r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash cc07d664b5dadee6f9120d54904dfa57
df75a55b0b2019684a6c512bee528c51a2c4a756
14a1bd6315a3256468edafedfd1c02a6ba147914c0f01e8504e7d8cc67781c34
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "14A1BD6315A3256468EDAFEDFD1C02A6BA147914C0F01E8504E7D8CC67781C34"
Last-Modified: Tue, 17 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6386
Expires: Thu, 19 Jan 2023 12:53:52 GMT
Date: Thu, 19 Jan 2023 11:07:26 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 37284a837312d6586460a3b86bbe7bd0
6ac0847abd48eb8607597218aaa2cb2d434c012b
6a0e11bb042555d72b397ae0cc3d5e242d3a3fe04418e28ffd222decca7d16ca
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6A0E11BB042555D72B397AE0CC3D5E242D3A3FE04418E28FFD222DECCA7D16CA"
Last-Modified: Wed, 18 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3471
Expires: Thu, 19 Jan 2023 12:05:17 GMT
Date: Thu, 19 Jan 2023 11:07:26 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 6c8239f3894cfba54d1f3a9ea1c85db5
a70f2b3bf79f2aa26b0cc0340dd182565c3eb946
64dc0508d3fcea1ec92fb60310e9b3f5454c0b69f61e8453fd443bc46ab9471b
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "64DC0508D3FCEA1EC92FB60310E9B3F5454C0B69F61E8453FD443BC46AB9471B"
Last-Modified: Tue, 17 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7684
Expires: Thu, 19 Jan 2023 13:15:30 GMT
Date: Thu, 19 Jan 2023 11:07:26 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash ff250d3ef3fa45322bf05039a0122a9f
b3e7a2c383bce1bab807dbe1a03c375258b51f1d
d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Alert, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 19 Jan 2023 10:49:27 GMT
content-type: application/json
age: 1079
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
File type PEM certificate\012- , ASCII text
Hash 7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c
GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: Pn5VSWft+lUdZ7F4FYQ69RbIemjdXs6F4mzv4sjTENn+kVqvfd6GB9Eg7KTbrO1tJiytms7KFZg=
x-amz-request-id: 3QTDEE2EYY6K93VY
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 19 Jan 2023 10:45:51 GMT
age: 1295
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 19 Jan 2023 11:07:26 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/?email=redacted@slurpmail.net&loginpage=&reff=ZWYzNzRkODllNTg0NjdmZTFhYmJmMWQ0MGEwMmFjN2E=
200 OK 1.8 kB URL HTTP/1.1 www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/?email=redacted@slurpmail.net&loginpage=&reff=ZWYzNzRkODllNTg0NjdmZTFhYmJmMWQ0MGEwMmFjN2E=
IP
File type HTML document text\012- exported SGML document, ASCII text, with very long lines (11231), with CRLF line terminators
Hash 040ad05c17acaeef26b6686c63e0fc1b
6bbff6c60f98dce3051c531c72de75f43accecbe
86c09848c4006221102ccadf7cec8f2d44124edee9ac52fae815d1c12e316549
Analyzer Verdict Alert urlquery suspicious Suspicious - Suspicious JS code
NIDS Severity Alert suricata medium ET PHISHING Possible Phishing Landing - Common Multiple JS Unescape May 25 2017
GET /wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/?email=redacted@slurpmail.net&loginpage=&reff=ZWYzNzRkODllNTg0NjdmZTFhYmJmMWQ0MGEwMmFjN2E= HTTP/1.1
Host: www.gruntindustries.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:26 GMT
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Vary: Accept-Encoding
X-Varnish: 144179324
Age: 0
X-Cache: MISS
Accept-Ranges: bytes
Content-Length: 1807
Connection: keep-alive
www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/index.php?email=redacted@slurpmail.net
200 OK 131 B URL HTTP/1.1 www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/index.php?email=redacted@slurpmail.net
IP
File type HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 700c31d269032992d4c0e342f02057df
56eb32d6e5d3d2d423887bef39763e8e3b3a9a79
ffa80c21ac8ec9408792c5664b2b0e39f9cc617cffa17108269a4e229765b568
GET /wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/index.php?email=redacted@slurpmail.net HTTP/1.1
Host: www.gruntindustries.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/?email=redacted@slurpmail.net&loginpage=&reff=ZWYzNzRkODllNTg0NjdmZTFhYmJmMWQ0MGEwMmFjN2E=
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:26 GMT
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Vary: Accept-Encoding
X-Varnish: 139493413
Age: 0
X-Cache: MISS
Accept-Ranges: bytes
Transfer-Encoding: chunked
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Expires, Pragma, Content-Type, Backoff, Last-Modified, Cache-Control, ETag
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 19 Jan 2023 10:48:57 GMT
age: 1109
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/style.css
200 OK 434 B URL HTTP/1.1 www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/style.css
IP
Hash e320361410f8ce5b2fe35d8c9c7dffab
e5c79f38ddea6aea7fae528885ff7bfc8cfd23fb
dd74406068fbc98cacb3eef019e375d2892422e54b42827a334dd750f5553be7
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/style.css HTTP/1.1
Host: www.gruntindustries.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/?email=redacted@slurpmail.net&loginpage=&reff=ZWYzNzRkODllNTg0NjdmZTFhYmJmMWQ0MGEwMmFjN2E=
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:26 GMT
Last-Modified: Thu, 19 Jan 2023 09:56:35 GMT
Content-Type: text/css
ETag: W/"c8c49b-34d-5f29af2c01136"
Content-Encoding: gzip
Vary: Accept-Encoding
X-Varnish: 137297976
Age: 0
X-Cache: MISS
Accept-Ranges: bytes
Transfer-Encoding: chunked
Connection: keep-alive
ocsp.digicert.com/
200 OK 471 B IP
Hash dce4a8be753d4a93db03ffca50421c43
068040a8f69777484e545c0053ad54f273710797
7e6dddef8a4a5502c9715f8c20dcb75e132ecc875f13459a967c9e235e9ce3e4
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1372
Cache-Control: max-age=166930
Content-Type: application/ocsp-response
Date: Thu, 19 Jan 2023 11:07:27 GMT
Etag: "63c90825-1d7"
Expires: Sat, 21 Jan 2023 09:29:37 GMT
Last-Modified: Thu, 19 Jan 2023 09:06:45 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471
www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/photos/logo.jpg
200 OK 443 B URL HTTP/1.1 www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/photos/logo.jpg
IP
File type GIF image data, version 89a, 134 x 42\012- data
Hash 749b06c85447bd7bc889ecbaaa0980ee
de5706a7d3a50bc3eb3b082439a8b990688e0e87
2f680b51b19fc3c5befd02bd9d0d4e88c2722a5210157e4ef68933c5ba352109
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/photos/logo.jpg HTTP/1.1
Host: www.gruntindustries.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/?email=redacted@slurpmail.net&loginpage=&reff=ZWYzNzRkODllNTg0NjdmZTFhYmJmMWQ0MGEwMmFjN2E=
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:27 GMT
Last-Modified: Thu, 19 Jan 2023 09:56:35 GMT
ETag: "c8c4aa-1bb-5f29af2c01e3b"
Content-Length: 443
Content-Type: image/jpeg
X-Varnish: 139493415
Age: 0
X-Cache: MISS
Accept-Ranges: bytes
Connection: keep-alive
www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/script.js
200 OK 1.2 kB URL HTTP/1.1 www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/script.js
IP
File type ASCII text, with very long lines (1698)
Hash 7bdc68e390769c5e244c2c0cbb86d56a
a79a2078ba583e244d42e142ad6af082f3d2174b
f56646721d5e096f8a0f8a051af97cb3d44a76c2438d212a01cd873d0da7da57
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/script.js HTTP/1.1
Host: www.gruntindustries.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/?email=redacted@slurpmail.net&loginpage=&reff=ZWYzNzRkODllNTg0NjdmZTFhYmJmMWQ0MGEwMmFjN2E=
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:27 GMT
Last-Modified: Thu, 19 Jan 2023 09:56:35 GMT
Content-Type: application/javascript
ETag: W/"c8c4a6-94c-5f29af2c01e3b"
Content-Encoding: gzip
Vary: Accept-Encoding
X-Varnish: 137297979
Age: 0
X-Cache: MISS
Accept-Ranges: bytes
Transfer-Encoding: chunked
Connection: keep-alive
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: jTNfu1ZeOeKAbsdSbOIhQg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: tPdA5YGKxM07v8GyhWD9o+xmAQ4=
ocsp.digicert.com/
200 OK 471 B IP
Hash fd3592f3fe052fe1720ce48839947ed8
b59e86993b2f7b4cee57fcb8056492ed6ac5375b
db393d3fdc6c8fd470c4ec2dadaf9f6ab6cfc30ef3e48618f44c3794a1d8042e
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 19 Jan 2023 11:07:27 GMT
Server: ECS (amb/6B74)
Content-Length: 471
www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/jquery.min.js
200 OK 30 kB URL HTTP/1.1 www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/jquery.min.js
IP
File type ASCII text, with very long lines (32180)
Hash 3732eff820ceb9bfc48f421261f7b2c4
0677735dff87235ac43b0d7e18c87871026d85e7
c34c3b7cc490a0ad75350e79dbd54983be26d8dc8cedecca56c9161752bddd8e
Analyzer Verdict Alert fortinet Phishing
GET /wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/jquery.min.js HTTP/1.1
Host: www.gruntindustries.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/?email=redacted@slurpmail.net&loginpage=&reff=ZWYzNzRkODllNTg0NjdmZTFhYmJmMWQ0MGEwMmFjN2E=
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:27 GMT
Last-Modified: Thu, 19 Jan 2023 09:56:35 GMT
Content-Type: application/javascript
ETag: W/"c8c4a7-14983-5f29af2c01e3b"
Content-Encoding: gzip
Vary: Accept-Encoding
X-Varnish: 131578840
Age: 0
X-Cache: MISS
Accept-Ranges: bytes
Transfer-Encoding: chunked
Connection: keep-alive
ocsp.digicert.com/
200 OK 278 B IP
Hash 26f4bc48669bf5b7675854647b311234
9afeaac3d692280f0d21185789f083d75c87a360
729d685c96c8653989fc4ddf6de9482715d0bfd6f2571a475320072ef30556a2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6018
Cache-Control: max-age=148884
Content-Type: application/ocsp-response
Date: Thu, 19 Jan 2023 11:07:27 GMT
Etag: "63c8af81-116"
Expires: Sat, 21 Jan 2023 04:28:51 GMT
Last-Modified: Thu, 19 Jan 2023 02:48:33 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 278
images.jdmagicbox.com/comp/chennai/m2/044pxx44.xx44.180817061507.n2m2/catalogue/dtdc-dhl-express-courier-service-kattupakkam-chennai-domestic-courier-services-8pge1s5old.jpg
200 OK 24 kB URL HTTP/2 images.jdmagicbox.com/comp/chennai/m2/044pxx44.xx44.180817061507.n2m2/catalogue/dtdc-dhl-express-courier-service-kattupakkam-chennai-domestic-courier-services-8pge1s5old.jpg
IP
File type JPEG image data, JFIF standard 1.01, resolution (DPCM), density 39x39, segment length 16, progressive, precision 8, 722x340, components 3\012- data
Hash fe6be2bca25791765383408a22011de0
b74b233ef596b717e938b4433a3d0e57a13f36de
f4909e662c2b981242419875f315e233aeb49c6ee9acf4433509cb131e2939c9
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /comp/chennai/m2/044pxx44.xx44.180817061507.n2m2/catalogue/dtdc-dhl-express-courier-service-kattupakkam-chennai-domestic-courier-services-8pge1s5old.jpg HTTP/1.1
Host: images.jdmagicbox.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
etag: "cfdc8b9f4dc5a2220cbcb216245b5686"
last-modified: Wed, 09 Sep 2020 03:11:26 GMT
server: Akamai Image Manager
unused62: 8096267
content-length: 23587
content-type: image/jpeg
cache-control: no-transform, max-age=31536000
expires: Fri, 19 Jan 2024 11:07:27 GMT
date: Thu, 19 Jan 2023 11:07:27 GMT
timing-allow-origin: *
X-Firefox-Spdy: h2
www.dpdhl.com/content/dam/dpdhl/en/about-us/teaser-carousel-1375x504/ecommerce-solutions-1375x504.jpg
200 OK 158 kB URL HTTP/2 www.dpdhl.com/content/dam/dpdhl/en/about-us/teaser-carousel-1375x504/ecommerce-solutions-1375x504.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, software=Adobe Photoshop CC 2018 (Macintosh)\012- GLS_BINARY_LSB_FIRST], baseline, precision 8, 1375x504, components 3\012- data
Size 158 kB (157568 bytes)
Hash ecedc65f709cbd66aa8983a92a60655d
99c718512097d9ec5ada1aaf0d58dca61b3340b9
e8c872384e28d54054537bf44c10daa927abd0e845a7938bc76f654b5ea2a869
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /content/dam/dpdhl/en/about-us/teaser-carousel-1375x504/ecommerce-solutions-1375x504.jpg HTTP/1.1
Host: www.dpdhl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-content-type-options: nosniff
x-frame-options: DENY
content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
last-modified: Wed, 18 Jan 2023 11:22:23 GMT
etag: "26780-5f28807c771c3"
accept-ranges: bytes
content-length: 157568
content-type: image/jpeg
strict-transport-security: max-age=31536000
cache-control: public, max-age=1670
expires: Thu, 19 Jan 2023 11:35:17 GMT
date: Thu, 19 Jan 2023 11:07:27 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=8
X-Firefox-Spdy: h2
www.dpdhl.com/content/dam/dpdhl/en/media-relations/teaser-carousel-1375x504/divisions.jpg
200 OK 143 kB URL HTTP/2 www.dpdhl.com/content/dam/dpdhl/en/media-relations/teaser-carousel-1375x504/divisions.jpg
IP
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=1, software=Adobe Photoshop Elements 15.0 (Windows)\012- GLS_BINARY_LSB_FIRST], baseline, precision 8, 1375x504, components 3\012- data
Size 143 kB (143443 bytes)
Hash 3e3ed157b9d4a338d86d3ddb389dc303
b6153a0eacdcd434e28e2d6812905a0b8565975c
04ece5be76d51aa5df39067b95366956f7c9cf66395086fe0746e5e13e9bf95c
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /content/dam/dpdhl/en/media-relations/teaser-carousel-1375x504/divisions.jpg HTTP/1.1
Host: www.dpdhl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-content-type-options: nosniff
x-frame-options: DENY
content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
last-modified: Thu, 19 Jan 2023 08:39:34 GMT
etag: W/"23053-5f299df56fc20"
accept-ranges: bytes
content-length: 143443
content-type: image/jpeg
strict-transport-security: max-age=31536000
cache-control: public, max-age=77527
expires: Fri, 20 Jan 2023 08:39:34 GMT
date: Thu, 19 Jan 2023 11:07:27 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=3
X-Firefox-Spdy: h2
ocsp.starfieldtech.com/
200 OK 1.8 kB IP
Hash 781e4fff4822c9025c9823eb580f52af
13d8995df915ecc769780d98064789c85cf597b8
a2424ac142047ddeb2a325452551b8f5d7a30bfac64a62be5f6172eaec00c475
POST / HTTP/1.1
Host: ocsp.starfieldtech.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 75
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Sucuri/Cloudproxy
Date: Thu, 19 Jan 2023 11:07:27 GMT
Content-Type: application/ocsp-response
Content-Length: 1845
Connection: keep-alive
X-Sucuri-ID: 19041
Content-Transfer-Encoding: Binary
Cache-Control: public, no-transform, must-revalidate
Last-Modified: Wed, 18 Jan 2023 22:11:40 GMT
Expires: Thu, 19 Jan 2023 22:11:40 GMT
ETag: "13d8995df915ecc769780d98064789c85cf597b8"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
www.thenational.ae/image/policy:1.655350:1506091043/image/jpeg.jpg
301 Moved Permanently 0 B URL HTTP/2 www.thenational.ae/image/policy:1.655350:1506091043/image/jpeg.jpg
IP
ASN #20940 Akamai International B.V.
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /image/policy:1.655350:1506091043/image/jpeg.jpg HTTP/1.1
Host: www.thenational.ae
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: AkamaiGHost
content-length: 0
location: https://www.thenationalnews.com/image/policy:1.655350:1506091043/image/jpeg.jpg
cache-control: private, max-age=0
expires: Thu, 19 Jan 2023 11:07:27 GMT
date: Thu, 19 Jan 2023 11:07:27 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-security-policy: upgrade-insecure-requests
akamai-true-ttl: -1
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash f16ba5bafc302548daa2601c5232f3e7
47cc1d77a33b1b7168086db30b204380b1ad14cf
7e8cad0e39a1f52cf02e036d3aeeafd0d9b0cca2ea0a82988259f9ad0cc783d6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 19 Jan 2023 11:07:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 109a7c0d88f32d84129d9f944e9bd71b
c2fffb0eced24d9eac699f9caa7d8f47661c1f1b
fcb2cd7e8659bea130dce47e73e66b1fb33b08d5b138188b25f3f526194072f7
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "FCB2CD7E8659BEA130DCE47E73E66B1FB33B08D5B138188B25F3F526194072F7"
Last-Modified: Tue, 17 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Thu, 19 Jan 2023 17:07:27 GMT
Date: Thu, 19 Jan 2023 11:07:27 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash f16ba5bafc302548daa2601c5232f3e7
47cc1d77a33b1b7168086db30b204380b1ad14cf
7e8cad0e39a1f52cf02e036d3aeeafd0d9b0cca2ea0a82988259f9ad0cc783d6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 19 Jan 2023 11:07:27 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
secureservercdn.net/198.71.233.227/4f2.e16.myftpupload.com/wp-content/uploads/2017/03/dhl.jpg
302 Found 0 B URL HTTP/2 secureservercdn.net/198.71.233.227/4f2.e16.myftpupload.com/wp-content/uploads/2017/03/dhl.jpg
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /198.71.233.227/4f2.e16.myftpupload.com/wp-content/uploads/2017/03/dhl.jpg HTTP/1.1
Host: secureservercdn.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 302 Found
server: nginx
date: Thu, 19 Jan 2023 11:07:27 GMT
content-length: 0
location: http://p3nlhclust404.shr.prod.phx3.secureserver.net/SharedContent/redirect_0.html
x-sucuri-id: 19016
cache-control: max-age=315360000
strict-transport-security: max-age=31536000; includeSubDomains
expires: Thu, 31 Dec 2037 23:55:55 GMT
x-sucuri-cache: HIT
X-Firefox-Spdy: h2
i.ytimg.com/vi/2Rb8iz3bQlo/maxresdefault.jpg
200 OK 196 kB URL HTTP/2 i.ytimg.com/vi/2Rb8iz3bQlo/maxresdefault.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x720, components 3\012- data
Size 196 kB (195930 bytes)
Hash bfef07c683f01767605b2ac655e86b4f
abddaca3a66483125b480484cb1203434ddee83c
ac9df1427781b10727f62fcf7211f77cea7fe1d9416a070ac260a7b8907347b4
GET /vi/2Rb8iz3bQlo/maxresdefault.jpg HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 195930
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 19 Jan 2023 09:11:00 GMT
expires: Thu, 19 Jan 2023 11:11:00 GMT
cache-control: public, max-age=7200
etag: "1559748006"
content-type: image/jpeg
age: 6987
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
i.ytimg.com/vi/hUZ-R8TiTcY/maxresdefault.jpg
200 OK 115 kB URL HTTP/2 i.ytimg.com/vi/hUZ-R8TiTcY/maxresdefault.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x720, components 3\012- data
Size 115 kB (114894 bytes)
Hash 8ce7794010e8ec7090eef20cd1c126f2
ae886449073f92c200e1dedb49a9a33cc462bb39
ede58d300cb6d11ee16fb3a30e32153c2bd80df53a9e4a3e5f8d36b0fac63dd3
GET /vi/hUZ-R8TiTcY/maxresdefault.jpg HTTP/1.1
Host: i.ytimg.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Origin
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
timing-allow-origin: *
content-length: 114894
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 19 Jan 2023 09:11:00 GMT
expires: Thu, 19 Jan 2023 11:11:00 GMT
cache-control: public, max-age=7200
etag: "1558961103"
content-type: image/jpeg
age: 6987
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash f16ba5bafc302548daa2601c5232f3e7
47cc1d77a33b1b7168086db30b204380b1ad14cf
7e8cad0e39a1f52cf02e036d3aeeafd0d9b0cca2ea0a82988259f9ad0cc783d6
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 19 Jan 2023 11:07:28 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.logistics.dhl/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
301 Moved Permanently 0 B URL HTTP/2 www.logistics.dhl/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg HTTP/1.1
Host: www.logistics.dhl
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 301 Moved Permanently
server: AkamaiGHost
content-length: 0
location: https://www.dhl.com/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
cache-control: max-age=0
expires: Thu, 19 Jan 2023 11:07:28 GMT
date: Thu, 19 Jan 2023 11:07:28 GMT
X-Firefox-Spdy: h2
3655c9b7d0e4c7eb8e62-f41b8e4824d18971b72e44324f6764b3.r43.cf1.rackcdn.com/global/imagelib/hero-images-offer/hero-friendly2-40.jpg
200 OK 61 kB URL HTTP/1.1 3655c9b7d0e4c7eb8e62-f41b8e4824d18971b72e44324f6764b3.r43.cf1.rackcdn.com/global/imagelib/hero-images-offer/hero-friendly2-40.jpg
IP
ASN #20940 Akamai International B.V.
File type JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS4 Macintosh, datetime=2010:02:18 13:15:19], baseline, precision 8, 914x355, components 3\012- data
Hash 1a08ccf46ad319f65482fe2cd85e5ecf
42fe51de3cab614bb3a5f49a12038b4369fd14cf
046624e8250366b85034880b08b85fc17e89c1cbb6b4d7951f7544a4322a1ca5
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /global/imagelib/hero-images-offer/hero-friendly2-40.jpg HTTP/1.1
Host: 3655c9b7d0e4c7eb8e62-f41b8e4824d18971b72e44324f6764b3.r43.cf1.rackcdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
HTTP/1.1 200 OK
X-Trans-Id: tx102e7fe53a834e9f8c5f2-0063c91219dfw1
Content-Length: 61318
Accept-Ranges: bytes
Last-Modified: Wed, 07 Mar 2012 03:06:20 GMT
ETag: 1a08ccf46ad319f65482fe2cd85e5ecf
X-Timestamp: 1331089579.40214
Content-Type: image/jpeg
Cache-Control: public, max-age=38488
Expires: Thu, 19 Jan 2023 21:48:56 GMT
Date: Thu, 19 Jan 2023 11:07:28 GMT
Connection: keep-alive
kijamii.com/images/work/13-%20Story%20Thirteen%20-%20DHL/Others%20(in%20story)/DHL%205.jpg
404 Not Found 6.8 kB URL HTTP/1.1 kijamii.com/images/work/13-%20Story%20Thirteen%20-%20DHL/Others%20(in%20story)/DHL%205.jpg
IP
ASN #14061 DIGITALOCEAN-ASN
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (8047), with CRLF, LF line terminators
Hash a9376c0bc58e273500d6670bcd411bea
bcf4cbe0d2da7d338bdac4fea4aca2f5caecc693
7b92366a71db9d3b70072eaa923e778f0e1d35abb6c9af37ec417754b2c6d10d
GET /images/work/13-%20Story%20Thirteen%20-%20DHL/Others%20(in%20story)/DHL%205.jpg HTTP/1.1
Host: kijamii.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Thu, 19 Jan 2023 11:07:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Content-Encoding: gzip
proceed.solutions/wp-content/uploads/2019/01/DHL-Tyrefort-Birmingham.jpg
200 OK 146 kB URL HTTP/2 proceed.solutions/wp-content/uploads/2019/01/DHL-Tyrefort-Birmingham.jpg
IP
ASN #12488 Krystal Hosting Ltd
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1600x684, components 3\012- data
Size 146 kB (146344 bytes)
Hash d7653710bd040d6dd5fc9eda7af82ee9
d69703aaf376bdbeb3e270516a72809c67034d5f
722eadc9eaf830bec18b54231bf09d78417e718d0c9397792be2a5aec01d56a3
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /wp-content/uploads/2019/01/DHL-Tyrefort-Birmingham.jpg HTTP/1.1
Host: proceed.solutions
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 26 Jan 2023 11:07:28 GMT
content-type: image/jpeg
last-modified: Fri, 30 Jul 2021 12:29:06 GMT
accept-ranges: bytes
content-length: 146344
date: Thu, 19 Jan 2023 11:07:28 GMT
server: LiteSpeed
vary: User-Agent
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2
www.dhl.com/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
200 OK 90 kB URL HTTP/2 www.dhl.com/content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1365x574, components 3\012- data
Hash eedd252b55cb9b88ad45d221af195ea6
d7950fccc40c89da50e17ae61a4d5668899cdc45
491b0063ed59d3bfb84c78d6d8d3ec7dbeca4aabaaa12e4f4063198de4c02683
GET /content/dam/dhl/global/core/images/homepage-background-2730x1148/glo-home-our-businesses-background-plane4.web.1366.574.jpg HTTP/1.1
Host: www.dhl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://www.gruntindustries.com.au/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-frame-options: DENY
content-security-policy: frame-ancestors 'self' https://dhlinsights.dhlsupplychain.dhl.com; default-src 'self' data: https: blob: wss://cctr-chat.dhl.com:443 wss://cctr-xchat.dhl.com:443 wss://streaming.mypurecloud.de wss://collection.decibelinsight.net; script-src 'unsafe-inline' 'unsafe-eval' 'self' https: blob:; style-src 'unsafe-inline' 'self' https: blob:; media-src 'unsafe-inline' 'self' https: blob:
last-modified: Wed, 23 Nov 2022 21:05:00 GMT
etag: W/"15ef0-5ee29a4409e22"
accept-ranges: bytes
content-length: 89840
content-type: image/jpeg
cache-control: public, max-age=0
expires: Thu, 19 Jan 2023 11:07:28 GMT
date: Thu, 19 Jan 2023 11:07:28 GMT
server-timing: cdn-cache; desc=HIT, edge; dur=3
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
X-Firefox-Spdy: h2
p3nlhclust404.shr.prod.phx3.secureserver.net/SharedContent/redirect_0.html
200 OK 895 B URL HTTP/1.1 p3nlhclust404.shr.prod.phx3.secureserver.net/SharedContent/redirect_0.html
IP
ASN #398101 GO-DADDY-COM-LLC
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with CRLF line terminators
Hash d4a0e7f4375aead34e6569edb9ad6d1e
73aad5888834ab72b5ba70bc5d1f831169e74f0a
864596d93013c9608b48f16fc9f976addf7186926d36f783979b79bebb3ac704
GET /SharedContent/redirect_0.html HTTP/1.1
Host: p3nlhclust404.shr.prod.phx3.secureserver.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.gruntindustries.com.au/
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:28 GMT
Server: Apache/2.4.6 (CentOS)
Last-Modified: Thu, 30 Sep 2010 22:59:26 GMT
ETag: "37f-491820797af80"
Accept-Ranges: bytes
Content-Length: 895
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash e67bed2d82ae56403207113768de39cc
2a99f6192215d1ca5c43804715da75f73d5739f9
5489d17fefab8025848a41df683a20c54515dbd356d425138a405494a82dfd57
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5489D17FEFAB8025848A41DF683A20C54515DBD356D425138A405494A82DFD57"
Last-Modified: Wed, 18 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21583
Expires: Thu, 19 Jan 2023 17:07:11 GMT
Date: Thu, 19 Jan 2023 11:07:28 GMT
Connection: keep-alive
www.dpdhl-brands.com/content/dam/dpdhl-corporate/dhl/guides/opener/logo-thumb.png
400 Bad Request 665 B URL HTTP/2 www.dpdhl-brands.com/content/dam/dpdhl-corporate/dhl/guides/opener/logo-thumb.png
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Hash ec7bf5c4f85d8448c6985d28f1516f11
c959f33e1c005765c94faaed0d66bd69f3314632
83325324aa8aea81353e132a9bc547c7dfa494f87ad5b0542a672c9b767fd3b7
GET /content/dam/dpdhl-corporate/dhl/guides/opener/logo-thumb.png HTTP/1.1
Host: www.dpdhl-brands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 400 Bad Request
x-msedge-ref: 0byTJYwAAAAAVxE8BptTeTblFDjXQmHenQ1BIMzBFREdFMDQxMQBFZGdl
date: Thu, 19 Jan 2023 11:07:27 GMT
X-Firefox-Spdy: h2
www.baumannmusic.com/wp-content/uploads/2017/12/Background-Music-for-DHL-Video-830x467.jpg
200 OK 84 kB URL HTTP/2 www.baumannmusic.com/wp-content/uploads/2017/12/Background-Music-for-DHL-Video-830x467.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 830x467, components 3\012- data
Hash a2563e0ceea6f7fe6b5c74b88aed269c
c5ae2ace75416ea298cd47d91dab9054bcf20d73
710b05eacf50d07b2b2def63c1e0fa07c2564a3e1a9a9627aafd3a7c47af11fc
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /wp-content/uploads/2017/12/Background-Music-for-DHL-Video-830x467.jpg HTTP/1.1
Host: www.baumannmusic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 19 Jan 2023 11:07:28 GMT
content-type: image/jpeg
content-length: 83852
last-modified: Thu, 11 Feb 2021 15:56:24 GMT
etag: "602553a8-1478c"
accept-ranges: bytes
X-Firefox-Spdy: h2
ocsp.digicert.com/
200 OK 278 B IP
Hash 26f4bc48669bf5b7675854647b311234
9afeaac3d692280f0d21185789f083d75c87a360
729d685c96c8653989fc4ddf6de9482715d0bfd6f2571a475320072ef30556a2
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 6019
Cache-Control: max-age=148884
Content-Type: application/ocsp-response
Date: Thu, 19 Jan 2023 11:07:28 GMT
Etag: "63c8af81-116"
Expires: Sat, 21 Jan 2023 04:28:52 GMT
Last-Modified: Thu, 19 Jan 2023 02:48:33 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 278
postandparcel.info/wp-content/uploads/2015/11/dpdhl-trainees-tutor-600.jpg
200 OK 74 kB URL HTTP/2 postandparcel.info/wp-content/uploads/2015/11/dpdhl-trainees-tutor-600.jpg
IP
File type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 600x395, components 3\012- data
Hash 8000a9cbeb975a560104e1c197a80afc
853d6182528c6620b5bdbc8abb345403519110f9
61da34a0d163bde26aba95ac6c08129884cafd67ee79af552f39688960ade93d
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /wp-content/uploads/2015/11/dpdhl-trainees-tutor-600.jpg HTTP/1.1
Host: postandparcel.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 19 Jan 2023 11:07:28 GMT
content-type: image/jpeg
content-length: 73725
last-modified: Sat, 02 Dec 2017 13:56:36 GMT
etag: "11ffd-55f5bda7f6d00"
cache-control: max-age=7200
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jwevr7%2FZ86DwltJG7wn%2FupCA0xbShRMZpLCcLYmzFk1H%2Fot1d34Bg8mo4PrLoWYr0%2Bnf%2FhqX%2FV%2F5JP92nJlV2M5RwY78VqE6AsRGUe2H7tunNjviXa5ot%2BWltWOz5CXgnnneew%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 78bf1b5bbae8b503-OSL
X-Firefox-Spdy: h2
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 89055b1f42119cc1e7a33ce2fc364e76
20550fd56bf49a8aa30e18a923be22cda3f2ba7b
7698e9bb59f46011dbd3b6b74fc5784ac60d64c9d8403e8fe3aa18a60c17393d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7698E9BB59F46011DBD3B6B74FC5784AC60D64C9D8403E8FE3AA18A60C17393D"
Last-Modified: Wed, 18 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6342
Expires: Thu, 19 Jan 2023 12:53:10 GMT
Date: Thu, 19 Jan 2023 11:07:28 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 89055b1f42119cc1e7a33ce2fc364e76
20550fd56bf49a8aa30e18a923be22cda3f2ba7b
7698e9bb59f46011dbd3b6b74fc5784ac60d64c9d8403e8fe3aa18a60c17393d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7698E9BB59F46011DBD3B6B74FC5784AC60D64C9D8403E8FE3AA18A60C17393D"
Last-Modified: Wed, 18 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6342
Expires: Thu, 19 Jan 2023 12:53:10 GMT
Date: Thu, 19 Jan 2023 11:07:28 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 89055b1f42119cc1e7a33ce2fc364e76
20550fd56bf49a8aa30e18a923be22cda3f2ba7b
7698e9bb59f46011dbd3b6b74fc5784ac60d64c9d8403e8fe3aa18a60c17393d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7698E9BB59F46011DBD3B6B74FC5784AC60D64C9D8403E8FE3AA18A60C17393D"
Last-Modified: Wed, 18 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6342
Expires: Thu, 19 Jan 2023 12:53:10 GMT
Date: Thu, 19 Jan 2023 11:07:28 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 89055b1f42119cc1e7a33ce2fc364e76
20550fd56bf49a8aa30e18a923be22cda3f2ba7b
7698e9bb59f46011dbd3b6b74fc5784ac60d64c9d8403e8fe3aa18a60c17393d
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7698E9BB59F46011DBD3B6B74FC5784AC60D64C9D8403E8FE3AA18A60C17393D"
Last-Modified: Wed, 18 Jan 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6342
Expires: Thu, 19 Jan 2023 12:53:10 GMT
Date: Thu, 19 Jan 2023 11:07:28 GMT
Connection: keep-alive
cdn.wallpapersafari.com/18/53/3K29yL.jpg
200 OK 176 kB URL HTTP/2 cdn.wallpapersafari.com/18/53/3K29yL.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 75", baseline, precision 8, 1366x768, components 3\012- data
Size 176 kB (176173 bytes)
Hash bd4f980418b45b4951b575217fb71afb
4eb172e2209fcf2e20440f00880f2cd7399287bf
fde2f8f83f005d237bbf12371a323b2820a3d4651576ed16b0b856c61bdd19ed
GET /18/53/3K29yL.jpg HTTP/1.1
Host: cdn.wallpapersafari.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Thu, 19 Jan 2023 11:07:28 GMT
content-type: image/jpeg
content-length: 176173
last-modified: Thu, 19 Sep 2019 21:20:27 GMT
etag: "5d83f11b-2b02d"
expires: Sat, 18 Feb 2023 11:07:28 GMT
cache-control: public, max-age=31536000, must-revalidate, proxy-revalidate
pragma: public
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jqBWC6aWXVP9k%2FuXrk8qEnZc%2Bm%2BqYRnytzzxXVmsQ47I985lLeKbXGo%2FiOeTFB9MwKlOTplAMzGcO00SSbU9jIQey1w2wcDURiajCzjlhvVzSX9BQsjLDV7HZtgTEKYiro%2FsrKLIF2vk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 78bf1b5ac88cb4ed-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faa0293b1-658b-40be-8f58-7c880a4f5b00.jpeg
200 OK 9.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faa0293b1-658b-40be-8f58-7c880a4f5b00.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b6cb560c00346a6c1d1862cfd25e5d92
0df06ee873767cda7b2f109caa5f3e0aab1ddc0a
1ee5d9792f084907b8837f818b7971c97eacff3b3e0cc83586220508c8755adf
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Faa0293b1-658b-40be-8f58-7c880a4f5b00.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9221
x-amzn-requestid: 90da1a22-2980-4582-b757-b7beb79cfbe4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e6q9SHmAIAMFRxA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c75854-46a9bdeb5f46a93508e8d94e;Sampled=0
x-amzn-remapped-date: Wed, 18 Jan 2023 02:24:20 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: _D1sGt_d3uR5yvgtW4szUzy6kp7UhFCXxnuAIVsss_yswxw0Cvpm7g==
via: 1.1 7f5e0d3b9ea85d0d75063a66c0ebc840.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 19 Jan 2023 08:47:26 GMT
age: 8402
etag: "0df06ee873767cda7b2f109caa5f3e0aab1ddc0a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F57ef64b6-6b9b-4860-a201-58a01048084b.jpeg
200 OK 9.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F57ef64b6-6b9b-4860-a201-58a01048084b.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 511bbd0c410838e4a978d471d361d876
706be1b2636ad65bf5fe78ef7301af472c015275
e124c1ba6059fb613d0ab8f7ad37f4524323e7bbde851f78e9e5727c7d20f19f
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F57ef64b6-6b9b-4860-a201-58a01048084b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9916
x-amzn-requestid: 42bb326d-889c-4b91-b989-47c1fd650afa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e96pVF61oAMF76g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c8a4a1-2f33e6be45e298a7120d1119;Sampled=0
x-amzn-remapped-date: Thu, 19 Jan 2023 02:02:09 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 68BfqCCeDzqQURstD87lSuWaXjwrqVQnXX8ws6EeFfQtbu_ad9JEgw==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Thu, 19 Jan 2023 02:14:04 GMT
age: 32004
etag: "706be1b2636ad65bf5fe78ef7301af472c015275"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F358af8d7-be1d-4bbe-ab3e-a9efaf49e1ac.jpeg
200 OK 5.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F358af8d7-be1d-4bbe-ab3e-a9efaf49e1ac.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 2b8f931fb5afe958e67fce9e1822dac4
5732887999b819f6facc6f4608a407b5a09adf75
3c6c787e700f8139ec0eeaad93923f647f9efa5ce60120fc0aab52fa9588efaf
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F358af8d7-be1d-4bbe-ab3e-a9efaf49e1ac.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5005
x-amzn-requestid: 647dd62e-6b47-4298-9457-c7f37e653e0e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e5qLKEX6IAMFX0g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c6f0ad-3dc1396c1b3662fa4ec5f1fa;Sampled=0
x-amzn-remapped-date: Tue, 17 Jan 2023 19:02:05 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: oi7K1Z45sral6ne0AsNTVD5vGc4WbZ7acJoq--4NFhN_f2z-xq7pWQ==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 b2f9564ebf9c745cc2ceae96d434977e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 21:55:43 GMT
etag: "5732887999b819f6facc6f4608a407b5a09adf75"
content-type: image/jpeg
age: 47505
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe34f344d-12b3-4719-9ecf-6191897f233e.jpeg
200 OK 6.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe34f344d-12b3-4719-9ecf-6191897f233e.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b015242ebdda9cc22cfe6741d2e926f1
76072223007cd11c6f7b9fda8f01818ab0fea740
b7a72c737cac91c83c39718de999bc6ff0ec4ede63342e86407190d95e60d9a1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe34f344d-12b3-4719-9ecf-6191897f233e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6908
x-amzn-requestid: 5f0a0b3b-1d4c-450e-bcd5-481bda79f4e1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eq1qQHwYIAMF-IQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c1030e-62d053e35c8ab2374fd2fe35;Sampled=0
x-amzn-remapped-date: Fri, 13 Jan 2023 07:06:54 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 1eiEXaC2jHawVVHg6KAlFvdV7ZMpXdCaN8o36sbYL9WwPvXejGobKA==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 17:36:56 GMT
age: 63032
etag: "76072223007cd11c6f7b9fda8f01818ab0fea740"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdd03bc60-bcfc-42c6-a1a0-0631c979fdd4.jpeg
200 OK 7.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdd03bc60-bcfc-42c6-a1a0-0631c979fdd4.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 26fa7bd40b5c3a3b5a6f95e7fca843b9
d8064f74f1e40bf6be4ea8ab4e319db22026c462
3e7744acf3e7ace6931c28cb5a5d3d7a77d9b97855b864c5c774368f2d0719c1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdd03bc60-bcfc-42c6-a1a0-0631c979fdd4.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7361
x-amzn-requestid: 54e3621a-ec24-4d56-85bf-84239fa7811e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e23ZvGtnIAMFivg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c5d2a4-7ce0e7924c03aeaa3ea684c3;Sampled=0
x-amzn-remapped-date: Mon, 16 Jan 2023 22:41:40 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: J2uv5_-X5xGBiqnD69jfx6ot6ufwK4aR1bg4uoaEftg70etZFbPmtQ==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 14:16:31 GMT
age: 75057
etag: "d8064f74f1e40bf6be4ea8ab4e319db22026c462"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa4d15f9a-9958-436b-ac3e-167b5a6563ea.jpeg
200 OK 3.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa4d15f9a-9958-436b-ac3e-167b5a6563ea.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b1b47910c4f71976f73a884bcae6f9bc
26c0d42fddb2a02d9878c34a76874710c92a9d30
9c5ce4945939b126cd36202f5afb8009ce790a792270ec31cc22099e4cd12a24
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa4d15f9a-9958-436b-ac3e-167b5a6563ea.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 3861
x-amzn-requestid: c8fbb2e1-9ec6-42c0-8030-9be785e8913e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e9TegFNEoAMFwqg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c865f6-04a9e7db684e88ed69e1bd43;Sampled=0
x-amzn-remapped-date: Wed, 18 Jan 2023 21:34:46 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0vlLtF3fPmIBiYrKVY8qBwVvS7PMn3OTGpu6C0umuCqXdzYxsF-xgQ==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 5565a51537c689d1d16f6b4d41f40082.cloudfront.net (CloudFront), 1.1 google
date: Wed, 18 Jan 2023 21:53:12 GMT
age: 47656
etag: "26c0d42fddb2a02d9878c34a76874710c92a9d30"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/photos/favicon.jpg
200 OK 14 kB URL HTTP/1.1 www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/photos/favicon.jpg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x512, components 3\012- data
Hash 136327a26d4244a53508386ead14b296
1a8062e27bbe32dcbfd1bb993bde5df86176f527
c53865ec446bb1418b2f74d320d61a4bec01169da5f5732bff41ddb9f92cf632
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/photos/favicon.jpg HTTP/1.1
Host: www.gruntindustries.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/?email=redacted@slurpmail.net&loginpage=&reff=ZWYzNzRkODllNTg0NjdmZTFhYmJmMWQ0MGEwMmFjN2E=
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:28 GMT
Last-Modified: Thu, 19 Jan 2023 09:56:35 GMT
ETag: "c8c4a9-35bb-5f29af2c01e3b"
Content-Length: 13755
Content-Type: image/jpeg
X-Varnish: 131578842
Age: 0
X-Cache: MISS
Accept-Ranges: bytes
Connection: keep-alive
chuyenphatnhanhdhlhcm.vn/wp-content/uploads/2018/07/bannerDHL-e1536645731248.jpg
200 OK 15 kB URL HTTP/2 chuyenphatnhanhdhlhcm.vn/wp-content/uploads/2018/07/bannerDHL-e1536645731248.jpg
IP
ASN #63760 AZDIGI Corporation
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 720x267, components 3\012- data
Hash 04b62e5173ca5e4a1474d741bd794bcb
8776bbf8e53ba1444d0ef0f8a5f736d6c74842ba
3c8258d55a687c7007ce15d917a4092dd6709abd81acdea2cdeaba26970b251d
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /wp-content/uploads/2018/07/bannerDHL-e1536645731248.jpg HTTP/1.1
Host: chuyenphatnhanhdhlhcm.vn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Thu, 26 Jan 2023 11:07:29 GMT
content-type: image/jpeg
last-modified: Tue, 11 Sep 2018 06:02:12 GMT
accept-ranges: bytes
content-length: 14852
date: Thu, 19 Jan 2023 11:07:29 GMT
server: LiteSpeed
vary: User-Agent
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2
www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/login.php?email=redacted@slurpmail.net
200 OK 1.4 kB URL HTTP/1.1 www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/login.php?email=redacted@slurpmail.net
IP
File type HTML document text\012- exported SGML document, ASCII text, with very long lines (3848), with CRLF line terminators
Hash 8f94729827ec4446d229c2ae0ee53238
f3e3ccb82a7d8ac823cfe628b2897a89001508a4
1510f7306c98dd73cffb393eea549be68c29f5df88aeabad5cf3e462b383c378
Analyzer Verdict Alert urlquery suspicious Suspicious - Suspicious JS code
urlquery suspicious Suspicious - Suspicious JS code
urlquery suspicious Suspicious - Suspicious JS code
NIDS Severity Alert suricata medium ET PHISHING Possible Phishing Landing - Common Multiple JS Unescape May 25 2017
suricata medium ET PHISHING Multiple Javascript Unescapes - Common Obfuscation Observed in Phish Landing
GET /wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/login.php?email=redacted@slurpmail.net HTTP/1.1
Host: www.gruntindustries.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:31 GMT
Content-Type: text/html; charset=UTF-8
Content-Encoding: gzip
Vary: Accept-Encoding
X-Varnish: 96432671
Age: 0
X-Cache: MISS
Accept-Ranges: bytes
Content-Length: 1419
Connection: keep-alive
www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/photos/logo.jpg
200 OK 3.9 kB URL HTTP/1.1 www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/photos/logo.jpg
IP
File type PNG image data, 425 x 125, 8-bit colormap, non-interlaced\012- data
Hash d8b38bb6321bd45ff42ed6931a870bb5
483fa5870b17eae93e8251dd50e694da5b0297a0
26933abb67839e269d8fc9d49b5ff722a1f48646776a8bdfb25e572d10996b41
Analyzer Verdict Alert urlquery phishing Phishing - DHL
GET /wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/photos/logo.jpg HTTP/1.1
Host: www.gruntindustries.com.au
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/wp-content/dhl/dhl_topscript/cmd-login=3c457d4b78edb5820cfb1c0576b5279a/content/login.php?email=redacted@slurpmail.net
HTTP/1.1 200 OK
Date: Thu, 19 Jan 2023 11:07:31 GMT
Last-Modified: Thu, 19 Jan 2023 09:56:35 GMT
ETag: "c8c4a4-f3e-5f29af2c01136"
Content-Length: 3902
Content-Type: image/jpeg
X-Varnish: 96432673
Age: 0
X-Cache: MISS
Accept-Ranges: bytes
Connection: keep-alive
www.parcello.org/assets/images/pages/dhl-paketnetzwerk-original.jpg
404 Not Found 0 B URL HTTP/2 www.parcello.org/assets/images/pages/dhl-paketnetzwerk-original.jpg
IP
ASN #24940 Hetzner Online GmbH
GET /assets/images/pages/dhl-paketnetzwerk-original.jpg HTTP/1.1
Host: www.parcello.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 404 Not Found
server: nginx
date: Thu, 19 Jan 2023 11:07:28 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2
www.dpdhl-brands.com/content/dam/dpdhl-corporate/dhl/guides/opener/logo-thumb.png
400 Bad Request 0 B URL HTTP/2 www.dpdhl-brands.com/content/dam/dpdhl-corporate/dhl/guides/opener/logo-thumb.png
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
GET /content/dam/dpdhl-corporate/dhl/guides/opener/logo-thumb.png HTTP/1.1
Host: www.dpdhl-brands.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www.gruntindustries.com.au/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 400 Bad Request
x-msedge-ref: 0byTJYwAAAABDR7Vk6fpySJImeeISKDgAQ1BIMzBFREdFMDQxMQBFZGdl
date: Thu, 19 Jan 2023 11:07:27 GMT
X-Firefox-Spdy: h2
139.162.20.243
35.241.9.150
188.68.47.111
95.100.9.53
104.110.14.29
93.184.220.29
45.252.248.44