Report - gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

Report Overview

Submitted URL
gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1
IP
124.221.194.248
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited
Submitted
2022-10-03 20:34:24
Access
Website Title
Final URL
Tags
None
urlquery detections
Phishing - DHL

Detections

urlquery
4
Network Intrusion Detection
0
Threat Detection Systems
32

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
cdn.jsdelivr.net	439	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	673 B	8.6 kB	151.101.85.229
content-signature-2.cdn.mozilla.net	1152	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	401 B	5.8 kB	143.204.55.25
code.jquery.com	634	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	376 B	31 kB	69.16.175.10
img-getpocket.cdn.mozilla.net	1631	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	3.2 kB	53 kB	34.120.237.76
ocsp.pki.goog	175	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	690 B	1.4 kB	142.250.74.3
ocsp.globalsign.com	2075	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	356 B	1.9 kB	104.18.20.226
firefox.settings.services.mozilla.com	867	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	758 B	2.7 kB	143.204.55.35
ajax.googleapis.com	12905	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	293 B	34 kB	142.250.74.42
ipinfo.io	8136	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	624 B	965 B	34.117.59.81
gennou.com	unknown	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	6.6 kB	581 kB	124.221.194.248
push.services.mozilla.com	2140	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	594 B	127 B	35.161.6.128
r3.o.lencr.org	344	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	2.0 kB	5.3 kB	23.36.76.249
contile.services.mozilla.com	1114	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	321 B	229 B	34.117.237.239
ocsp.digicert.com	86	0001-01-01T00:00:00Z	0001-01-01T00:00:00Z	329 B	737 B	93.184.220.29

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2022-10-03	medium	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	DHL Airways, Inc.

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2022-10-03	medium	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/js.cookie.js	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/jquery-lang.js	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/load.php	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/DHL_head.html	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/DHL_footer.html	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/fonts/default-274a65bae9742377aaf010bb1a7de971.woff	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/fonts/iconfont-e7bece496cd0e6d60e456bc2b48c9446.woff	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/fonts/default-815fcbb4d2c57901701125d768f09d67.woff	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/fonts/default-3e828e80f6e985c352eba4474518978d.woff	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/DHL_track.html	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/jquery.validate.min.js	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/fonts/default-5a6dd86f272b304a8b83f7df61f11c2f.woff	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/langpack/en.json	Phishing
2022-10-03	medium	gennou.com/n/dir/dist/langpack/en.json	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

JavaScript (14)

	URL	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.5.1.min.js	90 kB	2023-03-07	2024-04-25
Pretty URL code.jquery.com/jquery-3.5.1.min.js IP 69.16.175.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-25 14:16:01 Times Seen139121 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	gennou.com/n/dir/dist/jquery-lang.js	28 kB	2023-03-07	2024-04-22
Pretty URL gennou.com/n/dir/dist/jquery-lang.js IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-22 02:04:43 Times Seen478 Hash 1062fb1e2ffb1b8b6c596da423b9aef6 e0f54f2cdfce6d3861506744d6c52fbc23f612e9 67829a15eafd08a53376a78dc3574724e4bf87455bdc7b52c9b01828df272ca2 Loading...

	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	24 kB	2023-03-07	2023-04-05
Pretty URL gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:05 Last Seen2023-04-05 02:10:37 Times Seen48 Hash be2688fe29eb5135f6f36c94e2e53820 15364bc930a8e0f87a09b5aa645a312984a9da73 0ca6e9d89d18b037dcce799d02a32f53aca9497adba83f93ea6d8751fe2fa217 Loading...

	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	9 B	2023-03-07	2024-04-25
Pretty URL gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:05 Last Seen2024-04-25 09:32:13 Times Seen16139 Hash 5e543256c480ac577d30f76f9120eb74 d5d4cd07616a542891b7ec2d0257b3a24b69856e eb045d78d273107348b0300c01d29b7552d622abbc6faf81b3ec55359aa9950c Loading...

	ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js	93 kB	2023-03-07	2024-04-25
Pretty URL ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js IP 142.250.74.42 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-25 08:42:46 Times Seen16798 Hash e0e0559014b222245deb26b6ae8bd940 e2f3603e23711f6446f278a411d905623d65201e 89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e Loading...

	gennou.com/n/dir/dist/js.cookie.js	3.4 kB	2023-03-07	2024-04-22
Pretty URL gennou.com/n/dir/dist/js.cookie.js IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-22 02:04:43 Times Seen471 Hash 19d988c6d1e7cd9d601639a616dc769b 2cf3f170a083a3e4538a6f55b1064eaf737f6180 9df6e8c4bc8ea670d2f4da40a35a41772cc8857aca288a77acfa891cf1a54c36 Loading...

	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	1.8 kB	2023-03-07	2023-04-05
Pretty URL gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2023-04-05 02:10:37 Times Seen37 Hash 9ddee2a191326dc2605ceb1cc094990b d422115883d943f7449a253f252a830efdfeee71 c8504d5af9e4a9db87d3b945f0a2d75188098d24a3f87e99dcb7c01b98bd4029 Loading...

	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	1.4 kB	2023-03-07	2023-04-05
Pretty URL gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2023-04-05 02:10:37 Times Seen37 Hash 5329f7468d15783c00be6fe3f9b06b32 34a468c9ba09e58351afa6c0021e454245699815 6ebae2c4b8815818d94884a0939c122eb1b81a1b17add5fda8aa0904aa81025b Loading...

	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	629 B	2023-03-07	2024-04-22
Pretty URL gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:05 Last Seen2024-04-22 02:04:43 Times Seen194 Hash 40caf4b9db3eeb421d7639f1c1cb39e0 d0afc8f3fef2cf87946a0eca6461a4a2d55a5680 4443f9401c6a316d9ac2cb120686003f32a7933a52b29894609185f058a5308e Loading...

	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	1.0 kB	2023-03-07	2024-04-07
Pretty URL gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-07 07:13:32 Times Seen66 Hash 1d175bf3c30c7a41b8f0f6c60e2fcefc 1e1ac5cb8a33370b0eff734a461cf2bae98e1244 4323901acf3473e6164e79dcb144d4c5f97709819c0c572056c09174aa78dce9 Loading...

	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	5 B	2023-03-07	2024-04-24
Pretty URL gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-04-24 21:17:40 Times Seen2674 Hash 230a091930a82c5ae47e29610ee98ceb 6376b33e5123bf09a271789a272103f957c8f38d 4dc501d66cd78903b81b1a53459d0432939728c537bbe9ffab55ab81521cb352 Loading...

	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	1.6 kB	2023-03-08	2023-03-10
Pretty URL gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 04:41:31 Last Seen2023-03-10 12:25:27 Times Seen1 Hash 460bf6748634240fa3eca195e58211a0 a3cdd17c59e68ae3284e0d3fb3c65d3b804766ec 24cfb100539dc7a1cbeffd29722d736ca83ac42b84d0f5154967f6546a1baa72 Loading...

	cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js	21 kB	2023-03-07	2024-04-25
Pretty URL cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js IP 151.101.85.229 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:05 Last Seen2024-04-25 13:15:30 Times Seen5953 Hash 1022eaf388cc780bcfeb6456157adb7d 313789ca0e31b654784dbba8b0f83f364f8683b4 fe28dc38bc057f6eb11180235bbe458b3295a39b674d889075d3d9a0b5071d9f Loading...

	gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1	2.1 kB	2023-03-08	2023-03-13
Pretty URL gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 IP 124.221.194.248 ASN #45090 Shenzhen Tencent Computer Systems Company Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 01:35:52 Last Seen2023-03-13 17:25:02 Times Seen1 Hash b872933199f244e108c78018003794e1 544b2296812e60b439513f2cb4caf0ded58b90d8 e36be88f1ec25f275ccd5b146207ba6c67934d10a54659c2aebe3f348366c6b3 Loading...

HTTP Transactions (44)

URL IP Response Size

firefox.settings.services.mozilla.com/v1/

143.204.55.35

200 OK

939 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/
IP
143.204.55.35:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
1b3053fa528e28810f8a2cc9284cc921
cca9eb471d941881a6b9a1793aecb6c281908f6a
a2427848ba35575dda8a82cf88f104978234c05389deebc3fc8279d9075eff45

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Backoff, Content-Length, Retry-After
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Mon, 03 Oct 2022 19:46:51 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 475d4ecb64796af058573c6f1048e898.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: WOLoYT1Ejxiloc-RQB_B-9z6hoFDoQdjhsY6NzTQPvINoIAVeQoZYQ==
Age: 2843

r3.o.lencr.org/

23.36.76.249

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
9955bda9c9ef64bc5700a14af0bae25e
8de7b7469e905af0374bdfcc3006bbb844f13e94
1f611155394fac39439b8ec8217d8cd493d6b588d372d264e0d66c03129c50c6

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "1F611155394FAC39439B8EC8217D8CD493D6B588D372D264E0D66C03129C50C6"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18078
Expires: Tue, 04 Oct 2022 01:35:32 GMT
Date: Mon, 03 Oct 2022 20:34:14 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain

143.204.55.25

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain
IP
143.204.55.25:0
ASN
#16509 AMAZON-02

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
6113f8408c59aebe188d6af273b90743
7398873bf00f99944eaa77ad3ebc0d43c23dba6b
b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Mon, 03 Oct 2022 05:28:28 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: icIBMzv9B7hn8aMlNIgqEKKE4t7zbKS3OQjFaARECMZnRWLOofKBZg==
age: 54347
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Mon, 03 Oct 2022 20:34:14 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

124.221.194.248

200 OK

1.9 kB

URL HTTP/1.1
gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Size
1.9 kB (1917 bytes)
Hash
ac663b6b2014a63c2d60f68d0b2e201a
e90553ea100be3c4e570dba5e5f6626aa5de94f9
94d60149ca27c4663d089612ffff0ccdc303f89e80ef688b5f6a3532c436f4d9

Detections

Analyzer	Verdict	Alert
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1 HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:14 GMT
Content-Type: text/html
Last-Modified: Sat, 01 Oct 2022 15:48:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63386133-1f52"
Content-Encoding: gzip

ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js

142.250.74.42

200 OK

33 kB

URL HTTP/1.1
ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
IP
142.250.74.42:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (32072)
Size
33 kB (32954 bytes)
Hash
d38e2944bbc9ae54b8947a2bd0b9a932
782a825679b248d38979c2d7ecae257873344437
65a0917567cb7037612cf420629873f2f3594d2e741aaadf90d893d07d8f5fdd

HTTP Headers

GET /ajax/libs/jquery/1.10.2/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gennou.com/

HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Timing-Allow-Origin: *
Content-Length: 32954
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Mon, 03 Oct 2022 09:32:27 GMT
Expires: Tue, 03 Oct 2023 09:32:27 GMT
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
Content-Type: text/javascript; charset=UTF-8
Age: 39707

code.jquery.com/jquery-3.5.1.min.js

69.16.175.10

200 OK

31 kB

URL HTTP/2
code.jquery.com/jquery-3.5.1.min.js
IP
69.16.175.10:0
ASN
#20446 STACKPATH-CDN

File type
ASCII text, with very long lines (65451)
Size
31 kB (30879 bytes)
Hash
3700d0b271343804b9b9aa1c13efa521
3d6b03dbd74872ca3dfbb0529f6c80943788f918
fda7541f8e4cf921d20bcd0dc1d0efe69644c79bd18a0be4ce2f34246c83603e

HTTP Headers

GET /jquery-3.5.1.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://gennou.com
Connection: keep-alive
Referer: http://gennou.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Mon, 03 Oct 2022 20:34:14 GMT
content-encoding: gzip
content-length: 30879
content-type: application/javascript; charset=utf-8
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
accept-ranges: bytes
server: nginx
etag: W/"611feac9-15d84"
cache-control: max-age=315360000, public
access-control-allow-origin: *
vary: Accept-Encoding
x-hw: 1664829254.dop206.sk1.t,1664829254.cds246.sk1.hn,1664829254.cds208.sk1.c
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

143.204.55.35

200 OK

329 B

URL HTTP/1.1
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
143.204.55.35:0
ASN
#16509 AMAZON-02

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Mon, 03 Oct 2022 20:29:33 GMT
Cache-Control: max-age=3600, max-age=3600
Expires: Mon, 03 Oct 2022 21:03:40 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 a9120cc3ff449047c990e82a4d5566ba.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: pQEDvZ5lX88SAjfYYE6Heu6MCSLEYjw6ZkLx_f4l8KasQuvyum0u1w==
Age: 281

gennou.com/n/dir/dist/js.cookie.js

124.221.194.248

200 OK

1.5 kB

URL HTTP/1.1
gennou.com/n/dir/dist/js.cookie.js
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
ASCII text
Size
1.5 kB (1459 bytes)
Hash
c2b8a5ec7feab55c9367484bf1a827b8
3235843155f4895895a3c82bc486cb7cf04d0293
462e9b036ef7da2ce8ac4afce22db9f437fd7a061a643e885acf303acfe23600

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/js.cookie.js HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:14 GMT
Content-Type: application/javascript
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"61fa2666-d60"
Expires: Tue, 04 Oct 2022 08:34:14 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
321fa9a78e31dcb66601ac5890bfba73
c325580db79bde6fd00d2d0c7e3f675e4c0046bb
83029b324b4c36522ae47eef9614c124b0ad2994de412d7ea82f990ad8ae9d92

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6258
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Mon, 03 Oct 2022 20:34:15 GMT
Last-Modified: Mon, 03 Oct 2022 18:49:57 GMT
Server: ECS (ska/F70B)
X-Cache: HIT
Content-Length: 471

gennou.com/n/dir/dist/jquery-lang.js

124.221.194.248

200 OK

8.0 kB

URL HTTP/1.1
gennou.com/n/dir/dist/jquery-lang.js
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
ASCII text
Size
8.0 kB (8035 bytes)
Hash
ea15f345d5b4c6c29679113a0760a048
efc848d46e044e487d28df111e35cc84baf2be95
eb82846df5ab3495a4aa3567562bb43dc52983f808f0d0dd15e4950f3a259068

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/jquery-lang.js HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:15 GMT
Content-Type: application/javascript
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"61fa2666-6c2d"
Expires: Tue, 04 Oct 2022 08:34:15 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

push.services.mozilla.com/

35.161.6.128

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
35.161.6.128:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: V+dUHYL3J2tLwGSZndKzfg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: JdpIkxEDQSVyO1ZiCJGDNuZtqR8=

r3.o.lencr.org/

23.36.76.249

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ff433c9569a3557d806b1480aeafece9
20bbd46383b85326837f45290ff87df708b3b310
e8e5212b8d90257f23bdb0d1d643b5e7d7528d964056c3a4a269b5e09f409f2d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11893
Expires: Mon, 03 Oct 2022 23:52:29 GMT
Date: Mon, 03 Oct 2022 20:34:16 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.249

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ff433c9569a3557d806b1480aeafece9
20bbd46383b85326837f45290ff87df708b3b310
e8e5212b8d90257f23bdb0d1d643b5e7d7528d964056c3a4a269b5e09f409f2d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11893
Expires: Mon, 03 Oct 2022 23:52:29 GMT
Date: Mon, 03 Oct 2022 20:34:16 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.249

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ff433c9569a3557d806b1480aeafece9
20bbd46383b85326837f45290ff87df708b3b310
e8e5212b8d90257f23bdb0d1d643b5e7d7528d964056c3a4a269b5e09f409f2d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11893
Expires: Mon, 03 Oct 2022 23:52:29 GMT
Date: Mon, 03 Oct 2022 20:34:16 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.249

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ff433c9569a3557d806b1480aeafece9
20bbd46383b85326837f45290ff87df708b3b310
e8e5212b8d90257f23bdb0d1d643b5e7d7528d964056c3a4a269b5e09f409f2d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11893
Expires: Mon, 03 Oct 2022 23:52:29 GMT
Date: Mon, 03 Oct 2022 20:34:16 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.76.249

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.76.249:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
ff433c9569a3557d806b1480aeafece9
20bbd46383b85326837f45290ff87df708b3b310
e8e5212b8d90257f23bdb0d1d643b5e7d7528d964056c3a4a269b5e09f409f2d

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E8E5212B8D90257F23BDB0D1D643B5E7D7528D964056C3A4A269B5E09F409F2D"
Last-Modified: Sun, 02 Oct 2022 21:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11893
Expires: Mon, 03 Oct 2022 23:52:29 GMT
Date: Mon, 03 Oct 2022 20:34:16 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg

34.120.237.76

200 OK

6.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.3 kB (6315 bytes)
Hash
206fb65e75dbadf119512f71e0b78402
58ff0bf8ce7528b303d28bab01a80ad721705569
56c8d5f3b3060ee54bf81995269b86c070855d8c33bf437161339a45b309703f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F180dee10-1cde-4fbe-8a74-62b7b3bdb1e2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6315
x-amzn-requestid: 6aa75b16-32e4-48a7-9fb0-9e3d5528c2d5
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZWSdsHUnIAMFXtw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6338cabd-742d8a436403683e0cd9368f;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 23:18:21 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 5sAzc5Ewv4g6Wqq6JJiLylG3Jyy_nlWrr5Oteeo6ebEgq7Rvss4XaQ==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 09331f0822fc98eebaf04130a83dbd44.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 04:42:51 GMT
age: 57085
etag: "58ff0bf8ce7528b303d28bab01a80ad721705569"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7d589035-4143-4e43-a45c-b842ae27b9a3.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.5 kB (4522 bytes)
Hash
34ba42086104460665f7f4f579235592
58f10485c5273cbed8159c98b9065b192ba3d00b
79f1febc020ab611c5d9a8bc1af237a63420f8215963fd97f6c4b9bccfa17d24

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7d589035-4143-4e43-a45c-b842ae27b9a3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4522
x-amzn-requestid: cc836204-3c4f-48d0-9569-b1622e6d2178
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZMVoRH9toAMFwig=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6334cfce-096ff90412945ca06335e987;Sampled=0
x-amzn-remapped-date: Wed, 28 Sep 2022 22:50:54 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: fudDd0zzDKrnJFkd5SprRVtrhRWr9sSccbhORco9XUEJTO2TXYouzQ==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d01e7742f82df0bbc1fb681d709ed69c.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 17:50:25 GMT
age: 9831
etag: "58f10485c5273cbed8159c98b9065b192ba3d00b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F954ddf3b-951c-46b3-a8ce-00e3bd3ef239.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10490 bytes)
Hash
bed17699f6b123b33b8df416b23c4cac
36458cca636c4ffc873df8acd254ff726b1a9544
65dac85ddf2d9918696ea270a5a3d034e07e43ca5714f169747feee09fc4b897

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F954ddf3b-951c-46b3-a8ce-00e3bd3ef239.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10490
x-amzn-requestid: a7e4d6b4-be77-41a9-94dd-83167d5b002e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y5tUrE72oAMFZYQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632d5c1d-1ba0805b629e657b60ff1b85;Sampled=0
x-amzn-remapped-date: Fri, 23 Sep 2022 07:11:25 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: DZ6ZMlje50ktV6_cABRx3fr4Dke7Z2UhNhBDi1aCK00kRPTlnG691A==
via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 cd858042f70b416ca05e042acf3908a4.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 03:36:14 GMT
age: 61082
etag: "36458cca636c4ffc873df8acd254ff726b1a9544"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

9.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcd0be942-f345-4da4-974e-a9fe16b90b3c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
9.1 kB (9083 bytes)
Hash
523edd86af4757d0bc5fa5b3b8a3596a
8118ee462077c291b9d6f1402b85b55a9ceba8c2
c27de9970317636df8c4a517a9ed38e573235b351bf92c9b8bb1f964cd100031

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcd0be942-f345-4da4-974e-a9fe16b90b3c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 9083
x-amzn-requestid: fda71fd3-ef25-4a63-94ae-1bfc8aef8d14
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZZXD2H0DIAMFjrg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633a054b-198915fc17ce3dab571b7575;Sampled=0
x-amzn-remapped-date: Sun, 02 Oct 2022 21:40:27 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: BobS2JU-TqDuL8q31SVlerM15cRoMhL1oM5MkL7MVhY9RZG_Ukp5yA==
via: 1.1 112c6b3f9aea37a6cb00b7d933e5af6e.cloudfront.net (CloudFront), 1.1 68fadeb91f97256bb67b03bfca74d830.cloudfront.net (CloudFront), 1.1 google
date: Sun, 02 Oct 2022 21:46:36 GMT
age: 82060
etag: "8118ee462077c291b9d6f1402b85b55a9ceba8c2"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb5f7661f-9945-4971-aac6-d15570c4d954.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.3 kB (8277 bytes)
Hash
6a90e53b55500427aed06efa3a9baa8c
43a66cd291d1413d7147a29b2a7b27277a443f0b
2cf5790e81140bc56b46163787f84c54a07f58e90001837624f426aafa8031c5

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb5f7661f-9945-4971-aac6-d15570c4d954.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8277
x-amzn-requestid: a7d76241-7da1-4c84-9c73-2e3a71b81b52
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZTMfEGHiIAMFpmw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63378df9-3727a65235e4dbc60cc11cf0;Sampled=0
x-amzn-remapped-date: Sat, 01 Oct 2022 00:46:49 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 8n1l3bN8ykztmC-wGNH_w7xASHFplZa2LvHs8psQ146XILdvEHLWgw==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 b13f158bdf9805ca47e07c0c35870c12.cloudfront.net (CloudFront), 1.1 google
date: Mon, 03 Oct 2022 16:41:17 GMT
age: 13979
etag: "43a66cd291d1413d7147a29b2a7b27277a443f0b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98a090b5-0736-4ddd-b6ca-3c76661e7051.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
8.2 kB (8158 bytes)
Hash
721a8d8f94c3796abf021978fcdbc831
3fc3aeae907a0ce0db21753c67c1000681e48b8e
cb497b15e7c2e49930b99f8d6659f0394acefb7b11613ca04397ee782dac759d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98a090b5-0736-4ddd-b6ca-3c76661e7051.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 8158
x-amzn-requestid: 424c8c6c-7075-4ace-97e6-2b0a609d1b7e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ZZXDxGRlIAMFZrA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-633a054b-046d963a345c15e81dc74e4d;Sampled=0
x-amzn-remapped-date: Sun, 02 Oct 2022 21:40:27 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: aFBTRAsXhi4io7fSc02hftf9hRQ-J5yaBgU4Wgwijyir30xjTjdMLQ==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 b8c4a4ca04bb1976e020396d211bc8dc.cloudfront.net (CloudFront), 1.1 google
date: Sun, 02 Oct 2022 21:46:36 GMT
age: 82060
etag: "3fc3aeae907a0ce0db21753c67c1000681e48b8e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

gennou.com/n/dir/dist/dhl.css

124.221.194.248

200 OK

364 kB

URL HTTP/1.1
gennou.com/n/dir/dist/dhl.css
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
Unicode text, UTF-8 text, with very long lines (1148), with CRLF line terminators
Size
364 kB (363584 bytes)
Hash
1173a779603e4bb35745ed92a25a1ad7
5a922c9e379676611381e2fa5fdff353b1823a89
b71c0c9eda07ed2f929ddfd5e3ca9c3919a122d8297785834dafffa3c6611c35

HTTP Headers

GET /n/dir/dist/dhl.css HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:14 GMT
Content-Type: text/css
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"61fa2666-15b189"
Expires: Tue, 04 Oct 2022 08:34:14 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

gennou.com/n/dir/dist/favicon.ico

124.221.194.248

200 OK

1.2 kB

URL HTTP/1.1
gennou.com/n/dir/dist/favicon.ico
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Size
1.2 kB (1150 bytes)
Hash
d8106bf3a1d00ab43b01e6e3c92500eb
202b5e8654ab1b28351378293bca3b9d844cc29b
9ada5709e264c31b04a05bd85448a9bd5e91925e8d83df5cef0762ec97cc283e

HTTP Headers

GET /n/dir/dist/favicon.ico HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:18 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Connection: keep-alive
ETag: "61fa2666-47e"
Accept-Ranges: bytes

gennou.com/n/dir/dist/load.php

124.221.194.248

200 OK

1.2 kB

URL HTTP/1.1
gennou.com/n/dir/dist/load.php
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
HTML document, ASCII text, with CRLF line terminators
Size
1.2 kB (1178 bytes)
Hash
c81ab15c01444ca14ab575ec887e6efd
336c0c787532534fbe935279de0e263c87dbe683
486bf42cfcdaa1a4fb885273935636932da78691aaabc36ecf2209bfe917972e

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/load.php HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

gennou.com/n/dir/dist/DHL_head.html

124.221.194.248

200 OK

3.5 kB

URL HTTP/1.1
gennou.com/n/dir/dist/DHL_head.html
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
HTML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (1836), with CRLF line terminators
Size
3.5 kB (3476 bytes)
Hash
2540f49a0ddcc9732f8e1826356970a2
d5ffb83b3dda826807adc6977082b801805af900
1a1836942aebcf8a2cabb7d41b4402920c1566f25d77fa2b0fa34b9d13429481

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/DHL_head.html HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:18 GMT
Content-Type: text/html
Last-Modified: Thu, 08 Sep 2022 05:22:44 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63197c24-2e70"
Content-Encoding: gzip

gennou.com/n/dir/dist/DHL_footer.html

124.221.194.248

200 OK

6.3 kB

URL HTTP/1.1
gennou.com/n/dir/dist/DHL_footer.html
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (2591), with CRLF line terminators
Size
6.3 kB (6318 bytes)
Hash
0a51af7230884001bb533d9e6efb3adc
6b15c73311eb725193cbf33d3d42ab48255a35aa
e4a76827381183b29484c2bf5c9b896dd011b529cd1ab9e2a7d08549c3f91d3c

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/DHL_footer.html HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:18 GMT
Content-Type: text/html
Last-Modified: Thu, 08 Sep 2022 05:22:12 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"63197c04-3d39"
Content-Encoding: gzip

gennou.com/n/dir/dist/fonts/default-274a65bae9742377aaf010bb1a7de971.woff

124.221.194.248

200 OK

41 kB

URL HTTP/1.1
gennou.com/n/dir/dist/fonts/default-274a65bae9742377aaf010bb1a7de971.woff
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
Web Open Font Format, TrueType, length 41084, version 1.66\012- data
Size
41 kB (41084 bytes)
Hash
03f859bf58e4d37841070de34be7d978
3436d4fa17e7ee470c3d62b08787cfa7de408408
5af5c3746b03792640b9cafdabddfb2c5407f72988e128541a88fa439607d940

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/fonts/default-274a65bae9742377aaf010bb1a7de971.woff HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gennou.com/n/dir/dist/dhl.css

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:18 GMT
Content-Type: font/woff
Content-Length: 41084
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Connection: keep-alive
ETag: "61fa2666-a07c"
Accept-Ranges: bytes

gennou.com/n/dir/dist/fonts/iconfont-e7bece496cd0e6d60e456bc2b48c9446.woff

124.221.194.248

200 OK

9.3 kB

URL HTTP/1.1
gennou.com/n/dir/dist/fonts/iconfont-e7bece496cd0e6d60e456bc2b48c9446.woff
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
Web Open Font Format, TrueType, length 9316, version 1.0\012- data
Size
9.3 kB (9316 bytes)
Hash
9355df62a665ef9249036bbccad8c54c
6b7779a10187a1a7473f604fbe3db96350868c6a
6d051536af97fbd33fae0683a1b6ce3749757ab43c8ee8c89295755fd4595807

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/fonts/iconfont-e7bece496cd0e6d60e456bc2b48c9446.woff HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gennou.com/n/dir/dist/dhl.css

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:18 GMT
Content-Type: font/woff
Content-Length: 9316
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Connection: keep-alive
ETag: "61fa2666-2464"
Accept-Ranges: bytes

ipinfo.io/country

34.117.59.81

302 Found

72 B

URL HTTP/1.1
ipinfo.io/country
IP
34.117.59.81:0
ASN
#15169 GOOGLE

File type
ASCII text, with no line terminators
Size
72 B (72 bytes)
Hash
b79f12127b13f3298b65130f55033eea
0c5df3d4734c5d754f78df4dd08f329ce38ab901
76d7f55bf215f2132f41391f47b4efd048f7c3b61db2b650e2a0a9b4a02d79f0

HTTP Headers

GET /country HTTP/1.1
Host: ipinfo.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://gennou.com/
Origin: http://gennou.com
Connection: keep-alive

HTTP/1.1 302 Found
access-control-allow-origin: *
location: https://ipinfo.io/country
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
date: Mon, 03 Oct 2022 20:34:18 GMT
x-envoy-upstream-service-time: 1
strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: gzip
transfer-encoding: chunked
Via: 1.1 google

ocsp.pki.goog/s/gts1d4/5QlTZKzjgCw

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/s/gts1d4/5QlTZKzjgCw
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
1c10c9bb2e49ee10d5687fd3ca81071b
fac16e4052a9085efa2c731e406cbf11fa72e71c
13641e7d0a0901826875db6da56196efc8fefa359b08d989beab3d95218a233c

HTTP Headers

POST /s/gts1d4/5QlTZKzjgCw HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 03 Oct 2022 20:34:18 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

gennou.com/n/dir/dist/fonts/default-815fcbb4d2c57901701125d768f09d67.woff

124.221.194.248

200 OK

41 kB

URL HTTP/1.1
gennou.com/n/dir/dist/fonts/default-815fcbb4d2c57901701125d768f09d67.woff
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
Web Open Font Format, TrueType, length 41328, version 1.66\012- data
Size
41 kB (41328 bytes)
Hash
e39bd2e2657ce5dd6f9c33df18529233
6db81ebb91bfa67cef8f2f870f03046150568799
19d0bda83ecbc986620468801adf000c77c3c38398650903c63fac8dcbac4383

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/fonts/default-815fcbb4d2c57901701125d768f09d67.woff HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gennou.com/n/dir/dist/dhl.css

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:18 GMT
Content-Type: font/woff
Content-Length: 41328
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Connection: keep-alive
ETag: "61fa2666-a170"
Accept-Ranges: bytes

ocsp.pki.goog/s/gts1d4/5QlTZKzjgCw

142.250.74.3

200 OK

472 B

URL HTTP/1.1
ocsp.pki.goog/s/gts1d4/5QlTZKzjgCw
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
1c10c9bb2e49ee10d5687fd3ca81071b
fac16e4052a9085efa2c731e406cbf11fa72e71c
13641e7d0a0901826875db6da56196efc8fefa359b08d989beab3d95218a233c

HTTP Headers

POST /s/gts1d4/5QlTZKzjgCw HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 03 Oct 2022 20:34:19 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

gennou.com/n/dir/dist/fonts/default-3e828e80f6e985c352eba4474518978d.woff

124.221.194.248

200 OK

44 kB

URL HTTP/1.1
gennou.com/n/dir/dist/fonts/default-3e828e80f6e985c352eba4474518978d.woff
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
Web Open Font Format, TrueType, length 44260, version 1.66\012- data
Size
44 kB (44260 bytes)
Hash
4a350e02a03ac62e72e9ea575b31ce84
d47b03b96b6e7034a1473a293bb594e597a41dc2
87c40e3961e21f759770615ae67568a3de3ec6e0735f1238a6aae062f4ea15d5

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/fonts/default-3e828e80f6e985c352eba4474518978d.woff HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gennou.com/n/dir/dist/dhl.css

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:18 GMT
Content-Type: font/woff
Content-Length: 44260
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Connection: keep-alive
ETag: "61fa2666-ace4"
Accept-Ranges: bytes

gennou.com/n/dir/dist/DHL_track.html

124.221.194.248

200 OK

2.6 kB

URL HTTP/1.1
gennou.com/n/dir/dist/DHL_track.html
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
HTML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with very long lines (356)
Size
2.6 kB (2573 bytes)
Hash
0c7b7259abc46422f5d830687bbb0c84
4cc31e593f4c41166236fbf37b5bb4c88364df30
dbde243b328fc1c7a707a8144a98cb359facd0102c53d176abafc80b8b4748a6

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/DHL_track.html HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:20 GMT
Content-Type: text/html
Last-Modified: Thu, 15 Sep 2022 05:57:42 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"6322bed6-196f"
Content-Encoding: gzip

gennou.com/n/dir/dist/jquery.validate.min.js

124.221.194.248

200 OK

8.8 kB

URL HTTP/1.1
gennou.com/n/dir/dist/jquery.validate.min.js
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
Unicode text, UTF-8 text, with very long lines (24237)
Size
8.8 kB (8756 bytes)
Hash
0aa2ca51109290ccf21ac5217babbbe1
7ea8f79d4df043f4cdd4db3bfeffe30787c21c5b
c157bb061310123c090432240fdb79e6c6f5cd8a4501a87a72495cbe1f593a7c

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/jquery.validate.min.js HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:20 GMT
Content-Type: application/javascript
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"61fa2666-5f38"
Expires: Tue, 04 Oct 2022 08:34:20 GMT
Cache-Control: max-age=43200
Content-Encoding: gzip

cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js

151.101.85.229

301 Moved Permanently

0 B

URL HTTP/1.1
cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
IP
151.101.85.229:0
ASN
#54113 FASTLY

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /npm/popper.js@1.16.1/dist/umd/popper.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://gennou.com/

HTTP/1.1 301 Moved Permanently
Connection: close
Content-Length: 0
Server: Varnish
Retry-After: 0
Location: https://cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
Accept-Ranges: bytes
Date: Mon, 03 Oct 2022 20:34:20 GMT
X-Served-By: cache-bma1663-BMA
X-Cache: HIT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400

cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js

151.101.85.229

200 OK

7.5 kB

URL HTTP/2
cdn.jsdelivr.net/npm/popper.js@1.16.1/dist/umd/popper.min.js
IP
151.101.85.229:0
ASN
#54113 FASTLY

File type
ASCII text, with very long lines (21060)
Size
7.5 kB (7503 bytes)
Hash
1f61c1b15b25ba046056238766ff3a43
2b8db740e4e913e9dc87a6060dea2a6b17ad0ec8
fe78a2c604b4757dd5d114e0efb7e74c8f4acfe840bf6b6c01517205744a7648

HTTP Headers

GET /npm/popper.js@1.16.1/dist/umd/popper.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://gennou.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 1.16.1
x-jsd-version-type: version
etag: W/"52f1-MTeJyg4xtlR4TbuosPg/Nk+Gg7Q"
content-encoding: gzip
accept-ranges: bytes
date: Mon, 03 Oct 2022 20:34:20 GMT
age: 11119466
x-served-by: cache-fra19126-FRA, cache-bma1651-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7503
X-Firefox-Spdy: h2

ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1

104.18.20.226

200 OK

1.5 kB

URL HTTP/1.1
ocsp.globalsign.com/ca/gsatlasr3dvtlsca2022q1
IP
104.18.20.226:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
1.5 kB (1462 bytes)
Hash
243a40ac4d729ca8b69fd94863f8ec11
a095c023e5509fee51925eda40062235db762ca3
214367cec134c75e66fe261696685eeb67655dbb9d64cc81bb92eb17af6e160c

HTTP Headers

POST /ca/gsatlasr3dvtlsca2022q1 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Mon, 03 Oct 2022 20:34:20 GMT
Content-Type: application/ocsp-response
Transfer-Encoding: chunked
Connection: keep-alive
Etag: "BA542C41990863435076AC9F30542EFA766F8061"
Expires: Tue, 04 Oct 2022 07:00:00 GMT
Last-Modified: Mon, 03 Oct 2022 19:00:00 UTC
Cache-Control: s-maxage=3600, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Age: 2432
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 754875409ff2b4fa-OSL

gennou.com/n/dir/dist/fonts/default-5a6dd86f272b304a8b83f7df61f11c2f.woff

124.221.194.248

200 OK

41 kB

URL HTTP/1.1
gennou.com/n/dir/dist/fonts/default-5a6dd86f272b304a8b83f7df61f11c2f.woff
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
Web Open Font Format, TrueType, length 41352, version 1.66\012- data
Size
41 kB (41352 bytes)
Hash
4e23ecf085132857bdb54b4da7373151
a50215c22a591536b21e509100d1707c6886ffd6
b033eff45e6e8ecd5c5bccd8ef9a96c4dc37325adc64c5aed8b1d909b24c4eb4

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/fonts/default-5a6dd86f272b304a8b83f7df61f11c2f.woff HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://gennou.com/n/dir/dist/dhl.css

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:20 GMT
Content-Type: font/woff
Content-Length: 41352
Last-Modified: Wed, 02 Feb 2022 06:36:22 GMT
Connection: keep-alive
ETag: "61fa2666-a188"
Accept-Ranges: bytes

gennou.com/n/dir/dist/langpack/en.json

124.221.194.248

200 OK

514 B

URL HTTP/1.1
gennou.com/n/dir/dist/langpack/en.json
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
JSON data\012- , ASCII text
Size
514 B (514 bytes)
Hash
e5111c3d242107acc93f71f9c9182079
c648da6b0a6c4f9b89dbee1027cf9a7be36217ca
86f9abd216bc64ead1404975e2b6132aebc42ebd106e5be0f660b7e5852051a3

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/langpack/en.json HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:20 GMT
Content-Type: application/json
Content-Length: 514
Last-Modified: Mon, 02 Aug 2021 11:58:58 GMT
Connection: keep-alive
ETag: "6107de02-202"
Accept-Ranges: bytes

gennou.com/n/dir/dist/langpack/en.json

124.221.194.248

200 OK

514 B

URL HTTP/1.1
gennou.com/n/dir/dist/langpack/en.json
IP
124.221.194.248:0
ASN
#45090 Shenzhen Tencent Computer Systems Company Limited

File type
JSON data\012- , ASCII text
Size
514 B (514 bytes)
Hash
e5111c3d242107acc93f71f9c9182079
c648da6b0a6c4f9b89dbee1027cf9a7be36217ca
86f9abd216bc64ead1404975e2b6132aebc42ebd106e5be0f660b7e5852051a3

Detections

Analyzer	Verdict	Alert
urlquery		Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /n/dir/dist/langpack/en.json HTTP/1.1
Host: gennou.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: keep-alive
Referer: http://gennou.com/n/dir/dcd41466c5b21b429f260cb995526bb4/execution.html?validation=e1s1

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 03 Oct 2022 20:34:20 GMT
Content-Type: application/json
Content-Length: 514
Last-Modified: Mon, 02 Aug 2021 11:58:58 GMT
Connection: keep-alive
ETag: "6107de02-202"
Accept-Ranges: bytes

ipinfo.io/country

34.117.59.81

429 Too Many Requests

0 B

URL HTTP/2
ipinfo.io/country
IP
34.117.59.81:0
ASN
#15169 GOOGLE

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /country HTTP/1.1
Host: ipinfo.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Referer: http://gennou.com/
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 429 Too Many Requests
access-control-allow-origin: *
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-type: application/json; charset=utf-8
date: Mon, 03 Oct 2022 20:34:19 GMT
x-envoy-upstream-service-time: 4
strict-transport-security: max-age=2592000; includeSubDomains
vary: Accept-Encoding
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

JavaScript (14)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations