Overview

URLtracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
IP 157.230.242.66 (Singapore)
ASN#14061 DIGITALOCEAN-ASN
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Access public lock_open
Report completed2023-03-23 10:56:17 UTC
StatusLoading report..
IDS alerts0
Blocklist alert0
urlquery alerts
27
Phishing - DHL
Tags dhl logistics phishing

Domain Summary (7)

Fully Qualifying Domain Name Rank First Seen Last Seen Sent bytes Received bytes IP Comment
r3.o.lencr.org (8) 344 2020-12-02T09:52:13Z 2023-03-29T05:09:11Z 2704 7094 23.33.119.27
firefox.settings.services.mozilla.com (2) 867 2020-06-04T22:08:41Z 2023-03-29T05:09:03Z 782 2374 35.241.9.150
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03T13:26:46Z 2023-03-29T05:09:31Z 413 5881 34.160.144.191
tracking.822684.tification.club (27) 0 2023-03-23T06:19:48Z 2023-03-26T04:44:42Z 12954 859033 157.230.242.66
contile.services.mozilla.com (1) 1114 2021-05-27T20:32:35Z 2023-03-29T05:09:31Z 333 391 34.117.237.239
push.services.mozilla.com (1) 2140 2014-10-24T10:27:06Z 2023-03-29T05:09:32Z 606 127 52.36.246.241
img-getpocket.cdn.mozilla.net (6) 1631 2018-06-22T01:36:00Z 2023-03-29T05:09:12Z 3246 47359 34.120.237.76

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected

ThreatFox
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 5 reports on IP: 157.230.242.66
Date UQ / IDS / BL URL IP
2023-03-23 16:30:57 UTC 27 - 0 - 0 dhl.249221.guitartone.ch/dlogin.php 157.230.242.66
2023-03-23 16:25:37 UTC 27 - 0 - 0 dhl.249221.guitartone.ch/dlogin.php 157.230.242.66
2023-03-23 15:55:37 UTC 27 - 0 - 0 dhl.249221.guitartone.ch/verfolgung/tracking. (...) 157.230.242.66
2023-03-23 15:55:35 UTC 27 - 0 - 0 dhl.249221.guitartone.ch/verfolgung/tracking. (...) 157.230.242.66
2023-03-23 15:11:12 UTC 27 - 0 - 0 tracking.758568.guitartone.ch/verfolgung/trac (...) 157.230.242.66


Last 5 reports on ASN: DIGITALOCEAN-ASN
Date UQ / IDS / BL URL IP
2023-06-09 21:44:21 UTC 0 - 4 - 0 e8zr.life/rd/c5262NQOEM32905kcyl549921XhH1865 (...) 165.232.33.191
2023-06-09 21:43:16 UTC 0 - 0 - 2 sg.clean-3-clean.club/sx/ 128.199.109.227
2023-06-09 21:37:01 UTC 0 - 2 - 2 139.59.186.183/ 139.59.186.183
2023-06-09 21:30:58 UTC 0 - 9 - 0 sber.avito.avito.avito.avito.sber.git.covid19 (...) 159.89.215.151
2023-06-09 21:28:45 UTC 0 - 1 - 0 trafficole.com/f87fefadf38d78d1ad1e8fc36c4d32 (...) 143.198.124.24


Last 3 reports on domain: tification.club
Date UQ / IDS / BL URL IP
2023-03-23 10:56:17 UTC 27 - 0 - 0 tracking.822684.tification.club/verfolgung/tr (...) 157.230.242.66
2023-03-23 10:56:16 UTC 27 - 0 - 0 tracking.822684.tification.club/verfolgung/tr (...) 157.230.242.66
2023-03-23 10:56:15 UTC 27 - 0 - 0 tracking.822684.tification.club/verfolgung/tr (...) 157.230.242.66


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-04-04 14:11:17 UTC 26 - 0 - 0 suqbkggpzr.aezka.cloud/uPihceQTQm?q=896993670 (...) 80.66.75.42
2023-04-04 08:38:33 UTC 26 - 0 - 0 dhlexpress.dhl.nbxozwgada.kevinhaferkamp.clou (...) 80.66.75.42
2023-04-04 07:52:41 UTC 26 - 0 - 0 bogitdraia.granov.cloud/uPihceQTQm?q=56061595 (...) 80.66.75.42
2023-03-29 14:45:46 UTC 26 - 0 - 0 dhl.de.0953365214825645.naturural.org/blogin. (...) 188.93.233.165
2023-03-29 13:23:55 UTC 26 - 0 - 0 dhl.de.0953365214825645.naturural.org/blogin. (...) 188.93.233.165

JavaScript

Executed Scripts (2)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (46)


Request Response
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "469B97BF9F57401B3C9571039483589F2815F4794212B75C7C85CFEFE0AE71E9"
Last-Modified: Wed, 22 Mar 2023 14:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16086
Expires: Thu, 23 Mar 2023 15:24:13 GMT
Date: Thu, 23 Mar 2023 10:56:07 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "D93D50C523C7F735987ABA09DB628259441EB75EFE713A2DF3C214E1FB8B5171"
Last-Modified: Wed, 22 Mar 2023 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4194
Expires: Thu, 23 Mar 2023 12:06:01 GMT
Date: Thu, 23 Mar 2023 10:56:07 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Backoff, Alert
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 23 Mar 2023 10:27:32 GMT
age: 1715
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    bc86ef2a0cee04915bc360f5821adc8f
Sha1:   3658f9028cce204d38f7f48fcfaa2a8e4f54383a
Sha256: aeecd718d03811322457de4f20828bdba86b277e7e0e328cae9c0a8075638454
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "EA7838393D83805A7B8A2B01BD09E4423617C4DA285B983A11E9BA36266810D5"
Last-Modified: Wed, 22 Mar 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2514
Expires: Thu, 23 Mar 2023 11:38:01 GMT
Date: Thu, 23 Mar 2023 10:56:07 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-04-30-16-53-14.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        
                                             34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                            
x-amz-id-2: zKXPJl60t2Qkgft5P+24AplJh6HSufJFJkvpPp2sGq1ntf76wNsFnWymPcSHuY6mH+wMJUuRIwM=
x-amz-request-id: 6GQAFJR9Q1MXK6RA
x-amz-server-side-encryption: AES256
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 23 Mar 2023 10:54:01 GMT
age: 126
last-modified: Sat, 11 Mar 2023 16:53:15 GMT
etag: "e7bace7c1e04d44012e37ddffe36e5d5"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    e7bace7c1e04d44012e37ddffe36e5d5
Sha1:   3ac8d7c0a9d3e3f0b28b2530c7b8d8407b4042c2
Sha256: 6b4f80f2e95b26f6122ea8dcd0ef8d762299be822c69e839fc37581ca2bcb5f2
                                        
                                            GET /verfolgung/tracking.php?id=4087523&page=370 HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        
                                             157.230.242.66
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:07 GMT
Content-Length: 169
Connection: keep-alive
Location: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   169
Md5:    0f952b73d3f5586637ea9a5a789d48f4
Sha1:   b29aff4ffa1d4decd77db5160f920e1c6417e5e9
Sha256: 69d11528ee32902d0c47ed215877f0610399536f755db03ed02a77ecedd74751

urlquery:
  - Phishing - DHL
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                            
server: nginx
date: Thu, 23 Mar 2023 10:56:07 GMT
content-length: 12
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                            
access-control-allow-origin: *
access-control-expose-headers: ETag, Last-Modified, Retry-After, Content-Length, Alert, Cache-Control, Expires, Content-Type, Backoff, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 23 Mar 2023 10:17:23 GMT
age: 2324
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "26F2BD08BCCFF0B44D418D2A6EA721D3AD166831697065C9A6A2309C425699DA"
Last-Modified: Thu, 23 Mar 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14275
Expires: Thu, 23 Mar 2023 14:54:02 GMT
Date: Thu, 23 Mar 2023 10:56:07 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "B6129B9D1848F75265DCA4446C5399927BDAF15C7B49C083765847B0FE276EAF"
Last-Modified: Wed, 22 Mar 2023 06:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17883
Expires: Thu, 23 Mar 2023 15:54:10 GMT
Date: Thu, 23 Mar 2023 10:56:07 GMT
Connection: keep-alive

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Vv639Q4Tt3bKtHCKo7lGfg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        
                                             52.36.246.241
HTTP/1.1 101 Switching Protocols
                                            
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: l5xpGttP+3FhgzrRIkQ5G1wNjnw=

                                        
                                            GET /verfolgung/tracking.php?id=4087523&page=370 HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:07 GMT
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1304), with CRLF line terminators
Size:   119922
Md5:    bc3141c8e30113983a5025aababf29ee
Sha1:   3330b7269d89ce30b5a7d97226939dc8a772c7b5
Sha256: 9aaea063d4b82d80fb36f37a1b8a83a661d5210106bf08b87f0c9c4cc229c177
                                        
                                            GET /verfolgung/js/jquery-1.12.2.min.js HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: application/javascript
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:08 GMT
Content-Length: 97244
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "17bdc-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (32029)
Size:   97244
Md5:    bdc2b7efb1faf219d65edfe253a103e9
Sha1:   4921529fc15b8133f2fe65b3bebf53d1e9ef8579
Sha256: 95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/css/6.css HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:08 GMT
Content-Length: 4271
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 09:18:34 GMT
ETag: "10af-5edcf4e772e80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   4271
Md5:    8eb7809b45d4079fbaa48175f64c7441
Sha1:   f865a99867d1eac58a575a518996ae2e9ca1de95
Sha256: 00d16054bb78393fecfbeff7eed0d44e005ebe51f034c838c1f69bdfddf40b01

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/css/3.css HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:08 GMT
Content-Length: 22046
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 09:05:56 GMT
ETag: "561e-5edcf21490500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with CRLF line terminators
Size:   22046
Md5:    c54f6668454402879168d2782296d35e
Sha1:   dd3c72855079f3d074cfe6fd500959874650c736
Sha256: d40a85d0988ad1b83645365ac9bd5ef15ed33517733d847317f86c6ea271ad32

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/css/5.css HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:08 GMT
Content-Length: 48507
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 09:05:56 GMT
ETag: "bd7b-5edcf21490500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (661), with CRLF line terminators
Size:   48507
Md5:    67f662870fef3deea83c75f68622a1e4
Sha1:   45bdedb38dca005081238b4cf80fa10c90778465
Sha256: 8fd91a16c9b120c1f43fecdb1d40a9adf7e6dc05b69c3261c342ea76ecc50c2d

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/css/2.css HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:08 GMT
Content-Length: 48503
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 09:05:56 GMT
ETag: "bd77-5edcf21490500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (661), with CRLF line terminators
Size:   48503
Md5:    68bb9d41de0ac82959f8f90c552e4948
Sha1:   fb4e7fd67a692ae70e6b3813fe7913f0c3800103
Sha256: a0879b822817892ccecb11bc4c475d4bf3aad5e03a37a49eae46dfbdcf9e8fb3

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/css/1.css HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: text/css
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:08 GMT
Content-Length: 53751
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 09:05:56 GMT
ETag: "d1f7-5edcf21490500"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines (23076), with CRLF line terminators
Size:   53751
Md5:    c773c2e44cb33bd02d04987a8017056b
Sha1:   af122938b5fab20abed2fd9df00af09e66294222
Sha256: a116a577d744fd0c240b7f1c1b3139cc0d61b953d36fe2b61506e379e9c8bc0a

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/rating-play-store.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 904
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "388-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (512)
Size:   904
Md5:    19a24c818ad0e0eab9418b77ff8e7c1c
Sha1:   3787691d98fd4b9f494664274a641226e33c1588
Sha256: a6b35b6b7cabb9d33c2e1d6afef2d5f546a2fd3912f5f3e96495cd64218b9251

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/dhl-official.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 2040
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "7f8-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (2040), with no line terminators
Size:   2040
Md5:    d5a053f0005dd58489a461f599b5a508
Sha1:   ba71dd77800ef3d410beb8282d790642bec8193b
Sha256: aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/amex.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 734
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "2de-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (565)
Size:   734
Md5:    1c003076f46fc215f19de22568f3b5a1
Sha1:   112caa9374e6c1d0f8325cdcf2bde5b073f0f1ad
Sha256: b64feafef2104c77f092f2bbfa526bad76e17fb053591284984e86a28ed721a2

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/paypal.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 3369
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "d29-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (3369), with no line terminators
Size:   3369
Md5:    4ac4e26be0277fab62f57835bca7ee1e
Sha1:   edef7e834db1d63bd5290adf1f0308522cced7e0
Sha256: 5e9402048b0efae8235057fc5db4276b0472c9a42c59c0b759e059ffbdafb32b

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/visa.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 4586
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "11ea-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1577)
Size:   4586
Md5:    09d8b96a0853e0bc8cec7c677c0da93b
Sha1:   a6aebdb9c339cac93762338353517b67e23f1903
Sha256: a60079ce89803190740ddcf6e03eace0492b8f73ec57ffb4132b72a9736b68fe

urlquery:
  - Phishing - DHL
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16600
Expires: Thu, 23 Mar 2023 15:32:49 GMT
Date: Thu, 23 Mar 2023 10:56:09 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16600
Expires: Thu, 23 Mar 2023 15:32:49 GMT
Date: Thu, 23 Mar 2023 10:56:09 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        
                                             23.33.119.27
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                            
Server: nginx
Content-Length: 503
ETag: "C8FF32C6809A506D4C656D3200DBFC6682C156C3DE0647D13AB8F07A6F9A38BA"
Last-Modified: Tue, 21 Mar 2023 15:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=16600
Expires: Thu, 23 Mar 2023 15:32:49 GMT
Date: Thu, 23 Mar 2023 10:56:09 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F26aea22c-e627-45d1-bce6-55eaa4acfd06.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 10816
x-amzn-requestid: 60a537d2-1b8a-4ae2-967c-a7e57c818cc6
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B9xY0EHqoAMFrrQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6415629e-1be08f9f3a13492717fdaa48;Sampled=0
x-amzn-remapped-date: Sat, 18 Mar 2023 07:05:02 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: vDHHtzyodFMqzVuaPCmaEfKrHTLjTL8d25c9PJjPXAdyN-SYJC1NGA==
via: 1.1 1b0911478686968732f973d6e5e31d10.cloudfront.net (CloudFront), 1.1 6ca7826fb0f4c565b1af9c7737725c48.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 22:58:21 GMT
age: 43068
etag: "ee683e481a4501d2ab8ca63d1426d6fab6f2b064"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   10816
Md5:    f3aa18378fc5715083fb26bd0d62f382
Sha1:   ee683e481a4501d2ab8ca63d1426d6fab6f2b064
Sha256: 8aade71c4b55f6a9daab28a05a90bcc3c6c01b700aa48d2f8ccdb1992fa5ee81
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F93c300c4-e707-428c-9ae5-d4699c20a7ef.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5950
x-amzn-requestid: ce85112e-428d-4ca1-9dac-1d6c8c6dc74a
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CKyF9EI3oAMFtyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641a96f2-05c5948d6f74948b1c67d68c;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 05:49:38 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: lnMR6Lh4T37cFhMwb1qXIxjoPBghVFOGUz7HTt65DegMaxlElZxfjQ==
via: 1.1 59456abf79b201034ab5c9cfef7355e2.cloudfront.net (CloudFront), 1.1 599f04a365a179d553682d476509c388.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:43:32 GMT
age: 56796
etag: "0917d2c376f8d2af2a436a33ce2bfe1cbdb8b239"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5950
Md5:    800c2662fd6ab8829a02b7d63084c38d
Sha1:   0917d2c376f8d2af2a436a33ce2bfe1cbdb8b239
Sha256: 76545e9f75dc558fdb7b54550934c7775318fb4150a9309f60e65d982d2e576e
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fea5d4e17-e42c-49fb-a54b-d7d97ad50ba4.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7083
x-amzn-requestid: 352ae6e5-476d-430b-adf0-84d4a739967b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B6fGcE1foAMFbRQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-64141228-7dc6c3cb72cd40965006ab76;Sampled=0
x-amzn-remapped-date: Fri, 17 Mar 2023 07:09:28 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: bgeeN4oUpN5wPo6UnQKqKTGDiuLWu-ioS9UtrO5a6m5SI7WyiRNLcA==
via: 1.1 4dde8ec6d6c12741888c2d3a059d4a2e.cloudfront.net (CloudFront), 1.1 6bdc2963c9ed59b475ec36c35e5932a4.cloudfront.net (CloudFront), 1.1 google
date: Thu, 23 Mar 2023 09:43:54 GMT
age: 4335
etag: "76213c7d5c759471ed3823888860f918ac7e8f13"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7083
Md5:    40d24dfcd9f0afe0e4077384f16cc494
Sha1:   76213c7d5c759471ed3823888860f918ac7e8f13
Sha256: fbbbef0498ddf14bc9b204273a3cd416c357dceed20339c3e8c64a16b0be3caf
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9024651c-3847-4a12-9650-405ea99fd1b9.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 5753
x-amzn-requestid: d2538544-4f4c-4de0-a438-a48642dd0f17
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CM8pDGqyIAMFwRQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641b74a0-339c26cd16208aae5c47dc2f;Sampled=0
x-amzn-remapped-date: Wed, 22 Mar 2023 21:35:28 GMT
x-amz-cf-pop: HIO52-P1, SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: VRd1F4m0DnPtGvICp20ib8dhdwJ_jxdVMJEHqA9CmvQB6USSEupsLA==
via: 1.1 4b800f7fa2c3fbb9f4f3c505b0df315e.cloudfront.net (CloudFront), 1.1 fec77e486350d1bd33f526a760d8b5a4.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 21:43:22 GMT
age: 47567
etag: "391c43d349b943ea9af4aa6e3b6910c07370ee78"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5753
Md5:    6f29db357e8536a4aeccdd3df67d3205
Sha1:   391c43d349b943ea9af4aa6e3b6910c07370ee78
Sha256: b0ee1cab104b785c33aca9f3caae8f9c1abd856af3cfe1603b2b7036727468ae
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F255e6a5a-97bb-4a35-8a48-4d120747a63c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 4000
x-amzn-requestid: 68dc01d7-3eed-48f6-8532-8efaa96cc1ec
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: CJpraEqyoAMFgNQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641a2315-3852cc8961365a560d1fa02f;Sampled=0
x-amzn-remapped-date: Tue, 21 Mar 2023 21:35:17 GMT
x-amz-cf-pop: SEA19-C1
x-cache: Hit from cloudfront
x-amz-cf-id: Ncagzm12kJaHQtYhhjUUhcfXVfbwMdonoNYqpK-QXEmLfyyENgFnFA==
via: 1.1 288c777a01e22425da9494dad7a69734.cloudfront.net (CloudFront), 1.1 42ef990e439ae115ff739f04e3945234.cloudfront.net (CloudFront), 1.1 google
date: Thu, 23 Mar 2023 02:49:25 GMT
age: 29204
etag: "b798268806dc2f79f033e5872676019faf0e0cc1"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4000
Md5:    85351059b67b0a42eda7e69a31b3b4b4
Sha1:   b798268806dc2f79f033e5872676019faf0e0cc1
Sha256: 86e163b7159b197d6358ab01333ac6da221de0ebe1c5da8d5cef2977d38625fe
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9a7546f8-3d34-4fb4-b63f-8e8098b48c30.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        
                                             34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                            
server: nginx
content-length: 7419
x-amzn-requestid: bc02abbe-706d-42af-b963-0163b07b87c9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: B9xbnE7OIAMFW2g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-641562b0-247606a3713a20d25cf83763;Sampled=0
x-amzn-remapped-date: Sat, 18 Mar 2023 07:05:20 GMT
x-amz-cf-pop: SEA19-C3
x-cache: Hit from cloudfront
x-amz-cf-id: 3hcFsEgTbzbZ7idbLT-fhzhzhO6nT7xNDgHvY4iF8Hd934YYbjviLA==
via: 1.1 4d7fa73f804f1c93f20cfc24c4b1266e.cloudfront.net (CloudFront), 1.1 618052a0d9c86c1a3bf663f82d041d1c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 22 Mar 2023 18:52:41 GMT
age: 57808
etag: "3518e8a18807209e94011806a96492e0d86ee9c9"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   7419
Md5:    f777f840a3fc7e500c57a7cbdf88f26d
Sha1:   3518e8a18807209e94011806a96492e0d86ee9c9
Sha256: 44aa32fa1bf15785a4dd8cd6184772fb268113cbf459f5f30a70ff5ca66c9e05
                                        
                                            GET /verfolgung/img/1.png HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/png
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 108508
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "1a7dc-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  PNG image data, 366 x 206, 8-bit/color RGB, non-interlaced\012- data
Size:   108508
Md5:    634c39f2a51e26d2ac85598a2103e16d
Sha1:   1badf4773207d7238f8808f1bd42e355dd4b3a01
Sha256: afcc3febb5b047b9f7d691e6e92c2239c2feee6cdb5e56a910e8a9e62387d430

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/fonts/delivery-rg.woff2 HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 33580
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "832c-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 33580, version 1.0\012- data
Size:   33580
Md5:    1a05a4d2566dc2490cae801e9d885ec6
Sha1:   2fae1307a017a9afe73d351cf15932e51dc57887
Sha256: 2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7

urlquery:
  - Phishing - DHL
                                        
                                            POST /verfolgung/phplib/ajax.php?id=4087523 HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 12
Origin: https://tracking.822684.tification.club
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Set-Cookie: PHPSESSID=f223sm4v93mtjjd8eu1ll333r3; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/fonts/delivery-bd.woff2 HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 33840
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "8430-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 33840, version 1.0\012- data
Size:   33840
Md5:    682ea1d6962cd47974cd715fa3b80b4a
Sha1:   94a563948862a70f4d1be0a3aebc3a9f7aa800a6
Sha256: 4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/sprite.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 41430
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "a1d6-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (28844), with CRLF line terminators
Size:   41430
Md5:    cebbc77896c22e29f2a223a9efe685e3
Sha1:   ab3e7dc74207c4bb1f45a712d334c3d3ef8bdce8
Sha256: 07908237900ec13b078abee11041a05af9a7c8930a9a0e1c7d85f2c5f8ca9425

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/icons-nepal.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 25893
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "6525-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (25753), with CRLF line terminators
Size:   25893
Md5:    953dd00cb38ca1767d1145caf35a035b
Sha1:   8510eeee5a546b92d2cb4413f065aa5d49d0bfdb
Sha256: 2691d1e5392f267802498adb1ddc58e4d8a95a5fc69de8380e0d4ae7850c2e1c

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/dhl-ssl-logo.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 4470
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "1176-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (403)
Size:   4470
Md5:    f0e3cb96921af370a3ce18d1a1ded9b9
Sha1:   1fedecbb71184bc23dfdac38ef5b27d31da7f420
Sha256: dc0fa4b8eaff05882b34c64260a6f630a3398a3a77584ef2ae6297ef10353578

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/mastercard.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 14915
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "3a43-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1435)
Size:   14915
Md5:    b81045f3a463d4aabc0a41fef3bc55ef
Sha1:   0cf6c882fac621b65b627cb39c3bbc9d669e20d3
Sha256: f4551892c81a15874332cfa9639f76a41356c9ed4ca79ff682c9114aeb12563e

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/fonts/delivery-cdblk.woff2 HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 36652
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "8f2c-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 36652, version 1.0\012- data
Size:   36652
Md5:    774e0efbb9da45395efa24c9ca4248de
Sha1:   04eab63ba86f912514fc0ea04b025b7f2df6145b
Sha256: ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/sepapay.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 12024
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "2ef8-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (12024), with no line terminators
Size:   12024
Md5:    176e69bbf00a8da5fe4921dbff1a30eb
Sha1:   384bbdee655135ef9a290f1365902ed6c9316969
Sha256: b1764022abfe9e716542e55a05b94b851e369cd75407474874a439c61f5bd982

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/icon-sprite.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 116511
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "1c71f-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Size:   116511
Md5:    a2f73421956e77814bc75b9f1ef7978c
Sha1:   76fff6b10243ee8b0d9f2b8c281e5023bef29816
Sha256: 616309a0321797f048d134f8c83c2ad6a94170f166093baa5fa6fd999461772e

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/giropay.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 2396
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "95c-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2396), with no line terminators
Size:   2396
Md5:    9b9e19be4be87ab5a0b96cd99754747e
Sha1:   edc3926e9431d362d794de7388fb4d78b156c4e8
Sha256: 2ef06fae9ac89777a220421e87980ef61b2a914e3eb1dec5b5c06a93531a9e38

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/img/dhl-group.svg HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:09 GMT
Content-Length: 8715
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "220b-5e8a4c3deea80"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (724)
Size:   8715
Md5:    56ceadc8919cd52c7b19d6bfd2ed1a96
Sha1:   5716fe99efb512515553b02fc4ca7f858aa5c980
Sha256: 55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114

urlquery:
  - Phishing - DHL
                                        
                                            GET /verfolgung/favicon.ico HTTP/1.1 
Host: tracking.822684.tification.club
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking.822684.tification.club/verfolgung/tracking.php?id=4087523&page=370
Cookie: PHPSESSID=f223sm4v93mtjjd8eu1ll333r3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

                                        
                                             157.230.242.66
HTTP/1.1 200 OK
Content-Type: image/vnd.microsoft.icon
                                            
Server: nginx/1.20.1
Date: Thu, 23 Mar 2023 10:56:10 GMT
Content-Length: 7406
Connection: keep-alive
Last-Modified: Sat, 29 Oct 2022 02:03:10 GMT
ETag: "1cee-5ec22c6afb380"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel\012- data
Size:   7406
Md5:    bbba65f5c0e656750df8c649749447c8
Sha1:   107d1dc536e768776a10d20b362e253ec684832a
Sha256: c4caa8b38ca6962dfeaa34445597ba59d691d60633f4dda63630f27738c06497

urlquery:
  - Phishing - DHL