Report - dunwell.seenseen.co/mail/BIbAZTGkMv4125/

Report Overview

Submitted URL
dunwell.seenseen.co/mail/BIbAZTGkMv4125/
IP
188.114.96.1
ASN
#13335 CLOUDFLARENET
Submitted
2023-06-06 00:21:25
Access
public
Website Title
Final URL
Tags
chronopost logistics phishing
urlquery detections
Phishing - Chronopost

Detections

urlquery
7
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ajax.googleapis.com	12905	2005-01-25	2013-08-16	2023-06-05	436 B	32 kB	172.217.21.170
ocsp.r2m01.amazontrust.com	unknown	2007-05-11	2022-10-12	2023-06-05	340 B	942 B	54.230.80.227
kit-free.fontawesome.com	22974	2012-10-18	2019-05-10	2023-06-05	1.6 kB	218 kB	172.67.172.121
s3-us-west-2.amazonaws.com	unknown	2005-08-18	2017-01-29	2023-06-05	445 B	177 kB	52.218.248.8
stackpath.bootstrapcdn.com	2467	2012-05-25	2018-06-15	2023-06-05	494 B	161 kB	104.18.11.207
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2023-06-05	1.5 kB	113 kB	104.17.24.14
ocsp.pki.goog	175	2016-06-13	2018-07-01	2023-06-05	666 B	1.4 kB	142.250.74.3
dunwell.seenseen.co	unknown	2018-08-27	2022-04-04	2023-06-05	4.5 kB	104 kB	188.114.96.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-06-05	medium	dunwell.seenseen.co/mail/BIbAZTGkMv4125/

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (6)

	URL	Size	First Seen	Last Seen
	dunwell.seenseen.co/mail/BIbAZTGkMv4125/	0 B	2023-03-07	2024-04-26
Pretty URL dunwell.seenseen.co/mail/BIbAZTGkMv4125/ IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-26 12:21:25 Times Seen37091343 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js	88 kB	2023-03-07	2024-04-26
Pretty URL ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js IP 172.217.21.170 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-04-26 10:59:49 Times Seen95587 Hash 220afd743d9e9643852e31a135a9f3ae 88523924351bac0b5d560fe0c5781e2556e7693d 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Loading...

	dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/chronopost_if.js	3.5 kB	2023-06-05	2024-04-14
Pretty URL dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/chronopost_if.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-06-05 13:54:25 Last Seen2024-04-14 07:08:12 Times Seen78 Hash 21957f9bede9d7664aef92b0fdea4248 58b39f2376e4efaeac4d07770d1f3debfb2b0426 aca86b9641b8ebaba7d7cf4d2804211ff136c473fd2b7b848190dfa71b4bae5a Loading...

	dunwell.seenseen.co/mail/BIbAZTGkMv4125/	0 B	2023-03-07	2024-04-26
Pretty URL dunwell.seenseen.co/mail/BIbAZTGkMv4125/ IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-04-26 12:21:25 Times Seen37091343 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js	87 kB	2023-03-07	2024-04-26
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:34 Last Seen2024-04-26 11:00:50 Times Seen263939 Hash e071abda8fe61194711cfc2ab99fe104 f647a6d37dc4ca055ced3cf64bbc1f490070acba 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Loading...

	s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js	176 kB	2023-03-07	2024-04-15
Pretty URL s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js IP 52.218.248.8 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:07:11 Last Seen2024-04-15 06:23:30 Times Seen777 Hash f0b02d9f2d3c6679556e63935ac23320 384bb74cdb2840da6eaa9400242faf4a2fac3daa f708ad894d421f32ed297a914632db6bc1577841d1c210b34f1a0821ea0aaa4b Loading...

HTTP Transactions (21)

URL IP Response Size

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

104.17.24.14

200 OK

5.6 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintA9:11:71:07:07:92:48:7E:A9:3C:E8:32:25:3F:EB:AC:7D:51:7E:8F
ValidityWed, 03 Aug 2022 00:00:00 GMT - Wed, 02 Aug 2023 23:59:59 GMT

File type
ASCII text, with very long lines (30837)
Size
5.6 kB (5631 bytes)
Hash
269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 06 Jun 2023 00:21:07 GMT
content-type: text/css; charset=utf-8
content-length: 5631
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-7918"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 976032
expires: Sun, 26 May 2024 00:21:07 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1B7TF5xKxtLtXjFfeL%2Bh%2B93Pvfq0LS1hMst6rbP1kvIzWf2gq1uyvI7lXveBKs9HiQVNPTWGMX3ZO%2FeGuukneCNSlf6v4y5HmyXtdJzsCD7JZkBK2xwFI%2Fsfro6Iyn3WmAnRXJU3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7d2c7e53d8d1b51b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js

104.17.24.14

200 OK

27 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintA9:11:71:07:07:92:48:7E:A9:3C:E8:32:25:3F:EB:AC:7D:51:7E:8F
ValidityWed, 03 Aug 2022 00:00:00 GMT - Wed, 02 Aug 2023 23:59:59 GMT

File type
ASCII text, with very long lines (32030)
Size
27 kB (27192 bytes)
Hash
e071abda8fe61194711cfc2ab99fe104
f647a6d37dc4ca055ced3cf64bbc1f490070acba
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

HTTP Headers

GET /ajax/libs/jquery/3.1.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 06 Jun 2023 00:21:07 GMT
content-type: application/javascript; charset=utf-8
content-length: 27192
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec4-152b5"
last-modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1730721
expires: Sun, 26 May 2024 00:21:07 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vrvB5SGGUMr%2FsgBotmR9axqJcuVRqmeBpM3z72XhNKxr49IZmkVo2IrP6ieFDITQGaEUxMd5kOKcgbL9Z8wkBDCStfpe47WxuY%2Bnaexj2pgqnDJu4sIZIuVGPoAnmpG%2FLGUvICb9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7d2c7e53f8dab51b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.3

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
f6e0fad54cb828605d258b3a3fc3494d
1998f119ae42787f25cac22435e05b7d8a7ecbcc
fdde19b20684979988b4db7567fdb883ef8cd0438f4c4ef053bdd058011f1dbc

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 06 Jun 2023 00:21:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/chronopost_logo_small.png

188.114.96.1

200 OK

6.7 kB

URL GET HTTP/3
dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/chronopost_logo_small.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerGoogle Trust Services LLC
Subject*.seenseen.co
Fingerprint24:EF:FE:BE:6F:5D:8F:63:AB:27:01:9C:B0:30:F0:92:84:2F:F3:86
ValidityTue, 11 Apr 2023 03:49:52 GMT - Mon, 10 Jul 2023 03:49:51 GMT

File type
PNG image data, 170 x 39, 8-bit/color RGBA, non-interlaced\012- data
Size
6.7 kB (6690 bytes)
Hash
83844a55b0719c2c568323edcc3aa72f
904ae759c546c8055bc558670db715c03d5d5e3b
277b3d7509e18a5853b95de911547f1453ad45c201bee91ccdc814d8441ddf11

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chronopost

HTTP Headers

GET /mail/BIbAZTGkMv4125/sourceApp/img/chronopost_logo_small.png HTTP/1.1
Host: dunwell.seenseen.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:07 GMT
content-type: image/png
content-length: 6690
last-modified: Mon, 05 Jun 2023 03:17:50 GMT
etag: "647d53de-1a22"
cache-control: public, max-age=2592000
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9TzB1798eoWwC9TaOwN%2Be3jmMd%2BnqLFKYCikoZyyQuSV9hxUbOysWxjDi8Bpzo3G%2BV2hkigy2VPN%2FIFjRmpHOjKu6oaMdPf98LYcjCjPrk4Q6BVfnbr5z0ycaauuC7lYL%2BXlcHrS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d2c7e53b80db517-OSL
alt-svc: h3=":443"; ma=86400

ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

172.217.21.170

200 OK

31 kB

URL GET HTTP/2
ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
IP
172.217.21.170:443
ASN
#15169 GOOGLE

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint3F:94:23:08:F7:DB:8B:36:93:90:93:F4:9E:46:A6:6A:93:75:15:C0
ValidityFri, 19 May 2023 12:57:42 GMT - Fri, 11 Aug 2023 12:57:41 GMT

File type
ASCII text, with very long lines (65451)
Size
31 kB (30774 bytes)
Hash
220afd743d9e9643852e31a135a9f3ae
88523924351bac0b5d560fe0c5781e2556e7693d
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

HTTP Headers

GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 30774
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 03 Jun 2023 13:53:33 GMT
expires: Sun, 02 Jun 2024 13:53:33 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
age: 210454
last-modified: Mon, 13 May 2019 14:37:17 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

dunwell.seenseen.co/mail/BIbAZTGkMv4125/

188.114.96.1

200 OK

16 kB

URL User Request GET HTTP/2
dunwell.seenseen.co/mail/BIbAZTGkMv4125/
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subject*.seenseen.co
Fingerprint24:EF:FE:BE:6F:5D:8F:63:AB:27:01:9C:B0:30:F0:92:84:2F:F3:86
ValidityTue, 11 Apr 2023 03:49:52 GMT - Mon, 10 Jul 2023 03:49:51 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Size
16 kB (16507 bytes)
Hash
89f2fe10b74b642f2145747988d3dbed
94e0c3600e1917971b7fdbced1d17fa452a6a89b
bddadefa98478b81d748bee405be7979780ee6c80c62b2d479df5fbe06e1399a

Detections

Analyzer	Verdict	Alert
openphish	Chronopost International

HTTP Headers

GET /mail/BIbAZTGkMv4125/ HTTP/1.1
Host: dunwell.seenseen.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 06 Jun 2023 00:21:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
age: 11949
x-cache: HIT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JJvfDebV13YZii6ztZvRN%2FEQZ1l9JxJxWrSwiXVzGBAwiBhz3Al%2Fgsmw3Jg4CbmFveNYyrzvWVsu%2FPwY7ZbQKvIV9%2BRUVHz7SbPc97l5giJ01WQkpUUWlVKcD6VlhcnM5Hv%2BJqF6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d2c7e4e0f7cb50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/Capture.png

188.114.96.1

200 OK

1.9 kB

URL GET HTTP/3
dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/Capture.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerGoogle Trust Services LLC
Subject*.seenseen.co
Fingerprint24:EF:FE:BE:6F:5D:8F:63:AB:27:01:9C:B0:30:F0:92:84:2F:F3:86
ValidityTue, 11 Apr 2023 03:49:52 GMT - Mon, 10 Jul 2023 03:49:51 GMT

File type
PNG image data, 194 x 34, 8-bit/color RGBA, non-interlaced\012- data
Size
1.9 kB (1948 bytes)
Hash
e42b8fc7b9b5f270f844353a5945fef5
72e19086fcdb5d15bd1501f999532c460846132f
b5bd9e64eea624aa2343f918af01f093ec4f2df1ca74b77eb1e10eecd596b336

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chronopost

HTTP Headers

GET /mail/BIbAZTGkMv4125/sourceApp/img/Capture.png HTTP/1.1
Host: dunwell.seenseen.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:08 GMT
content-type: image/png
content-length: 1948
last-modified: Mon, 05 Jun 2023 03:17:50 GMT
etag: "647d53de-79c"
cache-control: public, max-age=2592000
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YXojBxZ3PrGEDh%2FB7DMdGU1%2BoLmVSO55p8M2B5425OfbraAhw4oLHeLUYfyOHy0lrtn9zEmaSwxE7OAfydiS%2Bez5%2BEpV1d3DXSYWrG974pHS804346%2B46UrL7Dply6kowPt5cavH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d2c7e53b80ab517-OSL
alt-svc: h3=":443"; ma=86400

ocsp.pki.goog/gts1c3

142.250.74.3

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.3:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
f6e0fad54cb828605d258b3a3fc3494d
1998f119ae42787f25cac22435e05b7d8a7ecbcc
fdde19b20684979988b4db7567fdb883ef8cd0438f4c4ef053bdd058011f1dbc

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 06 Jun 2023 00:21:08 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.r2m01.amazontrust.com/

54.230.80.227

471 B

URL
ocsp.r2m01.amazontrust.com/
IP
54.230.80.227:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
3c46123049c31a7ac1f1040cc334cffc
4e828dd42d948b21879872167df09418ff4d690a
f3f5c9f758b8b0127cceaa506878adccb40dab29d1a1dd6e6bb74fd0e62e6971

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m01.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Tue, 06 Jun 2023 00:21:08 GMT
Last-Modified: Mon, 05 Jun 2023 23:03:19 GMT
Server: ECAcc (bsa/EA9D)
X-Cache: Miss from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: n328oTH9libRtq8maQ4pdwJ2xu9NwayrS8vEossaGw_59CIpcPZovA==
Age: 4669

dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/chronopost_logo.png

188.114.96.1

200 OK

17 kB

URL GET HTTP/3
dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/chronopost_logo.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerGoogle Trust Services LLC
Subject*.seenseen.co
Fingerprint24:EF:FE:BE:6F:5D:8F:63:AB:27:01:9C:B0:30:F0:92:84:2F:F3:86
ValidityTue, 11 Apr 2023 03:49:52 GMT - Mon, 10 Jul 2023 03:49:51 GMT

File type
PNG image data, 339 x 77, 8-bit/color RGBA, non-interlaced\012- data
Size
17 kB (16564 bytes)
Hash
c33a8f71f937b74aa1c92c074bc57e30
8cedfc20a2e9b83a7478a2f88ee90e226faa5a4b
a1d4dc7ed12cbd39ab6e8d1f572312c75c1051047a0c5b40b78721c6f6f4f934

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chronopost

HTTP Headers

GET /mail/BIbAZTGkMv4125/sourceApp/img/chronopost_logo.png HTTP/1.1
Host: dunwell.seenseen.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:08 GMT
content-type: image/png
content-length: 16564
last-modified: Mon, 05 Jun 2023 03:17:50 GMT
etag: "647d53de-40b4"
cache-control: public, max-age=2592000
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UIiX%2BJrmjLtM77TS8ymVX2SBfu9h%2BwD%2BoKMCfGJwytWpljlL2BkR%2FVyjqc1LDo42nqVM7AoJ%2BBEmRJLiwG19EZbS4PuUmPtvdHPXi3mOHYdyIqIP3CiTLJEkhwRvKObj6AlK7zHv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d2c7e539fe7b517-OSL
alt-svc: h3=":443"; ma=86400

dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/dpd-logo.png

188.114.96.1

200 OK

3.3 kB

URL GET HTTP/3
dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/dpd-logo.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerGoogle Trust Services LLC
Subject*.seenseen.co
Fingerprint24:EF:FE:BE:6F:5D:8F:63:AB:27:01:9C:B0:30:F0:92:84:2F:F3:86
ValidityTue, 11 Apr 2023 03:49:52 GMT - Mon, 10 Jul 2023 03:49:51 GMT

File type
PNG image data, 128 x 33, 8-bit/color RGB, non-interlaced\012- data
Size
3.3 kB (3305 bytes)
Hash
f34de078547c6cb96064a9b2ea61c251
267eec3f02fd2f6ec8ce0218f812ad1c8f517aee
bc5fa15b90d078322fac07419dbce0372e156a38d69c6b3abc38bf29ad476b32

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chronopost

HTTP Headers

GET /mail/BIbAZTGkMv4125/sourceApp/img/dpd-logo.png HTTP/1.1
Host: dunwell.seenseen.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:08 GMT
content-type: image/png
content-length: 3305
last-modified: Mon, 05 Jun 2023 03:17:50 GMT
etag: "647d53de-ce9"
cache-control: public, max-age=2592000
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Wt2m4OTNYvjNYDBS9lyCYQqkzAkYvWcG6%2F0X4Cyk0R1ZozX6NFoVU3pqAf1%2BEHnzkOaytzOM6eWS4gvlDCMrnd%2BHAUuUm976x037RS1hSMT%2BHxzhiBGEzkb47z4Dzc%2Fa3lQdH0r"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d2c7e53b809b517-OSL
alt-svc: h3=":443"; ma=86400

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

104.17.24.14

200 OK

77 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintA9:11:71:07:07:92:48:7E:A9:3C:E8:32:25:3F:EB:AC:7D:51:7E:8F
ValidityWed, 03 Aug 2022 00:00:00 GMT - Wed, 02 Aug 2023 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 77160, version 4.459\012- data
Size
77 kB (77160 bytes)
Hash
af7ae505a9eed503f8b8e6982036873e
d6f48cba7d076fb6f2fd6ba993a75b9dc1ecbf0c
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://dunwell.seenseen.co
DNT: 1
Connection: keep-alive
Referer: https://cdnjs.cloudflare.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:08 GMT
content-type: application/octet-stream; charset=utf-8
content-length: 77160
access-control-allow-origin: *
cache-control: public, max-age=30672000
etag: "5eb03e5f-12d68"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1721691
expires: Sun, 26 May 2024 00:21:08 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DFhohh%2BSsS9jniJ4m1HgmVCH4Ozm6hriIWrwjY1iY2MNOIMPmNsM3s3Sztwytk2pNtItLnRq0WPsB5XUZtUx8GeqvJpOvv8U5nj47viqGnFbdgZY5kgzbIL6cS%2FKcMAxDLsPer2s"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7d2c7e5a189e0b49-OSL
alt-svc: h3=":443"; ma=86400

kit-free.fontawesome.com/releases/latest/webfonts/free-fa-solid-900.woff2

172.67.172.121

200 OK

78 kB

URL GET HTTP/3
kit-free.fontawesome.com/releases/latest/webfonts/free-fa-solid-900.woff2
IP
172.67.172.121:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerLet's Encrypt
Subjectkit-free.fontawesome.com
Fingerprint11:3F:AD:BC:52:B9:78:DD:34:9E:75:8B:93:4E:F3:6B:D8:EA:73:37
ValiditySun, 07 May 2023 02:32:03 GMT - Sat, 05 Aug 2023 02:32:02 GMT

File type
Web Open Font Format (Version 2), TrueType, length 78168, version 331.-31196\012- data
Size
78 kB (78168 bytes)
Hash
a9fd1225fb2cd32320e2b931dca01089
44ec5c6a868b4ce62350d9f040ed8e18f7a1d128
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7

HTTP Headers

GET /releases/latest/webfonts/free-fa-solid-900.woff2 HTTP/1.1
Host: kit-free.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://dunwell.seenseen.co
DNT: 1
Connection: keep-alive
Referer: https://kit-free.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:09 GMT
content-type: font/woff2
content-length: 78168
x-amz-id-2: NnrjK6kT2PvQpMZPzGivlvxrI8EPUk3GDnkX424qXrmVXzRu3fNlAspXLtPV8ai8TyPK/wysI0A=
x-amz-request-id: FKF5MQQYYCKJ0ZY1
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 21:26:53 GMT
etag: "a9fd1225fb2cd32320e2b931dca01089"
cache-control: max-age=1800
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bFNQsXVd67cVbGO9%2F%2BMqjj6MNLy1r1%2BWEwGPPA9Nxx0mihfRcLj3%2BZeN2orkE1T%2BnRDgB3mcRMklgHJnP%2BKTi7mAIT3R1Y9X4OT8M71VoHce3UvM8M6RdWULJIIjEowoKDAOnWb5Fjhn8po%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d2c7e59dc1ab517-OSL
alt-svc: h3=":443"; ma=86400

kit-free.fontawesome.com/releases/latest/webfonts/free-fa-brands-400.woff2

172.67.172.121

200 OK

77 kB

URL GET HTTP/3
kit-free.fontawesome.com/releases/latest/webfonts/free-fa-brands-400.woff2
IP
172.67.172.121:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerLet's Encrypt
Subjectkit-free.fontawesome.com
Fingerprint11:3F:AD:BC:52:B9:78:DD:34:9E:75:8B:93:4E:F3:6B:D8:EA:73:37
ValiditySun, 07 May 2023 02:32:03 GMT - Sat, 05 Aug 2023 02:32:02 GMT

File type
Web Open Font Format (Version 2), TrueType, length 76736, version 331.-31196\012- data
Size
77 kB (76736 bytes)
Hash
4f5ec865a8274ab291b6a42b5f70639e
6f00f8c75208b96e585646824c4011093446acd2
b5be0732ab1cc16692e165a7950810f0c772e400f6a2f63e1026a0b938016813

HTTP Headers

GET /releases/latest/webfonts/free-fa-brands-400.woff2 HTTP/1.1
Host: kit-free.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://dunwell.seenseen.co
DNT: 1
Connection: keep-alive
Referer: https://kit-free.fontawesome.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:09 GMT
content-type: font/woff2
content-length: 76736
x-amz-id-2: XC9uqoH0HHiGkv0JUIaPCqWIYU+92DID2YdlxpZUJ+3kFw24kRPwd3rDFl5zKlCgSrKgKDbnq6U=
x-amz-request-id: FKF502GX0NYWVQDZ
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified: Wed, 04 Aug 2021 21:26:53 GMT
etag: "4f5ec865a8274ab291b6a42b5f70639e"
cache-control: max-age=1800
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u%2BfpQY%2BZJVMqBOVqsaxxnKB7zdJroc%2BoS9vPunhMHfDGSv70vDvjVsScmnbeMtcDoxghLkbbBQ90sumWhwPEXtwGzbDgV4%2FW2Y8OZHDpqUO4p%2BR4XSzlqww4vjq0tyT%2Bp17O%2F%2Boe4oioY18%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d2c7e5a0c2bb517-OSL
alt-svc: h3=":443"; ma=86400

s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js

52.218.248.8

200 OK

176 kB

URL GET HTTP/1.1
s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js
IP
52.218.248.8:443
ASN
#16509 AMAZON-02

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerAmazon
Subject*.s3-us-west-2.amazonaws.com
Fingerprint4B:CD:30:FC:7D:85:73:AF:B7:B6:E7:68:00:54:01:3B:0E:B6:CD:10
ValidityTue, 11 Apr 2023 00:00:00 GMT - Thu, 28 Dec 2023 23:59:59 GMT

File type
ASCII text, with very long lines (544)
Size
176 kB (176433 bytes)
Hash
f0b02d9f2d3c6679556e63935ac23320
384bb74cdb2840da6eaa9400242faf4a2fac3daa
f708ad894d421f32ed297a914632db6bc1577841d1c210b34f1a0821ea0aaa4b

HTTP Headers

GET /s.cdpn.io/3/jquery.inputmask.bundle.js HTTP/1.1
Host: s3-us-west-2.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: X6oflNIFWbbbJnp45dKWWNiIZASedvJyKaRGdFYNlYYFnAS+o5lQNHLGOUyyjSxkyiQQoPbCC4I=
x-amz-request-id: YEC44CG7TSC799TX
Date: Tue, 06 Jun 2023 00:21:09 GMT
Last-Modified: Wed, 30 Nov 2016 13:28:36 GMT
ETag: "f0b02d9f2d3c6679556e63935ac23320"
Cache-Control: public
Expires: Mon, 30 Nov 2026 13:28:34 GMT
x-amz-version-id: null
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Content-Length: 176433

dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/chronopost_tours_03712200_113425863.jpg

188.114.96.1

200 OK

14 kB

URL GET HTTP/3
dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/chronopost_tours_03712200_113425863.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerGoogle Trust Services LLC
Subject*.seenseen.co
Fingerprint24:EF:FE:BE:6F:5D:8F:63:AB:27:01:9C:B0:30:F0:92:84:2F:F3:86
ValidityTue, 11 Apr 2023 03:49:52 GMT - Mon, 10 Jul 2023 03:49:51 GMT

File type
JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 250x250, components 3\012- data
Size
14 kB (14094 bytes)
Hash
df1086e658818d5b7ac4d7e8af7ed2c6
621741b6c59d7703ea055f3598d6b03a86829140
2309a3b42db8684ed57dce9e29ed418477acb7740b979a15004f3e1f28b5e5ca

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chronopost

HTTP Headers

GET /mail/BIbAZTGkMv4125/sourceApp/img/chronopost_tours_03712200_113425863.jpg HTTP/1.1
Host: dunwell.seenseen.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:07 GMT
content-type: image/jpeg
content-length: 14094
last-modified: Mon, 05 Jun 2023 03:17:50 GMT
etag: "647d53de-370e"
cache-control: public, max-age=2592000
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3DuXiW8Rj8ImUCcTFNmsJ6sAuJRmEvg6UCoxtA9u%2FUuAzdRjKGAWucFAG4VaoHyf1kv6bYUMsF%2FNWogT9jw4b1lVlk4NJISHqrQ5Bqyf%2F%2FAfo8mLnCiOANEgHRMDc4eE8Ss2lcUI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d2c7e539febb517-OSL
alt-svc: h3=":443"; ma=86400

dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/chronopost_if.js

188.114.96.1

200 OK

3.5 kB

URL GET HTTP/3
dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/chronopost_if.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerGoogle Trust Services LLC
Subject*.seenseen.co
Fingerprint24:EF:FE:BE:6F:5D:8F:63:AB:27:01:9C:B0:30:F0:92:84:2F:F3:86
ValidityTue, 11 Apr 2023 03:49:52 GMT - Mon, 10 Jul 2023 03:49:51 GMT

File type
ASCII text, with very long lines (3869), with no line terminators
Size
3.5 kB (3483 bytes)
Hash
239c06d8e5ac9f3dc90ef441505f1e69
643482843c7e84884e3f8fe6597b767b99674ad1
04993dd0e1e54c7270ff67475c659dac01d6eaa244643f7274473ba2ffded4a5

HTTP Headers

GET /mail/BIbAZTGkMv4125/sourceApp/chronopost_if.js HTTP/1.1
Host: dunwell.seenseen.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:08 GMT
content-type: application/javascript
last-modified: Mon, 05 Jun 2023 03:17:50 GMT
vary: Accept-Encoding
etag: W/"647d53de-d9b"
cache-control: public, max-age=2592000
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EacyrDyzMAw1TfEcxwnbEZ0rdqV7%2BTrgaRz3msZhUkpXBZ3yOG3Sw%2BUVD1cIRwf9UIaefLmNtj%2F4kOAAuTMlk0j6pJ9JHIgY4dY%2FnUo4fl57hebo2uJog8mta5s61KRxhfFfCVeB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d2c7e539feab517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/favicon.ico

188.114.96.1

200 OK

32 kB

URL GET HTTP/3
dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/img/favicon.ico
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerGoogle Trust Services LLC
Subject*.seenseen.co
Fingerprint24:EF:FE:BE:6F:5D:8F:63:AB:27:01:9C:B0:30:F0:92:84:2F:F3:86
ValidityTue, 11 Apr 2023 03:49:52 GMT - Mon, 10 Jul 2023 03:49:51 GMT

File type
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel\012- data
Size
32 kB (32038 bytes)
Hash
dcab71ebc93152daf929fb28339ed0fe
ffe045a4c0bf1f17083bb3458146bd9017cb5781
9fe9ceea600ac587b9df4e87ac5099ae40f7957965743bc500231b466557e041

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Chronopost

HTTP Headers

GET /mail/BIbAZTGkMv4125/sourceApp/img/favicon.ico HTTP/1.1
Host: dunwell.seenseen.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:09 GMT
content-type: image/x-icon
last-modified: Mon, 05 Jun 2023 03:18:16 GMT
vary: Accept-Encoding
etag: W/"647d53f8-7d26"
cache-control: public, max-age=2592000
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hmlW7K2fh3I2s161chaL6NZrWneyRO9RV1ZvxUV%2FDTB%2BynPnf%2BX5IQFii%2BplAvtVuhpNGl%2BK92d5nLIb1ZCTIyh%2FeUpvfZHdWh%2B0nReoblWFE2a%2BGt%2F4UvWw4rKFEumsLrGLyAOj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d2c7e5c0d43b517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

kit-free.fontawesome.com/releases/latest/css/free.min.css

172.67.172.121

200 OK

60 kB

URL GET HTTP/2
kit-free.fontawesome.com/releases/latest/css/free.min.css
IP
172.67.172.121:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerLet's Encrypt
Subjectkit-free.fontawesome.com
Fingerprint11:3F:AD:BC:52:B9:78:DD:34:9E:75:8B:93:4E:F3:6B:D8:EA:73:37
ValiditySun, 07 May 2023 02:32:03 GMT - Sat, 05 Aug 2023 02:32:02 GMT

File type
ASCII text, with very long lines (60130)
Size
60 kB (60312 bytes)
Hash
a12ec7ebe75a4d59a5dd6b79e2ba2e16
28f5dcc595ee6d4163481ef64170180502c8629b
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

HTTP Headers

GET /releases/latest/css/free.min.css HTTP/1.1
Host: kit-free.fontawesome.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 06 Jun 2023 00:21:07 GMT
content-type: text/css
x-amz-id-2: OZeBLP45a2GcJRBfl8lbDxCc1bfgvLQ3isZCG3/q48AxmGRx5VerQhS3C2ToX/URMjSEdp544lc=
x-amz-request-id: YXSKPV089932RWSC
last-modified: Wed, 04 Aug 2021 21:22:50 GMT
etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
cache-control: max-age=1800
cf-cache-status: HIT
age: 1605
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EREUGJStk5vtyyVd9LOZLHuSwMDqDETj13iyADfLNeu5InVgHjoOjKW1uEBeA6pcyBqdYgbMhRg903OiqeHc8YyuxDaCrTvVu5%2F1JJS6uaqmpsCiGdKXt5XHbfcivutGvW5lOMv0FZ0Z%2BqY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d2c7e53fe130b41-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

104.18.11.207

200 OK

160 kB

URL GET HTTP/2
stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
IP
104.18.11.207:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint5B:F7:8F:50:AD:E5:5B:5E:8C:4A:39:3D:0C:98:E8:8C:18:4B:3D:8A
ValidityFri, 30 Dec 2022 00:00:00 GMT - Sat, 30 Dec 2023 23:59:59 GMT

File type
ASCII text, with very long lines (65324)
Size
160 kB (160403 bytes)
Hash
3afe15e976734d9daac26310110c4594
4f14a09a606c99a11f8fda15564ef66f70402826
680af6669abc319f9803f0fa26d443df1b6bc29133d88a8e4bea560ffed7288c

HTTP Headers

GET /bootstrap/4.5.0/css/bootstrap.min.css HTTP/1.1
Host: stackpath.bootstrapcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dunwell.seenseen.co
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 06 Jun 2023 00:21:07 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-pullzone: 252412
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestcountrycode: DE
access-control-allow-origin: *
cache-control: public, max-age=31919000
etag: W/"3afe15e976734d9daac26310110c4594"
last-modified: Mon, 25 Jan 2021 22:04:10 GMT
cdn-cachedat: 11/25/2022 23:03:19
cdn-proxyver: 1.03
cdn-requestpullcode: 200
cdn-requestpullsuccess: True
cdn-edgestorageid: 865
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
cdn-status: 200
cdn-requestid: adc8df56f8219b915b7412dd8441b530
cdn-cache: HIT
cf-cache-status: HIT
age: 44820
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 7d2c7e53dcfe0b06-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/style.css

188.114.96.1

200 OK

2.8 kB

URL GET HTTP/3
dunwell.seenseen.co/mail/BIbAZTGkMv4125/sourceApp/style.css
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Certificate
IssuerGoogle Trust Services LLC
Subject*.seenseen.co
Fingerprint24:EF:FE:BE:6F:5D:8F:63:AB:27:01:9C:B0:30:F0:92:84:2F:F3:86
ValidityTue, 11 Apr 2023 03:49:52 GMT - Mon, 10 Jul 2023 03:49:51 GMT

File type
ASCII text, with very long lines (3122), with no line terminators
Size
2.8 kB (2762 bytes)
Hash
30d411c75502aa389386cdb5f60f6e93
f2c685f9be1053e68fb7b53eb5ef727debf03da9
e9ab32e0b557bbcdf6354a6bd20453a10aade2ee06b63effeda45e8ff345629a

HTTP Headers

GET /mail/BIbAZTGkMv4125/sourceApp/style.css HTTP/1.1
Host: dunwell.seenseen.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dunwell.seenseen.co/mail/BIbAZTGkMv4125/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 06 Jun 2023 00:21:08 GMT
content-type: text/css
last-modified: Mon, 05 Jun 2023 03:17:50 GMT
vary: Accept-Encoding
etag: W/"647d53de-aca"
cache-control: public, max-age=2592000
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hg4HzloMbm8EhBNGRF%2BY5j6Jbve4gpNp2UMIhvZxvd2Q9%2BpzyqF1zs%2Fjlb2an5ow%2FMPPLtSkL%2FrheqOY0f%2FboF1GzS3jlCrYjBcJbJ5Cf6OTDgaorE2YyyLMCSm3PAZPvSkIPj%2BE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d2c7e539fe2b517-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (6)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (21)

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP