Overview

URLmediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
IP 188.165.1.159 (France)
ASN#16276 OVH SAS
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2023-01-05 03:04:19 UTC
StatusLoading report..
IDS alerts0
Blocklist alert0
urlquery alerts
11
Phishing - DHL
Tags dhl logistics phishing

Domain Summary (10)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
firefox.settings.services.mozilla.com (2) 867 2020-05-25 20:06:39 UTC 2023-01-04 17:12:37 UTC 35.241.9.150
cdnjs.cloudflare.com (1) 235 2012-05-23 12:49:49 UTC 2023-01-04 17:27:29 UTC 104.17.25.14
content-signature-2.cdn.mozilla.net (1) 1152 2020-11-03 12:26:46 UTC 2023-01-04 17:13:05 UTC 34.160.144.191
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2023-01-04 17:12:20 UTC 34.117.237.239
ocsp.digicert.com (1) 86 2012-05-21 07:02:23 UTC 2023-01-04 20:15:28 UTC 93.184.220.29
nosir.github.io (1) 309655 2014-04-11 12:09:42 UTC 2023-01-04 20:14:10 UTC 185.199.110.153
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2023-01-04 17:22:39 UTC 52.24.78.9
img-getpocket.cdn.mozilla.net (6) 1631 2017-09-01 03:40:57 UTC 2023-01-04 17:14:42 UTC 34.120.237.76
mediagator.net (11) 0 2022-06-28 09:09:29 UTC 2022-12-19 09:01:43 UTC 188.165.1.159 Unknown ranking
r3.o.lencr.org (9) 344 2020-12-02 08:52:13 UTC 2023-01-04 17:12:31 UTC 23.36.77.32

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
 No alerts detected

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 1 reports on IP: 188.165.1.159
Date UQ / IDS / BL URL IP
2023-01-05 03:04:19 +0000 11 - 0 - 0 mediagator.net/dhl/home.php?ip=102.78.165.181 (...) 188.165.1.159


Last 5 reports on ASN: OVH SAS
Date UQ / IDS / BL URL IP
2023-03-29 20:10:54 +0000 0 - 0 - 8 bourgogne-emballages.com/ 46.105.51.211
2023-03-29 20:10:23 +0000 0 - 2 - 0 webmail.macelleriadelcorso.biz/ 146.59.214.72
2023-03-29 20:07:46 +0000 0 - 1 - 0 rastreio.e-negociacao.com.br/ctijwn/inUZ0d1l 51.222.28.219
2023-03-29 20:05:31 +0000 0 - 0 - 25 51.222.196.129/ 51.222.196.129
2023-03-29 19:54:40 +0000 0 - 1 - 0 54-37-142-43.xyz/Getintopc.com/DS.SolidWorks. (...) 54.37.142.43


Last 1 reports on domain: mediagator.net
Date UQ / IDS / BL URL IP
2023-01-05 03:04:19 +0000 11 - 0 - 0 mediagator.net/dhl/home.php?ip=102.78.165.181 (...) 188.165.1.159


Last 5 reports with similar screenshot
Date UQ / IDS / BL URL IP
2023-01-04 20:14:19 +0000 21 - 0 - 4 www.spectrumpharmatech.com/assets/dhl/home.ph (...) 121.240.11.32
2023-01-04 19:28:17 +0000 21 - 0 - 4 www.spectrumpharmatech.com/assets/dhl/home.ph (...) 121.240.11.32
2023-01-04 17:45:52 +0000 21 - 0 - 4 www.spectrumpharmatech.com/assets/dhl/home.ph (...) 121.240.11.32
2023-01-04 12:11:35 +0000 21 - 0 - 0 www.spectrumpharmatech.com/assets/dhl/home.ph (...) 121.240.11.32
2023-01-04 11:18:48 +0000 21 - 0 - 0 www.spectrumpharmatech.com/assets/dhl/home.ph (...) 121.240.11.32

JavaScript

Executed Scripts (6)

Executed Evals (0)

Executed Writes (0)


HTTP Transactions (34)


Request Response
                                        
                                            GET /dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010 HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         188.165.1.159
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
                                        
Server: nginx/1.20.2
Date: Thu, 05 Jan 2023 03:04:07 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://mediagator.net:443/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size:   169
Md5:    9527755784f5014d2c94dcabdf6ae892
Sha1:   941126eba6b0b049b4a09fb846ebd943e894e068
Sha256: 5b111ef9f2dbaf8e8870567dc8e2302efe2b0feb9d4ba62ce74c1039ab663523
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "52EDDDBDA4A3A3B778F61A491B21E6EA439E9D8024189E636B1F37B2DD7226FC"
Last-Modified: Wed, 04 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6818
Expires: Thu, 05 Jan 2023 04:57:46 GMT
Date: Thu, 05 Jan 2023 03:04:08 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "96C2C75F700AB55649882111713CA3CFB2EAF08E404C2BC245A641DC12AE168A"
Last-Modified: Wed, 04 Jan 2023 19:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12672
Expires: Thu, 05 Jan 2023 06:35:20 GMT
Date: Thu, 05 Jan 2023 03:04:08 GMT
Connection: keep-alive

                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Content-Type, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 05 Jan 2023 02:47:48 GMT
age: 980
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    14cd9a0afb6ba9a763651d5112760d1e
Sha1:   75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
Sha256: 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "766BBE15EB1642AC39E9B71669FBB44252471C8DE5ADB555CD1A76DB44FBE7BC"
Last-Modified: Mon, 02 Jan 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9359
Expires: Thu, 05 Jan 2023 05:40:07 GMT
Date: Thu, 05 Jan 2023 03:04:08 GMT
Connection: keep-alive

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2023-02-08-14-47-57.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: zMXKuy1JRfw4Yvwu/aPfS5Ti028BbDLyH8WWh8LAopuU05Uewe1qrRcu2xTPDoq3AdPFQiGhfjs=
x-amz-request-id: SXDR0YRKF4SP7Q3C
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 05 Jan 2023 03:01:34 GMT
age: 154
last-modified: Tue, 20 Dec 2022 14:47:58 GMT
etag: "b1fcd419a4245617397846e8d17233f6"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    b1fcd419a4245617397846e8d17233f6
Sha1:   2a037ce244587640b27ead9a0ec2af4f862d91b2
Sha256: e059b6d834c06e58494c43fb2ff42acbc27c1a1d8f7f30e2f32ca0e167599e2f
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Thu, 05 Jan 2023 03:04:08 GMT
content-length: 12
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "1B1DD5ED86D9820B02FCDD71A0ACE46714C2AFA1FED56FB0A001B2EE201A0D88"
Last-Modified: Tue, 03 Jan 2023 03:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Thu, 05 Jan 2023 09:04:08 GMT
Date: Thu, 05 Jan 2023 03:04:08 GMT
Connection: keep-alive

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         35.241.9.150
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Expires, Pragma, Content-Type, Backoff, Last-Modified, Cache-Control, ETag
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 05 Jan 2023 02:33:37 GMT
age: 1831
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            GET /ajax/libs/imask/3.4.0/imask.min.js HTTP/1.1 
Host: cdnjs.cloudflare.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         104.17.25.14
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Thu, 05 Jan 2023 03:04:08 GMT
content-length: 10899
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e9f-b217"
last-modified: Mon, 04 May 2020 16:11:11 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 7887576
expires: Tue, 26 Dec 2023 03:04:08 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XnIZP7Pq5g96CDhkya3%2Br0N4L9SEyhujKu6hLtNrWhAdoXTrUdXbYRVHueMrNZk%2F3GYIsLuOkUY9uzPQ1ybItjafQSJZu9uYttoHiewVq3S2UggkMQEbp4eXsGlLw8NdaujWkiD1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7848fc1e0e5c0b4d-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (45552)
Size:   10899
Md5:    6dd93e13c5bb3b67dadd0de250ffea2f
Sha1:   961bf5bb7cc4aa32bcd66b9ac34461f7e02d96d3
Sha256: 1238c95de9a6c90c1992853fd140b31d2ec8854a09deaa0d4a2d3136281af5e9
                                        
                                            GET /dhl/lg.svg HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: image/svg+xml
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
content-length: 2040
last-modified: Thu, 02 Dec 2021 04:37:26 GMT
etag: "61a84d86-7f8"
strict-transport-security: max-age=31536000;
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (2040), with no line terminators
Size:   2040
Md5:    d5a053f0005dd58489a461f599b5a508
Sha1:   ba71dd77800ef3d410beb8282d790642bec8193b
Sha256: aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3612
Cache-Control: max-age=111775
Date: Thu, 05 Jan 2023 03:04:08 GMT
Etag: "63b541ab-1d7"
Expires: Fri, 06 Jan 2023 10:07:03 GMT
Last-Modified: Wed, 04 Jan 2023 09:06:51 GMT
Server: ECS (ska/F71E)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /cleave.js/dist/cleave.min.js HTTP/1.1 
Host: nosir.github.io
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         185.199.110.153
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
server: GitHub.com
permissions-policy: interest-cohort=()
x-origin-cache: HIT
last-modified: Tue, 19 May 2020 10:51:11 GMT
access-control-allow-origin: *
etag: W/"5ec3ba1f-528d"
expires: Thu, 05 Jan 2023 00:18:29 GMT
cache-control: max-age=600
content-encoding: gzip
x-proxy-cache: HIT
x-github-request-id: 1788:16A8:55BD0D:724F2A:63B615E8
accept-ranges: bytes
date: Thu, 05 Jan 2023 03:04:08 GMT
via: 1.1 varnish
age: 0
x-served-by: cache-bma1676-BMA
x-cache: HIT
x-cache-hits: 1
x-timer: S1672887849.695587,VS0,VE97
vary: Accept-Encoding
x-fastly-request-id: ef7233c437651aafbb0ceab99392294aec7201fc
content-length: 6354
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (20970)
Size:   6354
Md5:    8378b0a97cdaa165e55a407e99191b8f
Sha1:   b8115b0f8c4b3df2323df521d8bc9d29fe3bf1c8
Sha256: 0b00bad54f9f54a374b05ab0dad2aa0405d1646cfe9a3756d763713af151e5f3

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /dhl/pub.jpg HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
content-length: 82133
last-modified: Thu, 02 Dec 2021 04:37:26 GMT
etag: "61a84d86-140d5"
strict-transport-security: max-age=31536000;
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1024x150, components 3\012- data
Size:   82133
Md5:    5000355f5ce08e172610325f3f5ac5bc
Sha1:   381442803d0a67fa45def5d89d3ff49000e4a28d
Sha256: fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /dhl/pubr.gif HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: image/gif
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
content-length: 8344
last-modified: Thu, 02 Dec 2021 04:37:26 GMT
etag: "61a84d86-2098"
strict-transport-security: max-age=31536000;
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 468 x 60\012- data
Size:   8344
Md5:    8f1cbb67f49a41df278431ef173c6269
Sha1:   d7147e8695b1c4abc80f08fefe36326b2de0cc15
Sha256: 38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET /dhl/favicon.ico HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: image/x-icon
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
content-length: 1150
last-modified: Thu, 02 Dec 2021 04:37:26 GMT
etag: "61a84d86-47e"
strict-transport-security: max-age=31536000;
accept-ranges: bytes
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Size:   1150
Md5:    d8106bf3a1d00ab43b01e6e3c92500eb
Sha1:   202b5e8654ab1b28351378293bca3b9d844cc29b
Sha256: 9ada5709e264c31b04a05bd85448a9bd5e91925e8d83df5cef0762ec97cc283e

Alerts:
  urlquery:
    - Phishing - DHL
    - Phishing - DHL
                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: JDTha3+JOee8wz+r0Yyq2A==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         52.24.78.9
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: agdwiASajROtVW3Thcci4qWyw8o=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "BD2222D291DEEC7BA01875B7DDFD0D27DE71E68FC600057FB3D1FA9394AA46FA"
Last-Modified: Wed, 04 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12937
Expires: Thu, 05 Jan 2023 06:39:47 GMT
Date: Thu, 05 Jan 2023 03:04:10 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "BD2222D291DEEC7BA01875B7DDFD0D27DE71E68FC600057FB3D1FA9394AA46FA"
Last-Modified: Wed, 04 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12937
Expires: Thu, 05 Jan 2023 06:39:47 GMT
Date: Thu, 05 Jan 2023 03:04:10 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "BD2222D291DEEC7BA01875B7DDFD0D27DE71E68FC600057FB3D1FA9394AA46FA"
Last-Modified: Wed, 04 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12937
Expires: Thu, 05 Jan 2023 06:39:47 GMT
Date: Thu, 05 Jan 2023 03:04:10 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "BD2222D291DEEC7BA01875B7DDFD0D27DE71E68FC600057FB3D1FA9394AA46FA"
Last-Modified: Wed, 04 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12937
Expires: Thu, 05 Jan 2023 06:39:47 GMT
Date: Thu, 05 Jan 2023 03:04:10 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "BD2222D291DEEC7BA01875B7DDFD0D27DE71E68FC600057FB3D1FA9394AA46FA"
Last-Modified: Wed, 04 Jan 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12937
Expires: Thu, 05 Jan 2023 06:39:47 GMT
Date: Thu, 05 Jan 2023 03:04:10 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9fa6a01c-46d6-4da2-a9c5-b0c4eb493b7c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 3053
x-amzn-requestid: b8ae4cad-d262-49f9-b70e-37c888c8ae22
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eCvChGxqIAMFTeA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b0f876-018a733e43ae9e2133fa87f5;Sampled=0
x-amzn-remapped-date: Sun, 01 Jan 2023 03:05:26 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: pEeSOFJThFD01adNHnXRNQMvMcXweyChs_1xt4nzpnFhQID00tUZcQ==
via: 1.1 9b311162717b41c968f6f00426d88aaa.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Wed, 04 Jan 2023 05:30:33 GMT
age: 77617
etag: "be216b1693e6049b3896667348c91f7c525d1175"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3053
Md5:    dc01bd9bbc532db4cab1fd75db43eaa0
Sha1:   be216b1693e6049b3896667348c91f7c525d1175
Sha256: 562b35431b14d57d97913b388784d7949908acbc920e4811f15c46b99c0200cc
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F038e46b4-c5e2-4f46-817c-434795e1e545.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 5601
x-amzn-requestid: 54813ea9-9435-4355-910b-5b4d1eadf2ff
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eGlhgHU1oAMFTYA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b282d6-17e772ae5b70371367792063;Sampled=0
x-amzn-remapped-date: Mon, 02 Jan 2023 07:08:06 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: pigrktUzOcu_-Z-HnUPOnmF7yhHIdOv9bB9x7VVONHr7YZXwZAEvZA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Wed, 04 Jan 2023 07:41:03 GMT
age: 69787
etag: "761049019c342553004815ea394dcf282f2cc613"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   5601
Md5:    5ce88a04d7f32ce0497bd84db44da8d4
Sha1:   761049019c342553004815ea394dcf282f2cc613
Sha256: 038aa4e5da1428524de833071814998d6c1d8b8b60d4e9c10e60d8a75f7b88fb
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F343434d9-f716-41aa-8934-1a5f79402aa1.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4248
x-amzn-requestid: 17ccfd69-0d12-42ac-b111-059a68735e70
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eCutmF7mIAMFW2w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b0f7f0-5e1653641a0303815656a578;Sampled=0
x-amzn-remapped-date: Sun, 01 Jan 2023 03:03:12 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: nR6vOzio5JonZZq2SZTwpYBaOUlL9Dw5ntz93jS__r16JEGVqc8Xhw==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Wed, 04 Jan 2023 06:06:12 GMT
age: 75478
etag: "968bc262d2939ec6f0dce9d852682c0aaf86d3d7"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4248
Md5:    008614d302ad57bc6502ad5e07652378
Sha1:   968bc262d2939ec6f0dce9d852682c0aaf86d3d7
Sha256: 5eab9a2591f0f9761ba3b90a5a191b79b6326cccb1ee6b586b00dfc1517c8db6
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa3f96f2f-9480-405d-a177-757b4cdb01db.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8296
x-amzn-requestid: 3dc67582-04fe-45bd-b3c8-0c8f1d228582
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ePK0FEFhIAMFcPQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b5f1b3-5c3a498a15a4219e10e8c3ef;Sampled=0
x-amzn-remapped-date: Wed, 04 Jan 2023 21:37:55 GMT
x-amz-cf-pop: SEA19-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: uOp9PtN3StLD5z7sJewKOfNIVRPEGHMPafVgTyJZUl0Di-DeM_WjCw==
via: 1.1 2241406ac19fffc8f35d6ddef8e22f56.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Wed, 04 Jan 2023 22:15:22 GMT
age: 17328
etag: "ce2e1d0f4925717aca4f2d02dc87c2e16879bcb8"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8296
Md5:    d24a6df88f783b455a57250f1d92ccac
Sha1:   ce2e1d0f4925717aca4f2d02dc87c2e16879bcb8
Sha256: 89b3dfc01030e6329f7f0e2240df218ab037386b5ff87df388e83c680ddccb3d
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F7501442a-ef54-4aa9-a3fa-5362c9f60911.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4974
x-amzn-requestid: 2196cf39-c7fa-4b0b-88d0-04de5751e42f
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eKpNxF2_oAMFuNg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b42257-33a6f0245389c4b570748d0a;Sampled=0
x-amzn-remapped-date: Tue, 03 Jan 2023 12:40:55 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: dbys8Cg5g2xgDY5PCEI8JY8yUjPhExGJbYjlMl1LnhsUVgjONXz2Yw==
via: 1.1 26ca01ec7377e425b59b6a08cb1ec342.cloudfront.net (CloudFront), 1.1 6172bb1a5d00a3b06ae3700570ebe116.cloudfront.net (CloudFront), 1.1 google
date: Wed, 04 Jan 2023 08:01:35 GMT
age: 68555
etag: "f79bc11eb9f5db4d750468d3c896502fdd2b7b23"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4974
Md5:    17023e595d475bd09cd8768fe4099525
Sha1:   f79bc11eb9f5db4d750468d3c896502fdd2b7b23
Sha256: cccac0d1215a6f0f285dd89c614d2580a2a7fb7c00eff50a8606c78921569b25
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F625ac435-5ac8-46ca-9178-7aa9cb621f60.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 8307
x-amzn-requestid: 008b9a75-d739-4c2b-97ee-125dab1961a2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: eH6EJF0uIAMFd8g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63b30a1a-3f738a875090ce970fba51f5;Sampled=0
x-amzn-remapped-date: Mon, 02 Jan 2023 16:45:14 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: -2r9e3QyrKCQGQVFWS-XL71lb7b3DyO1Svt4tTWZlh6Cnzoo2rnaFg==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 05 Jan 2023 02:24:43 GMT
age: 2367
etag: "09d31b45d4cc16c4d321e616e5445d9ba921a1ba"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   8307
Md5:    c820340d5ed98c9573754e3a749bf40c
Sha1:   09d31b45d4cc16c4d321e616e5445d9ba921a1ba
Sha256: 2a69c58358ae763ddef6603f783d7d25c465ff4d3777e6bd540c1b673381813a
                                        
                                            GET /dhl/date.js HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
last-modified: Thu, 02 Dec 2021 04:37:26 GMT
etag: W/"61a84d86-7d"
strict-transport-security: max-age=31536000;
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /dhl/script.js HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
last-modified: Thu, 02 Dec 2021 04:37:26 GMT
etag: W/"61a84d86-17e3b"
strict-transport-security: max-age=31536000;
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /dhl/style.js HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: application/javascript
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
last-modified: Thu, 02 Dec 2021 04:37:26 GMT
etag: W/"61a84d86-17db1"
strict-transport-security: max-age=31536000;
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010 HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
strict-transport-security: max-age=31536000;
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /dhl/style.css HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
last-modified: Thu, 02 Dec 2021 04:37:26 GMT
etag: W/"61a84d86-3ce78"
strict-transport-security: max-age=31536000;
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
                                        
                                            GET /dhl/cc.css HTTP/1.1 
Host: mediagator.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://mediagator.net/dhl/home.php?ip=102.78.165.181&countryCode=MA&OS=Windows%2010
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers

search
                                         188.165.1.159
HTTP/2 200 OK
content-type: text/css
                                        
server: nginx/1.20.2
date: Thu, 05 Jan 2023 03:04:08 GMT
last-modified: Thu, 02 Dec 2021 04:37:26 GMT
etag: W/"61a84d86-15cf"
strict-transport-security: max-age=31536000;
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---