Report - psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start

Report Overview

Submitted URL
psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start
IP
34.141.187.181
ASN
#396982 GOOGLE-CLOUD-PLATFORM
Submitted
2023-01-19 08:20:54
Access
Website Title
Final URL
Tags
dhl logistics phishing
urlquery detections
Phishing - DHL

Detections

urlquery
6
Network Intrusion Detection
0
Threat Detection Systems
8

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	333 B	391 B	34.117.237.239
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	341 B	759 B	93.184.220.29
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	606 B	127 B	35.162.50.16
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	50 kB	34.120.237.76
psostask.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	11 kB	177 kB	34.141.187.181
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.7 kB	7.1 kB	23.36.77.32
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	782 B	2.4 kB	35.241.9.150
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	413 B	5.8 kB	34.160.144.191

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-01-19	medium	psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start	Phishing
2023-01-19	medium	psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start	Phishing
2023-01-19	medium	psostask.com/ch/dnc/start/ng/ng.js?v=63c8fd5c70792	Phishing
2023-01-19	medium	psostask.com/ch/dnc/start/token/token.js?v=63c8fd5c70791	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (12)

	URL	Size	First Seen	Last Seen
	unknown	0 B	2023-03-07	2024-04-19
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-19 11:06:20 Times Seen36957053 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	psostask.com/ch/dnc/bower_components/ua-parser-js/dist/ua-parser.min.js	17 kB	2023-03-07	2024-04-09
Pretty URL psostask.com/ch/dnc/bower_components/ua-parser-js/dist/ua-parser.min.js IP 34.141.187.181 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:40 Last Seen2024-04-09 18:16:12 Times Seen660 Hash e0ae48c8ebbe57edeacb5b02f16d0df9 0c5a29a88add39486162e0c16f23e2e06fc7842e 0fda30cf243e7650bf3e1666eddeb4fbba6b788ede36753eda5e2964cc14c896 Loading...

	psostask.com/ch/dnc/core/form/core_form.js	19 kB	2023-03-07	2024-04-13
Pretty URL psostask.com/ch/dnc/core/form/core_form.js IP 34.141.187.181 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:24:45 Last Seen2024-04-13 11:54:42 Times Seen165 Hash b7ec4716ba358eb04a58e6bcfa599d8a d296a3aae9d4203bae5e21edcf954f8eab8e7ce4 cd62accfe6fb47f3c15d12eeec8d05c2fc4f77de289430d2d551b92f9f112f53 Loading...

	psostask.com/ch/dnc/core/token/core_token.js	9.3 kB	2023-03-07	2024-04-13
Pretty URL psostask.com/ch/dnc/core/token/core_token.js IP 34.141.187.181 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:24:45 Last Seen2024-04-13 11:54:42 Times Seen130 Hash f7df5f53550069cad1fea66b4c85a7df 0e47bca397b00b49a8874defa10c1e0f58392514 f281d6837cf16bcaf4cab32757cd2052d1aeea0caf2e367fe94b533b3bce908b Loading...

	psostask.com/ch/dnc/bower_components/angular/angular.min.js	169 kB	2023-03-07	2024-04-17
Pretty URL psostask.com/ch/dnc/bower_components/angular/angular.min.js IP 34.141.187.181 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:06:40 Last Seen2024-04-17 21:52:49 Times Seen427 Hash 4c619ef91e3fa3f1d4813db2b2eb738d c5f77156c6f5397be71914eb80d8f998ea1279e7 35f73a70cca067828be9e0a712b8b48908e1bc4490637c62bd70158f95cd6e27 Loading...

	psostask.com/ch/dnc/start/ng/ng.js?v=63c8fd5c70792	5.4 kB	2023-03-07	2024-04-13
Pretty URL psostask.com/ch/dnc/start/ng/ng.js?v=63c8fd5c70792 IP 34.141.187.181 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:24:45 Last Seen2024-04-13 11:54:42 Times Seen116 Hash e668c7af4e520012aa094aaedb73d538 18d67d10cae5273ed08ba965f75095496638b028 cd777cb766206a47779d483d2364d6fb99b057554efa2b08684b832a277929ff Loading...

	psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/#56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d	56 B	2023-03-13	2023-03-13
Pretty URL psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/#56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 02:58:21 Last Seen2023-03-13 02:58:21 Times Seen1 Hash 8fc0479791bf6d582829600aae7e3322 fcba35e34cafe13d9de661fdc97ea80e2faa5286 9c70e5a545767fd6efc6db26c71ff6498f1e25615f96ff2c9f39418c0c1fe51d Loading...

	psostask.com/ch/dnc/bower_components/jquery.maskedinput/dist/jquery.maskedinput.min.js	16 kB	2023-03-07	2024-04-13
Pretty URL psostask.com/ch/dnc/bower_components/jquery.maskedinput/dist/jquery.maskedinput.min.js IP 34.141.187.181 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:24:45 Last Seen2024-04-13 11:54:42 Times Seen290 Hash 9ae7e30099732f0bec486490be9e19cf e0e853d67e9afa8005cba8b3074836c9e75bf898 6a2f967ab83a1b16b06c60bbbbbe901f1719b620718f43ee6b7a48d7578cee67 Loading...

	psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/	7.7 kB	2023-03-13	2023-03-13
Pretty URL psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/ IP 34.141.187.181 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 02:52:59 Last Seen2023-03-13 03:03:04 Times Seen1 Hash 0d03d1854c2aad84ad1c9379ec824711 f8c233070b9b32e26797028543c24ead69b1b9c5 aa0d9f2ac5a5da0051d48777361e629bbc1c4bbfc57e97ab93ae47a1340e1d25 Loading...

	psostask.com/ch/dnc/start/form/form.js?v=63c8fd5c7078d	2.5 kB	2023-03-07	2024-04-13
Pretty URL psostask.com/ch/dnc/start/form/form.js?v=63c8fd5c7078d IP 34.141.187.181 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:24:45 Last Seen2024-04-13 11:54:42 Times Seen119 Hash 49fa171e8a0468fb8eaf7317bc2a5901 ac2c7d77b4c06b2d041902062d19d9fb415d2e73 546e8207c308f8a10a5c9e3e55450149392b0bd1271db3d2c9cbcf14be163e89 Loading...

	psostask.com/ch/dnc/start/token/token.js?v=63c8fd5c70791	1.3 kB	2023-03-07	2024-04-13
Pretty URL psostask.com/ch/dnc/start/token/token.js?v=63c8fd5c70791 IP 34.141.187.181 ASN #396982 GOOGLE-CLOUD-PLATFORM Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:24:45 Last Seen2024-04-13 11:54:42 Times Seen117 Hash 56b32f4184ff26e4eef40f901ca21190 b29b5351ee8810b14024b36730de7a4a791ce40c 9da0f85356eb16abfeef33483e78a889148a49abedd80fe782db466828c8277c Loading...

	psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/#56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d	56 B	2023-03-13	2023-03-13
Pretty URL psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/#56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d56e71887e17c4f792fcf642bfd07743d IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 02:58:21 Last Seen2023-03-13 02:58:21 Times Seen1 Hash e3966a02bed0a27c8cb871eba30d3dcb 567bc978d83670b08517c790e91c3691c2b22c22 733c9d79399973ef7460c05cbf73280d233172c015ca8f94c247457d6763307c Loading...

HTTP Transactions (43)

URL IP Response Size

psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start

34.141.187.181

301 Moved Permanently

343 B

URL HTTP/1.1
psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
343 B (343 bytes)
Hash
ee0627d6b3521acdaa96d9c77862d4e1
f74eb48ce51ce5d8b33fd072bed76a4fead6a869
27249222fa7794c848565ec0a838f37a2d5bfb89bdd90fbaf4312f16fd19b35d

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Date: Thu, 19 Jan 2023 08:20:43 GMT
Server: Apache
Location: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start
Content-Length: 343
Connection: close
Content-Type: text/html; charset=iso-8859-1

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
648bf42163c5d645d8a33cd0a9afebd0
9b9ac85435c4e90647e8379bca54c689058a8929
060757fb4857858d4d01a715824ea6771d0137e73a24bf75e2844d0f346380fa

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "060757FB4857858D4D01A715824EA6771D0137E73A24BF75E2844D0F346380FA"
Last-Modified: Tue, 17 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8086
Expires: Thu, 19 Jan 2023 10:35:30 GMT
Date: Thu, 19 Jan 2023 08:20:44 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
cc07d664b5dadee6f9120d54904dfa57
df75a55b0b2019684a6c512bee528c51a2c4a756
14a1bd6315a3256468edafedfd1c02a6ba147914c0f01e8504e7d8cc67781c34

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "14A1BD6315A3256468EDAFEDFD1C02A6BA147914C0F01E8504E7D8CC67781C34"
Last-Modified: Tue, 17 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16388
Expires: Thu, 19 Jan 2023 12:53:52 GMT
Date: Thu, 19 Jan 2023 08:20:44 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Alert, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 19 Jan 2023 07:34:32 GMT
content-type: application/json
age: 2772
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6c8239f3894cfba54d1f3a9ea1c85db5
a70f2b3bf79f2aa26b0cc0340dd182565c3eb946
64dc0508d3fcea1ec92fb60310e9b3f5454c0b69f61e8453fd443bc46ab9471b

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "64DC0508D3FCEA1EC92FB60310E9B3F5454C0B69F61E8453FD443BC46AB9471B"
Last-Modified: Tue, 17 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4497
Expires: Thu, 19 Jan 2023 09:35:41 GMT
Date: Thu, 19 Jan 2023 08:20:44 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: T2WyZzCY7YgojVh44pA5PkWn1vYJBU1/8F7VgdM0+MTD86hbgKuRiUKAcHkAUG5GpYULm07i5Lo=
x-amz-request-id: 4S3TWNPRWACV6CYH
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 19 Jan 2023 08:17:08 GMT
age: 216
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
6bc571434ba2207ec643c3c872d59a4e
59305af15c37122975ae4acc05d532fac96d48d5
381f948c0859f19e4ad81f4119ace1473824257066d5cf76ff848e724033f2b1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "381F948C0859F19E4AD81F4119ACE1473824257066D5CF76FF848E724033F2B1"
Last-Modified: Tue, 17 Jan 2023 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15823
Expires: Thu, 19 Jan 2023 12:44:27 GMT
Date: Thu, 19 Jan 2023 08:20:44 GMT
Connection: keep-alive

psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start

34.141.187.181

301 Moved Permanently

345 B

URL HTTP/2
psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
345 B (345 bytes)
Hash
5d07dde43c6b54b92995aab3ad72c3a6
4bdb7911342fba07edd0f6611ec428084921b294
37d62a06de99952239579abf0faa856664ad624642d6d5acb2d3bc01280aaf46

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/2 301 Moved Permanently
location: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
content-length: 345
content-type: text/html; charset=iso-8859-1
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Thu, 19 Jan 2023 08:20:44 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/

34.141.187.181

200 OK

4.3 kB

URL HTTP/2
psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (7681)
Size
4.3 kB (4296 bytes)
Hash
6698cdfc9f1b2aa41f818d99e2812ed2
70c61c5eccd550a62eb7566898b509916acc1a54
37631219d2b6a0e55cbc95a9531ad3b57f09a52b5cef2c86e550039c9721746b

HTTP Headers

GET /ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/ HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers

HTTP/2 200 OK
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
vary: Accept-Encoding
content-encoding: gzip
content-length: 4296
content-type: text/html; charset=UTF-8
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/bower_components/jquery/dist/jquery.min.js

34.141.187.181

200 OK

30 kB

URL HTTP/2
psostask.com/ch/dnc/bower_components/jquery/dist/jquery.min.js
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text, with very long lines (32058)
Size
30 kB (30138 bytes)
Hash
3430607b4301113ad9394c9260eef3f0
8c4db68b161b17e31be300e968a30ab0116b3193
31e4d11375322cd6f94dba7338570426f2412d6c5fa670427966d45c3648098c

HTTP Headers

GET /ch/dnc/bower_components/jquery/dist/jquery.min.js HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 05 Jun 2017 05:55:06 GMT
etag: "15283-5513025158280-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 30138
content-type: application/javascript
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/core/form/core_form.js

34.141.187.181

200 OK

4.6 kB

URL HTTP/2
psostask.com/ch/dnc/core/form/core_form.js
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text
Size
4.6 kB (4643 bytes)
Hash
c95cae31289e66d1f317c6824213bdbf
00613860faeb6269e1c38d22d94aa2f2767ade58
bb33df3ec6cd16c652d3dd1ddfd7cfc9b7e2751659a48a7a7c18e71afc6526c4

HTTP Headers

GET /ch/dnc/core/form/core_form.js HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 22 May 2020 08:22:58 GMT
etag: "49b2-5a63856313c80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 4643
content-type: application/javascript
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/bower_components/ua-parser-js/dist/ua-parser.min.js

34.141.187.181

200 OK

6.1 kB

URL HTTP/2
psostask.com/ch/dnc/bower_components/ua-parser-js/dist/ua-parser.min.js
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
Unicode text, UTF-8 text, with very long lines (16817)
Size
6.1 kB (6063 bytes)
Hash
14da93cff6d49885bf214d2503f614db
04d64d738cd0fd2b4eee3b8abc5326dfda3f1dea
49e584e9a0aee55b81771b9e010ccf1da6278da03fb8ddba07ef7a1f0a126732

HTTP Headers

GET /ch/dnc/bower_components/ua-parser-js/dist/ua-parser.min.js HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 12 Oct 2017 10:16:24 GMT
etag: "4298-55b56d5182e00-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 6063
content-type: application/javascript
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Pragma, Content-Length, Alert, Expires, ETag, Last-Modified, Backoff, Content-Type, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 19 Jan 2023 07:48:57 GMT
age: 1907
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

psostask.com/ch/dnc/core/token/core_token.js

34.141.187.181

200 OK

1.5 kB

URL HTTP/2
psostask.com/ch/dnc/core/token/core_token.js
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text
Size
1.5 kB (1467 bytes)
Hash
22d8188eb35c4ed9cb2e9167bfcbe83e
6694915e8715fa4c7b294d61c1f0c649bf6c124f
47da348fec168c0903cfec0f1f93acc514febd42f5a6df48938c65a7e5620acf

HTTP Headers

GET /ch/dnc/core/token/core_token.js HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Wed, 27 May 2020 17:42:04 GMT
etag: "243d-5a6a4bae57300-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1467
content-type: application/javascript
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/bower_components/font-awesome/css/font-awesome.min.css

34.141.187.181

200 OK

7.1 kB

URL HTTP/2
psostask.com/ch/dnc/bower_components/font-awesome/css/font-awesome.min.css
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text, with very long lines (30837)
Size
7.1 kB (7053 bytes)
Hash
52f1a8a2ce85fa8432308b33bc1a2e79
fd80917af5371c8ecad0198592a1e7cce4b77b0e
07bd6a9ea0213e20f362485aadc17a88c486ecfb394004b41b8b38db6e6a35f6

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /ch/dnc/bower_components/font-awesome/css/font-awesome.min.css HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Sun, 09 Apr 2017 06:29:24 GMT
etag: "7918-54cb5facbb900-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 7053
content-type: text/css
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/core/form/core_form.css

34.141.187.181

200 OK

935 B

URL HTTP/2
psostask.com/ch/dnc/core/form/core_form.css
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text
Size
935 B (935 bytes)
Hash
7a17ade6880ccf29240a71a8d1004088
4e2c619aed2bdda0a6de5e98c488a8320568a503
3996e0dd22dff3df8a3ee49d260649637bafd39aaf4d6728e7be785b51049401

HTTP Headers

GET /ch/dnc/core/form/core_form.css HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 22 May 2020 20:38:50 GMT
etag: "11f9-5a6429ddb4a80-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 935
content-type: text/css
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/bower_components/jquery.maskedinput/dist/jquery.maskedinput.min.js

34.141.187.181

200 OK

3.3 kB

URL HTTP/2
psostask.com/ch/dnc/bower_components/jquery.maskedinput/dist/jquery.maskedinput.min.js
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text
Size
3.3 kB (3284 bytes)
Hash
4d50860adbc3bac5b59f9c900670b2e4
19fb9ee275b56a0b239a76bc301b6d6ef3eae25f
6167a19f3ce290fe0a5620e7240f6a9b8e5137e7b080c2442c0e58b7e1bcbb02

HTTP Headers

GET /ch/dnc/bower_components/jquery.maskedinput/dist/jquery.maskedinput.min.js HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 17 Nov 2017 15:03:36 GMT
etag: "4001-55e2f0a7d2200-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 3284
content-type: application/javascript
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/start/form/css.css

34.141.187.181

200 OK

0 B

URL HTTP/2
psostask.com/ch/dnc/start/form/css.css
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /ch/dnc/start/form/css.css HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Sun, 22 Sep 2019 11:13:18 GMT
etag: "0-5932263e9ef80"
accept-ranges: bytes
content-length: 0
content-type: text/css
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/start/style.css

34.141.187.181

200 OK

25 kB

URL HTTP/2
psostask.com/ch/dnc/start/style.css
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text, with very long lines (724)
Size
25 kB (24951 bytes)
Hash
c821ca472d7645b57708c2f72a4e1e24
2c37df94ad66d55a1ba1951666c80f7f6ba3ea85
20d4881c73f31a2b864801215a0e580b1ee363f5e8111661fb65183c0d1da608

HTTP Headers

GET /ch/dnc/start/style.css HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 21 May 2020 10:36:42 GMT
etag: "2d42e-5a626169e6280-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 24951
content-type: text/css
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/start/pak.png

34.141.187.181

200 OK

878 B

URL HTTP/2
psostask.com/ch/dnc/start/pak.png
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
PNG image data, 57 x 58, 8-bit/color RGB, non-interlaced\012- data
Size
878 B (878 bytes)
Hash
997a3db672059033a232bcc726aed047
8f67ab4067299aa29920295baa38417160a6d524
4057023fcfa4360934b1a1409a74a40ffbc2bb7dacd2bcc6f69d66a9673f09e8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /ch/dnc/start/pak.png HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 18 May 2020 07:12:38 GMT
etag: "36e-5a5e6e34ba580"
accept-ranges: bytes
content-length: 878
content-type: image/png
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/start/form/form.js?v=63c8fd5c7078d

34.141.187.181

200 OK

699 B

URL HTTP/2
psostask.com/ch/dnc/start/form/form.js?v=63c8fd5c7078d
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text
Size
699 B (699 bytes)
Hash
6ea1a243f45a0ab1c7603cd42ffb0daa
5a3dcc87723adf1039d7e137d8e70fcf1556e7ca
b86d85808c5b01265b1c8b3614aaf3dc1ce52c7561599c7a688ac3045db0eb47

HTTP Headers

GET /ch/dnc/start/form/form.js?v=63c8fd5c7078d HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 21 May 2020 15:56:50 GMT
etag: "9be-5a62a8f813480-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 699
content-type: application/javascript
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/start/ta3.svg

34.141.187.181

200 OK

1.0 kB

URL HTTP/2
psostask.com/ch/dnc/start/ta3.svg
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (1665)
Size
1.0 kB (1048 bytes)
Hash
1b7469dae7854cf013b22f128bae7a5b
3fbf298228c6d74ece72f3209f12b3c956c16b83
70ecb621992bb7019e4ba68aa43209144ae5fd5cec961c982bac5934ad147d4a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /ch/dnc/start/ta3.svg HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 18 May 2020 07:12:38 GMT
etag: "77d-5a5e6e34ba580-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1048
content-type: image/svg+xml
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/start/ng/ng.js?v=63c8fd5c70792

34.141.187.181

200 OK

1.4 kB

URL HTTP/2
psostask.com/ch/dnc/start/ng/ng.js?v=63c8fd5c70792
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text
Size
1.4 kB (1388 bytes)
Hash
9782a1b81f27fe4348b1bc5ae4219897
637055e4cfaf180cef32e4e6a74dd61e3b80e727
01182372163b64f2e080aa1cd5b3e25423b4aa58c8df13d59f343f3e7e38bab4

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ch/dnc/start/ng/ng.js?v=63c8fd5c70792 HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 22 May 2020 17:03:04 GMT
etag: "14e6-5a63f9a370200-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 1388
content-type: application/javascript
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/start/token/token.js?v=63c8fd5c70791

34.141.187.181

200 OK

529 B

URL HTTP/2
psostask.com/ch/dnc/start/token/token.js?v=63c8fd5c70791
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text
Size
529 B (529 bytes)
Hash
688426340ca3832144606ce47c45585a
b3b2d724d44385ccd5935ccc91de4302dd9cbd60
06f1d3c3bb48c2195bdb552abc06390880e6cceb844b498f5e81d65944a861a8

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /ch/dnc/start/token/token.js?v=63c8fd5c70791 HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Thu, 21 May 2020 15:55:16 GMT
etag: "518-5a62a89e6e100-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-length: 529
content-type: application/javascript
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/start/pub.jpg

34.141.187.181

200 OK

82 kB

URL HTTP/2
psostask.com/ch/dnc/start/pub.jpg
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1024x150, components 3\012- data
Size
82 kB (82133 bytes)
Hash
5000355f5ce08e172610325f3f5ac5bc
381442803d0a67fa45def5d89d3ff49000e4a28d
fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /ch/dnc/start/pub.jpg HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Mon, 18 May 2020 07:12:38 GMT
etag: "140d5-5a5e6e34ba580"
accept-ranges: bytes
content-length: 82133
content-type: image/jpeg
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
79af32d8e279b4cfec147ab51cb6fcb3
d726903292bd1e08a6d9fe0719d2cd5b33dc5fe6
bfcb2d8f14d89736ac6b771f1618a8fc5e707691d60807a574fb719c8e9393ab

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4563
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 19 Jan 2023 08:20:44 GMT
Etag: "63c7b6a8-1d7"
Last-Modified: Thu, 19 Jan 2023 07:04:41 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471

psostask.com/favicon.ico

34.141.187.181

404 Not Found

259 B

URL HTTP/2
psostask.com/favicon.ico
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
259 B (259 bytes)
Hash
d0dcf333a14518b404b74166ae1098ab
f6acc6de05d55dbe88b603fa2cd21d287b0ca08b
5aa40d69cbb364b64fe4c9b65e0269cc3ffc2efd22c7097de7a33891460d93bb

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 404 Not Found
content-length: 259
content-type: text/html; charset=iso-8859-1
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

push.services.mozilla.com/

35.162.50.16

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
35.162.50.16:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: o/rAaHUr/fexRy7pShoaxg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: fyyw6HpzXakkKzYBB2iA2WLy0nk=

psostask.com/ch/dnc/home.php?pl=token&link=dhl&bid=1fd4b00aae0097f590767fe686674fe6&callback=jQuery3210690392051016819_1674116444483&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1674116444484

34.141.187.181

200 OK

74 B

URL HTTP/2
psostask.com/ch/dnc/home.php?pl=token&link=dhl&bid=1fd4b00aae0097f590767fe686674fe6&callback=jQuery3210690392051016819_1674116444483&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1674116444484
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text, with no line terminators
Size
74 B (74 bytes)
Hash
69b7c2556a21f2bb931818b76d459264
0b0373e15d5ddae0a3a64291dfcb23575201128c
585c3e014b831fc90c3dcfce287a73db7023f63fc2f5bae60bf15df3eb9c9b8a

HTTP Headers

GET /ch/dnc/home.php?pl=token&link=dhl&bid=1fd4b00aae0097f590767fe686674fe6&callback=jQuery3210690392051016819_1674116444483&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1674116444484 HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Cookie: lng=en
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-length: 74
content-type: application/json
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/home.php?pl=token&link=dhl&bid=1fd4b00aae0097f590767fe686674fe6&callback=jQuery3210690392051016819_1674116444485&data=%7B%22mes%22%3A%22User%20on%20start%20page%22%7D&_=1674116444486

34.141.187.181

200 OK

74 B

URL HTTP/2
psostask.com/ch/dnc/home.php?pl=token&link=dhl&bid=1fd4b00aae0097f590767fe686674fe6&callback=jQuery3210690392051016819_1674116444485&data=%7B%22mes%22%3A%22User%20on%20start%20page%22%7D&_=1674116444486
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text, with no line terminators
Size
74 B (74 bytes)
Hash
99f6b9e84a90128c35554eb522027d04
e899cdb1e687046cd4a9affb360fa231efa16c89
8cf3cbcd9fda508e5aecd940b1fdc6b82b9c5a118f4c30e63f90e5743f40dd95

HTTP Headers

GET /ch/dnc/home.php?pl=token&link=dhl&bid=1fd4b00aae0097f590767fe686674fe6&callback=jQuery3210690392051016819_1674116444485&data=%7B%22mes%22%3A%22User%20on%20start%20page%22%7D&_=1674116444486 HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Cookie: lng=en
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-length: 74
content-type: application/json
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
89055b1f42119cc1e7a33ce2fc364e76
20550fd56bf49a8aa30e18a923be22cda3f2ba7b
7698e9bb59f46011dbd3b6b74fc5784ac60d64c9d8403e8fe3aa18a60c17393d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7698E9BB59F46011DBD3B6B74FC5784AC60D64C9D8403E8FE3AA18A60C17393D"
Last-Modified: Wed, 18 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16344
Expires: Thu, 19 Jan 2023 12:53:10 GMT
Date: Thu, 19 Jan 2023 08:20:46 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
89055b1f42119cc1e7a33ce2fc364e76
20550fd56bf49a8aa30e18a923be22cda3f2ba7b
7698e9bb59f46011dbd3b6b74fc5784ac60d64c9d8403e8fe3aa18a60c17393d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7698E9BB59F46011DBD3B6B74FC5784AC60D64C9D8403E8FE3AA18A60C17393D"
Last-Modified: Wed, 18 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16344
Expires: Thu, 19 Jan 2023 12:53:10 GMT
Date: Thu, 19 Jan 2023 08:20:46 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
89055b1f42119cc1e7a33ce2fc364e76
20550fd56bf49a8aa30e18a923be22cda3f2ba7b
7698e9bb59f46011dbd3b6b74fc5784ac60d64c9d8403e8fe3aa18a60c17393d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7698E9BB59F46011DBD3B6B74FC5784AC60D64C9D8403E8FE3AA18A60C17393D"
Last-Modified: Wed, 18 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16344
Expires: Thu, 19 Jan 2023 12:53:10 GMT
Date: Thu, 19 Jan 2023 08:20:46 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
89055b1f42119cc1e7a33ce2fc364e76
20550fd56bf49a8aa30e18a923be22cda3f2ba7b
7698e9bb59f46011dbd3b6b74fc5784ac60d64c9d8403e8fe3aa18a60c17393d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7698E9BB59F46011DBD3B6B74FC5784AC60D64C9D8403E8FE3AA18A60C17393D"
Last-Modified: Wed, 18 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16344
Expires: Thu, 19 Jan 2023 12:53:10 GMT
Date: Thu, 19 Jan 2023 08:20:46 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe34f344d-12b3-4719-9ecf-6191897f233e.jpeg

34.120.237.76

200 OK

6.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe34f344d-12b3-4719-9ecf-6191897f233e.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.9 kB (6908 bytes)
Hash
b015242ebdda9cc22cfe6741d2e926f1
76072223007cd11c6f7b9fda8f01818ab0fea740
b7a72c737cac91c83c39718de999bc6ff0ec4ede63342e86407190d95e60d9a1

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe34f344d-12b3-4719-9ecf-6191897f233e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6908
x-amzn-requestid: 5f0a0b3b-1d4c-450e-bcd5-481bda79f4e1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eq1qQHwYIAMF-IQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c1030e-62d053e35c8ab2374fd2fe35;Sampled=0
x-amzn-remapped-date: Fri, 13 Jan 2023 07:06:54 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1eiEXaC2jHawVVHg6KAlFvdV7ZMpXdCaN8o36sbYL9WwPvXejGobKA==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 17:36:56 GMT
age: 53030
etag: "76072223007cd11c6f7b9fda8f01818ab0fea740"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60b96714-9b31-441b-a346-5099f350e204.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.4 kB (8388 bytes)
Hash
115c22a4d18aebbb8ffb5fdd8da8c8ba
6f77d73abc59ca903e2a7fd514b559c60931c4d7
74ef77f35165e40f1d9e2c68924a797a8f1b586c325c2d053f830a6f4163ca97

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F60b96714-9b31-441b-a346-5099f350e204.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8388
x-amzn-requestid: 01537ac7-e1b1-4fe8-96dd-e6abd92c4a16
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e9TegGC7IAMF-BQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c865f6-0838524e1f33c0f53b548205;Sampled=0
x-amzn-remapped-date: Wed, 18 Jan 2023 21:34:46 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: BFn5gcxvAZWydXMPSEYOJIr6zBTAu8elKbwd90734RSpSNnO-GXunQ==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 21:53:12 GMT
age: 37654
etag: "6f77d73abc59ca903e2a7fd514b559c60931c4d7"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

3.9 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa4d15f9a-9958-436b-ac3e-167b5a6563ea.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.9 kB (3861 bytes)
Hash
b1b47910c4f71976f73a884bcae6f9bc
26c0d42fddb2a02d9878c34a76874710c92a9d30
9c5ce4945939b126cd36202f5afb8009ce790a792270ec31cc22099e4cd12a24

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa4d15f9a-9958-436b-ac3e-167b5a6563ea.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3861
x-amzn-requestid: c8fbb2e1-9ec6-42c0-8030-9be785e8913e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e9TegFNEoAMFwqg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c865f6-04a9e7db684e88ed69e1bd43;Sampled=0
x-amzn-remapped-date: Wed, 18 Jan 2023 21:34:46 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0vlLtF3fPmIBiYrKVY8qBwVvS7PMn3OTGpu6C0umuCqXdzYxsF-xgQ==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 21:53:12 GMT
age: 37654
etag: "26c0d42fddb2a02d9878c34a76874710c92a9d30"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5dc15588-7ab3-449b-841e-1b44848c69ff.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11511 bytes)
Hash
6ac1e9ae8dfefbc1932d060052188c0b
73e01cd7b75bb0768df616c1a0ebf02df8de5443
bdfbd218becc507160f4e4a162e345300b49aaf0a05effa900b15f757f0ccb3f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5dc15588-7ab3-449b-841e-1b44848c69ff.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11511
x-amzn-requestid: 8f92a31a-a233-4f35-9aac-b7b60a105021
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e3vgjF9MIAMFlpA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c62c69-7844213f4c220b0b140cabe0;Sampled=0
x-amzn-remapped-date: Tue, 17 Jan 2023 05:04:41 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: AvKbDGfVG3LVkWi1R2W02OfdD5-rC0LsjwMMDxUp0JPhpA6_Dfk1QQ==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 21:54:10 GMT
age: 37596
etag: "73e01cd7b75bb0768df616c1a0ebf02df8de5443"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc5e839b2-9887-4705-93dd-351351c5f612.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.5 kB (6489 bytes)
Hash
dca732f3b0a525c0689d566633effb47
9b12e4ce9f936ccb2203807886765e5b0c6e0339
cb5b0faffd9a609aa7f9af0458d032b30d32894b412ecd6d8aa18c90dc0448bf

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc5e839b2-9887-4705-93dd-351351c5f612.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6489
x-amzn-requestid: 8290bd7c-4fb9-4149-b82a-dde38ba2afca
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ewag5H5EoAMFV-w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c33e05-6ad6ec63583c8d511f1b6425;Sampled=0
x-amzn-remapped-date: Sat, 14 Jan 2023 23:43:01 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: splv2LTI5lvHrhvTcF5T0t15iXeLQ2FFZ5uPopDoYxFaa8LE5U9uxA==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 12:34:58 GMT
age: 71148
etag: "9b12e4ce9f936ccb2203807886765e5b0c6e0339"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa848e8c9-5ea8-4948-a3e7-109001ff6cba.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.2 kB (6235 bytes)
Hash
13457311f170ebcd637e77aa48873488
a51ef5eb01736824f382541c5a4ad025ae35c09e
f57f95cc9f18b2e41951f1fcd9c278ca0f522e98dbf57aeb4c59b4b59deeb605

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa848e8c9-5ea8-4948-a3e7-109001ff6cba.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6235
x-amzn-requestid: 919a5e9d-11c0-4b12-a718-f5a256f4fda2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e3RXBG8xoAMFW1w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c5fc2c-2398fc8910eb707e4c15b416;Sampled=0
x-amzn-remapped-date: Tue, 17 Jan 2023 01:38:52 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: MKOZeVCOBgny84FGH7fem1LQnV756ylBS2sGbZSdTpJQ2TNM2qJKFQ==
via: 1.1 e5af640ced3aa8764b82c4bc3f7af38e.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 21:54:10 GMT
age: 37596
etag: "a51ef5eb01736824f382541c5a4ad025ae35c09e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

psostask.com/ch/dnc/home.php?pl=token&link=dhl&bid=1fd4b00aae0097f590767fe686674fe6&callback=jQuery3210690392051016819_1674116444485&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1674116444487

34.141.187.181

200 OK

74 B

URL HTTP/2
psostask.com/ch/dnc/home.php?pl=token&link=dhl&bid=1fd4b00aae0097f590767fe686674fe6&callback=jQuery3210690392051016819_1674116444485&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1674116444487
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type
ASCII text, with no line terminators
Size
74 B (74 bytes)
Hash
99f6b9e84a90128c35554eb522027d04
e899cdb1e687046cd4a9affb360fa231efa16c89
8cf3cbcd9fda508e5aecd940b1fdc6b82b9c5a118f4c30e63f90e5743f40dd95

HTTP Headers

GET /ch/dnc/home.php?pl=token&link=dhl&bid=1fd4b00aae0097f590767fe686674fe6&callback=jQuery3210690392051016819_1674116444485&data=%7B%22online_bider%22%3A1%2C%22w%22%3A0%2C%22dev%22%3A3%7D&_=1674116444487 HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Cookie: lng=en
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
vary: Accept-Encoding
content-encoding: gzip
content-length: 74
content-type: application/json
date: Thu, 19 Jan 2023 08:20:49 GMT
server: Apache
X-Firefox-Spdy: h2

psostask.com/ch/dnc/bower_components/angular/angular.min.js

34.141.187.181

200 OK

0 B

URL HTTP/2
psostask.com/ch/dnc/bower_components/angular/angular.min.js
IP
34.141.187.181:0
ASN
#396982 GOOGLE-CLOUD-PLATFORM

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /ch/dnc/bower_components/angular/angular.min.js HTTP/1.1
Host: psostask.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://psostask.com/ch/dnc/a1b2c3/1fd4b00aae0097f590767fe686674fe6/start/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 200 OK
last-modified: Fri, 18 Aug 2017 16:37:28 GMT
etag: "2937c-55709be9f8200-gzip"
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: application/javascript
date: Thu, 19 Jan 2023 08:20:44 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL