Overview

URLvowruory.danielagarcia.com.ar/vnafvra97w?q=vmovfscf&id=u1
IP 31.41.244.107 (Russia)
ASN#0
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-12-02 23:30:37 UTC
StatusLoading report..
IDS alerts0
Blocklist alert10
urlquery alerts
19
Phishing - DHL
Tags None

Domain Summary (9)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
ocsp.digicert.com (2) 86 2012-05-21 07:02:23 UTC 2020-05-02 20:58:10 UTC 93.184.220.29
content-signature-2.cdn.mozilla.net (1) 1152 No data No data 34.160.144.191
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-12-02 17:12:21 UTC 34.117.237.239
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2020-05-03 10:09:39 UTC 52.39.96.8
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-21 23:36:00 UTC 2020-02-19 04:43:25 UTC 34.120.237.76
vowruory.danielagarcia.com.ar (1) 0 No data No data 31.41.244.107 Unknown ranking
r3.o.lencr.org (8) 344 No data No data 23.36.76.226
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-12-02 17:27:45 UTC 34.102.187.140
dhl.de.laforma.co.za (19) 0 2022-09-27 09:04:58 UTC 2022-12-02 20:11:48 UTC 104.223.118.83 Unknown ranking

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/js/jquery-1.12.2.min.js Phishing
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/img/dhl-official.svg Phishing
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/img/rating-play-store.svg Phishing
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/img/amex.svg Phishing
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/img/paypal.svg Phishing
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/img/visa.svg Phishing
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/fonts/delivery-bd.woff2 Phishing
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/fonts/delivery-rg.woff2 Phishing
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/img/sprite.svg Phishing
2022-12-02 2 dhl.de.laforma.co.za/verfolgung/fonts/delivery-cdblk.woff2 Phishing

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 31.41.244.107
Date UQ / IDS / BL URL IP
2023-02-06 02:46:52 +0000 53 - 0 - 20 xjvjfedmpx.bestlandingpagebuilder.review/vnaf (...) 31.41.244.107
2023-02-05 08:33:42 +0000 0 - 0 - 1 mdayjvovia.rib4fsrch.club/vnafvra97w?q=408517 (...) 31.41.244.107
2023-02-04 01:29:47 +0000 51 - 0 - 21 de.tracking-1932.codebreakerschool.co.uk/dlog (...) 31.41.244.107
2023-02-03 07:01:12 +0000 53 - 1 - 19 nxzjevmykp.rafiki.asia/vnafvra97w?q=667232019 (...) 31.41.244.107
2023-01-31 10:36:48 +0000 0 - 0 - 2 yqwdgjlhup.sgdixon.co.uk/ 31.41.244.107


Last 5 reports on ASN:
Date UQ / IDS / BL URL IP
2023-02-09 05:37:51 +0000 0 - 3 - 2 208.67.105.179/prosperzx.exe 208.67.105.179
2023-02-09 05:19:35 +0000 0 - 0 - 1 www.services.chance-impression.net/bb/VF1cIFt (...) 45.145.179.238
2023-02-09 05:18:52 +0000 0 - 0 - 1 www.marketing.dailydisclosure.net/bb/VF1cIGRV (...) 45.145.176.248
2023-02-09 05:12:02 +0000 0 - 0 - 1 www.connected.widely-considered.net/bb/ZmRmUy (...) 45.145.177.213
2023-02-09 05:11:45 +0000 0 - 0 - 1 www.connected.widely-considered.net/bb/VF1cIF (...) 45.145.177.213


Last 1 reports on domain: danielagarcia.com.ar
Date UQ / IDS / BL URL IP
2022-12-02 23:30:37 +0000 19 - 0 - 10 vowruory.danielagarcia.com.ar/vnafvra97w?q=vm (...) 31.41.244.107


No other reports with similar screenshot

JavaScript

Executed Scripts (4)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (41)


Request Response
                                        
                                            GET /vnafvra97w?q=vmovfscf&id=u1 HTTP/1.1 
Host: vowruory.danielagarcia.com.ar
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         31.41.244.107
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx/1.14.0 (Ubuntu)
Date: Fri, 02 Dec 2022 23:25:13 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Set-Cookie: 3aadabe57ebc3065f47464478243cf05=0; expires=Sat, 03-Dec-2022 23:25:13 GMT; Max-Age=86400; path=/; secure; HttpOnly; SameSite=None
Location: https://dhl.de.laforma.co.za/verfolgung/ef8159c7cca611ecaebeb178?page=u1


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  urlquery:
    - Phishing - DHL
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "6035871C0DE6FF2D120921461207CFA32BC286E1FE78849CE74815FFBB9FF950"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4409
Expires: Sat, 03 Dec 2022 00:38:42 GMT
Date: Fri, 02 Dec 2022 23:25:13 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "39F6BB64420BCFC8F0B010168FD35B67732984CD0698409F04D5AE40410422AA"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17804
Expires: Sat, 03 Dec 2022 04:21:57 GMT
Date: Fri, 02 Dec 2022 23:25:13 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3797
Cache-Control: max-age=130159
Date: Fri, 02 Dec 2022 23:25:13 GMT
Etag: "6389d3f3-1d7"
Expires: Sun, 04 Dec 2022 11:34:32 GMT
Last-Modified: Fri, 02 Dec 2022 10:31:15 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: 04dryIlS/RZM0jc61GgzLnDAmxWEkvZyPcO9i+PqJZ5ai023fxvnAHcuMlP6Gcsi87uKNcBgLAc=
x-amz-request-id: 1EDW46E256VAX31D
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 02 Dec 2022 22:46:52 GMT
age: 2301
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 02 Dec 2022 23:18:13 GMT
cache-control: public,max-age=3600
age: 420
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    14cd9a0afb6ba9a763651d5112760d1e
Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Fri, 02 Dec 2022 23:25:13 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 02 Dec 2022 23:08:57 GMT
cache-control: public,max-age=3600
age: 977
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "181F76C33A3674E6539BA5F491F1B0F4A6C9A30DC670C01B4BFFDABD99B19296"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=15069
Expires: Sat, 03 Dec 2022 03:36:23 GMT
Date: Fri, 02 Dec 2022 23:25:14 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3787
Cache-Control: max-age=125087
Date: Fri, 02 Dec 2022 23:25:14 GMT
Etag: "6389c02e-1d7"
Expires: Sun, 04 Dec 2022 10:10:01 GMT
Last-Modified: Fri, 02 Dec 2022 09:06:54 GMT
Server: ECS (ska/F71B)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: WHfUxyOfEVo7pY6ypHuuRQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         52.39.96.8
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 74toYw2ukmV/I60cgDq5PLnwzbs=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5948
Expires: Sat, 03 Dec 2022 01:04:23 GMT
Date: Fri, 02 Dec 2022 23:25:15 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5948
Expires: Sat, 03 Dec 2022 01:04:23 GMT
Date: Fri, 02 Dec 2022 23:25:15 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5948
Expires: Sat, 03 Dec 2022 01:04:23 GMT
Date: Fri, 02 Dec 2022 23:25:15 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5948
Expires: Sat, 03 Dec 2022 01:04:23 GMT
Date: Fri, 02 Dec 2022 23:25:15 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.76.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "D469C5ADB69F261084B016F8E24EDF8B69B62D9F930CA2D85CF35375E2303ECC"
Last-Modified: Thu, 01 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5948
Expires: Sat, 03 Dec 2022 01:04:23 GMT
Date: Fri, 02 Dec 2022 23:25:15 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73a2ea57-9c46-4205-a91a-a39e992ffe29.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6042
x-amzn-requestid: f28e5f64-3737-455c-accc-86a37dfef4b6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cTPeXHUKoAMF99A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63845f8e-20a6aba25e200ff41c6dab91;Sampled=0
x-amzn-remapped-date: Mon, 28 Nov 2022 07:13:18 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: bLltF1-sTeAt9wHZVQTsbPQRRw8yteYRgK9XPUmhO3jMLcywS_bYDQ==
via: 1.1 d042f60a962591f741406f28a8170c5a.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 06:29:46 GMT
age: 60929
etag: "3b36c020f5fc38693ac159e5747518a3234ba8cc"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6042
Md5:    a483cb4f5948987ff2fa6be8d8f3c4ab
Sha1:   3b36c020f5fc38693ac159e5747518a3234ba8cc
Sha256: a1c33278142371a168ca50aff0c5dc887461a9c83251e397d45c957c7cf788e3
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F20049904-a818-4d1c-9585-79edf76dcc61.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6966
x-amzn-requestid: 2b40c185-e050-4bfd-9b08-bb70e6f89824
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cfAb7Ev3oAMFnrQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6389144c-65301ace20da6f580ed77e82;Sampled=0
x-amzn-remapped-date: Thu, 01 Dec 2022 20:53:32 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: xBRZ6xulfveO7b5ZY8ApNbQJ1Sz8LbzEAb3YqxOEaZGYem-ZRaar_Q==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 be082a2326b7d49643607b097f1e7180.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 08:01:16 GMT
age: 55439
etag: "458aa485b9abef3b72427d308a172d1c24eceabd"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6966
Md5:    9b77186d0d93f7ccfe729edd9d184af3
Sha1:   458aa485b9abef3b72427d308a172d1c24eceabd
Sha256: 8bed5a8e56e8c43fcbdc807245c2b651d014a06368574e57a25b718399a4a701
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F73b53015-e415-4fff-9252-8a16bbe000f5.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9715
x-amzn-requestid: c8102cfa-78dc-4d81-ad6a-e16b9132e238
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ciZO2HQKIAMF8IA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a6f2b-350c586b568e6565763376bd;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 21:33:31 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 0QkVKyYm9UwlF5FEeli9UsRAQwEi3-c3bMR-QSJxIKRQe7WWT76dGQ==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 21:51:06 GMT
age: 5649
etag: "d4b3052021ff3ad1dc4134fa25eb12a98e7c17da"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9715
Md5:    45182367fd4f8b6dd234eef1022acdb1
Sha1:   d4b3052021ff3ad1dc4134fa25eb12a98e7c17da
Sha256: a57fadaf74db2fb457cfe761314d56f021d22146f5bdb6a8bf11b6519e8a558d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F652bfe35-9b09-4fba-b7b5-c6bd90cccdbe.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6119
x-amzn-requestid: cac5842e-2b57-4eda-9b09-27ec8a0b1bf8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cMiE7Hq0oAMFzHg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6381b085-151f123551f999a918de8a3a;Sampled=0
x-amzn-remapped-date: Sat, 26 Nov 2022 06:21:57 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: mrS561ug59NStQyD3cH4ndqGvY3QiLVeMFOoC86ktj52PghNjeYa5w==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 20:55:39 GMT
age: 8976
etag: "398fd2d837c73f54c4591b69cd683f29bdf9184a"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6119
Md5:    7ffa12df550123f63b20f67437cd8a04
Sha1:   398fd2d837c73f54c4591b69cd683f29bdf9184a
Sha256: fd9ac4396488098923c27531295e64475047dd008a901e59915109a73a69f305
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F881a33ae-e81b-4603-85d9-a2242b17be66.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4803
x-amzn-requestid: ad2d9243-5e32-4faf-8ff3-b9abd3af1e89
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cb1_hEJJIAMF4Vg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6387d063-596f5833509112ee6cbedf54;Sampled=0
x-amzn-remapped-date: Wed, 30 Nov 2022 21:51:31 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: jM-fTqLsmU3c_gc9Wle-lvCwXelA9Sid9axtzJQDsfOHv23yUbKsBw==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 943c6a4d4ee43b18ee91634536f53eae.cloudfront.net (CloudFront), 1.1 google
date: Thu, 01 Dec 2022 23:43:28 GMT
age: 85307
etag: "cedf2f21be7cd366bd46055b62b5513db3011dfc"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4803
Md5:    cc0a257323f882caff067adb86d906e4
Sha1:   cedf2f21be7cd366bd46055b62b5513db3011dfc
Sha256: c16a9296d5e840a468fef7fb2764b9f7d4b3131d7ade2ce4999de1eead5469e0
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F741da48c-a860-42fc-8f5c-4572522c2f56.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 6416
x-amzn-requestid: f5456dd6-8459-4a19-a9b5-b7b567fceb01
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cik2pG5aoAMFrVg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638a81c3-0923232b35133f471332062b;Sampled=0
x-amzn-remapped-date: Fri, 02 Dec 2022 22:52:52 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: fO2Nzz-s_o-67i4JhGgbUZdA5G1B8c9RrnJKm56RN7Ae_MK65KeRtQ==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 1b74ccf4cb51eacf97a0e6d60ae46a3e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 02 Dec 2022 23:08:03 GMT
age: 1032
etag: "34b768eb68f6cb850ff984fd687096e089649523"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   6416
Md5:    585e7e56aed6b2f2f5e658f46bb791c4
Sha1:   34b768eb68f6cb850ff984fd687096e089649523
Sha256: 5412ba902e667571b0bbb3879ba6b9ad39501abce59381e84e6aa09779e7198b
                                        
                                            GET /verfolgung/ef8159c7cca611ecaebeb178?page=u1 HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         104.223.118.83
HTTP/1.1 302 Found
Content-Type: text/html; charset=utf-8
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:16 GMT
Content-Length: 86
Connection: keep-alive
X-Powered-By: PHP/5.4.16
location: tracking.php?id=ef8159c7cca611ecaebeb178&page=u1


--- Additional Info ---
Magic:  HTML document, ASCII text, with no line terminators
Size:   86
Md5:    c0c9292e91a02b61949b64543b5bb18a
Sha1:   6291d51ec9b10c1588a9075face29227c080214f
Sha256: 19fab5f243f3813bf1c4339b5726ac0a825e3c1f96eee244782d9a30ca241129
                                        
                                            GET /verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1 HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:18 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1304), with CRLF line terminators
Size:   120752
Md5:    69e0c499f838fed0987c4df803c1d388
Sha1:   08ba018d187c19d857934e047c0a32ef940ca411
Sha256: 242a4b44f100ab88367bb1a475a0d07d32d17d74b6f051dc7eea25cb959bc722
                                        
                                            GET /verfolgung/css/6.css HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:20 GMT
Content-Length: 4271
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:18:34 GMT
ETag: "10af-5edc1e53cee80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   4271
Md5:    8eb7809b45d4079fbaa48175f64c7441
Sha1:   f865a99867d1eac58a575a518996ae2e9ca1de95
Sha256: 00d16054bb78393fecfbeff7eed0d44e005ebe51f034c838c1f69bdfddf40b01

Alerts:
  urlquery:
    - Phishing - DHL
                                        
                                            GET /verfolgung/css/3.css HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:20 GMT
Content-Length: 22046
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "561e-5edc1b80ec500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   22046
Md5:    c54f6668454402879168d2782296d35e
Sha1:   dd3c72855079f3d074cfe6fd500959874650c736
Sha256: d40a85d0988ad1b83645365ac9bd5ef15ed33517733d847317f86c6ea271ad32

Alerts:
  urlquery:
    - Phishing - DHL
                                        
                                            GET /verfolgung/css/5.css HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:20 GMT
Content-Length: 48507
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "bd7b-5edc1b80ec500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (661), with CRLF line terminators
Size:   48507
Md5:    67f662870fef3deea83c75f68622a1e4
Sha1:   45bdedb38dca005081238b4cf80fa10c90778465
Sha256: 8fd91a16c9b120c1f43fecdb1d40a9adf7e6dc05b69c3261c342ea76ecc50c2d

Alerts:
  urlquery:
    - Phishing - DHL
                                        
                                            GET /verfolgung/css/2.css HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:20 GMT
Content-Length: 48503
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "bd77-5edc1b80ec500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (661), with CRLF line terminators
Size:   48503
Md5:    68bb9d41de0ac82959f8f90c552e4948
Sha1:   fb4e7fd67a692ae70e6b3813fe7913f0c3800103
Sha256: a0879b822817892ccecb11bc4c475d4bf3aad5e03a37a49eae46dfbdcf9e8fb3

Alerts:
  urlquery:
    - Phishing - DHL
                                        
                                            GET /verfolgung/css/1.css HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: text/css
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:20 GMT
Content-Length: 53751
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "d1f7-5edc1b80ec500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (23076), with CRLF line terminators
Size:   53751
Md5:    c773c2e44cb33bd02d04987a8017056b
Sha1:   af122938b5fab20abed2fd9df00af09e66294222
Sha256: a116a577d744fd0c240b7f1c1b3139cc0d61b953d36fe2b61506e379e9c8bc0a

Alerts:
  urlquery:
    - Phishing - DHL
                                        
                                            GET /verfolgung/js/jquery-1.12.2.min.js HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:20 GMT
Content-Length: 97244
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "17bdc-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (32029)
Size:   97244
Md5:    bdc2b7efb1faf219d65edfe253a103e9
Sha1:   4921529fc15b8133f2fe65b3bebf53d1e9ef8579
Sha256: 95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /verfolgung/img/dhl-official.svg HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 2040
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "7f8-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (2040), with no line terminators
Size:   2040
Md5:    d5a053f0005dd58489a461f599b5a508
Sha1:   ba71dd77800ef3d410beb8282d790642bec8193b
Sha256: aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /verfolgung/img/rating-play-store.svg HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 904
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "388-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (512)
Size:   904
Md5:    19a24c818ad0e0eab9418b77ff8e7c1c
Sha1:   3787691d98fd4b9f494664274a641226e33c1588
Sha256: a6b35b6b7cabb9d33c2e1d6afef2d5f546a2fd3912f5f3e96495cd64218b9251

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /verfolgung/img/amex.svg HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 734
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "2de-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (565)
Size:   734
Md5:    1c003076f46fc215f19de22568f3b5a1
Sha1:   112caa9374e6c1d0f8325cdcf2bde5b073f0f1ad
Sha256: b64feafef2104c77f092f2bbfa526bad76e17fb053591284984e86a28ed721a2

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /verfolgung/img/paypal.svg HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 3369
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "d29-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (3369), with no line terminators
Size:   3369
Md5:    4ac4e26be0277fab62f57835bca7ee1e
Sha1:   edef7e834db1d63bd5290adf1f0308522cced7e0
Sha256: 5e9402048b0efae8235057fc5db4276b0472c9a42c59c0b759e059ffbdafb32b

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /verfolgung/img/visa.svg HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 4586
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "11ea-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1577)
Size:   4586
Md5:    09d8b96a0853e0bc8cec7c677c0da93b
Sha1:   a6aebdb9c339cac93762338353517b67e23f1903
Sha256: a60079ce89803190740ddcf6e03eace0492b8f73ec57ffb4132b72a9736b68fe

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /verfolgung/img/1.png HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: image/png
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 108508
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1a7dc-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 366 x 206, 8-bit/color RGB, non-interlaced\012- data
Size:   108508
Md5:    634c39f2a51e26d2ac85598a2103e16d
Sha1:   1badf4773207d7238f8808f1bd42e355dd4b3a01
Sha256: afcc3febb5b047b9f7d691e6e92c2239c2feee6cdb5e56a910e8a9e62387d430

Alerts:
  urlquery:
    - Phishing - DHL
                                        
                                            POST /verfolgung/phplib/ajax.php?id=ef8159c7cca611ecaebeb178 HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 17
Origin: https://dhl.de.laforma.co.za
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:22 GMT
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Set-Cookie: PHPSESSID=hooo4mi2gsg8o3q5tis6d3cpr5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  urlquery:
    - Phishing - DHL
                                        
                                            GET /verfolgung/fonts/delivery-bd.woff2 HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 33840
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "8430-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 33840, version 1.0\012- data
Size:   33840
Md5:    682ea1d6962cd47974cd715fa3b80b4a
Sha1:   94a563948862a70f4d1be0a3aebc3a9f7aa800a6
Sha256: 4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /verfolgung/fonts/delivery-rg.woff2 HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 33580
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "832c-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 33580, version 1.0\012- data
Size:   33580
Md5:    1a05a4d2566dc2490cae801e9d885ec6
Sha1:   2fae1307a017a9afe73d351cf15932e51dc57887
Sha256: 2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /verfolgung/img/sprite.svg HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 41430
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "a1d6-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (28844), with CRLF line terminators
Size:   41430
Md5:    cebbc77896c22e29f2a223a9efe685e3
Sha1:   ab3e7dc74207c4bb1f45a712d334c3d3ef8bdce8
Sha256: 07908237900ec13b078abee11041a05af9a7c8930a9a0e1c7d85f2c5f8ca9425

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing
                                        
                                            GET /verfolgung/fonts/delivery-cdblk.woff2 HTTP/1.1 
Host: dhl.de.laforma.co.za
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://dhl.de.laforma.co.za/verfolgung/tracking.php?id=ef8159c7cca611ecaebeb178&page=u1
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

search
                                         104.223.118.83
HTTP/1.1 200 OK
                                        
Server: nginx/1.20.1
Date: Fri, 02 Dec 2022 23:25:21 GMT
Content-Length: 36652
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "8f2c-5e89907cbf280"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 36652, version 1.0\012- data
Size:   36652
Md5:    774e0efbb9da45395efa24c9ca4248de
Sha1:   04eab63ba86f912514fc0ea04b025b7f2df6145b
Sha256: ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1

Alerts:
  urlquery:
    - Phishing - DHL
  Blocklists:
    - fortinet: Phishing