r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 3b7089c645ddc074539d8e19b80cef98
34d2a12ab22405ce01c150dd13e46a781387b00d
1f48c58bc1624f3edf7c67a677f453210524dc536d6e71abe77e5b6f0b437fe5
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1F48C58BC1624F3EDF7C67A677F453210524DC536D6E71ABE77E5B6F0B437FE5"
Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7714
Expires: Mon, 13 Feb 2023 08:30:26 GMT
Date: Mon, 13 Feb 2023 06:21:52 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 254178cc40b1a92de9d879bd731aeb9a
bfab58d211f1f823deed8f91de96ddf778b393a3
469d18130ca960ff8efb710d09f4498bfc21df7339a2e7b79ad1f73a8ce3299a
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "469D18130CA960FF8EFB710D09F4498BFC21DF7339A2E7B79AD1F73A8CE3299A"
Last-Modified: Sat, 11 Feb 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20390
Expires: Mon, 13 Feb 2023 12:01:42 GMT
Date: Mon, 13 Feb 2023 06:21:52 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Content-Type, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Mon, 13 Feb 2023 05:34:40 GMT
content-type: application/json
age: 2832
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b95b930615e89adacbb0cba6ac43288b
257c13545fd3903ece587963bae0c90935ea9bf9
a129cf843807feff42f74c16f73d3e770b143b8f501969694fc4f158bc3e8ba4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A129CF843807FEFF42F74C16F73D3E770B143B8F501969694FC4F158BC3E8BA4"
Last-Modified: Sat, 11 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6070
Expires: Mon, 13 Feb 2023 08:03:02 GMT
Date: Mon, 13 Feb 2023 06:21:52 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP
File type PEM certificate\012- , ASCII text
Hash e76071a28ee566dababb3834f46d68ed
aebb4e68c1ba2de0f90025283e8ed8470944fde0
78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6
GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: uC9kaTdvvg9lNzOJOFyHbabNEFFMWlSuaZTIYn7WkG9cyKcVaDln8y8kCTVvJpSGaPSfennGg20=
x-amz-request-id: QS3G4HYA7CENF2ES
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Mon, 13 Feb 2023 05:37:58 GMT
age: 2634
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 13 Feb 2023 06:21:52 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
mzmlegal.com/wp-admin/dhl/dhl_topscript/index.php?email=info@mlf-ev.de
302 Found 1 B URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/index.php?email=info@mlf-ev.de
IP
File type very short file (no magic)
Hash 7215ee9c7d9dc229d2921a40e899ec5f
b858cb282617fb0956d960215c8e84d1ccf909c6
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /wp-admin/dhl/dhl_topscript/index.php?email=info@mlf-ev.de HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 302 Found
Date: Mon, 13 Feb 2023 06:21:52 GMT
Server: Apache
location: cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI=
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Expires, Retry-After, Content-Length, Content-Type, ETag, Cache-Control, Alert, Pragma, Backoff, Last-Modified
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Mon, 13 Feb 2023 06:14:53 GMT
age: 419
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI=
200 OK 13 kB URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI=
IP
File type HTML document text\012- exported SGML document, ASCII text, with very long lines (11231), with CRLF line terminators
Hash 3385637666f73992e01e7546828b7c12
d01c342ea81a145406e238c58edbb4a14da107e7
7e6524a9f194cb7a69528a93513cc11431900380246819bb5e7df818f9ed382e
Analyzer Verdict Alert urlquery suspicious Suspicious - JavaScript obfusction
NIDS Severity Alert suricata medium ET PHISHING Possible Phishing Landing - Common Multiple JS Unescape May 25 2017
GET /wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI= HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:52 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/style.css
200 OK 845 B URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/style.css
IP
Hash 3f96985049b2c0088b4d6195861786d0
4d687b62012cf45a30f505bfbedcf6a198b2df0f
1a81545f1d8376905aaf4d193a21c388bda4e45cf0f19fdab645185cc1357437
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/style.css HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI=
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:53 GMT
Server: Apache
Last-Modified: Mon, 13 Feb 2023 06:21:52 GMT
Accept-Ranges: bytes
Content-Length: 845
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/css
mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/index.php?email=info@mlf-ev.de
200 OK 131 B URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/index.php?email=info@mlf-ev.de
IP
File type HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4d4afa8e14f5c6c89564932e3131b777
25d8e7e9bdb0af00cde76bcec609f18ade673deb
49096e26bf6e59a96209c4f2b8ffb6c4eb991d443d701b74fadbaf459b795927
Analyzer Verdict Alert fortinet Phishing
GET /wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/index.php?email=info@mlf-ev.de HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI=
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:53 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8fb35800c2b4b14aa5a43cb1eec27200
c05fbacf454cda0cf3f3f62b94b0a00311d492d6
cf9df8a54e2dd5ba508ce4c27bd2ebc3524ad381fce0ec7b3bec1338e4569790
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CF9DF8A54E2DD5BA508CE4C27BD2EBC3524AD381FCE0EC7B3BEC1338E4569790"
Last-Modified: Sat, 11 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18299
Expires: Mon, 13 Feb 2023 11:26:52 GMT
Date: Mon, 13 Feb 2023 06:21:53 GMT
Connection: keep-alive
mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/photos/logo.jpg
200 OK 443 B URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/photos/logo.jpg
IP
File type GIF image data, version 89a, 134 x 42\012- data
Hash 749b06c85447bd7bc889ecbaaa0980ee
de5706a7d3a50bc3eb3b082439a8b990688e0e87
2f680b51b19fc3c5befd02bd9d0d4e88c2722a5210157e4ef68933c5ba352109
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/photos/logo.jpg HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI=
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:53 GMT
Server: Apache
Last-Modified: Mon, 13 Feb 2023 06:21:52 GMT
Accept-Ranges: bytes
Content-Length: 443
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/jpeg
mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/script.js
200 OK 2.4 kB URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/script.js
IP
File type ASCII text, with very long lines (1698)
Hash b9942657383bd3ad4283cd8e79f71d42
5bb017f919052b3c84dbd6674aa4943a244dfcf6
c8d448689181186560db0cdf8a559de76313811947f6e4842e6aefe134a84c0e
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
fortinet Phishing
GET /wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/script.js HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI=
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:53 GMT
Server: Apache
Last-Modified: Mon, 13 Feb 2023 06:21:52 GMT
Accept-Ranges: bytes
Content-Length: 2380
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: application/javascript
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: oVSCMQ2CQnHDgG+u40rNRA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: IEZMZHqSqn/siRVtCaemUCQjDE0=
mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/jquery.min.js
200 OK 84 kB URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/jquery.min.js
IP
File type ASCII text, with very long lines (32180)
Hash 7f9fb969ce353c5d77707836391eb28d
62c4042e9ebc691a5372d653b424512a561d1670
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
fortinet Phishing
GET /wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/jquery.min.js HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI=
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:53 GMT
Server: Apache
Last-Modified: Mon, 13 Feb 2023 06:21:52 GMT
Accept-Ranges: bytes
Content-Length: 84355
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/javascript
images.jdmagicbox.com/comp/chennai/m2/044pxx44.xx44.180817061507.n2m2/catalogue/dtdc-dhl-express-courier-service-kattupakkam-chennai-domestic-courier-services-8pge1s5old.jpg
200 OK 24 kB URL HTTP/2 images.jdmagicbox.com/comp/chennai/m2/044pxx44.xx44.180817061507.n2m2/catalogue/dtdc-dhl-express-courier-service-kattupakkam-chennai-domestic-courier-services-8pge1s5old.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPCM), density 39x39, segment length 16, progressive, precision 8, 722x340, components 3\012- data
Hash fe6be2bca25791765383408a22011de0
b74b233ef596b717e938b4433a3d0e57a13f36de
f4909e662c2b981242419875f315e233aeb49c6ee9acf4433509cb131e2939c9
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /comp/chennai/m2/044pxx44.xx44.180817061507.n2m2/catalogue/dtdc-dhl-express-courier-service-kattupakkam-chennai-domestic-courier-services-8pge1s5old.jpg HTTP/1.1
Host: images.jdmagicbox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
etag: "cfdc8b9f4dc5a2220cbcb216245b5686"
last-modified: Wed, 09 Sep 2020 03:11:26 GMT
server: Akamai Image Manager
unused62: 8096267
content-length: 23587
content-type: image/jpeg
cache-control: no-transform, max-age=31536000
expires: Tue, 13 Feb 2024 06:21:53 GMT
date: Mon, 13 Feb 2023 06:21:53 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 471 B IP
Hash d74123988c9f0a9891cffb9f99bb6ba7
59ae2d845c272b3806764c50046e50aea2ca2d19
a949e69201efa2ceb2825a94df24688053828e57c6e2f1132c4d91486099b9f4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=163240
Content-Type: application/ocsp-response
Date: Mon, 13 Feb 2023 06:21:53 GMT
Etag: "63e9b1a9-1d7"
Expires: Wed, 15 Feb 2023 03:42:33 GMT
Last-Modified: Mon, 13 Feb 2023 03:42:33 GMT
Server: nginx
Content-Length: 471
ocsp.digicert.com/
200 OK 280 B IP
Hash 834dff2f8e75b6bf166c26f08d97128f
053547c038bca128e2ef7a24239d7cf3e315f773
d98aaf369f8851c98b2a76ca69140bfd52a32e9ab52fb71fa7ada78db0596604
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4818
Cache-Control: max-age=164817
Content-Type: application/ocsp-response
Date: Mon, 13 Feb 2023 06:21:53 GMT
Etag: "63e9a500-118"
Expires: Wed, 15 Feb 2023 04:08:50 GMT
Last-Modified: Mon, 13 Feb 2023 02:48:32 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 280
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash a6e940b9ce5ee85ff9e71147e7485260
dd2600d2deb15e8674d2447c11e9c09fe8d7459a
0718d9184b0484d645c3dd6ec5e60d498e0c93eb93f941f19d768e439d06eaa1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 13 Feb 2023 06:21:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash a6e940b9ce5ee85ff9e71147e7485260
dd2600d2deb15e8674d2447c11e9c09fe8d7459a
0718d9184b0484d645c3dd6ec5e60d498e0c93eb93f941f19d768e439d06eaa1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 13 Feb 2023 06:21:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 8b0ef1a28b8110b90eaf4d859158709c
1e9d34d245eb2a6c8745a7e322215695176ecad6
d8e880fc327255bbe896f7d1cb9c6ec0688f84b1a0aa74a476c3cb18e56d0543
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "D8E880FC327255BBE896F7D1CB9C6EC0688F84B1A0AA74A476C3CB18E56D0543"
Last-Modified: Sun, 12 Feb 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21549
Expires: Mon, 13 Feb 2023 12:21:02 GMT
Date: Mon, 13 Feb 2023 06:21:53 GMT
Connection: keep-alive
www.thenational.ae/image/policy:1.655350:1506091043/image/jpeg.jpg
301 Moved Permanently 0 B URL HTTP/2 www.thenational.ae/image/policy:1.655350:1506091043/image/jpeg.jpg
IP
ASN #20940 Akamai International B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /image/policy:1.655350:1506091043/image/jpeg.jpg HTTP/1.1
Host: www.thenational.ae
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: AkamaiGHost
content-length: 0
location: https://www.thenationalnews.com/image/policy:1.655350:1506091043/image/jpeg.jpg
cache-control: private, max-age=60
expires: Mon, 13 Feb 2023 06:22:53 GMT
date: Mon, 13 Feb 2023 06:21:53 GMT
content-security-policy: upgrade-insecure-requests
x-arc-request-id: 0.4e0a655f.1676269313.241c23d
akamai-true-ttl: -1
X-Firefox-Spdy: h2
www.logistics.dhl/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
301 Moved Permanently 0 B URL HTTP/2 www.logistics.dhl/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg HTTP/1.1
Host: www.logistics.dhl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: AkamaiGHost
content-length: 0
location: https://www.dhl.com/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
cache-control: max-age=0
expires: Mon, 13 Feb 2023 06:21:53 GMT
date: Mon, 13 Feb 2023 06:21:53 GMT
X-Firefox-Spdy: h2
www.dpdhl-brands.com/content/dam/dpdhl-corporate/dhl/guides/opener/logo-thumb.png
400 Bad Request 474 B URL HTTP/2 www.dpdhl-brands.com/content/dam/dpdhl-corporate/dhl/guides/opener/logo-thumb.png
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash df9784d1bb40cdb6e4c938a7557eb800
f87c5bbe2bb1f05d22bb14742e991143f9998146
addb861baa2151cebc309b3f79bc2c074e50beba7a3e491db80c6e1048da27eb
GET /content/dam/dpdhl-corporate/dhl/guides/opener/logo-thumb.png HTTP/1.1
Host: www.dpdhl-brands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 400 Bad Request
x-msedge-ref: 0AdfpYwAAAAD3S7V5ojiMTZ5SxYKUfbNbQ1BIMzBFREdFMDQwNgBFZGdl
date: Mon, 13 Feb 2023 06:21:53 GMT
X-Firefox-Spdy: h2
i.ytimg.com/vi/hUZ-R8TiTcY/maxresdefault.jpg
200 OK 115 kB URL HTTP/2 i.ytimg.com/vi/hUZ-R8TiTcY/maxresdefault.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x720, components 3\012- data
Size 115 kB (114894 bytes)
Hash 8ce7794010e8ec7090eef20cd1c126f2
ae886449073f92c200e1dedb49a9a33cc462bb39
ede58d300cb6d11ee16fb3a30e32153c2bd80df53a9e4a3e5f8d36b0fac63dd3
GET /vi/hUZ-R8TiTcY/maxresdefault.jpg HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 114894
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 13 Feb 2023 06:21:53 GMT
expires: Mon, 13 Feb 2023 08:21:53 GMT
cache-control: public, max-age=7200
etag: "1558961103"
content-type: image/jpeg
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash a6e940b9ce5ee85ff9e71147e7485260
dd2600d2deb15e8674d2447c11e9c09fe8d7459a
0718d9184b0484d645c3dd6ec5e60d498e0c93eb93f941f19d768e439d06eaa1
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 13 Feb 2023 06:21:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.dpdhl.com/content/dam/dpdhl/en/about-us/teaser-carousel-1375x504/ecommerce-solutions-1375x504.jpg
200 OK 158 kB URL HTTP/2 www.dpdhl.com/content/dam/dpdhl/en/about-us/teaser-carousel-1375x504/ecommerce-solutions-1375x504.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, software=Adobe Photoshop CC 2018 (Macintosh)\012- GLS_BINARY_LSB_FIRST], baseline, precision 8, 1375x504, components 3\012- data
Size 158 kB (157568 bytes)
Hash ecedc65f709cbd66aa8983a92a60655d
99c718512097d9ec5ada1aaf0d58dca61b3340b9
e8c872384e28d54054537bf44c10daa927abd0e845a7938bc76f654b5ea2a869
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /content/dam/dpdhl/en/about-us/teaser-carousel-1375x504/ecommerce-solutions-1375x504.jpg HTTP/1.1
Host: www.dpdhl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
last-modified: Thu, 19 Jan 2023 09:09:44 GMT
etag: "26780-5f29a48bac7c7"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
accept-ranges: bytes
content-length: 157568
content-type: image/jpeg
cache-control: public, max-age=0
expires: Mon, 13 Feb 2023 06:21:53 GMT
date: Mon, 13 Feb 2023 06:21:53 GMT
x-akamai-cache: RefreshHit from child, RefreshHit from parent
X-Firefox-Spdy: h2
i.ytimg.com/vi/2Rb8iz3bQlo/maxresdefault.jpg
200 OK 196 kB URL HTTP/2 i.ytimg.com/vi/2Rb8iz3bQlo/maxresdefault.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x720, components 3\012- data
Size 196 kB (195930 bytes)
Hash bfef07c683f01767605b2ac655e86b4f
abddaca3a66483125b480484cb1203434ddee83c
ac9df1427781b10727f62fcf7211f77cea7fe1d9416a070ac260a7b8907347b4
GET /vi/2Rb8iz3bQlo/maxresdefault.jpg HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 195930
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Mon, 13 Feb 2023 06:21:53 GMT
expires: Mon, 13 Feb 2023 08:21:53 GMT
cache-control: public, max-age=7200
etag: "1559748006"
content-type: image/jpeg
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
ocsp.starfieldtech.com/
200 OK 1.8 kB IP
Hash 006761154e5fc3f08e1f4a712fe6ce18
f4194f348a58090e8795f91fb9f91bee2fbf1673
5610a04671b9e7a921fa13e466a7f86220c0904f36a86a09562a4622735c0ac8
POST / HTTP/1.1
Host: ocsp.starfieldtech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Mon, 13 Feb 2023 06:21:53 GMT
Content-Type: application/ocsp-response
Content-Length: 1845
Connection: keep-alive
X-Sucuri-ID: 19041
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Sun, 12 Feb 2023 22:43:35 GMT
Expires: Mon, 13 Feb 2023 22:43:35 GMT
ETag: "f4194f348a58090e8795f91fb9f91bee2fbf1673"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
www.dpdhl.com/content/dam/dpdhl/en/media-relations/teaser-carousel-1375x504/divisions.jpg
200 OK 143 kB URL HTTP/2 www.dpdhl.com/content/dam/dpdhl/en/media-relations/teaser-carousel-1375x504/divisions.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, software=Adobe Photoshop Elements 15.0 (Windows)\012- GLS_BINARY_LSB_FIRST], baseline, precision 8, 1375x504, components 3\012- data
Size 143 kB (143443 bytes)
Hash 3e3ed157b9d4a338d86d3ddb389dc303
b6153a0eacdcd434e28e2d6812905a0b8565975c
04ece5be76d51aa5df39067b95366956f7c9cf66395086fe0746e5e13e9bf95c
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /content/dam/dpdhl/en/media-relations/teaser-carousel-1375x504/divisions.jpg HTTP/1.1
Host: www.dpdhl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
last-modified: Thu, 19 Jan 2023 09:09:57 GMT
etag: "23053-5f29a4c034172"
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: DENY
content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
accept-ranges: bytes
content-length: 143443
content-type: image/jpeg
cache-control: public, max-age=0
expires: Mon, 13 Feb 2023 06:21:54 GMT
date: Mon, 13 Feb 2023 06:21:54 GMT
x-akamai-cache: RefreshHit from child, RefreshHit from parent
X-Firefox-Spdy: h2
proceed.solutions/wp-content/uploads/2019/01/DHL-Tyrefort-Birmingham.jpg
200 OK 146 kB URL HTTP/2 proceed.solutions/wp-content/uploads/2019/01/DHL-Tyrefort-Birmingham.jpg
IP
ASN #12488 Krystal Hosting Ltd
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1600x684, components 3\012- data
Size 146 kB (146344 bytes)
Hash d7653710bd040d6dd5fc9eda7af82ee9
d69703aaf376bdbeb3e270516a72809c67034d5f
722eadc9eaf830bec18b54231bf09d78417e718d0c9397792be2a5aec01d56a3
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /wp-content/uploads/2019/01/DHL-Tyrefort-Birmingham.jpg HTTP/1.1
Host: proceed.solutions
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Mon, 20 Feb 2023 06:21:53 GMT
content-type: image/jpeg
last-modified: Fri, 30 Jul 2021 12:29:06 GMT
accept-ranges: bytes
content-length: 146344
date: Mon, 13 Feb 2023 06:21:53 GMT
server: LiteSpeed
vary: User-Agent
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2
www.dhl.com/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
200 OK 90 kB URL HTTP/2 www.dhl.com/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1365x574, components 3\012- data
Hash eedd252b55cb9b88ad45d221af195ea6
d7950fccc40c89da50e17ae61a4d5668899cdc45
491b0063ed59d3bfb84c78d6d8d3ec7dbeca4aabaaa12e4f4063198de4c02683
GET /content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg HTTP/1.1
Host: www.dhl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://mzmlegal.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-frame-options: DENY
content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com https://dpdhlcsiace.my.site.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
last-modified: Tue, 24 Jan 2023 02:14:02 GMT
etag: "15ef0-5f2f911cb8132"
accept-ranges: bytes
content-length: 89840
content-type: image/jpeg
cache-control: public, max-age=0
expires: Mon, 13 Feb 2023 06:21:54 GMT
date: Mon, 13 Feb 2023 06:21:54 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=5
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
X-Firefox-Spdy: h2
ocsp.sectigo.com/
200 OK 471 B IP
Hash 61d79bb5dafa96b7b177a193aa961e27
4103693c6792108dedd49137e25b690361cd2b67
87076f9a3e10a649a6a390bafb08a5f67b671496869518d8decfb1bbc90ceafa
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:54 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Fri, 10 Feb 2023 04:53:50 GMT
Expires: Fri, 17 Feb 2023 04:53:49 GMT
Etag: "4103693c6792108dedd49137e25b690361cd2b67"
Cache-Control: max-age=339714,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb5
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 798b776cacc2b517-OSL
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash b936c0c6fdd6e7c87f02be00ff0869d7
48a71b2c1d254bfba1f9b641d8c42b44153583ec
4773dfa20bc1a7a8e805233536e313ce48d6a452134f553ab5388c4b3cc1c185
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4773DFA20BC1A7A8E805233536E313CE48D6A452134F553AB5388C4B3CC1C185"
Last-Modified: Mon, 13 Feb 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21589
Expires: Mon, 13 Feb 2023 12:21:43 GMT
Date: Mon, 13 Feb 2023 06:21:54 GMT
Connection: keep-alive
ocsp.digicert.com/
200 OK 280 B IP
Hash 834dff2f8e75b6bf166c26f08d97128f
053547c038bca128e2ef7a24239d7cf3e315f773
d98aaf369f8851c98b2a76ca69140bfd52a32e9ab52fb71fa7ada78db0596604
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4819
Cache-Control: max-age=164817
Content-Type: application/ocsp-response
Date: Mon, 13 Feb 2023 06:21:54 GMT
Etag: "63e9a500-118"
Expires: Wed, 15 Feb 2023 04:08:51 GMT
Last-Modified: Mon, 13 Feb 2023 02:48:32 GMT
Server: ECS (ska/F709)
X-Cache: HIT
Content-Length: 280
3655c9b7d0e4c7eb8e62-f41b8e4824d18971b72e44324f6764b3.r43.cf1.rackcdn.com/global/imagelib/hero-images-offer/hero-friendly2-40.jpg
200 OK 61 kB URL HTTP/1.1 3655c9b7d0e4c7eb8e62-f41b8e4824d18971b72e44324f6764b3.r43.cf1.rackcdn.com/global/imagelib/hero-images-offer/hero-friendly2-40.jpg
IP
ASN #20940 Akamai International B.V.
File type JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS4 Macintosh, datetime=2010:02:18 13:15:19], baseline, precision 8, 914x355, components 3\012- data
Hash 1a08ccf46ad319f65482fe2cd85e5ecf
42fe51de3cab614bb3a5f49a12038b4369fd14cf
046624e8250366b85034880b08b85fc17e89c1cbb6b4d7951f7544a4322a1ca5
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /global/imagelib/hero-images-offer/hero-friendly2-40.jpg HTTP/1.1
Host: 3655c9b7d0e4c7eb8e62-f41b8e4824d18971b72e44324f6764b3.r43.cf1.rackcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mzmlegal.com/
HTTP/1.1 200 OK
Last-Modified: Wed, 07 Mar 2012 03:06:20 GMT
ETag: 1a08ccf46ad319f65482fe2cd85e5ecf
Content-Length: 61318
Accept-Ranges: bytes
X-Timestamp: 1331089579.40214
Content-Type: image/jpeg
X-Trans-Id: tx681fa01af4e74a9b8f74f-0063e0e982dfw1
Cache-Control: public, max-age=43117
Expires: Mon, 13 Feb 2023 18:20:31 GMT
Date: Mon, 13 Feb 2023 06:21:54 GMT
Connection: keep-alive
secureservercdn.net/198.71.233.227/4f2.e16.myftpupload.com/wp-content/uploads/2017/03/dhl.jpg
404 Not Found 0 B URL HTTP/2 secureservercdn.net/198.71.233.227/4f2.e16.myftpupload.com/wp-content/uploads/2017/03/dhl.jpg
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /198.71.233.227/4f2.e16.myftpupload.com/wp-content/uploads/2017/03/dhl.jpg HTTP/1.1
Host: secureservercdn.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
server: nginx
date: Mon, 13 Feb 2023 06:21:54 GMT
content-length: 0
x-sucuri-id: 19016
strict-transport-security: max-age=31536000; includeSubDomains
x-sucuri-cache: MISS
X-Firefox-Spdy: h2
www.baumannmusic.com/wp-content/uploads/2017/12/Background-Music-for-DHL-Video-830x467.jpg
200 OK 84 kB URL HTTP/2 www.baumannmusic.com/wp-content/uploads/2017/12/Background-Music-for-DHL-Video-830x467.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 830x467, components 3\012- data
Hash a2563e0ceea6f7fe6b5c74b88aed269c
c5ae2ace75416ea298cd47d91dab9054bcf20d73
710b05eacf50d07b2b2def63c1e0fa07c2564a3e1a9a9627aafd3a7c47af11fc
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /wp-content/uploads/2017/12/Background-Music-for-DHL-Video-830x467.jpg HTTP/1.1
Host: www.baumannmusic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Mon, 13 Feb 2023 06:21:54 GMT
content-type: image/jpeg
content-length: 83852
last-modified: Thu, 11 Feb 2021 15:56:24 GMT
etag: "602553a8-1478c"
accept-ranges: bytes
X-Firefox-Spdy: h2
cdn.wallpapersafari.com/18/53/3K29yL.jpg
200 OK 176 kB URL HTTP/2 cdn.wallpapersafari.com/18/53/3K29yL.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 75", baseline, precision 8, 1366x768, components 3\012- data
Size 176 kB (176173 bytes)
Hash bd4f980418b45b4951b575217fb71afb
4eb172e2209fcf2e20440f00880f2cd7399287bf
fde2f8f83f005d237bbf12371a323b2820a3d4651576ed16b0b856c61bdd19ed
GET /18/53/3K29yL.jpg HTTP/1.1
Host: cdn.wallpapersafari.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 13 Feb 2023 06:21:54 GMT
content-type: image/jpeg
content-length: 176173
last-modified: Thu, 19 Sep 2019 21:20:27 GMT
etag: "5d83f11b-2b02d"
expires: Wed, 15 Mar 2023 06:21:54 GMT
cache-control: public, max-age=31536000, must-revalidate, proxy-revalidate
pragma: public
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RYfSx4xb4743GP2daRO9V3vKcX7gwsweI4j6alBHRBup6G29%2BYMVA6hGwX%2FJ9Fr5f5wfQ9WgfqMBCYTwXoVphO%2FZZxqGI%2B%2Bufjj1xA5dQ7fHiUFIr%2Bq0mV5nhxLyF78wH1bHNJHRjRjl"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 798b776af8941bfe-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
postandparcel.info/wp-content/uploads/2015/11/dpdhl-trainees-tutor-600.jpg
200 OK 74 kB URL HTTP/2 postandparcel.info/wp-content/uploads/2015/11/dpdhl-trainees-tutor-600.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 600x395, components 3\012- data
Hash 8000a9cbeb975a560104e1c197a80afc
853d6182528c6620b5bdbc8abb345403519110f9
61da34a0d163bde26aba95ac6c08129884cafd67ee79af552f39688960ade93d
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /wp-content/uploads/2015/11/dpdhl-trainees-tutor-600.jpg HTTP/1.1
Host: postandparcel.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Mon, 13 Feb 2023 06:21:54 GMT
content-type: image/jpeg
content-length: 73725
last-modified: Sat, 02 Dec 2017 13:56:36 GMT
etag: "11ffd-55f5bda7f6d00"
cache-control: max-age=7200
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QzpqMj%2FjWSCm9EKMdYdOdMfiQz7gdEQSMzHTCA1mBik3tOUBVrx%2Bu8RAeq55tw8vb%2BV27WXdWzPSgV7%2BGm59DzJ3ZXWk6bH1G0tvrpeejIgbyJYhpluspaOG7B1t835cakmP8g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 798b776c0d5c0b4d-OSL
X-Firefox-Spdy: h2
kijamii.com/images/work/13-%20Story%20Thirteen%20-%20DHL/Others%20(in%20story)/DHL%205.jpg
404 Not Found 6.8 kB URL HTTP/1.1 kijamii.com/images/work/13-%20Story%20Thirteen%20-%20DHL/Others%20(in%20story)/DHL%205.jpg
IP
ASN #14061 DIGITALOCEAN-ASN
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (8047), with CRLF, LF line terminators
Hash 5c18db44cca411ce7035cc4b561a6ebc
d8b7f16e1cc282fa8816172b8ec314aa53545bbf
c64b256f7b63e49da113a542eccb062ff67e928de7fc9d11135cab512505adcc
GET /images/work/13-%20Story%20Thirteen%20-%20DHL/Others%20(in%20story)/DHL%205.jpg HTTP/1.1
Host: kijamii.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Mon, 13 Feb 2023 06:21:54 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Content-Encoding: gzip
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0de0354ee620551182e2bf1fbc6b2194
b5c7e4adb58b525586b77d56acd8c7a9c57c4d8c
c0fe5edc97b1f6642a50428fca8dc93e24696c79a880477beaf7ba27bbc5c243
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C0FE5EDC97B1F6642A50428FCA8DC93E24696C79A880477BEAF7BA27BBC5C243"
Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5702
Expires: Mon, 13 Feb 2023 07:56:56 GMT
Date: Mon, 13 Feb 2023 06:21:54 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0de0354ee620551182e2bf1fbc6b2194
b5c7e4adb58b525586b77d56acd8c7a9c57c4d8c
c0fe5edc97b1f6642a50428fca8dc93e24696c79a880477beaf7ba27bbc5c243
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C0FE5EDC97B1F6642A50428FCA8DC93E24696C79A880477BEAF7BA27BBC5C243"
Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5702
Expires: Mon, 13 Feb 2023 07:56:56 GMT
Date: Mon, 13 Feb 2023 06:21:54 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 0de0354ee620551182e2bf1fbc6b2194
b5c7e4adb58b525586b77d56acd8c7a9c57c4d8c
c0fe5edc97b1f6642a50428fca8dc93e24696c79a880477beaf7ba27bbc5c243
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C0FE5EDC97B1F6642A50428FCA8DC93E24696C79A880477BEAF7BA27BBC5C243"
Last-Modified: Sat, 11 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5702
Expires: Mon, 13 Feb 2023 07:56:56 GMT
Date: Mon, 13 Feb 2023 06:21:54 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1f208c1a-dd72-4a50-bc13-7161f3889c39.webp
200 OK 3.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1f208c1a-dd72-4a50-bc13-7161f3889c39.webp
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cb6dded44bef82a1267f0a7b1cc28062
51e60d0f7f19ae9ffccd53945549413f36d89f05
47b38fc59dc02e390f06294de570f0cd10c2148a5e051068e565105426f5cc7b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1f208c1a-dd72-4a50-bc13-7161f3889c39.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 3896
x-amzn-requestid: 34f5be23-eb92-4269-931e-b6abb5a6de3f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ACooWE-QIAMF3JA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e42168-2764425c76006481273c316f;Sampled=0
x-amzn-remapped-date: Wed, 08 Feb 2023 22:25:44 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: v23yQO9CO-TX38zHvibH_DkDA8bndKWoo2TKxV15k8a7AMFVFXAoxA==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 a847181d425b7fc57e81eb3c800bfdf2.cloudfront.net (CloudFront), 1.1 google
date: Sun, 12 Feb 2023 17:55:15 GMT
age: 44799
etag: "51e60d0f7f19ae9ffccd53945549413f36d89f05"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3d83838-2443-4bb3-a80f-c9fda2bb40b0.jpeg
200 OK 6.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3d83838-2443-4bb3-a80f-c9fda2bb40b0.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 5271b4b136443bb9335b0c03411d35d7
d00a532126b5035a49ebfa9e38eb4bdce6799763
d47ddb6110c00285e6a600929f0be131f5c66bf62304a796391a951be820aa12
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3d83838-2443-4bb3-a80f-c9fda2bb40b0.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6296
x-amzn-requestid: a444c4aa-4ed8-459f-b73d-0fa3e4fc0737
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: APti8EmkoAMFZ6A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e95c78-6e46ada940230145441d9041;Sampled=0
x-amzn-remapped-date: Sun, 12 Feb 2023 21:39:04 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 62aqw1JLFePdsca934CKvRJwwyBqpF6qbKXd-MnQO6g2nZs-4IsixA==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Sun, 12 Feb 2023 21:59:45 GMT
age: 30129
etag: "d00a532126b5035a49ebfa9e38eb4bdce6799763"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3b95fd0-70b7-4757-9068-83472c90622c.jpeg
200 OK 12 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3b95fd0-70b7-4757-9068-83472c90622c.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash dd9dfc91c131903f04b22bca2ea07569
8fac706269ae3ec4a9f60a64f6b08066e9eeb22a
d72e6a45a42dd6f6d39bdf2a68837a2fdd73b9df6e01a29dd173725b3d88e97e
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc3b95fd0-70b7-4757-9068-83472c90622c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12032
x-amzn-requestid: 1be7b95f-1088-4e2a-ba74-bba8a5c3b615
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AMZ_gHE7oAMFfkg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e809fc-65057649605a732b64098657;Sampled=0
x-amzn-remapped-date: Sat, 11 Feb 2023 21:34:52 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: yfww-qr6Q5rYeNV8RsfQnKlCYogDhCO15MGjGC3yyJovUYNFOpxgmA==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Sun, 12 Feb 2023 22:19:05 GMT
age: 28969
etag: "8fac706269ae3ec4a9f60a64f6b08066e9eeb22a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F494c1120-1fd9-47ff-b132-db864d82f336.jpeg
200 OK 16 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F494c1120-1fd9-47ff-b132-db864d82f336.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d541ed14872ffbe91d331fcb6ae12b57
746ee04db289437a81ab0033ead16e959c06deb1
6c3f451827e567e64e73f8daa0ad97683f4df059797e69edccc45bf764e0a569
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F494c1120-1fd9-47ff-b132-db864d82f336.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 15453
x-amzn-requestid: 2847ee06-aff6-4fbc-b7de-bf153069f9c2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fzWAgEaVIAMF5NA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63de039c-50f3c16743b8387a42c4c868;Sampled=0
x-amzn-remapped-date: Sat, 04 Feb 2023 07:05:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: fPoQQ7xfDGaa0qVqzA9PvrIAUmVdB9te6AVndHiU2jG0vZ4EHY4sIQ==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Sun, 12 Feb 2023 22:00:31 GMT
age: 30083
etag: "746ee04db289437a81ab0033ead16e959c06deb1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Febfb3c6e-f6c0-486d-87c5-7fc72a4dabb6.jpeg
200 OK 3.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Febfb3c6e-f6c0-486d-87c5-7fc72a4dabb6.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9f20375f5fdd99cbbf1d7ec7c5be5242
8669ace6acfeb69d86826555f89d8a4a398e18ee
0b3d1dd8e4327d69f469bc0b19a8179b6302548b76c1e659cd0ba1ba8d9da862
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Febfb3c6e-f6c0-486d-87c5-7fc72a4dabb6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 3223
x-amzn-requestid: c81e15fe-6a41-4afd-b271-9e9cab6dffa3
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AMD-KFquoAMF3hg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e7e6c0-29ef586a7dbcce451d1081e4;Sampled=0
x-amzn-remapped-date: Sat, 11 Feb 2023 19:04:32 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: o5R1hmzg1Uyeb72k-ggRRm21hsnHiYI-fU1shZbmsoNKyP3ETfcBKQ==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Sun, 12 Feb 2023 17:35:16 GMT
age: 45998
etag: "8669ace6acfeb69d86826555f89d8a4a398e18ee"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc385a816-266f-4c4a-bdfc-1deb175a43b9.jpeg
200 OK 6.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc385a816-266f-4c4a-bdfc-1deb175a43b9.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash d17cf9d6f7274008910e145f5ac8e18f
fa72764a6e7439a1ac6eec5cb1b2c849df285395
31cfab4ca940ef45ef316bd338216f942486eb62a3c2b6e530084f9a8ec7bb1b
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc385a816-266f-4c4a-bdfc-1deb175a43b9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6675
x-amzn-requestid: 80ba1e94-388d-4181-99d3-18ca46586aff
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ACnmkH6CIAMFcNg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e41fc3-7d075c1c0bcfbd2436166917;Sampled=0
x-amzn-remapped-date: Wed, 08 Feb 2023 22:18:43 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: YpFOsPWr9vD1HyL7qetS7cxwPcnN5VHlFInvJA6sCgqHd7koXuxJvQ==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Sun, 12 Feb 2023 22:32:41 GMT
age: 28153
etag: "fa72764a6e7439a1ac6eec5cb1b2c849df285395"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/photos/favicon.jpg
200 OK 14 kB URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/photos/favicon.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3\012- data
Hash 136327a26d4244a53508386ead14b296
1a8062e27bbe32dcbfd1bb993bde5df86176f527
c53865ec446bb1418b2f74d320d61a4bec01169da5f5732bff41ddb9f92cf632
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/photos/favicon.jpg HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/?email=info@mlf-ev.de&loginpage=&reff=NTczMjRlMzAwZDM3OTVjYWQ0ZGViMGU1ODI2OWQ3MDI=
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:54 GMT
Server: Apache
Last-Modified: Mon, 13 Feb 2023 06:21:52 GMT
Accept-Ranges: bytes
Content-Length: 13755
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: image/jpeg
chuyenphatnhanhdhlhcm.vn/wp-content/uploads/2018/07/bannerDHL-e1536645731248.jpg
200 OK 15 kB URL HTTP/2 chuyenphatnhanhdhlhcm.vn/wp-content/uploads/2018/07/bannerDHL-e1536645731248.jpg
IP
ASN #63760 AZDIGI Corporation
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 720x267, components 3\012- data
Hash 04b62e5173ca5e4a1474d741bd794bcb
8776bbf8e53ba1444d0ef0f8a5f736d6c74842ba
3c8258d55a687c7007ce15d917a4092dd6709abd81acdea2cdeaba26970b251d
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /wp-content/uploads/2018/07/bannerDHL-e1536645731248.jpg HTTP/1.1
Host: chuyenphatnhanhdhlhcm.vn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Mon, 20 Feb 2023 06:21:55 GMT
content-type: image/jpeg
last-modified: Tue, 11 Sep 2018 06:02:12 GMT
accept-ranges: bytes
content-length: 14852
date: Mon, 13 Feb 2023 06:21:55 GMT
server: LiteSpeed
vary: User-Agent
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2
mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/login.php?email=info@mlf-ev.de
200 OK 10 kB URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/login.php?email=info@mlf-ev.de
IP
File type HTML document text\012- exported SGML document, ASCII text, with very long lines (3848), with CRLF line terminators
Hash a6cfef7be499c5913dbe4431af234a9b
06f57bdd3f82e33ba76f637b34a55822a0d52b25
c1a146bc30fd3e083d9684cc49afd6329f154ee651724cb3a34c494b61ec9d48
Analyzer Verdict Alert urlquery suspicious Suspicious - JavaScript obfusction
urlquery suspicious Suspicious - JavaScript obfusction
urlquery suspicious Suspicious - JavaScript obfusction
fortinet Phishing
NIDS Severity Alert suricata medium ET PHISHING Possible Phishing Landing - Common Multiple JS Unescape May 25 2017
suricata medium ET PHISHING Multiple Javascript Unescapes - Common Obfuscation Observed in Phish Landing
GET /wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/login.php?email=info@mlf-ev.de HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:57 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/photos/logo.jpg
200 OK 3.9 kB URL HTTP/1.1 mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/photos/logo.jpg
IP
File type PNG image data, 425 x 125, 8-bit colormap, non-interlaced\012- data
Hash d8b38bb6321bd45ff42ed6931a870bb5
483fa5870b17eae93e8251dd50e694da5b0297a0
26933abb67839e269d8fc9d49b5ff722a1f48646776a8bdfb25e572d10996b41
Analyzer Verdict Alert urlquery phishing Phishing - DHL
urlquery phishing Phishing - DHL
GET /wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/photos/logo.jpg HTTP/1.1
Host: mzmlegal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://mzmlegal.com/wp-admin/dhl/dhl_topscript/cmd-login=7b7adf0f2b466d1461eae7dcc85b77d4/content/login.php?email=info@mlf-ev.de
HTTP/1.1 200 OK
Date: Mon, 13 Feb 2023 06:21:57 GMT
Server: Apache
Last-Modified: Mon, 13 Feb 2023 06:21:52 GMT
Accept-Ranges: bytes
Content-Length: 3902
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: image/jpeg
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb8d96f83-c427-42ea-9110-f6e241ad7a9b.jpeg
200 OK 8.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb8d96f83-c427-42ea-9110-f6e241ad7a9b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 08ea0f1f84bf64810d3e985517309811
bd35ba4f31a39175fb2e9c247afe7fda59184dd9
f6ea126b564a8d0d38142a7661f44ac1b3eb0181cc7ad809d214b92bd9f55484
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb8d96f83-c427-42ea-9110-f6e241ad7a9b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
content-length: 8819
x-amzn-requestid: 4868d848-f1c1-49d9-9e57-c812459f9453
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f9NRuHMLoAMFhsg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e1f5a4-0f279ed5392e5b2b1b2c5553;Sampled=0
x-amzn-remapped-date: Tue, 07 Feb 2023 06:54:28 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: dM2V9Kb6nWq4IV12gub1HpdaRQCzwk4sITaxnZI3B8awwLZEGQ-66g==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Sun, 12 Feb 2023 22:07:46 GMT
age: 29655
etag: "bd35ba4f31a39175fb2e9c247afe7fda59184dd9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
www.parcello.org/assets/images/pages/dhl-paketnetzwerk-original.jpg
404 Not Found 0 B URL HTTP/2 www.parcello.org/assets/images/pages/dhl-paketnetzwerk-original.jpg
IP
ASN #24940 Hetzner Online GmbH
GET /assets/images/pages/dhl-paketnetzwerk-original.jpg HTTP/1.1
Host: www.parcello.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://mzmlegal.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
server: nginx
date: Mon, 13 Feb 2023 06:21:54 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
www.thenationalnews.com/image/policy:1.655350:1506091043/image/jpeg.jpg
404 Not Found 0 B URL HTTP/2 www.thenationalnews.com/image/policy:1.655350:1506091043/image/jpeg.jpg
IP
ASN #20940 Akamai International B.V.
GET /image/policy:1.655350:1506091043/image/jpeg.jpg HTTP/1.1
Host: www.thenationalnews.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://mzmlegal.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 404 Not Found
content-type: text/html; charset=utf-8
content-length: 79049
server: openresty
content-encoding: gzip
etag: W/"10ac6f-/2IEu39PvVW951daUW8GdZ5Ft6k"
last-modified: Mon, 13 Feb 2023 06:21:54 GMT
vary: Accept-Encoding
cache-control: private, max-age=60
expires: Mon, 13 Feb 2023 06:22:54 GMT
date: Mon, 13 Feb 2023 06:21:54 GMT
set-cookie: arc-geo={"country_code":"NO","city":"OSLO","longitude":"10.75","latitude":"59.92"}; path=/; secure
content-security-policy: upgrade-insecure-requests
x-arc-request-id: 0.4e0a655f.1676269314.241c250
akamai-true-ttl: -1
X-Firefox-Spdy: h2
209.236.113.22
96.6.17.154
2.22.61.57
95.100.9.53
45.252.248.44
185.199.220.41