396
Md5:    24c69d7ef356b352956d6dcbc9f5df1d
Sha1:   2cc31dc1c5d2d2a8b3a378dce8a1240a79acfec9
Sha256: 94d068620c34652cb2d24ca8b3cf962febe9606e6d3a33d937fc9d99f176edef
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0b3b9022-ae31-4c4b-b4aa-3d82606d5c7c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5276
x-amzn-requestid: d337310e-59be-4268-bfd0-8cc4f2c91a11
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_soE98IAMF0aA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d131d-230591591f8fd0984c222549;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:33 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: x7xrn7E3aUdw75Br3B_GcqRhg-i5FcqG2NRMo4Pa5VhqjblbsvcgDg==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:48:15 GMT
age: 16635
etag: "2d47af0fb664d9fec52549bb3bdba1dfd8911bb2"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5276
Md5:    f0402b0c3474a5bd3b1ba804528b64a8
Sha1:   2d47af0fb664d9fec52549bb3bdba1dfd8911bb2
Sha256: 7f87af77663b8bf22211e135554ada8865cdcf6499e9fcf0f3442b10ca3984e1
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F47f316c5-1381-4b6e-9e8d-f1956258ef3e.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6826
x-amzn-requestid: f0abdba6-14c8-4aae-ba3b-37ba0af2ff08
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: co_t2FsLIAMFekA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638d1325-3452be066acddb554f528cc3;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 21:37:41 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: GS4yLzXiIZt-eL9T7gjbf2-vMu8i30WKPDmc2EQDxv0CELjdW1gMVA==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 61bc723adb3b1884ed759711e84e13a8.cloudfront.net (CloudFront), 1.1 google
date: Sun, 04 Dec 2022 21:46:51 GMT
age: 16719
etag: "a6f82481ea0a820da0f199e8f9051a4aa4013c82"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6826
Md5:    a349d02cce160f72cc93f6fb6e45fa46
Sha1:   a6f82481ea0a820da0f199e8f9051a4aa4013c82
Sha256: ab320118577a2dcb6ab7ad904d6350e187501a94b39b71fdd70b31cbc8853b24
                                        
                                            GET /verfolgung/ef96b2a4cca611ecaebeb178?page=u2.2 HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         154.56.0.125
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:55 GMT
Content-Length: 88
Connection: keep-alive
X-Powered-By: PHP/5.4.16
location: tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   88
Md5:    4402f69f0497f76ec31747f2810a19a9
Sha1:   a088adb88c94dbaf72be8b649aa0a2d1de3363de
Sha256: 3464b8f788523618085d8f0f3c60aa9885be22d348d298d1615973e03ada98d2
                                        
                                            GET /verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2 HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1304), with CRLF line terminators
Size:   120762
Md5:    c40e1b6a6dd73a278291e82ddb926305
Sha1:   281661431524c1e4e8c73cc61fc7da31b2127d36
Sha256: fa8b3db0ac661a57498e5f9c7033b953b1b97905ccabf0bca751a660e7aa2d36
                                        
                                            GET /verfolgung/css/6.css HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Length: 4271
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:18:34 GMT
ETag: "10af-5edc1e53cee80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   4271
Md5:    8eb7809b45d4079fbaa48175f64c7441
Sha1:   f865a99867d1eac58a575a518996ae2e9ca1de95
Sha256: 00d16054bb78393fecfbeff7eed0d44e005ebe51f034c838c1f69bdfddf40b01

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/css/3.css HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Length: 22046
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "561e-5edc1b80ec500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   22046
Md5:    c54f6668454402879168d2782296d35e
Sha1:   dd3c72855079f3d074cfe6fd500959874650c736
Sha256: d40a85d0988ad1b83645365ac9bd5ef15ed33517733d847317f86c6ea271ad32

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/css/5.css HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Length: 48507
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "bd7b-5edc1b80ec500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (661), with CRLF line terminators
Size:   48507
Md5:    67f662870fef3deea83c75f68622a1e4
Sha1:   45bdedb38dca005081238b4cf80fa10c90778465
Sha256: 8fd91a16c9b120c1f43fecdb1d40a9adf7e6dc05b69c3261c342ea76ecc50c2d

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/css/2.css HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Length: 48503
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "bd77-5edc1b80ec500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (661), with CRLF line terminators
Size:   48503
Md5:    68bb9d41de0ac82959f8f90c552e4948
Sha1:   fb4e7fd67a692ae70e6b3813fe7913f0c3800103
Sha256: a0879b822817892ccecb11bc4c475d4bf3aad5e03a37a49eae46dfbdcf9e8fb3

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/css/1.css HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Length: 53751
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "d1f7-5edc1b80ec500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (23076), with CRLF line terminators
Size:   53751
Md5:    c773c2e44cb33bd02d04987a8017056b
Sha1:   af122938b5fab20abed2fd9df00af09e66294222
Sha256: a116a577d744fd0c240b7f1c1b3139cc0d61b953d36fe2b61506e379e9c8bc0a

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/js/jquery-1.12.2.min.js HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:58 GMT
Content-Length: 97244
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "17bdc-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (32029)
Size:   97244
Md5:    bdc2b7efb1faf219d65edfe253a103e9
Sha1:   4921529fc15b8133f2fe65b3bebf53d1e9ef8579
Sha256: 95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/visa.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Length: 4586
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "11ea-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1577)
Size:   4586
Md5:    09d8b96a0853e0bc8cec7c677c0da93b
Sha1:   a6aebdb9c339cac93762338353517b67e23f1903
Sha256: a60079ce89803190740ddcf6e03eace0492b8f73ec57ffb4132b72a9736b68fe

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/rating-play-store.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Length: 904
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "388-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (512)
Size:   904
Md5:    19a24c818ad0e0eab9418b77ff8e7c1c
Sha1:   3787691d98fd4b9f494664274a641226e33c1588
Sha256: a6b35b6b7cabb9d33c2e1d6afef2d5f546a2fd3912f5f3e96495cd64218b9251

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/amex.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Length: 734
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "2de-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (565)
Size:   734
Md5:    1c003076f46fc215f19de22568f3b5a1
Sha1:   112caa9374e6c1d0f8325cdcf2bde5b073f0f1ad
Sha256: b64feafef2104c77f092f2bbfa526bad76e17fb053591284984e86a28ed721a2

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/paypal.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Length: 3369
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "d29-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (3369), with no line terminators
Size:   3369
Md5:    4ac4e26be0277fab62f57835bca7ee1e
Sha1:   edef7e834db1d63bd5290adf1f0308522cced7e0
Sha256: 5e9402048b0efae8235057fc5db4276b0472c9a42c59c0b759e059ffbdafb32b

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/dhl-official.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Length: 2040
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "7f8-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (2040), with no line terminators
Size:   2040
Md5:    d5a053f0005dd58489a461f599b5a508
Sha1:   ba71dd77800ef3d410beb8282d790642bec8193b
Sha256: aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/1.png HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:25:59 GMT
Content-Length: 108508
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1a7dc-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 366 x 206, 8-bit/color RGB, non-interlaced\012- data
Size:   108508
Md5:    634c39f2a51e26d2ac85598a2103e16d
Sha1:   1badf4773207d7238f8808f1bd42e355dd4b3a01
Sha256: afcc3febb5b047b9f7d691e6e92c2239c2feee6cdb5e56a910e8a9e62387d430

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            POST /verfolgung/phplib/ajax.php?id=ef96b2a4cca611ecaebeb178 HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 17
Origin: https://dhl.tracking.mli.cloud
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Set-Cookie: PHPSESSID=kjkuvh1aerlo5avnm7aghkgnb1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/sprite.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 41430
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "a1d6-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (28844), with CRLF line terminators
Size:   41430
Md5:    cebbc77896c22e29f2a223a9efe685e3
Sha1:   ab3e7dc74207c4bb1f45a712d334c3d3ef8bdce8
Sha256: 07908237900ec13b078abee11041a05af9a7c8930a9a0e1c7d85f2c5f8ca9425

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/fonts/delivery-bd.woff2 HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 33840
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "8430-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 33840, version 1.0\012- data
Size:   33840
Md5:    682ea1d6962cd47974cd715fa3b80b4a
Sha1:   94a563948862a70f4d1be0a3aebc3a9f7aa800a6
Sha256: 4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/fonts/delivery-rg.woff2 HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 33580
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "832c-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 33580, version 1.0\012- data
Size:   33580
Md5:    1a05a4d2566dc2490cae801e9d885ec6
Sha1:   2fae1307a017a9afe73d351cf15932e51dc57887
Sha256: 2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/fonts/delivery-cdblk.woff2 HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 36652
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "8f2c-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 36652, version 1.0\012- data
Size:   36652
Md5:    774e0efbb9da45395efa24c9ca4248de
Sha1:   04eab63ba86f912514fc0ea04b025b7f2df6145b
Sha256: ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/dhl-ssl-logo.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 4470
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1176-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (403)
Size:   4470
Md5:    f0e3cb96921af370a3ce18d1a1ded9b9
Sha1:   1fedecbb71184bc23dfdac38ef5b27d31da7f420
Sha256: dc0fa4b8eaff05882b34c64260a6f630a3398a3a77584ef2ae6297ef10353578

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/mastercard.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 14915
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "3a43-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1435)
Size:   14915
Md5:    b81045f3a463d4aabc0a41fef3bc55ef
Sha1:   0cf6c882fac621b65b627cb39c3bbc9d669e20d3
Sha256: f4551892c81a15874332cfa9639f76a41356c9ed4ca79ff682c9114aeb12563e

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/giropay.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 2396
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "95c-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2396), with no line terminators
Size:   2396
Md5:    9b9e19be4be87ab5a0b96cd99754747e
Sha1:   edc3926e9431d362d794de7388fb4d78b156c4e8
Sha256: 2ef06fae9ac89777a220421e87980ef61b2a914e3eb1dec5b5c06a93531a9e38

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/sepapay.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 12024
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "2ef8-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (12024), with no line terminators
Size:   12024
Md5:    176e69bbf00a8da5fe4921dbff1a30eb
Sha1:   384bbdee655135ef9a290f1365902ed6c9316969
Sha256: b1764022abfe9e716542e55a05b94b851e369cd75407474874a439c61f5bd982

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/icons-nepal.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 25893
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "6525-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (25753), with CRLF line terminators
Size:   25893
Md5:    953dd00cb38ca1767d1145caf35a035b
Sha1:   8510eeee5a546b92d2cb4413f065aa5d49d0bfdb
Sha256: 2691d1e5392f267802498adb1ddc58e4d8a95a5fc69de8380e0d4ae7850c2e1c

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/dhl-group.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:01 GMT
Content-Length: 8715
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "220b-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (724)
Size:   8715
Md5:    56ceadc8919cd52c7b19d6bfd2ed1a96
Sha1:   5716fe99efb512515553b02fc4ca7f858aa5c980
Sha256: 55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /verfolgung/img/icon-sprite.svg HTTP/1.1 
Host: dhl.tracking.mli.cloud
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.tracking.mli.cloud/verfolgung/tracking.php?id=ef96b2a4cca611ecaebeb178&page=u2.2
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

search
                                         154.56.0.125
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Mon, 05 Dec 2022 02:26:00 GMT
Content-Length: 116511
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1c71f-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---