| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash09a973de929ab7452edc342c780d3668 3f14f6e0a36f76863c0aea6fb561c266404a7ea3 e82ca5f310e37267fbf792427747e65c2bb35e684d3f629c0aa302f688bc4f80
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E82CA5F310E37267FBF792427747E65C2BB35E684D3F629C0AA302F688BC4F80"
Last-Modified: Fri, 23 Sep 2022 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17003
Expires: Fri, 23 Sep 2022 15:14:10 GMT
Date: Fri, 23 Sep 2022 10:30:47 GMT
Connection: keep-alive
|
|
| firefox.settings.services.mozilla.com/v1/ | 143.204.55.115 | 200 OK | 939 B |
URL HTTP/1.1firefox.settings.services.mozilla.com/v1/ IP143.204.55.115:0
File typeJSON data\012- , ASCII text, with very long lines (939), with no line terminators Hash1b3053fa528e28810f8a2cc9284cc921 cca9eb471d941881a6b9a1793aecb6c281908f6a a2427848ba35575dda8a82cf88f104978234c05389deebc3fc8279d9075eff45
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Alert, Content-Type, Backoff, Content-Length, Retry-After
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Fri, 23 Sep 2022 10:14:07 GMT
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: co53qgsIZscrXY4zcZvO8pzk646fz2md06voVTK7SZP3gIMaeLec2A==
Age: 1000
|
|
| content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain | 143.204.55.35 | 200 OK | 5.3 kB |
URL HTTP/2content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain IP143.204.55.35:0
File typePEM certificate\012- , ASCII text Hash6113f8408c59aebe188d6af273b90743 7398873bf00f99944eaa77ad3ebc0d43c23dba6b b6e0cc9ad68306208a160f3835fb8da76acc5a82d8fde1da5a98e1de1c11a770
GET /chains/remote-settings.content-signature.mozilla.org-2022-10-30-18-47-44.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: binary/octet-stream
content-length: 5348
last-modified: Sat, 10 Sep 2022 18:47:45 GMT
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
date: Fri, 23 Sep 2022 04:35:15 GMT
etag: "6113f8408c59aebe188d6af273b90743"
x-cache: Hit from cloudfront
via: 1.1 dac7cf040932e0c072eeed10afdd7b3e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: RtwZfKoL-3Cv-dwzRoxvaUcenHmAB40EXdobH5VPlAbWnqMJOpVkaQ==
age: 21333
X-Firefox-Spdy: h2
|
|
| contile.services.mozilla.com/v1/tiles | 34.117.237.239 | 200 OK | 12 B |
URL HTTP/2contile.services.mozilla.com/v1/tiles IP34.117.237.239:0
File typeJSON data\012- , ASCII text, with no line terminators Hash23e88fb7b99543fb33315b29b1fad9d6 a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| ocsp.sectigo.com/ | 172.64.155.188 | 200 OK | 471 B |
IP172.64.155.188:0
Hash599bd1927e224c446f773606a8175fbc 694dfebf34432b1365c906cb74990d1fd836a518 023aa28373ba71d1c7600cd7bcf4a6419625c18b10f178650b6d5a2b421daae9
POST / HTTP/1.1
Host: ocsp.sectigo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 23 Sep 2022 10:30:47 GMT
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Last-Modified: Wed, 21 Sep 2022 03:33:24 GMT
Expires: Wed, 28 Sep 2022 03:33:23 GMT
Etag: "694dfebf34432b1365c906cb74990d1fd836a518"
Cache-Control: max-age=406355,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 74f29b6138ceb50c-OSL
|
|
| firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US | 143.204.55.115 | 200 OK | 329 B |
URL HTTP/1.1firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US IP143.204.55.115:0
File typeJSON data\012- , ASCII text, with very long lines (329), with no line terminators Hash0333b0655111aa68de771adfcc4db243 63f295a144ac87a7c8e23417626724eeca68a7eb 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Cache-Control: max-age=3600, max-age=3600
Date: Fri, 23 Sep 2022 10:03:22 GMT
Expires: Fri, 23 Sep 2022 10:23:11 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 185768229530368be94556dcab1c486a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: KiyXPyh33fv6XFTITPWuG3iUY4r4kSYeX7yEsfQw86v14BC4_Mg0vA==
Age: 1645
|
|
| ocsp.digicert.com/ | 93.184.220.29 | 200 OK | 471 B |
IP93.184.220.29:0
Hashf714931cf870bfa33815fd259b7246fd 38e411ef8ca1b31ead8415ee5f21d98bd9653a86 897675130112daff8bdf6fa25b56faa4b9fdb367daca2b2645ed65c83a2e423f
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4402
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Fri, 23 Sep 2022 10:30:47 GMT
Last-Modified: Fri, 23 Sep 2022 09:17:25 GMT
Server: ECS (ska/F717)
X-Cache: HIT
Content-Length: 471
|
|
| push.services.mozilla.com/ | 44.242.3.166 | 101 Switching Protocols | 0 B |
URL HTTP/1.1push.services.mozilla.com/ IP44.242.3.166:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: L2+LFgEy1LpA46En0W641Q==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 6tO9RaLYxr7bWEM4L4QSHC/yRYA=
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/images/logo.svg | 63.250.43.14 | 200 OK | 722 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/images/logo.svg IP63.250.43.14:0
File typeSVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text Hash75e6a3a06ceab9d5d544db411b461773 6133136f4082d6e1286023a7a28e32fe69d0ad40 60f60db64661c2ec17815671734b616bab2fe1befacad5482953f3e7dc13961a
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/images/logo.svg HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: image/svg+xml
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-643"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
content-length: 722
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/jquery.min.js | 63.250.43.14 | 200 OK | 31 kB |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/jquery.min.js IP63.250.43.14:0
File typeASCII text, with very long lines (65450), with CRLF line terminators Hash036ea929140cc272177d72861479bc9d d44e3b6a79ee1049628ac55ac258cce758074d68 a2b493a2b7f79b8c544dd10224faccf27480b58bb57e93499ceb54ed28494388
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/js/jquery.min.js HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: application/javascript
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-15851"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
content-length: 30719
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/main.js | 63.250.43.14 | 200 OK | 565 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/main.js IP63.250.43.14:0
File typeAlgol 68 source text\012- Pascal source, ASCII text, with CRLF line terminators Hashf80419a1a989646bddaa104eeda9984f 6ed87c6331f21c268824527cbcc4772a037d3409 1adf68bdda16e702b24e9c7fd96e533e5ed5b8caf2347fec191faa50129152d0
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/js/main.js HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: application/javascript
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-7a4"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
content-length: 565
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Regular.woff2 | 63.250.43.14 | 200 OK | 29 kB |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Regular.woff2 IP63.250.43.14:0
File typeWeb Open Font Format (Version 2), TrueType, length 29188, version 1.0\012- data Hash69279aef7fbc11101022a9f06079bbbf 44118888e95417adcd5da115cdf1fc23e8de85d1 76df5b67646f4f0f999d4e1c482ab2007b948f3b9acc2c8a207bfdb214103855
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Regular.woff2 HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/fonts.css
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:48 GMT
content-type: font/woff2
content-length: 29188
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
etag: "6328ca8e-7204"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
accept-ranges: bytes
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Black.woff2 | 63.250.43.14 | 200 OK | 28 kB |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Black.woff2 IP63.250.43.14:0
File typeWeb Open Font Format (Version 2), TrueType, length 28284, version 1.0\012- data Hashe29067446336b1e58be582e29387da02 84e0481e68acf4b9956e243a43a2672f213ac4cd c16911984dce7909e91263930a1f34352a03476a6c58894a482f33aad91cd379
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Black.woff2 HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/fonts.css
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:48 GMT
content-type: font/woff2
content-length: 28284
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
etag: "6328ca8e-6e7c"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
accept-ranges: bytes
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Light.woff2 | 63.250.43.14 | 200 OK | 25 kB |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Light.woff2 IP63.250.43.14:0
File typeWeb Open Font Format (Version 2), TrueType, length 24880, version 1.0\012- data Hash09201a1cc16b4ea1d1b7c8fdf90d5a60 b2f5abe7583b81206f7f716e0cd53b31b9a07c85 bd4c2248c2087eb5f44a46a67b8b4ce961d0fde9053dbfda30cf6af08a6c70e6
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Light.woff2 HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/fonts.css
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:48 GMT
content-type: font/woff2
content-length: 24880
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
etag: "6328ca8e-6130"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
accept-ranges: bytes
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Bold.woff2 | 63.250.43.14 | 200 OK | 29 kB |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Bold.woff2 IP63.250.43.14:0
File typeWeb Open Font Format (Version 2), TrueType, length 28676, version 1.0\012- data Hash12a234e87f37d441adc9bb2e3dec13de 58e6927255411344225d51588b63cdf5923bd3e4 e47c34e4bb6a2fe7f50c02b0656e10666ded963f874015cb10ee1be923ea4448
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/fonts/Lato-Bold.woff2 HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/fonts.css
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:48 GMT
content-type: font/woff2
content-length: 28676
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
etag: "6328ca8e-7004"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
accept-ranges: bytes
age: 0
x-cache: MISS
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash8ebb267e443b81854ef9a01b3eb6489d b932e9e5679da5a9160da5429458041765509b52 4ac5aa5b4fb4a85282b825c5c0ed7b1aaf2b39ffe77d69dec5123a84709f3fe2
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14084
Expires: Fri, 23 Sep 2022 14:25:33 GMT
Date: Fri, 23 Sep 2022 10:30:49 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash8ebb267e443b81854ef9a01b3eb6489d b932e9e5679da5a9160da5429458041765509b52 4ac5aa5b4fb4a85282b825c5c0ed7b1aaf2b39ffe77d69dec5123a84709f3fe2
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14084
Expires: Fri, 23 Sep 2022 14:25:33 GMT
Date: Fri, 23 Sep 2022 10:30:49 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.36.77.32 | 200 OK | 503 B |
IP23.36.77.32:0 ASN#20940 Akamai International B.V.
Hash8ebb267e443b81854ef9a01b3eb6489d b932e9e5679da5a9160da5429458041765509b52 4ac5aa5b4fb4a85282b825c5c0ed7b1aaf2b39ffe77d69dec5123a84709f3fe2
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4AC5AA5B4FB4A85282B825C5C0ED7B1AAF2B39FFE77D69DEC5123A84709F3FE2"
Last-Modified: Tue, 20 Sep 2022 22:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14084
Expires: Fri, 23 Sep 2022 14:25:33 GMT
Date: Fri, 23 Sep 2022 10:30:49 GMT
Connection: keep-alive
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ac88c56-4515-47b4-9c1e-7745782bd306.jpeg | 34.120.237.76 | 200 OK | 10 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ac88c56-4515-47b4-9c1e-7745782bd306.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hashb877ead4a15221fdd278ef27f281a7ec 48c10714503e8dfdd3e3c3d39b919ef2792f0d15 f4a1d5abcfa4092828e004b6c0605a7a24e4133d275312f613dceff875971daf
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ac88c56-4515-47b4-9c1e-7745782bd306.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10127
x-amzn-requestid: 456e3c6a-e173-433e-8d54-d787cb50b7e8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4Y0sHmCoAMFVSg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd4ea-7a07b336571396533e48b4cb;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:34:34 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: KKYAef15NoI3It5UfVcqhPx50Fr6IK7O2VFasuAILVN9PP8CH1_7Ng==
via: 1.1 5a1753718d8b33365e5f693dd338c510.cloudfront.net (CloudFront), 1.1 cd858042f70b416ca05e042acf3908a4.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 21:58:25 GMT
age: 45144
etag: "48c10714503e8dfdd3e3c3d39b919ef2792f0d15"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F56c6b5fd-d351-45b8-9f62-d5052869881a.jpeg | 34.120.237.76 | 200 OK | 11 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F56c6b5fd-d351-45b8-9f62-d5052869881a.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash948abf9bedd1bd67010284080ba06d01 dd94d525ad264856a0fdcb7a4b1faa2d68c3f68b 236639cc2279c6f269dd521796a087a40b43b252cb55faf3e4214cbdc8369a62
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F56c6b5fd-d351-45b8-9f62-d5052869881a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10822
x-amzn-requestid: 0cec2f7d-e906-4f5f-baa7-5d8a1a7c6820
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y2P7bEeQoAMFhGQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632bf9e2-5bdf18be72eed24028034edb;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 06:00:02 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: Pj5hSr5LtIWPRDYjHxp8-K8gVghjf8GlO-FnXDvxscJqdygfZH8hIA==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 19:36:01 GMT
age: 53688
etag: "dd94d525ad264856a0fdcb7a4b1faa2d68c3f68b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb77ad616-c829-40b4-8b70-2be46252d64c.jpeg | 34.120.237.76 | 200 OK | 10 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb77ad616-c829-40b4-8b70-2be46252d64c.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash8ea5f06ad31f0cedd2cb5c6df82f35f4 60a83a1618ffae06e49ca3002bac1db9980dcfe8 5f6a4cb92c016ef0f229b11d727e9680a15b10782b5bfe9e66ad9d100b458d8d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb77ad616-c829-40b4-8b70-2be46252d64c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10279
x-amzn-requestid: 2ff2c324-51c5-484d-b049-3eacbdc1024a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Yyj8THHdoAMF44g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632a804e-0f4da4ba2a84679b3fd297fc;Sampled=0
x-amzn-remapped-date: Wed, 21 Sep 2022 03:09:02 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 6uqNnpll2kgC_0_t5e9yp0AgFAvprQq_GF_jgwj2sX2TE9S1l023Aw==
via: 1.1 c21a0d27ceec21e266c9f962d0349438.cloudfront.net (CloudFront), 1.1 989017835f43d594873bde5a7ee7fe5e.cloudfront.net (CloudFront), 1.1 google
date: Fri, 23 Sep 2022 03:58:47 GMT
age: 23522
etag: "60a83a1618ffae06e49ca3002bac1db9980dcfe8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/images/favicon.ico | 63.250.43.14 | 200 OK | 9.8 kB |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/images/favicon.ico IP63.250.43.14:0
Hash704d752248393bd6f260b48f90c5e388 f58cab30505143f613f51c9b91a3ecb55b33e627 8c20f7a1a4f72873b568e58997dca6af0fa9998d419d793d5a258f17d9555e22
GET /wp-admin/Dhl-tracking-ch/assets/images/favicon.ico HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:48 GMT
content-type: image/x-icon
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-47e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98db69a9-8416-4b0b-b1b4-1ed196b985e5.jpeg | 34.120.237.76 | 200 OK | 5.3 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98db69a9-8416-4b0b-b1b4-1ed196b985e5.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash3b318ea5c36d2b22b925f7dfe382df5f 0264e73c4cfff0bb255757c7e1c760a5ad3ece80 0c2f58ea4f5f32bb327f292e1b8fb5a4a60230bffc3abc440a624df27ec0d6bc
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F98db69a9-8416-4b0b-b1b4-1ed196b985e5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5340
x-amzn-requestid: b13bc974-e15d-43a4-a918-fbc35b09a36f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4Y19HljIAMFY8w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd4f2-2cb226ba4bd7c7e74d9ab2db;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:34:42 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 8DCVWC4Ihr4R21i3ySyiWdUK0aGymTE22B842ZKolG-ZThiKSMX-uQ==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 32d624dbeb2a8b7f24dbe49007e37c90.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 22:04:45 GMT
age: 44764
etag: "0264e73c4cfff0bb255757c7e1c760a5ad3ece80"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffccf6ade-04f7-4d15-943c-bde343725d94.jpeg | 34.120.237.76 | 200 OK | 8.0 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffccf6ade-04f7-4d15-943c-bde343725d94.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash02a682b4703bb9d6381c762726c05531 1d7f7b4cfdd7425213a21afdd1d5a5d8d11d0e54 fb672de67420a239fe5d7e2588f640150ed29883fe2a46ded160385e3265004c
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffccf6ade-04f7-4d15-943c-bde343725d94.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8029
x-amzn-requestid: 2fc5c63d-5cef-42f4-a6d2-b55f51c57af6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Y4Y0tHjGoAMFcFw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-632cd4ea-73f2f78a2d1ca8fc666d2571;Sampled=0
x-amzn-remapped-date: Thu, 22 Sep 2022 21:34:34 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 5ur411n5hU7eWb68iExZCUrhpCybRyTBHCi72ra8dS2kd3UhW8sb1A==
via: 1.1 0aebf3fe433ff96e68d785fad4ea4c0e.cloudfront.net (CloudFront), 1.1 1481cc55c02c3a782ad420b6bac2cb32.cloudfront.net (CloudFront), 1.1 google
date: Thu, 22 Sep 2022 21:59:00 GMT
age: 45109
etag: "1d7f7b4cfdd7425213a21afdd1d5a5d8d11d0e54"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/bootstrap.min.css | 63.250.43.14 | 200 OK | 0 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/bootstrap.min.css IP63.250.43.14:0
GET /wp-admin/Dhl-tracking-ch/assets/css/bootstrap.min.css HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: text/css
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-2606e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/images/glo-footer-logo.svg | 63.250.43.14 | 200 OK | 0 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/images/glo-footer-logo.svg IP63.250.43.14:0
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/images/glo-footer-logo.svg HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: image/svg+xml
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-2ec0"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/main.css | 63.250.43.14 | 200 OK | 0 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/main.css IP63.250.43.14:0
GET /wp-admin/Dhl-tracking-ch/assets/css/main.css HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: text/css
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-18c5"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/popper.min.js | 63.250.43.14 | 200 OK | 0 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/popper.min.js IP63.250.43.14:0
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/js/popper.min.js HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: application/javascript
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-4f74"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE | 63.250.43.14 | 200 OK | 0 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE IP63.250.43.14:0
Analyzer | Verdict | Alert | openphish | DHL Airways, Inc. | | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate, public
pragma: no-cache
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/helpers.css | 63.250.43.14 | 200 OK | 0 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/css/helpers.css IP63.250.43.14:0
GET /wp-admin/Dhl-tracking-ch/assets/css/helpers.css HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: text/css
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-a318"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/bootstrap.min.js | 63.250.43.14 | 200 OK | 0 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/bootstrap.min.js IP63.250.43.14:0
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/js/bootstrap.min.js HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: application/javascript
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-21388"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|
| trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/fontawesome.min.js | 63.250.43.14 | 200 OK | 0 B |
URL HTTP/2trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/assets/js/fontawesome.min.js IP63.250.43.14:0
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /wp-admin/Dhl-tracking-ch/assets/js/fontawesome.min.js HTTP/1.1
Host: trackingparcel-bb2af1.ingress-daribow.ewp.live
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://trackingparcel-bb2af1.ingress-daribow.ewp.live/wp-admin/Dhl-tracking-ch/login/index.php?trackid=CS471210241DE
Connection: keep-alive
Cookie: PHPSESSID=phjqeagmij9ftdp7jcvsqrcl1b
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 23 Sep 2022 10:30:47 GMT
content-type: application/javascript
last-modified: Mon, 19 Sep 2022 20:01:18 GMT
vary: Accept-Encoding
etag: W/"6328ca8e-10314e"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-encoding: gzip
age: 0
x-cache: MISS
accept-ranges: bytes
strict-transport-security: max-age=15768000
X-Firefox-Spdy: h2
|
|