{"report_id":"21b60a5d-3d25-481a-83a8-8cf1fa2ef188","version":0,"status":"done","tags":[],"date":"2026-07-17T09:10:14Z","url":{"schema":"https","addr":"pdfreader.globalexshipping.com/","fqdn":"pdfreader.globalexshipping.com","domain":"globalexshipping.com","tld":"com"},"ip":{"addr":"167.86.82.141","port":0,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"final":{"url":{"schema":"https","addr":"pdfreader.globalexshipping.com/","fqdn":"pdfreader.globalexshipping.com","domain":"globalexshipping.com","tld":"com"},"title":"Statement","dom":{"size":16954,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (5019)","md5":"920ac82a4e74d1e918a554df7b425611","sha1":"4cfeefb6172ae9d4337b0a6cf09a7d183e0d8d2e","sha256":"fbffb5a659b0f82f546c92207691f7d3f0be6a5e20392ba70bd5a38b836139bc","sha512":"4ed9a0217fbde32c0bcc11bf1ea2700d154779e37b4aa07e91fab8f2811cfd5cc2e96f9095ef5617533dc06531c23d09ea99c9c56be3e7d02bfd3d29b86e1463","ssdeep":"192:Yho+o6dtvtkww7vd9H7JXeS7JXex/27x09GogkJbRRoQ8Rx0:YkTphL7297gwbRRoQEx0","tlshash":"5372e636b4a82029ed13c0dae9e1774d312990c7d60fc258f9ad2565fbcad8b59f324c","dom_hash":"domhash6291fcc11b4bf55b83c93c9cc8352bf6","first_seen":"2026-07-17T05:01:38.89775Z","last_seen":"2026-07-17T09:10:15.621832Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"pdfreader.globalexshipping.com/","fqdn":"pdfreader.globalexshipping.com","domain":"globalexshipping.com","tld":"com"},"ip":{"addr":"167.86.82.141","port":0,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T09:10:14Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"pdfreader.globalexshipping.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"i.postimg.cc","ip":{"addr":"45.43.142.102","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"domain_registered":"2016-06-11","domain_rank":103883,"first_seen":"2018-04-11T10:01:12Z","last_seen":"2026-07-16T09:25:37.690215Z","alert_count":0,"request_count":1,"received_data":70548,"sent_data":563,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"pdfreader.globalexshipping.com","ip":{"addr":"167.86.82.141","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"domain_registered":"2025-10-25","domain_rank":0,"first_seen":"2026-07-17T05:01:36.924768Z","last_seen":"2026-07-17T05:01:36.924768Z","alert_count":12,"request_count":3,"received_data":14308,"sent_data":1601,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]}]},{"fqdn":"cdn.tailwindcss.com","ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2017-07-20","domain_rank":117330,"first_seen":"2018-07-09T05:46:13Z","last_seen":"2026-07-13T08:19:52.745508Z","alert_count":0,"request_count":2,"received_data":408704,"sent_data":966,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","size":407279,"data":"","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-08T23:46:16.375886Z","times_seen":48481,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pdfreader.globalexshipping.com/","fqdn":"pdfreader.globalexshipping.com","domain":"globalexshipping.com","tld":"com"},"ip":{"addr":"167.86.82.141","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"e883bddfbd13f839c6b53183d7a2c9c0","sha1":"04a084862d98294d9b57e073c036d0ba1a2f250e","sha256":"ca973aa7c70a1c10324e66ec4f7937c3474865da73daf771a1b3c1ab06e39477","sha512":"dd55e631db7d9defaea30ca0e8d15fa5dbaf8baf7337c237d4eebb2c69ae9a601b0b77bedc3de3c896cceed7de7e8324f8a9eefe667f6df971507063cd60926f","ssdeep":"","tlshash":"f1e02661cdbde97165fd42732e68eb08ae78a582210a300cb25c4c4dea4088c92bb607","size":333,"data":"","first_seen":"2026-07-17T05:01:38.917142Z","last_seen":"2026-07-17T09:10:15.642834Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pdfreader.globalexshipping.com/","fqdn":"pdfreader.globalexshipping.com","domain":"globalexshipping.com","tld":"com"},"ip":{"addr":"167.86.82.141","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"introduction_type":"scriptElement","is_inline":true,"md5":"b0c3ae0bc95ade6ed87dfc8326860844","sha1":"07369834120ebd7341b5f696c9383d5c430ad4d2","sha256":"b7f54a74d4a7e29e68162cb984d218ea09c5102128b253c4f9b2eb9e5c144039","sha512":"c7855b7e4a34144bd724206eeab6ac73513bdf29649cd4badb6989794c83671738c40f9be0459cad0da31d0e199f1c6295d0adbcaf6e5c9976f64ecc61a37f0b","ssdeep":"","tlshash":"fe3141fb396b64380a4f99bf547eab8c34b15108ae03c484ac3c1da5c075ea1293b9d5","size":1684,"data":"","first_seen":"2026-07-17T05:01:38.923295Z","last_seen":"2026-07-17T09:10:15.644302Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"warn","text":"cdn.tailwindcss.com should not be used in production. To use Tailwind CSS in production, install it as a PostCSS plugin or use the Tailwind CLI: https://tailwindcss.com/docs/installation","filename":"https://cdn.tailwindcss.com/","line_number":64,"column_number":1711}]},"http":[{"url":{"schema":"https","addr":"pdfreader.globalexshipping.com/","fqdn":"pdfreader.globalexshipping.com","domain":"globalexshipping.com","tld":"com"},"ip":{"addr":"167.86.82.141","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T09:09:46.102Z","timestamp":1784279386102,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pdfreader.globalexshipping.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 12:40:27 GMT","end":"Wed, 07 Oct 2026 12:40:26 GMT"},"fingerprint":{"sha1":"97:F6:7C:CB:BC:37:63:CD:66:DE:33:80:4E:95:60:AF:67:8F:DC:E9","sha256":"74:E9:E1:2C:D1:3B:2F:38:B5:AC:8B:C8:96:83:CD:A8:16:13:60:B5:5F:6F:38:D7:92:C7:B8:1A:C4:C7:61:88"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: pdfreader.globalexshipping.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html; charset=UTF-8\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\ncontent-length: 3539\r\ndate: Fri, 17 Jul 2026 09:09:46 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Tailwind CSS","description":"Tailwind is a utility-first CSS framework.","website":"https://tailwindcss.com/","common_platform_enumeration":"","icon":"tailwindcss.svg","categories":["UI frameworks"]}],"data":{"size":11780,"size_decoded":3917,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (399)","md5":"f4f920660213452de40458325f6b3043","sha1":"cd54f58ca18e193017b0b7ffc9fdf122a25e1729","sha256":"4cfa6691f3384a92c1ae6dc20ad84260eb2a1a8309383bbff1796d5f01f23b65","sha512":"7401913fd9ad53f274199da75e956256131d78a5bae10249f40f4a330798226d42cec98013961ef23a9e08218b2885a45ca3bc082caab247243c251c9e57098d","ssdeep":"96:jYhtK+yjpTW9dtJRtrZ61w6RYU7vd9jMXvvokf99kkxQfpy386F7QEdwjb46nKZn:Uho+o6dtvtkww7vd9jGoIkJklRoQ8Rx0","tlshash":"bd32a737b4b96039a513c0a965a5574e31bad007d60b8108fd6d35eadbcaecb8d3329c","first_seen":"2026-07-17T05:01:38.903542Z","last_seen":"2026-07-17T09:10:15.63072Z","times_seen":2,"resource_available":true,"data":null}},"time_used":240,"timings":{"blocked":-1,"dns":69,"connect":24,"send":0,"wait":95,"receive":0,"ssl":52},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"pdfreader.globalexshipping.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pdfreader.globalexshipping.com/","date":"2026-07-17T09:09:46.724Z","timestamp":1784279386724,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 19 May 2026 14:31:45 GMT","end":"Mon, 17 Aug 2026 15:31:39 GMT"},"fingerprint":{"sha1":"B6:67:6F:5A:BE:B9:2A:B2:16:10:49:96:1E:1F:99:2B:44:AF:EA:A6","sha256":"63:A9:BF:FB:46:E0:B8:37:95:77:F3:63:84:AE:78:22:46:11:85:5E:DF:87:F6:4B:EF:F2:2E:24:D5:74:70:39"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pdfreader.globalexshipping.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 \r\ndate: Fri, 17 Jul 2026 09:09:46 GMT\r\ncache-control: max-age=14400\r\nlocation: /3.4.17\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::fpmrj-1784279313459-c918f825aa5a\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nage: 73\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=bE%2F6Y0gdDVMQimbQH%2FTHdCVEPVven8z98iLzRhjdOfm6L5v8MXNsjlosr5BQu9zCVXloQR%2BktKC4ineddzXqvvqrev1sCXTqyUNgs0srUxS20%2FtIa356349G2pAy4S0S8fHzoQQ%3D\"}]}\r\ncf-ray: a1c81c172b90569c-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/javascript","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-08T23:49:09.487212Z","times_seen":17789067,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":3,"connect":1,"send":0,"wait":9,"receive":0,"ssl":17},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.postimg.cc/fypwGWM0/Absa-27-1.jpg","fqdn":"i.postimg.cc","domain":"postimg.cc","tld":"cc"},"ip":{"addr":"45.43.142.102","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pdfreader.globalexshipping.com/","date":"2026-07-17T09:09:46.734Z","timestamp":1784279386734,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"postimg.cc","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 12 Jun 2026 20:49:56 GMT","end":"Thu, 10 Sep 2026 20:49:55 GMT"},"fingerprint":{"sha1":"26:FA:0F:A3:79:17:51:D3:85:0A:52:F9:5D:2A:5A:4C:F4:BB:21:8E","sha256":"62:CC:53:22:C5:B5:DB:6F:00:DC:A7:E7:8D:47:E9:73:22:99:BC:E0:89:01:FC:1E:55:8C:11:6F:D1:05:9F:66"}}},"request":{"raw":"GET /fypwGWM0/Absa-27-1.jpg HTTP/1.1\r\nHost: i.postimg.cc\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pdfreader.globalexshipping.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: openresty\r\ndate: Fri, 17 Jul 2026 09:09:47 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 70182\r\nlast-modified: Fri, 03 Jul 2026 07:18:50 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":70182,"size_decoded":70548,"mime_type":"image/jpeg","magic":"JPEG image data, progressive, precision 8, 566x800, components 3","md5":"b18c110dcd857d4f966cbd48d228858f","sha1":"aaf916180f720cd0140044cef84d5f82a2d5a1aa","sha256":"9c9d39310a4018c7c890ac0446bc20f0d9e7d6ba75c5dcd479669fcc04a6d441","sha512":"5fc4aef4a03ba176d4a7869372f713fe1ecef58fc12de316951b3f4c98542290bbf0bfdbb176cec33e4f4c15f29b0f0e8d34af0f7367767671df87b0ed169ea3","ssdeep":"1536:BgBm6TkOrfWyxMi/LG10yZHoOYjGgaaRdPHW2Ti0TnV/9UB57Gvu3:BgkQk3SMiDyFGP12220TV/27GI","tlshash":"3a63e07c4ec10ef8d5c653ba2da6b5b5c6e3f88625cf145eb0b9513d0268127be90a82","first_seen":"2026-07-17T05:01:38.910963Z","last_seen":"2026-07-17T09:10:15.636227Z","times_seen":2,"resource_available":false,"data":null}},"time_used":1171,"timings":{"blocked":17,"dns":0,"connect":1035,"send":0,"wait":22,"receive":45,"ssl":52},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdn.tailwindcss.com/3.4.17","fqdn":"cdn.tailwindcss.com","domain":"tailwindcss.com","tld":"com"},"ip":{"addr":"104.26.3.143","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://pdfreader.globalexshipping.com/","date":"2026-07-17T09:09:46.761Z","timestamp":1784279386761,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"tailwindcss.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Tue, 19 May 2026 14:31:45 GMT","end":"Mon, 17 Aug 2026 15:31:39 GMT"},"fingerprint":{"sha1":"B6:67:6F:5A:BE:B9:2A:B2:16:10:49:96:1E:1F:99:2B:44:AF:EA:A6","sha256":"63:A9:BF:FB:46:E0:B8:37:95:77:F3:63:84:AE:78:22:46:11:85:5E:DF:87:F6:4B:EF:F2:2E:24:D5:74:70:39"}}},"request":{"raw":"GET /3.4.17 HTTP/1.1\r\nHost: cdn.tailwindcss.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://pdfreader.globalexshipping.com/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 09:09:46 GMT\r\ncontent-type: text/javascript\r\ncache-control: max-age=31536000\r\ncontent-encoding: br\r\nserver: cloudflare\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-cache: MISS\r\nx-vercel-id: fra1::iad1::bj55r-1781146628084-40ce7f37f405\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: accept-encoding\r\nage: 3132758\r\nlast-modified: Wed, 01 Jul 2026 01:49:34 GMT\r\ncf-cache-status: HIT\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ixyGvfDGw%2B2BC2bf65AZtqPHYBAZgQMPWg3ugoJ%2FLYKTnFKRVajdayPoUBikSH7i09Xyv5j2CywDh0ojnrv5Uda2Q0tr%2BgCPvW%2B2zodNcvbwdkDX9SakuDPU77EN4ON2RNhJYTE%3D\"}]}\r\ncf-ray: a1c81c174b9f569c-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":407279,"size_decoded":127122,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (52853)","md5":"7a614b9a197e532c00d09a23b0996b5f","sha1":"1ff1738a40f3716e30e9031b181b0955ae578955","sha256":"176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15","sha512":"a67bc26f52d938358471be5671ff4b79e11af4e68b486aaf73a35a4c9bf3777aab51101af81563b4e5b7ba4b04dd8971fcfa9ee2c41fb10a0c1ee5604a99abd6","ssdeep":"12288:fpgrZxSAoNbJb0Wie75aUXGuyQZhK4O0s:RCVoNB0Wie75aUWmnO0s","tlshash":"e8844aa57396702647eb51e850ea1042f2beaa38840c44bcf7edd4da39e5e4440fbf79","first_seen":"2025-07-28T16:58:08.903462Z","last_seen":"2026-08-08T23:46:16.375886Z","times_seen":48481,"resource_available":true,"data":null}},"time_used":8,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":8,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"pdfreader.globalexshipping.com/open.php","fqdn":"pdfreader.globalexshipping.com","domain":"globalexshipping.com","tld":"com"},"ip":{"addr":"167.86.82.141","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://pdfreader.globalexshipping.com/","date":"2026-07-17T09:09:47.061Z","timestamp":1784279387061,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pdfreader.globalexshipping.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 12:40:27 GMT","end":"Wed, 07 Oct 2026 12:40:26 GMT"},"fingerprint":{"sha1":"97:F6:7C:CB:BC:37:63:CD:66:DE:33:80:4E:95:60:AF:67:8F:DC:E9","sha256":"74:E9:E1:2C:D1:3B:2F:38:B5:AC:8B:C8:96:83:CD:A8:16:13:60:B5:5F:6F:38:D7:92:C7:B8:1A:C4:C7:61:88"}}},"request":{"raw":"POST /open.php HTTP/1.1\r\nHost: pdfreader.globalexshipping.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://pdfreader.globalexshipping.com/\r\nContent-Type: application/json\r\nContent-Length: 122\r\nOrigin: https://pdfreader.globalexshipping.com\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":122,"data":"{\"timestamp\":1784279387059,\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\"}"}},"response":{"raw":"HTTP/3 200 \r\ncontent-type: application/json\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: POST\r\naccess-control-allow-headers: Content-Type\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\ncontent-length: 75\r\ndate: Fri, 17 Jul 2026 09:09:47 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":57,"size_decoded":535,"mime_type":"application/json","magic":"JSON text data","md5":"b36abe2c06294d3e88e37eb9527c67aa","sha1":"385b488a1d49d7f34e3e8003fbc285459acaf343","sha256":"c235d7b7922167ee25b1ec5c38dcda0b79b5b76af083d4b94689f1c10d8fd930","sha512":"e74f0814e345deea82819f2d360bb55273c2c7b8832929f445cc0327e40bae81ef721bc4c912c174e2596d934a0f3de1fbb7f25e29e3609cb4d78b26bf407971","ssdeep":"","tlshash":"0890026b034138d917521663b166546126b38448d7812015954a001c5a5568471f7546","first_seen":"2026-03-14T17:21:38.234776Z","last_seen":"2026-07-17T11:59:01.84857Z","times_seen":8,"resource_available":false,"data":null}},"time_used":358,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":358,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"pdfreader.globalexshipping.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"pdfreader.globalexshipping.com/favicon.ico","fqdn":"pdfreader.globalexshipping.com","domain":"globalexshipping.com","tld":"com"},"ip":{"addr":"167.86.82.141","port":443,"asn":51167,"as":"Contabo GmbH","country":"Germany","country_code":"DE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://pdfreader.globalexshipping.com/","date":"2026-07-17T09:09:47.280Z","timestamp":1784279387280,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"pdfreader.globalexshipping.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 09 Jul 2026 12:40:27 GMT","end":"Wed, 07 Oct 2026 12:40:26 GMT"},"fingerprint":{"sha1":"97:F6:7C:CB:BC:37:63:CD:66:DE:33:80:4E:95:60:AF:67:8F:DC:E9","sha256":"74:E9:E1:2C:D1:3B:2F:38:B5:AC:8B:C8:96:83:CD:A8:16:13:60:B5:5F:6F:38:D7:92:C7:B8:1A:C4:C7:61:88"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: pdfreader.globalexshipping.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://pdfreader.globalexshipping.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncontent-type: text/html\r\ncache-control: private, no-cache, max-age=0\r\npragma: no-cache\r\ndate: Fri, 17 Jul 2026 09:09:47 GMT\r\nserver: LiteSpeed\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1249,"size_decoded":1095,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"f58515dfe987f7e027c8a71bbc884621","sha1":"bec6aebf5940ea88fbbff5748d539453d49fa284","sha256":"679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43","sha512":"f085346a38318f7935d76909db0367862924cc9b0d96256f7ff4e8999c041e610bbcde8ca56c92673bde0991c85e9c9d9b6726abd91d0c3177462c80d4a99140","ssdeep":"","tlshash":"8b21653ec1c1520ae0271164fb81f3a86629821191970f703b8eb176f6cd0bb52a36c8","first_seen":"2024-02-10T12:39:22Z","last_seen":"2026-08-08T21:24:24.152395Z","times_seen":43321,"resource_available":true,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"pdfreader.globalexshipping.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"pdfreader.globalexshipping.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}