Report - helpdesk.randevupanzio.ro/public/3bLv7ZWDp2DWbfXCkpFa982WqUTMHnsJ

Report Overview

Submitted URL
helpdesk.randevupanzio.ro/public/3bLv7ZWDp2DWbfXCkpFa982WqUTMHnsJ
IP
89.35.204.123
ASN
#20616 H88 Web Hosting S.r.l.
Submitted
2023-01-28 14:29:08
Access
Website Title
Final URL
Tags
dhl logistics phishing
urlquery detections
Phishing - DHL

Detections

urlquery
14
Network Intrusion Detection
1
Threat Detection Systems
52

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
ka-f.fontawesome.com	3598	2019-12-17T07:36:13Z	2023-03-13T05:10:17Z	1.9 kB	348 kB	172.64.169.22
r.lr-in.com	16828	2021-07-27T15:26:50Z	2023-03-13T05:28:10Z	567 B	837 B	104.198.23.205
helpdesk.randevupanzio.ro	unknown	2022-12-30T10:36:17Z	2023-03-12T14:32:21Z	24 kB	2.2 MB	89.35.204.123
ws-mt1.pusher.com	8253	2018-09-20T13:30:02Z	2023-03-13T07:20:47Z	540 B	186 B	52.0.113.204
kit.fontawesome.com	1868	2019-12-16T20:51:31Z	2023-03-13T05:10:17Z	416 B	650 B	104.18.22.52
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.8 kB	34.160.144.191
cdnjs.cloudflare.com	235	2015-04-17T22:46:33Z	2023-03-13T05:09:21Z	952 B	85 kB	104.17.25.14
killbot.org	unknown	2014-03-26T14:15:40Z	2023-03-13T03:31:53Z	1.1 kB	4.5 kB	172.67.166.105
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	3.0 kB	8.0 kB	23.36.77.32
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	52.27.19.5
ocsp.digicert.com	86	2012-05-21T09:02:23Z	2023-03-13T06:00:13Z	682 B	1.3 kB	93.184.220.29
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	48 kB	34.120.237.76
static.hotjar.com	641	2014-11-01T06:14:27Z	2023-03-13T05:12:51Z	386 B	112 kB	54.230.111.39

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-01-28 14:29:03	high	89.35.204.123	Client IP	ET EXPLOIT_KIT TDS Sutra - page redirecting to a SutraTDS

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.
2023-01-28	medium	helpdesk.randevupanzio.ro/	DHL Airways, Inc.

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-01-28	medium	helpdesk.randevupanzio.ro/public/3bLv7ZWDp2DWbfXCkpFa982WqUTMHnsJ	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/public	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/public/	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/L2z1vWRJXQv1UCIzEI049PGMNACYej04/	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/public/js/session-recorder.js	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/public/js/app.js	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.woff2?1551f4f60c37af51121f106501f69b80	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/fonts/vendor/@fontsource/roboto/files/roboto-all-400-normal.woff?376ea5d93f71583052f65de4e0c6a92c	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-brands-400.woff?2285773e6b4b172f07d9b777c81b0775	Phishing
2023-01-28	medium	helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.ttf?be9ee23c0c6390141475d519c2c5fb8f	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (11)

	URL	Size	First Seen	Last Seen
	helpdesk.randevupanzio.ro/public/	214 B	2023-03-13	2023-03-13
Pretty URL helpdesk.randevupanzio.ro/public/ IP 89.35.204.123 ASN #20616 H88 Web Hosting S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 09:08:36 Last Seen2023-03-13 18:09:50 Times Seen1 Hash b6ecea27f7d0f66013aa8298d5c13321 6d46bd5a05aedfc0015d8211dea4bc5d73808aae 882edc75f4a585da3518be1fe71dd8f724de342722703bdd93d843ebed86c7c3 Loading...

	helpdesk.randevupanzio.ro/public/	135 B	2023-03-13	2023-03-13
Pretty URL helpdesk.randevupanzio.ro/public/ IP 89.35.204.123 ASN #20616 H88 Web Hosting S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 09:50:52 Last Seen2023-03-13 09:50:52 Times Seen1 Hash 194610fd41f185a49838bac2f75ecf8f 745bc174844da8f7256a15dce86273e40fee4983 3dada573a67078e3017b4fce46ca31914337800c6c296ea7f2c00371a1acc89d Loading...

	kit.fontawesome.com/f7165dd215.js	11 kB	2023-03-08	2023-03-18
Pretty URL kit.fontawesome.com/f7165dd215.js IP 104.18.22.52 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 14:24:23 Last Seen2023-03-18 03:33:30 Times Seen1 Hash e5056bb4f9e1612bdf780e2ffb0f97a5 c471728fa07baccc5201a31687c0e745d933554c da3060b6585615d3c5886f83d756e8c61eb6de3520b8868bd986261b800f9314 Loading...

	helpdesk.randevupanzio.ro/public/js/session-recorder.js	45 kB	2023-03-07	2024-05-06
Pretty URL helpdesk.randevupanzio.ro/public/js/session-recorder.js IP 89.35.204.123 ASN #20616 H88 Web Hosting S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:20:33 Last Seen2024-05-06 08:43:28 Times Seen21888 Hash 701984b4995f3c29820e83c999b7eb23 a3b50104a3bfa05bf59a317273816c7d8ae1f81d 67ad94e12a745b1b09c6cd616e20a2ad283ed68f8060bd1dd0d9a2b6ad9dc7ee Loading...

	cdn.lr-in.com/logger-1.min.js	821 kB	2023-03-13	2023-03-13
Pretty URL cdn.lr-in.com/logger-1.min.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 09:00:33 Last Seen2023-03-13 12:34:16 Times Seen1 Hash 4785fb3bc6f80849e54195c813deb8c2 73962c96b311f04507038215195ee38a61eaf47f 88cc0d1193a0c09e9cbc5b22ad028a61774379390908f6cf9ab7b57e395c050a Loading...

	static.hotjar.com/c/hotjar-2895475.js?sv=6	9.3 kB	2023-03-13	2023-03-13
Pretty URL static.hotjar.com/c/hotjar-2895475.js?sv=6 IP 54.230.111.39 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 09:50:52 Last Seen2023-03-13 09:50:52 Times Seen1 Hash 0faac68a2f16f94aa99e02cb3459d358 091f5bf0d7c5e7e9b89fa4bd7adddab14e189f91 0e5eb0045e86ceb7e5d4dd59add6892bbdcea83d656836005d25fd8d4e525485 Loading...

	cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js	2.7 kB	2023-03-07	2024-04-06
Pretty URL cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 13:54:49 Last Seen2024-04-06 06:20:41 Times Seen447 Hash a652ab92584024571b6ea0f3255eb380 9266ee9ab680b63d7205d6bc65b9767513d162a5 a8831773f69697c641e349c519d162ad5afe58cc583703d96f98a79d29087ef1 Loading...

	helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04	551 B	2023-03-13	2023-03-13
Pretty URL helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04 IP 89.35.204.123 ASN #20616 H88 Web Hosting S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 09:50:52 Last Seen2023-03-13 09:50:52 Times Seen1 Hash 6f45465bf78dd6db6afefb9b1addf57e 119df0af7e1a26febb2453a0b22088bef68b0151 3aebff38ce297b72d3107b3d6281b03891b3be7bb6ff5abac886882c302e7131 Loading...

	helpdesk.randevupanzio.ro/public/js/app.js	1.6 MB	2023-03-07	2024-05-06
Pretty URL helpdesk.randevupanzio.ro/public/js/app.js IP 89.35.204.123 ASN #20616 H88 Web Hosting S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:06:51 Last Seen2024-05-06 08:43:28 Times Seen13887 Hash fd900f643203761f2eeca2132fc15f1d 375f23ca9ad75b647373bda03b02e2d0f6e729be 399e233cea4e5468820e5c5f98ddbb156de729983710cf576a6508f076326c68 Loading...

	helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04	391 B	2023-03-07	2024-05-06
Pretty URL helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04 IP 89.35.204.123 ASN #20616 H88 Web Hosting S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 15:24:49 Last Seen2024-05-06 05:48:36 Times Seen2265 Hash 80de9b2b722e432581322cc3c51a88f1 48ea5d8c88c33cece64863a14ba87f02f8094436 de4565f7ec2b50b5adfee37223556a4c0cb911cb4fa1057942646ee83e51051e Loading...

	helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04	499 B	2023-03-13	2023-03-13
Pretty URL helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04 IP 89.35.204.123 ASN #20616 H88 Web Hosting S.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 09:50:52 Last Seen2023-03-13 09:50:52 Times Seen1 Hash 108692921e2ceb16380693ed2a741ed8 8390cd08dd4184014af21a961ebefdcf9e55404a b9d564676daad15ae03ea5ff6d6ee12eaf8a38527fac5f9039319bc03ff97a5d Loading...

HTTP Transactions (52)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
a2104f935c638b4767ca5ae0d738ef23
85c6af15af749be0ceeae6de17c36925b750f166
5d4789a3696bd7faa9916768cb627bbc89bf70a756d80e53860cbac13c2bc8b1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "5D4789A3696BD7FAA9916768CB627BBC89BF70A756D80E53860CBAC13C2BC8B1"
Last-Modified: Fri, 27 Jan 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7692
Expires: Sat, 28 Jan 2023 16:37:09 GMT
Date: Sat, 28 Jan 2023 14:28:57 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2405562765b49b2782ebd2e2994851d5
be7ac8e558f7875bb1fb86ab5ec674424a5ff269
422cfa907461cb7b93b9089d600052f9e94951e5e0c93d97651905002e48ad3e

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "422CFA907461CB7B93B9089D600052F9E94951E5E0C93D97651905002E48AD3E"
Last-Modified: Thu, 26 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11109
Expires: Sat, 28 Jan 2023 17:34:06 GMT
Date: Sat, 28 Jan 2023 14:28:57 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
dcd75ca6daca51c5e39d431468511793
07f76d3bf23d65c9110d810fa71a994e39e085d3
73672a816da4450fe2c938b08d7ae002d9ca29fdcbd3e29cc97084d826f8b459

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Retry-After, Content-Type, Content-Length, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 28 Jan 2023 13:43:05 GMT
content-type: application/json
age: 2752
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
69f73ac59327cd9ad7d99816ccfcc03e
c54844f82dbee0d5ee4c8ce344eb0139373e6c6b
e81c685b2d8f0e31b89e5cfc911a2c5a99a556646830ac5a8468d991b5e871a3

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E81C685B2D8F0E31B89E5CFC911A2C5A99A556646830AC5A8468D991B5E871A3"
Last-Modified: Thu, 26 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5197
Expires: Sat, 28 Jan 2023 15:55:34 GMT
Date: Sat, 28 Jan 2023 14:28:57 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: bMNlIMGRExAi9dfE5sQQ5cg/bUOjWVzjjkJY66jV1quQ/BKUq2Xw3X1tE8oeeFyk5BM2h/4JCyY=
x-amz-request-id: Q0C0KSWB161E25ER
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 28 Jan 2023 14:21:00 GMT
age: 477
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Sat, 28 Jan 2023 14:28:57 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Last-Modified, ETag, Expires, Backoff, Content-Length, Cache-Control, Alert, Retry-After, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 28 Jan 2023 13:41:40 GMT
age: 2837
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

helpdesk.randevupanzio.ro/public/3bLv7ZWDp2DWbfXCkpFa982WqUTMHnsJ

89.35.204.123

302 Found

402 B

URL HTTP/1.1
helpdesk.randevupanzio.ro/public/3bLv7ZWDp2DWbfXCkpFa982WqUTMHnsJ
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
402 B (402 bytes)
Hash
c7e2b93b8b57f8ec7abdc5562b1df370
b5366062dfeb8944f9a3adc6c3ef8cbc2e1ab967
eadfb206e403a9fa125e8e899f640bbcf15714ea9610b3799d1833457a7cfc7a

Detections

Analyzer	Verdict	Alert
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /public/3bLv7ZWDp2DWbfXCkpFa982WqUTMHnsJ HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkRQcHNmOWttTWovaDZxU0RxdWoxR2c9PSIsInZhbHVlIjoiZ1pEQ3dtd2dSMCtZMyt3TDlpZzA5L3FkVFVkaHlrY28zWS9ZRGZOT1ZLOS80VU5vWkN1TzRkS1h6azFhaVFETStGelZJZTZtSWJteGE2V0ZIRCtMUzVMV1VQbWdPUUYrZUJVQkQrdkorU1l4S0tuUHh5d29KMUFqaGMyL3NCMFAiLCJtYWMiOiIyNTM3YzZkZDk1NGJkNzkyYjdkNWY5NTM5ZGExZGJjYTMxNjVkMDY3YWNjM2MxNjYxYmU2MjFjYjBmNjdmMWQ2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ikx1a1R0NVVpRzJMMDAxbUFvclJ0RkE9PSIsInZhbHVlIjoiVEZBZG1kc2xTeTlwMVY0cHBLa241YnY0UWd1TENBMkJHWVRLWHllK2tCWXQ1Q1NiZjl6WS9zemNmb1VrVG9RMjdkVTRzL2dxcDRzY0FJamRheTFMZXpPbXhjUXUvNHJUOE90NFhuYlF1S1YrU1h0eGJocHI5b3Vld0Rvb0FhRzkiLCJtYWMiOiJkMmZlZTgyNTRjMTVjZTk1MzI1MTJlZGRlMGRjNWM2YzYyYTI2OGFmNGVlYTBlOTNjMTU4MmIxNzVjZTc2OWYxIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}
Upgrade-Insecure-Requests: 1

HTTP/1.1 302 Found
Server: nginx
Date: Sat, 28 Jan 2023 14:27:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6Ii80Qklmd3ZONDJzYjJmMUlERFNWeXc9PSIsInZhbHVlIjoiSlpxc3E3TnBpdVExNlBqNHR1VzZqNUhvYVNBK2ljVjQ5UGZYL0ZuaWdlLzVMVzdUTHk1Wjh3dTVqT3NFTjdwUTgrcTIrRy9mMVhnMU1aWS9Zb05SeVhvckNXMHYwY0xZalBRS0FQTEE5cHZ3WTNsMUlrRXBkYXVLaFl2Wk5PYjAiLCJtYWMiOiIwZmVkNjM1YjdjMmYyZjQ5YTA0OTYxZDM4ZTgxNGMyMTQwOWIyY2U0ODQ1YzUzNTA0ZDc5ZTUxYzU2YmJiOTU5IiwidGFnIjoiIn0%3D; expires=Sat, 28-Jan-2023 16:27:37 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6Iis3WGIzbUoxNkNIaXpCSkNKT2VRakE9PSIsInZhbHVlIjoiSzdRdEVEUVB3OUY1NWlTNkhTNG1zU0NkdVY4cjFURlp3azBSRUJ4T3lUUnNTQ2FTVStYZ0t1amg1ektNQzNOd0x0aTN3ODJ6dS9tZnByZ2IxbXE4UGVXMExnclozekhLUTFJcFdWQm9iN0QyeGQrOHBSMmVqM3NpZlVtaWFSUUsiLCJtYWMiOiJiZGE2YTdlNzhiZjc2MjQzYWEwYTFiYzEzNjRmMzdjOTU4ZjdhMDFmNjgxZGQ0YjgyOGVkMDI3YjRkNjI4NjAwIiwidGFnIjoiIn0%3D; expires=Sat, 28-Jan-2023 16:27:37 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Location: http://helpdesk.randevupanzio.ro/public

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
16a7b6a7128312e2f985d30df18c4487
6017bff79ffb525d9c7f9f32b999b74b5dc69602
663fd12209627f08e759c2ed1c76278a5da79dae1e0b46082dd1bb44775f7a16

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "663FD12209627F08E759C2ED1C76278A5DA79DAE1E0B46082DD1BB44775F7A16"
Last-Modified: Fri, 27 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9528
Expires: Sat, 28 Jan 2023 17:07:46 GMT
Date: Sat, 28 Jan 2023 14:28:58 GMT
Connection: keep-alive

helpdesk.randevupanzio.ro/public

89.35.204.123

301 Moved Permanently

248 B

URL HTTP/1.1
helpdesk.randevupanzio.ro/public
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
248 B (248 bytes)
Hash
e27c781319443fad5fb4666d6211e2f8
1f3badd9f5f5d30f318072544ff3fd694f799a3e
24c2f56cce8a7a344840ce98dc465dd7d61758690d1485d47717c608fd60f750

Detections

Analyzer	Verdict	Alert
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /public HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ii80Qklmd3ZONDJzYjJmMUlERFNWeXc9PSIsInZhbHVlIjoiSlpxc3E3TnBpdVExNlBqNHR1VzZqNUhvYVNBK2ljVjQ5UGZYL0ZuaWdlLzVMVzdUTHk1Wjh3dTVqT3NFTjdwUTgrcTIrRy9mMVhnMU1aWS9Zb05SeVhvckNXMHYwY0xZalBRS0FQTEE5cHZ3WTNsMUlrRXBkYXVLaFl2Wk5PYjAiLCJtYWMiOiIwZmVkNjM1YjdjMmYyZjQ5YTA0OTYxZDM4ZTgxNGMyMTQwOWIyY2U0ODQ1YzUzNTA0ZDc5ZTUxYzU2YmJiOTU5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Iis3WGIzbUoxNkNIaXpCSkNKT2VRakE9PSIsInZhbHVlIjoiSzdRdEVEUVB3OUY1NWlTNkhTNG1zU0NkdVY4cjFURlp3azBSRUJ4T3lUUnNTQ2FTVStYZ0t1amg1ektNQzNOd0x0aTN3ODJ6dS9tZnByZ2IxbXE4UGVXMExnclozekhLUTFJcFdWQm9iN0QyeGQrOHBSMmVqM3NpZlVtaWFSUUsiLCJtYWMiOiJiZGE2YTdlNzhiZjc2MjQzYWEwYTFiYzEzNjRmMzdjOTU4ZjdhMDFmNjgxZGQ0YjgyOGVkMDI3YjRkNjI4NjAwIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 28 Jan 2023 14:27:37 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 248
Connection: keep-alive
Location: http://helpdesk.randevupanzio.ro/public/

push.services.mozilla.com/

52.27.19.5

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.27.19.5:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 5bmMCmWSC2vsO3KjZxpg9w==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: ZiJbda0PVJroiRGse8mUvYWdvpU=

helpdesk.randevupanzio.ro/public/

89.35.204.123

200 OK

558 B

URL HTTP/1.1
helpdesk.randevupanzio.ro/public/
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text
Size
558 B (558 bytes)
Hash
66a3be83f13f1b09d6360bc2030a72b8
5620d75398201520bedf714c248a1104e0b6ee54
a32dbc16fd9b87239b2c540e0df077797694783c7108c288b66e1893126f47e0

Detections

Analyzer	Verdict	Alert
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /public/ HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ii80Qklmd3ZONDJzYjJmMUlERFNWeXc9PSIsInZhbHVlIjoiSlpxc3E3TnBpdVExNlBqNHR1VzZqNUhvYVNBK2ljVjQ5UGZYL0ZuaWdlLzVMVzdUTHk1Wjh3dTVqT3NFTjdwUTgrcTIrRy9mMVhnMU1aWS9Zb05SeVhvckNXMHYwY0xZalBRS0FQTEE5cHZ3WTNsMUlrRXBkYXVLaFl2Wk5PYjAiLCJtYWMiOiIwZmVkNjM1YjdjMmYyZjQ5YTA0OTYxZDM4ZTgxNGMyMTQwOWIyY2U0ODQ1YzUzNTA0ZDc5ZTUxYzU2YmJiOTU5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Iis3WGIzbUoxNkNIaXpCSkNKT2VRakE9PSIsInZhbHVlIjoiSzdRdEVEUVB3OUY1NWlTNkhTNG1zU0NkdVY4cjFURlp3azBSRUJ4T3lUUnNTQ2FTVStYZ0t1amg1ektNQzNOd0x0aTN3ODJ6dS9tZnByZ2IxbXE4UGVXMExnclozekhLUTFJcFdWQm9iN0QyeGQrOHBSMmVqM3NpZlVtaWFSUUsiLCJtYWMiOiJiZGE2YTdlNzhiZjc2MjQzYWEwYTFiYzEzNjRmMzdjOTU4ZjdhMDFmNjgxZGQ0YjgyOGVkMDI3YjRkNjI4NjAwIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 14:27:39 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 558
Connection: keep-alive
Cache-Control: no-cache, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6ImNyR2JIMEJ5OXM2VlJtSmhBV05hSmc9PSIsInZhbHVlIjoibEcyODl0QmRQYlF2RzZjUVNzakRHaWVMVU1MYmJFNVJ3UXhzUUdVaFZvWG9qWSswMlc2WmRPSDZSQW5adGxtN1lOYnRUcHQ2Y08rUSszbmZFdjV1MmxjY0R2MU8yVitGODVla3hvaEdGY2VCaW0xcUEwVkFFOWM3V3VDTFE5R2siLCJtYWMiOiI4MTAxZWJiNTRlZTFiZTVkZjdhMzMzYTZkOWMzOGY0ZTI4MjE4YmI5MWY2ZGM0NmRiMmUwMmFlOGUwMzRiOTdkIiwidGFnIjoiIn0%3D; expires=Sat, 28-Jan-2023 16:27:39 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6ImRjV29DQ1ZxVDlTRENTK1k3SlJFelE9PSIsInZhbHVlIjoiK0FnWlg5UTFWYXhlWmlwbVNtYkJ0UGw3SjV4MHBOVFU5ZGU4M3NvUlpkdDJuZVcwenpMaGhwNGZtL1YzdXRiRGd5SW1meStLOFhGdlllNTZVRnM3TVZ2cTk2VGdYQnpYczNBekxjcmYrRTY4RHc3T0hCMGJxSEY3c09EQ3ZORVUiLCJtYWMiOiI2ODNkNDcyZGVlYWVjZTcxYzk0ZTdkZTg3MzQ5ZjYyMjk0OTEwODQ0Y2NiODk5MzY1YWMzOGFiNGZkY2RkNjFkIiwidGFnIjoiIn0%3D; expires=Sat, 28-Jan-2023 16:27:39 GMT; Max-Age=7200; path=/; httponly; samesite=lax

ocsp.digicert.com/

93.184.220.29

200 OK

280 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
280 B (280 bytes)
Hash
e49323565051e208f7cbd172dce8c355
036e42fe97d04b991cb7f9b3bdd3ce34a0860216
d6aa3832c4fd9e9128138a2eab69963e705f2c1dd41e4b9446081b43b08260cf

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3977
Cache-Control: max-age=101280
Content-Type: application/ocsp-response
Date: Sat, 28 Jan 2023 14:28:59 GMT
Etag: "63d40a42-118"
Expires: Sun, 29 Jan 2023 18:36:59 GMT
Last-Modified: Fri, 27 Jan 2023 17:30:42 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 280

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2e21811f62c077f45a93d7c3b543998d
3e890a73bb51d9dd1021d5339271aa40833ba258
c6b77371a50390fd68d44ff05e080f064c16c3095df8856b330ab0c6685cd3d1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C6B77371A50390FD68D44FF05E080F064C16C3095DF8856B330AB0C6685CD3D1"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5403
Expires: Sat, 28 Jan 2023 15:59:02 GMT
Date: Sat, 28 Jan 2023 14:28:59 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2e21811f62c077f45a93d7c3b543998d
3e890a73bb51d9dd1021d5339271aa40833ba258
c6b77371a50390fd68d44ff05e080f064c16c3095df8856b330ab0c6685cd3d1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C6B77371A50390FD68D44FF05E080F064C16C3095DF8856B330AB0C6685CD3D1"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5403
Expires: Sat, 28 Jan 2023 15:59:02 GMT
Date: Sat, 28 Jan 2023 14:28:59 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2e21811f62c077f45a93d7c3b543998d
3e890a73bb51d9dd1021d5339271aa40833ba258
c6b77371a50390fd68d44ff05e080f064c16c3095df8856b330ab0c6685cd3d1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C6B77371A50390FD68D44FF05E080F064C16C3095DF8856B330AB0C6685CD3D1"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5403
Expires: Sat, 28 Jan 2023 15:59:02 GMT
Date: Sat, 28 Jan 2023 14:28:59 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
2e21811f62c077f45a93d7c3b543998d
3e890a73bb51d9dd1021d5339271aa40833ba258
c6b77371a50390fd68d44ff05e080f064c16c3095df8856b330ab0c6685cd3d1

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C6B77371A50390FD68D44FF05E080F064C16C3095DF8856B330AB0C6685CD3D1"
Last-Modified: Thu, 26 Jan 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5403
Expires: Sat, 28 Jan 2023 15:59:02 GMT
Date: Sat, 28 Jan 2023 14:28:59 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fddac8c39-e94f-40c1-bf35-4a70c575efbe.jpeg

34.120.237.76

200 OK

7.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fddac8c39-e94f-40c1-bf35-4a70c575efbe.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.8 kB (7819 bytes)
Hash
6a40be482a56db1e4d48ba4a8cf515ba
da9c7255d5840c025526c6c24354750d9ba3a4ef
fa0bfe56b97ce5cf450e4799db2fe6d5645553b71d1e2bd928df0278a81a33c8

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fddac8c39-e94f-40c1-bf35-4a70c575efbe.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7819
x-amzn-requestid: b9c17e9a-8da5-4736-a8bc-ea430feaef8d
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_diGfbIAMFX2g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d445f0-695dd291002d9cc425df0edc;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:45:20 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: Gf-xQLbrbbXCRM8Q720PrSNSrvoelOoNlqbKwfiZHNIKCD_59TARLQ==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 556b99c6be8d7078b9f067347c62df6a.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 22:03:06 GMT
etag: "da9c7255d5840c025526c6c24354750d9ba3a4ef"
content-type: image/jpeg
age: 59153
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

4.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
4.5 kB (4475 bytes)
Hash
4205d8106659e00fff1cbe9262918b8c
ab4f6528594a1725934727dc7d834c028a79c609
31f1a28602a194bd0856495d4d81d5c72cd7ff4e5bad6bdd1a31ec3041f4a2cc

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5f0097a6-af00-4a1c-8faa-f9516e27b31a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 4475
x-amzn-requestid: b7b272d6-3089-4f33-89b5-5cb388640e10
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_e6HsaIAMF5Lg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d445f8-1789f7f4264270916da323db;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:45:28 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: hAzO-IMqc1CFpiBAlRl8seIYL9UonyrBMATibovyFq5kEuaweY_VyA==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:56:46 GMT
age: 59533
etag: "ab4f6528594a1725934727dc7d834c028a79c609"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

helpdesk.randevupanzio.ro/L2z1vWRJXQv1UCIzEI049PGMNACYej04/

89.35.204.123

301 Moved Permanently

280 B

URL HTTP/1.1
helpdesk.randevupanzio.ro/L2z1vWRJXQv1UCIzEI049PGMNACYej04/
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
280 B (280 bytes)
Hash
b5dac0ed9d86c1261e6a17eb07253972
766d09d36b360cf405f99bb2c0e22f58c1d7c252
db31b1e177a3c0ba448412758a00c71ba9da64ce669ec1805263de2dc3afa0ab

Detections

Analyzer	Verdict	Alert
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /L2z1vWRJXQv1UCIzEI049PGMNACYej04/ HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/
Cookie: XSRF-TOKEN=eyJpdiI6ImNyR2JIMEJ5OXM2VlJtSmhBV05hSmc9PSIsInZhbHVlIjoibEcyODl0QmRQYlF2RzZjUVNzakRHaWVMVU1MYmJFNVJ3UXhzUUdVaFZvWG9qWSswMlc2WmRPSDZSQW5adGxtN1lOYnRUcHQ2Y08rUSszbmZFdjV1MmxjY0R2MU8yVitGODVla3hvaEdGY2VCaW0xcUEwVkFFOWM3V3VDTFE5R2siLCJtYWMiOiI4MTAxZWJiNTRlZTFiZTVkZjdhMzMzYTZkOWMzOGY0ZTI4MjE4YmI5MWY2ZGM0NmRiMmUwMmFlOGUwMzRiOTdkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImRjV29DQ1ZxVDlTRENTK1k3SlJFelE9PSIsInZhbHVlIjoiK0FnWlg5UTFWYXhlWmlwbVNtYkJ0UGw3SjV4MHBOVFU5ZGU4M3NvUlpkdDJuZVcwenpMaGhwNGZtL1YzdXRiRGd5SW1meStLOFhGdlllNTZVRnM3TVZ2cTk2VGdYQnpYczNBekxjcmYrRTY4RHc3T0hCMGJxSEY3c09EQ3ZORVUiLCJtYWMiOiI2ODNkNDcyZGVlYWVjZTcxYzk0ZTdkZTg3MzQ5ZjYyMjk0OTEwODQ0Y2NiODk5MzY1YWMzOGFiNGZkY2RkNjFkIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 28 Jan 2023 14:27:39 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 280
Connection: keep-alive
Location: http://helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04

34.120.237.76

200 OK

7.4 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5fb39717-4b7d-45c4-b211-c2990bf99811.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.4 kB (7395 bytes)
Hash
3b5b797e164d0f2c91200829d1ec90f8
15a55176d8e55b6816acabae5c7cc3e4528648c9
16eb29148856512f556b22b86a153e54032caaf98dbf141119f8c126e009591f

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F5fb39717-4b7d-45c4-b211-c2990bf99811.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7395
x-amzn-requestid: 166e5623-fc91-4b12-80c8-f5e1a762b387
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa-ELH3eIAMF56w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d443b4-439b5d2b67b9347d4d634d9d;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:35:48 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: L1BWTWAPsW5tfkJO0UBR4dKoW3_0Le7QhZLjBxtsY0fmf7cwEYWrMQ==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:49:07 GMT
age: 59992
etag: "15a55176d8e55b6816acabae5c7cc3e4528648c9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.0 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0cadb8fa-5527-46cd-92dd-6316ac84a7d5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.0 kB (7028 bytes)
Hash
57b73886cbbb719eda5f733c018eedfb
b84ed40973f8a0d3c10529e34f9466746cfdaf0c
4ba11c23e0bbd2aed53b04ad0b3d22161af1971ddcfb75ae55734de9a49af207

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0cadb8fa-5527-46cd-92dd-6316ac84a7d5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7028
x-amzn-requestid: c1743fed-205a-431b-8648-474facde6d09
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa-CwFtboAMF9rg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d443ab-5b94864c707c42fc36fbc63a;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:35:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 7LUa_R8g8Rlv7JJA0_okht-vGe-xBSyZ5TPJTFakAHlncQPZKEdULQ==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 d6b180eb367f7de26d67a9f3901b96a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 21:48:58 GMT
age: 60001
etag: "b84ed40973f8a0d3c10529e34f9466746cfdaf0c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.6 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.6 kB (7585 bytes)
Hash
ea24bcba583bd8bd139559448a343e68
b9d37c2b14f890d41983a59f352e8f7caa9c94bb
e5ef5975eec964ae1684deb424f00833f2d217bdc7e6c385320ed3adeb6bc1c4

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F22cc3f55-9811-4ec2-a57e-a3e71a3f0554.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7585
x-amzn-requestid: bfb52acb-e0d7-482d-8be9-be5db1c16cac
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fa_vkE5roAMF0Hw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d44663-2d38d314177e0ac40d4c8240;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 21:47:15 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: K9YWM9eaEc1DQ6wtEEuADnG1U-ahRBXDaiHIAm20dkWMOxPWBlJidw==
via: 1.1 c34da255183aa208dd1c722ff211f9b2.cloudfront.net (CloudFront), 1.1 7022a5bbf9872d4a09d63e6cdb457dfe.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 22:46:13 GMT
age: 56566
etag: "b9d37c2b14f890d41983a59f352e8f7caa9c94bb"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.5 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb781854-72d1-4a71-a095-0416f886f570.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.5 kB (7538 bytes)
Hash
131eb343c5abd61939457d69bd371348
ffb2035cf64fc83f01db5c6f26ffa264b6aac95b
8486eb9dc6325018f8721bc6f37408f260b6e652b145280f2d778d860d3ec2d5

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcb781854-72d1-4a71-a095-0416f886f570.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7538
x-amzn-requestid: 113924cc-a196-4dbd-91d9-68c213265afe
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: e3fobF-ZoAMFjjA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63c61302-6b24941a642b22cf21e47dc0;Sampled=0
x-amzn-remapped-date: Tue, 17 Jan 2023 03:16:18 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 2P09wOtKPDHjxxAuzcLFMQJwmGN1zNJcH9LA6IJpeaGiaPVRF4y-TA==
via: 1.1 eece508272520f70691e4eebdc5a6dea.cloudfront.net (CloudFront), 1.1 caf6806821bc479b28a6f1ce3043b8a6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 27 Jan 2023 22:14:23 GMT
age: 58476
etag: "ffb2035cf64fc83f01db5c6f26ffa264b6aac95b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

ocsp.digicert.com/

93.184.220.29

200 OK

471 B

URL HTTP/1.1
ocsp.digicert.com/
IP
93.184.220.29:0
ASN
#15133 EDGECAST

File type
data
Size
471 B (471 bytes)
Hash
d45e4036ad4a742751f256b53054a5db
3854359e843d7dd78c9dba3b83ebc9a7318f0af7
f660df4eb1067c10301e0b0272bdd3437a70f8b0556eee236dd4cd5c8727e4f2

HTTP Headers

POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5979
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Sat, 28 Jan 2023 14:29:00 GMT
Last-Modified: Sat, 28 Jan 2023 12:49:21 GMT
Server: ECS (ska/F704)
X-Cache: HIT
Content-Length: 471

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

104.17.25.14

200 OK

5.6 kB

URL HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
IP
104.17.25.14:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (30837)
Size
5.6 kB (5631 bytes)
Hash
109d1ed85cd01f9cdab73a4cac5bf80d
d6c6498ad46de2d8e2008a8ff68e364ae7f16b32
8b3a74fe462f5b3c0635995fd721a60eb640e237680b0b532b96711f2823e8bc

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 28 Jan 2023 14:29:00 GMT
content-type: text/css; charset=utf-8
content-length: 5631
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-7918"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 143176
expires: Thu, 18 Jan 2024 14:29:00 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gZt9fq0cbHxs1IPOO39FsPV2DCbnd1TZmzyQUJBhnA3JBHD7JulTwkNfAqO4kN983WnKa2g6O5zkDz5k%2F0QwAZiFxTWOD%2Bf0ROywC1qb3MKBRotbTf%2BD6F1QB955Qkyh8vz6CnCz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 790a6af69b57b500-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04

89.35.204.123

200 OK

60 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- assembler source text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (39884)
Size
60 kB (60062 bytes)
Hash
03279a1c5f9ca0159897705ead8c1504
5914fed7294baf71fc3150abce8b1605b9191ac0
2130bc956037a72e57b51e84c9d3949992ad6ad3a423cd062f55d798a34c4275

Detections

Analyzer	Verdict	Alert
openphish	DHL Airways, Inc.
fortinet	Phishing

NIDS	Severity	Alert
suricata	high	ET EXPLOIT_KIT TDS Sutra - page redirecting to a SutraTDS

HTTP Headers

GET /public/L2z1vWRJXQv1UCIzEI049PGMNACYej04 HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://helpdesk.randevupanzio.ro/public/
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImNyR2JIMEJ5OXM2VlJtSmhBV05hSmc9PSIsInZhbHVlIjoibEcyODl0QmRQYlF2RzZjUVNzakRHaWVMVU1MYmJFNVJ3UXhzUUdVaFZvWG9qWSswMlc2WmRPSDZSQW5adGxtN1lOYnRUcHQ2Y08rUSszbmZFdjV1MmxjY0R2MU8yVitGODVla3hvaEdGY2VCaW0xcUEwVkFFOWM3V3VDTFE5R2siLCJtYWMiOiI4MTAxZWJiNTRlZTFiZTVkZjdhMzMzYTZkOWMzOGY0ZTI4MjE4YmI5MWY2ZGM0NmRiMmUwMmFlOGUwMzRiOTdkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImRjV29DQ1ZxVDlTRENTK1k3SlJFelE9PSIsInZhbHVlIjoiK0FnWlg5UTFWYXhlWmlwbVNtYkJ0UGw3SjV4MHBOVFU5ZGU4M3NvUlpkdDJuZVcwenpMaGhwNGZtL1YzdXRiRGd5SW1meStLOFhGdlllNTZVRnM3TVZ2cTk2VGdYQnpYczNBekxjcmYrRTY4RHc3T0hCMGJxSEY3c09EQ3ZORVUiLCJtYWMiOiI2ODNkNDcyZGVlYWVjZTcxYzk0ZTdkZTg3MzQ5ZjYyMjk0OTEwODQ0Y2NiODk5MzY1YWMzOGFiNGZkY2RkNjFkIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 14:27:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; expires=Sat, 28-Jan-2023 16:27:40 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; expires=Sat, 28-Jan-2023 16:27:40 GMT; Max-Age=7200; path=/; httponly; samesite=lax

helpdesk.randevupanzio.ro/public/js/session-recorder.js

89.35.204.123

200 OK

45 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/public/js/session-recorder.js
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
ASCII text, with very long lines (44992)
Size
45 kB (45066 bytes)
Hash
701984b4995f3c29820e83c999b7eb23
a3b50104a3bfa05bf59a317273816c7d8ae1f81d
67ad94e12a745b1b09c6cd616e20a2ad283ed68f8060bd1dd0d9a2b6ad9dc7ee

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /public/js/session-recorder.js HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 14:27:40 GMT
Content-Type: application/javascript
Content-Length: 45066
Connection: keep-alive
Last-Modified: Wed, 03 Aug 2022 14:29:04 GMT
Accept-Ranges: bytes

helpdesk.randevupanzio.ro/public/css/app.css

89.35.204.123

200 OK

440 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/public/css/app.css
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
ASCII text
Size
440 kB (439658 bytes)
Hash
181990cc2279e4cea65c9363fb37fee9
b85a7ba40043b0c48a034d8382629ef7ec6a1e24
36839348d4cd3d5ffcb15317bc5e8f32b77c644d0c6c0f8f19bdf216caf49293

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.

HTTP Headers

GET /public/css/app.css HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 14:27:40 GMT
Content-Type: text/css
Content-Length: 439658
Connection: keep-alive
Last-Modified: Wed, 03 Aug 2022 14:29:04 GMT
Accept-Ranges: bytes

helpdesk.randevupanzio.ro/images/logo.png

89.35.204.123

200 OK

2.0 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/images/logo.png
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
PNG image data, 214 x 20, 8-bit/color RGBA, non-interlaced\012- data
Size
2.0 kB (1998 bytes)
Hash
5d14ab93691604e826e1319d53599eb9
78724360e9d25da584445b851e37bca05abe6b85
3f0c62b5ccdcdbf3b3ae3885f1e6959e2d937eba9b29dea9a6bdb98788041756

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.

HTTP Headers

GET /images/logo.png HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 14:27:41 GMT
Content-Type: image/png
Content-Length: 1998
Connection: keep-alive
Last-Modified: Wed, 03 Aug 2022 14:29:04 GMT
Accept-Ranges: bytes

helpdesk.randevupanzio.ro/images/all.png

89.35.204.123

200 OK

12 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/images/all.png
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
PNG image data, 123 x 84, 8-bit/color RGBA, non-interlaced\012- data
Size
12 kB (12499 bytes)
Hash
2cb0b7f615faf2deb9ec6f53d3149a3b
694a2c881c83e2ab86365bf1d16302ac5b9d500f
c1d5409eecb402a99f10718b06c266ba314d9e25f0b56c6fd063699334b8be6d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.

HTTP Headers

GET /images/all.png HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 14:27:41 GMT
Content-Type: image/png
Content-Length: 12499
Connection: keep-alive
Last-Modified: Wed, 03 Aug 2022 14:29:04 GMT
Accept-Ranges: bytes

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

104.17.25.14

200 OK

77 kB

URL HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
IP
104.17.25.14:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format (Version 2), TrueType, length 77160, version 4.459\012- data
Size
77 kB (77160 bytes)
Hash
af7ae505a9eed503f8b8e6982036873e
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://helpdesk.randevupanzio.ro
Connection: keep-alive
Referer: https://cdnjs.cloudflare.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 28 Jan 2023 14:29:01 GMT
content-type: application/octet-stream; charset=utf-8
content-length: 77160
access-control-allow-origin: *
cache-control: public, max-age=30672000
etag: "5eb03e5f-12d68"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 224071
expires: Thu, 18 Jan 2024 14:29:01 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h0rE4z7K1lnQSQ9krtMiM3PvVxOM%2F8OG%2FeVX7C8mWy6YNG2fprBZr7cKlwJea5NPU9EISwhZ7NW3tKPjv%2BSL2Q3YNS3x%2FrZI1UZlTNW89GahxFWw%2F8M4EZBif4GshaemdxtcULiJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 790a6afa69b9b4f3-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

helpdesk.randevupanzio.ro/public/js/app.js

89.35.204.123

200 OK

1.6 MB

URL HTTP/1.1
helpdesk.randevupanzio.ro/public/js/app.js
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
Unicode text, UTF-8 text
Size
1.6 MB (1613806 bytes)
Hash
fd900f643203761f2eeca2132fc15f1d
375f23ca9ad75b647373bda03b02e2d0f6e729be
399e233cea4e5468820e5c5f98ddbb156de729983710cf576a6508f076326c68

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /public/js/app.js HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}

HTTP/1.1 200 OK
Server: nginx
Date: Sat, 28 Jan 2023 14:27:40 GMT
Content-Type: application/javascript
Content-Length: 1613806
Connection: keep-alive
Last-Modified: Wed, 03 Aug 2022 14:29:04 GMT
Accept-Ranges: bytes

helpdesk.randevupanzio.ro/images/foo.png

89.35.204.123

404 Not Found

6.6 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/images/foo.png
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5395)
Size
6.6 kB (6609 bytes)
Hash
307dca9c775906b8de45869cabe98fcd
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.

HTTP Headers

GET /images/foo.png HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/L2z1vWRJXQv1UCIzEI049PGMNACYej04
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 28 Jan 2023 14:27:41 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private

ws-mt1.pusher.com/app/bc5ba70500b3342fb1aa?protocol=7&client=js&version=7.0.3&flash=false

52.0.113.204

101 Switching Protocols

0 B

URL HTTP/1.1
ws-mt1.pusher.com/app/bc5ba70500b3342fb1aa?protocol=7&client=js&version=7.0.3&flash=false
IP
52.0.113.204:0
ASN
#14618 AMAZON-AES

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /app/bc5ba70500b3342fb1aa?protocol=7&client=js&version=7.0.3&flash=false HTTP/1.1
Host: ws-mt1.pusher.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Sec-WebSocket-Version: 13
Origin: http://helpdesk.randevupanzio.ro
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: c7jqvvkz/WEMooh4uVKMpg==
Connection: keep-alive, Upgrade
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Date: Sat, 28 Jan 2023 14:29:01 GMT
Connection: upgrade
Server: nginx/1.17.7
Upgrade: websocket
Sec-WebSocket-Accept: dlgMAgjLVZjjxUJ3WPoN9skbmok=

ka-f.fontawesome.com/releases/v6.2.1/css/free.min.css?token=f7165dd215

172.64.169.22

200 OK

193 kB

URL HTTP/2
ka-f.fontawesome.com/releases/v6.2.1/css/free.min.css?token=f7165dd215
IP
172.64.169.22:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65536), with no line terminators
Size
193 kB (193368 bytes)
Hash
6631347c44ca7538f8b1775e88e63d38
a1c23370879aaadbf220f33a68aae8ed9e66cf6a
4b7a19011338eb294c50a3913d84bffec24fe575b1fdd2f4c1b1cdf240edd2d4

HTTP Headers

GET /releases/v6.2.1/css/free.min.css?token=f7165dd215 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://helpdesk.randevupanzio.ro/
Origin: http://helpdesk.randevupanzio.ro
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Sat, 28 Jan 2023 14:29:00 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Mon, 14 Nov 2022 15:06:08 GMT
etag: W/"2dbe34367e935e2684b01124b0860d71"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0dd1077162fbc5ae77bb4c494a180158.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P1
x-amz-cf-id: lmj3qUVv65TmN5nZwKQ3An8Xc6q1iBWAwT-Fi83-dEe4xgInXksgLg==
age: 40162
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nACEeBsbf13r9Ba5MONkmNmXYifyO8big69kLhIDxFPO%2BE1eriEzqQXHoeh5lRelsHS%2ByHcsaPJ3N4Zid2fnUe%2FIgXiTQKVn0qWKQuPFwBkHG9tyc9ZOBLoBoqiiPm6Xl9V0NN4UmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 790a6af8baa63861-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

helpdesk.randevupanzio.ro/public/css/fonts/webfa-brands-400.woff2?d878b0a6a1144760244ff0665888404c

89.35.204.123

404 Not Found

6.6 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/public/css/fonts/webfa-brands-400.woff2?d878b0a6a1144760244ff0665888404c
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5395)
Size
6.6 kB (6609 bytes)
Hash
307dca9c775906b8de45869cabe98fcd
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /public/css/fonts/webfa-brands-400.woff2?d878b0a6a1144760244ff0665888404c HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/css/app.css
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 28 Jan 2023 14:27:41 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private

helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.woff2?1551f4f60c37af51121f106501f69b80

89.35.204.123

404 Not Found

6.6 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.woff2?1551f4f60c37af51121f106501f69b80
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5395)
Size
6.6 kB (6609 bytes)
Hash
307dca9c775906b8de45869cabe98fcd
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.woff2?1551f4f60c37af51121f106501f69b80 HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/css/app.css
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-ffc31dc5-657a-446d-a662-a8a4691d7f1f%22%2C%22lastActivity%22:1674915997281}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674915997282}

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 28 Jan 2023 14:27:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private

killbot.org/api/v2/blocker?apikey=dj7y2CXKgj_oOZX1izDVTqUIV5twCJfa26sG37hioQMAU&ip=91.90.42.154&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64;%20rv:105.0)%20Gecko/20100101%20Firefox/105.0&url=

172.67.166.105

403 Forbidden

2.4 kB

URL HTTP/2
killbot.org/api/v2/blocker?apikey=dj7y2CXKgj_oOZX1izDVTqUIV5twCJfa26sG37hioQMAU&ip=91.90.42.154&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64;%20rv:105.0)%20Gecko/20100101%20Firefox/105.0&url=
IP
172.67.166.105:0
ASN
#13335 CLOUDFLARENET

File type
JSON data\012- , ASCII text
Size
2.4 kB (2433 bytes)
Hash
5df592490f4d2910cd3f76e73e7d92ce
8c3fdbd9b3d01c8d0291854c2024a2aa4c310dbd
7ceae24685d249dc09d172aa574f0d239618dec08866b38729abeccb9332f440

HTTP Headers

GET /api/v2/blocker?apikey=dj7y2CXKgj_oOZX1izDVTqUIV5twCJfa26sG37hioQMAU&ip=91.90.42.154&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64;%20rv:105.0)%20Gecko/20100101%20Firefox/105.0&url= HTTP/1.1
Host: killbot.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://helpdesk.randevupanzio.ro/
Origin: http://helpdesk.randevupanzio.ro
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 403 Forbidden
date: Sat, 28 Jan 2023 14:29:02 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-max-age: 86400
bug-bounty: Report to live chat :)
access-control-allow-origin: *
access-control-allow-methods: POST, GET
set-cookie: _killbot=codlnp80dn8o9m2519vnhpbu4pfnt0iu; expires=Sat, 28-Jan-2023 16:29:01 GMT; Max-Age=7200; path=/; SameSite=Lax; secure; HttpOnly
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1UIu50uLdTS7o8w6Z45MDv7WO2CniGvaJCfzyBOBi90pv6Xx0Nj1KJ1N0%2FGQN3Brsbg5dPdKJQIfG5d%2F%2BG58OgJFazMYFTx33SWrowpA111msZkCsefch9%2BTjwfHcg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 790a6afeaf55b523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

helpdesk.randevupanzio.ro/fonts/vendor/@fontsource/roboto/files/roboto-all-400-normal.woff?376ea5d93f71583052f65de4e0c6a92c

89.35.204.123

404 Not Found

6.6 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/fonts/vendor/@fontsource/roboto/files/roboto-all-400-normal.woff?376ea5d93f71583052f65de4e0c6a92c
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5395)
Size
6.6 kB (6609 bytes)
Hash
307dca9c775906b8de45869cabe98fcd
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /fonts/vendor/@fontsource/roboto/files/roboto-all-400-normal.woff?376ea5d93f71583052f65de4e0c6a92c HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/css/app.css
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-0d79b49f-bf10-4871-879e-f0bbd403c26c%22%2C%22lastActivity%22:1674916144608}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674916144608}; _lr_uf_-mnnzup=94c117ca-c1e5-43d2-b064-692ed6b1291d

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 28 Jan 2023 14:27:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private

helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-brands-400.woff?2285773e6b4b172f07d9b777c81b0775

89.35.204.123

404 Not Found

6.6 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-brands-400.woff?2285773e6b4b172f07d9b777c81b0775
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5395)
Size
6.6 kB (6609 bytes)
Hash
307dca9c775906b8de45869cabe98fcd
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /fonts/vendor/@fortawesome/fontawesome-free/webfa-brands-400.woff?2285773e6b4b172f07d9b777c81b0775 HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/css/app.css
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-0d79b49f-bf10-4871-879e-f0bbd403c26c%22%2C%22lastActivity%22:1674916144608}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674916144608}; _lr_uf_-mnnzup=94c117ca-c1e5-43d2-b064-692ed6b1291d

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 28 Jan 2023 14:27:43 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private

helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.woff?eeccf4f66002c6f2ba24d3d22f2434c2

89.35.204.123

404 Not Found

6.6 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.woff?eeccf4f66002c6f2ba24d3d22f2434c2
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5395)
Size
6.6 kB (6609 bytes)
Hash
307dca9c775906b8de45869cabe98fcd
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.woff?eeccf4f66002c6f2ba24d3d22f2434c2 HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/css/app.css
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-0d79b49f-bf10-4871-879e-f0bbd403c26c%22%2C%22lastActivity%22:1674916144608}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674916144608}; _lr_uf_-mnnzup=94c117ca-c1e5-43d2-b064-692ed6b1291d

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 28 Jan 2023 14:27:43 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private

helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-brands-400.ttf?527940b104eb2ea366c8630f3f038603

89.35.204.123

404 Not Found

6.6 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-brands-400.ttf?527940b104eb2ea366c8630f3f038603
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5395)
Size
6.6 kB (6609 bytes)
Hash
307dca9c775906b8de45869cabe98fcd
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /fonts/vendor/@fortawesome/fontawesome-free/webfa-brands-400.ttf?527940b104eb2ea366c8630f3f038603 HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/css/app.css
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-0d79b49f-bf10-4871-879e-f0bbd403c26c%22%2C%22lastActivity%22:1674916144608}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674916144608}; _lr_uf_-mnnzup=94c117ca-c1e5-43d2-b064-692ed6b1291d

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 28 Jan 2023 14:27:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private

static.hotjar.com/c/hotjar-2895475.js?sv=6

54.230.111.39

200 OK

111 kB

URL HTTP/2
static.hotjar.com/c/hotjar-2895475.js?sv=6
IP
54.230.111.39:0
ASN
#16509 AMAZON-02

File type
ASCII text, with very long lines (7535)
Size
111 kB (111323 bytes)
Hash
cfaa94fbd0afc6170432fea6dfc0b7c8
ee723e68664832cb8ad0c4e5b7f5a553717fe236
aaca93b3f039d228447b06af3892cb0d2e1117e61e7605eb09276a0c81e138e3

HTTP Headers

GET /c/hotjar-2895475.js?sv=6 HTTP/1.1
Host: static.hotjar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
date: Sat, 28 Jan 2023 14:29:02 GMT
access-control-allow-origin: *
cache-control: max-age=60
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: W/0faac68a2f16f94aa99e02cb3459d358
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: a9UFBdFc4tTGN7TcU4UO7F2hZ16MRRSX1g2YL3Zh1ajvCwYhTDdPyA==
X-Firefox-Spdy: h2

helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.ttf?be9ee23c0c6390141475d519c2c5fb8f

89.35.204.123

404 Not Found

6.6 kB

URL HTTP/1.1
helpdesk.randevupanzio.ro/fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.ttf?be9ee23c0c6390141475d519c2c5fb8f
IP
89.35.204.123:0
ASN
#20616 H88 Web Hosting S.r.l.

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with very long lines (5395)
Size
6.6 kB (6609 bytes)
Hash
307dca9c775906b8de45869cabe98fcd
2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1
8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
openphish	DHL Airways, Inc.
fortinet	Phishing

HTTP Headers

GET /fonts/vendor/@fortawesome/fontawesome-free/webfa-solid-900.ttf?be9ee23c0c6390141475d519c2c5fb8f HTTP/1.1
Host: helpdesk.randevupanzio.ro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/public/css/app.css
Cookie: XSRF-TOKEN=eyJpdiI6ImkvU3QrRzJSc3QwZVJQV0NKUFlxRlE9PSIsInZhbHVlIjoibFpUMU4rUHpNdUx5dk1DaGtIazA1eE1ITmtDRUFzVzNOWlB0dldHMjliTVRyU0VqR2QwYlNOQTdxYnY5aDRURkM2RHhYSFA4SWRsVW16cDg5T1hKSFdEb0dsK2hqTmJ1NnZFb2hQVmIrSkZkbFVKQWU5RUR5dkhCVTY2aTRqbXAiLCJtYWMiOiJjZjc3NjU3NmE5MjYwZmEyMzVkZDBlYmE0MDlkNzM5OWIyNWExNWFiZDBmZGZmNGQ0YWJkYjVlNmZkN2QwMTA2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdJYVpOWENLSyt3UGFMaHFmYm9kN3c9PSIsInZhbHVlIjoiYm11M2hKOEhOL0lTdmNrVExzOTVNZEk1aHlEbkdaak1wRTJicXM5bGFuYndEUVlpY3dhSSt3YU9kRzhLcTZBN25SYjNJRURydXpwRW03cGRjbkRnODVidlZmejAvNHdQbTNUZmxmbmhBY2RUTG51TmpESUZGVFMrdlluTHlzVWwiLCJtYWMiOiI1ZTZlZjFmNzA0ODUyNDVmODcwODgzMTdmOTg1YWJkZGJhZTlhOTdlYzE5NzMyYWM1NTRhZWFkZDRhYmEyYzYyIiwidGFnIjoiIn0%3D; _lr_tabs_-mnnzup%2Fdus={%22sessionID%22:0%2C%22recordingID%22:%225-0d79b49f-bf10-4871-879e-f0bbd403c26c%22%2C%22lastActivity%22:1674916144608}; _lr_hb_-mnnzup%2Fdus={%22heartbeat%22:1674916144608}; _lr_uf_-mnnzup=94c117ca-c1e5-43d2-b064-692ed6b1291d

HTTP/1.1 404 Not Found
Server: nginx
Date: Sat, 28 Jan 2023 14:27:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, private

ka-f.fontawesome.com/releases/v6.2.1/webfonts/free-fa-solid-900.woff2

172.64.169.22

200 OK

150 kB

URL HTTP/2
ka-f.fontawesome.com/releases/v6.2.1/webfonts/free-fa-solid-900.woff2
IP
172.64.169.22:0
ASN
#13335 CLOUDFLARENET

File type
Web Open Font Format (Version 2), TrueType, length 150500, version 770.768\012- data
Size
150 kB (150500 bytes)
Hash
69a76555beae5c43a59559396c1aeb54
7d2759002c67a66fc38a72dd0e395e2da3d41474
1494e2691e1c13a3f35cbc3e1b56c5187c10ffe220d1fdc58d99494a666244d4

HTTP Headers

GET /releases/v6.2.1/webfonts/free-fa-solid-900.woff2 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://helpdesk.randevupanzio.ro
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Sat, 28 Jan 2023 14:29:04 GMT
content-type: font/woff2
content-length: 150500
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Mon, 14 Nov 2022 15:15:23 GMT
etag: "69a76555beae5c43a59559396c1aeb54"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
x-cache: Hit from cloudfront
via: 1.1 b6143952706f018e1ba3e69247a6e10c.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P1
x-amz-cf-id: rvRkaU1TKGd6zTQtfvwi8Gb2VxAoiZBW3_eMeqrmUIJdF3MJxwjk7Q==
age: 40153
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xc%2BxmTJR8%2BUcIYi70w%2BNVzEHWCN1F0ZqSSR7mqSjqIVS7xKNWVs08CPquo%2BBP%2BMdUczp9lskKSSDzf%2FsRHwxRqYURSSU%2BzE5CE2GnBmtFJVl3Psklc2SH3QdKOG9BWuGMvFo9lyB0w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 790a6b0f6a113861-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7e1d83c1fb35bdb12081c99efa8319c7
5f73974302e1937271900c0908e3eb3f7d7beb56
6fc3cc33ea4b6e6f261339495daabae912faa307732ba55a87761ce0895590d7

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6FC3CC33EA4B6E6F261339495DAABAE912FAA307732BA55A87761CE0895590D7"
Last-Modified: Thu, 26 Jan 2023 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9131
Expires: Sat, 28 Jan 2023 17:01:15 GMT
Date: Sat, 28 Jan 2023 14:29:04 GMT
Connection: keep-alive

r.lr-in.com/i?a=mnnzup%2Fdus&r=5-0d79b49f-bf10-4871-879e-f0bbd403c26c&t=5f49c07a-dc7e-4ba8-a89b-c70e3de8ada7&s=0&rs=0%2Cu&u=81184b35-8f0d-4782-904e-baf51111d153

104.198.23.205

201 Created

104 B

URL HTTP/2
r.lr-in.com/i?a=mnnzup%2Fdus&r=5-0d79b49f-bf10-4871-879e-f0bbd403c26c&t=5f49c07a-dc7e-4ba8-a89b-c70e3de8ada7&s=0&rs=0%2Cu&u=81184b35-8f0d-4782-904e-baf51111d153
IP
104.198.23.205:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
104 B (104 bytes)
Hash
189e5aa5a897b0373bbde8ab5b70865d
6ca5b523eeae8ce1228d6cd12044762d6317b710
56c57ddb04140a37df2f0b9ae80dbdd58368da58e2705746420039eeb6a60b90

HTTP Headers

POST /i?a=mnnzup%2Fdus&r=5-0d79b49f-bf10-4871-879e-f0bbd403c26c&t=5f49c07a-dc7e-4ba8-a89b-c70e3de8ada7&s=0&rs=0%2Cu&u=81184b35-8f0d-4782-904e-baf51111d153 HTTP/1.1
Host: r.lr-in.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Length: 392279
Origin: http://helpdesk.randevupanzio.ro
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 201 Created
date: Sat, 28 Jan 2023 14:29:05 GMT
content-type: application/json; charset=utf-8
content-length: 104
x-powered-by: Express
access-control-allow-origin: *
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
etag: W/"68-bKW1I+6ujOEijWzRIER2LWMXtxA"
strict-transport-security: max-age=15724800; includeSubDomains
access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,X-Csrftoken,If-Modified-Since,Cache-Control,Content-Type,Authorization,Accept,Origin,X-Logrocket-Url,X-Logrocket-Ignore,X-Logrocket-Secret,X-LogRocket-ClickHouse-Override,X-LogRocket-ClickHouse-Enabled-Queries
access-control-max-age: 1728000
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v6.2.1/css/free-v4-font-face.min.css?token=f7165dd215

172.64.169.22

200 OK

0 B

URL HTTP/2
ka-f.fontawesome.com/releases/v6.2.1/css/free-v4-font-face.min.css?token=f7165dd215
IP
172.64.169.22:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /releases/v6.2.1/css/free-v4-font-face.min.css?token=f7165dd215 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://helpdesk.randevupanzio.ro/
Origin: http://helpdesk.randevupanzio.ro
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Sat, 28 Jan 2023 14:29:00 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Mon, 14 Nov 2022 15:06:07 GMT
etag: W/"075b2106ba08d32bc88fff3724503b1e"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 aa5f00ed95fd16b8d894989f7ad491ba.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR61-P1
x-amz-cf-id: HH5lcrfAGyJv90xGCnrRrzMwfZxixb67-aZW8Lvz9fxur6PnSm-fAw==
age: 40162
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y0qmDXGbOYYsb6yGL0Ok5dO03hKoXwfEy18%2Feq%2BqDpEdH5a7LsEkptwgwDCLjHkZYUrocYqBP%2BJ21Erzx9DVBEfN7FALOn55nwUs7lBDKLRp%2FITxjuAxwe27b9qqZpR7aC5W0uS7Dg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 790a6af8baa53861-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

kit.fontawesome.com/f7165dd215.js

104.18.22.52

200 OK

0 B

URL HTTP/2
kit.fontawesome.com/f7165dd215.js
IP
104.18.22.52:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /f7165dd215.js HTTP/1.1
Host: kit.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://helpdesk.randevupanzio.ro
Connection: keep-alive
Referer: http://helpdesk.randevupanzio.ro/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
date: Sat, 28 Jan 2023 14:29:00 GMT
content-type: text/javascript
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=60, public, must-revalidate
strict-transport-security: max-age=31536000; preload
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
x-request-id: Fz5a0rgavKP6qFTFQTXh
cf-cache-status: REVALIDATED
server: cloudflare
cf-ray: 790a6af6a829b4f7-OSL
content-encoding: gzip
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v6.2.1/css/free-v4-shims.min.css?token=f7165dd215

172.64.169.22

200 OK

0 B

URL HTTP/2
ka-f.fontawesome.com/releases/v6.2.1/css/free-v4-shims.min.css?token=f7165dd215
IP
172.64.169.22:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /releases/v6.2.1/css/free-v4-shims.min.css?token=f7165dd215 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://helpdesk.randevupanzio.ro/
Origin: http://helpdesk.randevupanzio.ro
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Sat, 28 Jan 2023 14:29:00 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Mon, 14 Nov 2022 15:06:08 GMT
etag: W/"0d00741459c51dd7330d97cd19326a7b"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2a699e0025d07c32806ac8609ddf615e.cloudfront.net (CloudFront)
x-amz-cf-pop: MAN50-C1
x-amz-cf-id: eeyjhBByOKkzkgSUEVQWrWi8bkBWdKgLGNDD-zNHMyf_FHWZh8L2Ew==
age: 40162
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UzwAPDerRWa4qB3zRnEujP0bOTfF7KuKt7YaIm9AOpt0Ocj%2FD7SNEd9NNcmBzQfq%2BpAc78MVHzEWgRCozkjQ094RLDhV6J30YFJbEqrMCPipYzYRTcL%2BAXC89FHGZanxDFy6%2FGUZ6A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 790a6af8baa83861-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

killbot.org/api/v2/whois?apikey=dj7y2CXKgj_oOZX1izDVTqUIV5twCJfa26sG37hioQMAU

172.67.166.105

200 OK

0 B

URL HTTP/2
killbot.org/api/v2/whois?apikey=dj7y2CXKgj_oOZX1izDVTqUIV5twCJfa26sG37hioQMAU
IP
172.67.166.105:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash

HTTP Headers

GET /api/v2/whois?apikey=dj7y2CXKgj_oOZX1izDVTqUIV5twCJfa26sG37hioQMAU HTTP/1.1
Host: killbot.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://helpdesk.randevupanzio.ro/
Origin: http://helpdesk.randevupanzio.ro
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

HTTP/2 200 OK
date: Sat, 28 Jan 2023 14:29:01 GMT
content-type: application/json
access-control-allow-credentials: true
access-control-max-age: 86400
bug-bounty: Report to live chat :)
set-cookie: _killbot=8d6onib9o8ajrl7n43ovf9r7kv1ca34l; expires=Sat, 28-Jan-2023 16:29:01 GMT; Max-Age=7200; path=/; SameSite=Lax; secure; HttpOnly
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-origin: *
access-control-allow-methods: POST, GET
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wyZIc97QtiRP3E0eC050VJiWe01c2cYC8ni9FO%2B%2FQ7QxQwtLupeWQRX0OvV45sxK9v5rB%2BQ0oQZngKs7WHncIfG%2BBJT55ScL%2F7FVoEZWTj1iDp2ZWsEf2t6oJcZ9Ug%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 790a6af85faeb523-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (11)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML