media.istockphoto.com/id/1282219840/photo/cardboard-box-isolated-on-white-background-with-clipping-path.jpg?s=612x612&w=0&k=20&c=1pBj9xJxvRblZ6_B4_d1BW-WosAS6-ouYShB46Fpusc=
200 OK 18 kB URL GET HTTP/1.1 media.istockphoto.com/id/1282219840/photo/cardboard-box-isolated-on-white-background-with-clipping-path.jpg?s=612x612&w=0&k=20&c=1pBj9xJxvRblZ6_B4_d1BW-WosAS6-ouYShB46Fpusc=
IP
Requested by https://uspostal-portal30.dynnamn.ru/landing.php
Certificate IssuerAmazon
Subjectmedia.gettyimages.com
Fingerprint59:7E:5E:D5:03:E0:F6:B7:A8:16:2A:7F:78:0B:60:CE:DF:B7:20:10
ValidityFri, 10 Feb 2023 00:00:00 GMT - Sun, 10 Mar 2024 23:59:59 GMT
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, description=Cardboard box isolated on white background with clipping path\377\341\005^http://ns.adobe.com/xap/1.0/], progressive, precision 8, 612x553, components 3\012- data
Hash e1737869d09662514c315536386c0bed
4ea2853ceb20dbde440ebc519863b0c35484120a
839d83a68d1efd17893d9bea516449fc816b9b1337e05dff6b95f55d2af2b1f9
GET /id/1282219840/photo/cardboard-box-isolated-on-white-background-with-clipping-path.jpg?s=612x612&w=0&k=20&c=1pBj9xJxvRblZ6_B4_d1BW-WosAS6-ouYShB46Fpusc= HTTP/1.1
Host: media.istockphoto.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://uspostal-portal30.dynnamn.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 17589
Connection: keep-alive
Date: Mon, 28 Aug 2023 04:57:30 GMT
Server: Kestrel
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=7776000
Last-Modified: Mon, 28 Aug 2023 04:57:30 GMT
Content-Disposition: inline; filename=istockphoto-1282219840-612x612.jpg
X-Cache: Hit from cloudfront
Via: 1.1 80d21802b1b80c40e55ccf83433b8eac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
Alt-Svc: h3=":443"; ma=86400
X-Amz-Cf-Id: hgMpfj2zO9xyy2oqjmX6iB7BpvvwQ6KjMXNOH4fYV5XxGrG1GF6pNw==
Age: 4524251
uspostal-portal30.dynnamn.ru/favicon.ico
404 Not Found 146 B URL GET HTTP/2 uspostal-portal30.dynnamn.ru/favicon.ico
IP
ASN #14061 DIGITALOCEAN-ASN
Requested by https://uspostal-portal30.dynnamn.ru/landing.php
Certificate IssuerLet's Encrypt
Subjectuspostal-portal30.dynnamn.ru
Fingerprint3A:C6:20:82:C0:5D:E1:0A:CB:CE:FA:0F:42:2A:27:73:A9:A6:BB:94
ValidityFri, 13 Oct 2023 12:20:53 GMT - Thu, 11 Jan 2024 12:20:52 GMT
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 8eec510e57f5f732fd2cce73df7b73ef
3c0af39ecb3753c5fee3b53d063c7286019eac3b
55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
OpenPhish phishing United States Postal Service
PhishTank phishing Other
Quad9 DNS malicious Sinkholed
GET /favicon.ico HTTP/1.1
Host: uspostal-portal30.dynnamn.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://uspostal-portal30.dynnamn.ru/landing.php
Cookie: PHPSESSID=u0h6tf5c2k5gkahtdd57vn5rdl
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 404 Not Found
server: nginx
date: Thu, 19 Oct 2023 13:41:41 GMT
content-type: text/html
content-length: 146
X-Firefox-Spdy: h2
uspostal-portal30.dynnamn.ru/
302 Found 12 kB URL User Request GET HTTP/2 uspostal-portal30.dynnamn.ru/
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerLet's Encrypt
Subjectuspostal-portal30.dynnamn.ru
Fingerprint3A:C6:20:82:C0:5D:E1:0A:CB:CE:FA:0F:42:2A:27:73:A9:A6:BB:94
ValidityFri, 13 Oct 2023 12:20:53 GMT - Thu, 11 Jan 2024 12:20:52 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
OpenPhish phishing United States Postal Service
PhishTank phishing Other
Quad9 DNS malicious Sinkholed
GET / HTTP/1.1
Host: uspostal-portal30.dynnamn.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: nginx
date: Thu, 19 Oct 2023 13:41:40 GMT
content-type: text/html; charset=UTF-8
location: ./landing.php
set-cookie: PHPSESSID=u0h6tf5c2k5gkahtdd57vn5rdl; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2
uspostal-portal30.dynnamn.ru/landing.php
200 OK 12 kB URL User Request GET HTTP/2 uspostal-portal30.dynnamn.ru/landing.php
IP
ASN #14061 DIGITALOCEAN-ASN
Certificate IssuerLet's Encrypt
Subjectuspostal-portal30.dynnamn.ru
Fingerprint3A:C6:20:82:C0:5D:E1:0A:CB:CE:FA:0F:42:2A:27:73:A9:A6:BB:94
ValidityFri, 13 Oct 2023 12:20:53 GMT - Thu, 11 Jan 2024 12:20:52 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (9453)
Hash a357a2d628edf9821d0d49dca869bb75
1f7ae094d2790ffc3b4e3a60ca5bc831dda57458
9b8249eb1aae0f148879fdc0af5b4c187af2ed56c6fd42cf4ac0f1b6a2269229
Analyzer Verdict Alert urlquery suspicious Suspicious - DynDNS domain
OpenPhish phishing United States Postal Service
PhishTank phishing Other
Quad9 DNS malicious Sinkholed
GET /landing.php HTTP/1.1
Host: uspostal-portal30.dynnamn.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=u0h6tf5c2k5gkahtdd57vn5rdl
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 19 Oct 2023 13:41:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
X-Firefox-Spdy: h2
165.227.180.255