Report - nxzjevmykp.rafiki.asia/vnafvra97w?q=6672320199&id=u2.3

Report Overview

Submitted URL
nxzjevmykp.rafiki.asia/vnafvra97w?q=6672320199&id=u2.3
IP
31.41.244.107
ASN
#0
Submitted
2023-02-03 07:01:12
Access
Website Title
Final URL
Tags
dhl logistics phishing
urlquery detections
Phishing - DHL

Detections

urlquery
53
Network Intrusion Detection
1
Threat Detection Systems
38

Domain Summary

Domain / FQDN	Rank	First Seen	Last Seen	Sent	Received	IP
content-signature-2.cdn.mozilla.net	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413 B	5.8 kB	34.160.144.191
nxzjevmykp.rafiki.asia	unknown			385 B	449 B	31.41.244.107
contile.services.mozilla.com	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333 B	391 B	34.117.237.239
push.services.mozilla.com	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606 B	127 B	52.35.120.215
tracking-75403.laforma.co.za	unknown	2023-02-02T13:54:38Z	2023-03-07T17:30:32Z	13 kB	860 kB	185.38.142.20
img-getpocket.cdn.mozilla.net	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3.2 kB	50 kB	34.120.237.76
r3.o.lencr.org	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	3.4 kB	8.9 kB	23.36.77.32
firefox.settings.services.mozilla.com	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	782 B	2.4 kB	35.241.9.150

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-02-03 07:01:31	medium	Client IP	31.41.244.107	ET INFO HTTP Request to a *.asia domain

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/ef26e96ccca611ecaebeb178?page=u2.3	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/js/jquery-1.12.2.min.js	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/paypal.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/visa.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/dhl-official.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/amex.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/dhl-group.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/phplib/ajax.php?id=ef26e96ccca611ecaebeb178	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/fonts/delivery-bd.woff2	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/fonts/delivery-rg.woff2	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/fonts/delivery-cdblk.woff2	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/sprite.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/dhl-ssl-logo.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/mastercard.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/sepapay.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/icons-nepal.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/giropay.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/rating-play-store.svg	Phishing
2023-02-03	medium	tracking-75403.laforma.co.za/verfolgung/img/icon-sprite.svg	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	tracking-75403.laforma.co.za/verfolgung/js/jquery-1.12.2.min.js	97 kB	2023-03-07	2024-04-20
Pretty URL tracking-75403.laforma.co.za/verfolgung/js/jquery-1.12.2.min.js IP 185.38.142.20 ASN #47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:39:30 Last Seen2024-04-20 08:14:21 Times Seen31117 Hash bdc2b7efb1faf219d65edfe253a103e9 4921529fc15b8133f2fe65b3bebf53d1e9ef8579 95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9 Loading...

	tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3	903 B	2023-03-13	2023-03-13
Pretty URL tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3 IP 185.38.142.20 ASN #47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-13 15:36:09 Last Seen2023-03-13 15:36:09 Times Seen1 Hash 7177d3bb6d8e8e2ad84fa6edb54d56cd 9bcaeac429763e9b3a203abd1bb8f2f46535191e 4831f6c6e4973006edb2976e0726fe2a4b350e6af64d563cbb13c22f3336b131 Loading...

	tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3	141 B	2023-03-07	2024-04-20
Pretty URL tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3 IP 185.38.142.20 ASN #47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:42:09 Last Seen2024-04-20 08:14:21 Times Seen11593 Hash 42f8700a35ca70b82cd749f20e7bf849 bbeea25f4f83161e23997dbf4e0fa8a909825a05 ee3ffd02317a94b02acb151698827b68d47896b38ae53f6918703557f9a938c6 Loading...

	tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3	214 B	2023-03-07	2024-04-20
Pretty URL tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3 IP 185.38.142.20 ASN #47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:29:18 Last Seen2024-04-20 08:14:21 Times Seen11590 Hash 60480af0c7b84a8db11f568bdfc1f343 c0289fa1764697be2aba314e6b743ef0f33d40c2 8fc08ef287bb85ed813cab365db65493074410cc07ade1993e6a666dd0d9cf8e Loading...

HTTP Transactions (49)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d4e95d0d8982bcd07804baf6fc88231c
5027abda0875bd2529dd4d6691784c74da71a9ee
373799b5749d2cb08b5721699a3e4c6b94b0d41604ac07d4ef7179e47dabc71f

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "373799B5749D2CB08B5721699A3E4C6B94B0D41604AC07D4EF7179E47DABC71F"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3506
Expires: Fri, 03 Feb 2023 07:59:27 GMT
Date: Fri, 03 Feb 2023 07:01:01 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
e935ea42be4feaed61a824b0b903913e
f966cfa80d65a805cb9d7c6a53b3340865d7c51a
eb0ce9ae50d156fe5924b2d77346735e4e93b5240cff301c9aa835bb0b385815

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "EB0CE9AE50D156FE5924B2D77346735E4E93B5240CFF301C9AA835BB0B385815"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17312
Expires: Fri, 03 Feb 2023 11:49:33 GMT
Date: Fri, 03 Feb 2023 07:01:01 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size
939 B (939 bytes)
Hash
30db107dcf4380cef05efea409c2e6a3
96e6a306fbc07299aba64e5c14e2bfca35872fa9
b64051a4a8e346e3c72b2aef77f360a5736ab5e16711d8e0bae3876feaa15b6e

HTTP Headers

GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Backoff, Retry-After, Content-Length, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 03 Feb 2023 06:36:10 GMT
content-type: application/json
age: 1491
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
7d2222d41721947297aaeb5a6e3d0714
04cc1ee417c8bf6338657fd4c2e4e1c1ddfd3065
de0e45969a2ad95e52f7e2fbd0d021d9075dd7b14666c929346efe111f648f7c

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DE0E45969A2AD95E52F7E2FBD0D021D9075DD7B14666C929346EFE111F648F7C"
Last-Modified: Thu, 02 Feb 2023 16:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9788
Expires: Fri, 03 Feb 2023 09:44:09 GMT
Date: Fri, 03 Feb 2023 07:01:01 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain

34.160.144.191

200 OK

5.3 kB

URL HTTP/2
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain
IP
34.160.144.191:0
ASN
#15169 GOOGLE

File type
PEM certificate\012- , ASCII text
Size
5.3 kB (5348 bytes)
Hash
7b922915ebf1fa3639b333f994c74f24
144a3f80b98fd0652d4614f24cf6cbbee40f8938
adbb3e06df0e870f5c7a9cb81e8979d4e92735853d75c9b779c06470d4db5d9c

HTTP Headers

GET /chains/remote-settings.content-signature.mozilla.org-2023-02-28-18-04-20.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
x-amz-id-2: sJs4tp5U9oU2VTZWcSYNf+cNHw6+QiS0xLe0vzQs0Hc4nsV55HZvD6spABAl2fkFewdE7i33uEw=
x-amz-request-id: SWR0E6TA8T2558NJ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 03 Feb 2023 06:52:18 GMT
age: 523
last-modified: Mon, 09 Jan 2023 18:04:21 GMT
etag: "7b922915ebf1fa3639b333f994c74f24"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

nxzjevmykp.rafiki.asia/vnafvra97w?q=6672320199&id=u2.3

31.41.244.107

302 Found

0 B

URL HTTP/1.1
nxzjevmykp.rafiki.asia/vnafvra97w?q=6672320199&id=u2.3
IP
31.41.244.107:0
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

NIDS	Severity	Alert
suricata	medium	ET INFO HTTP Request to a *.asia domain

HTTP Headers

GET /vnafvra97w?q=6672320199&id=u2.3 HTTP/1.1
Host: nxzjevmykp.rafiki.asia
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

HTTP/1.1 302 Found
Server: nginx/1.14.0 (Ubuntu)
Date: Fri, 03 Feb 2023 07:01:01 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
Set-Cookie: 0d645788ce21351ae419af1854fa7e9d=0; expires=Sat, 04-Feb-2023 07:01:01 GMT; Max-Age=86400; path=/; secure; HttpOnly; SameSite=None
Location: https://tracking-75403.laforma.co.za/verfolgung/ef26e96ccca611ecaebeb178?page=u2.3

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

12 B

URL HTTP/2
contile.services.mozilla.com/v1/tiles
IP
34.117.237.239:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with no line terminators
Size
12 B (12 bytes)
Hash
23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 03 Feb 2023 07:01:01 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US

35.241.9.150

200 OK

329 B

URL HTTP/2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
35.241.9.150:0
ASN
#15169 GOOGLE

File type
JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size
329 B (329 bytes)
Hash
0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300

HTTP Headers

GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Pragma, Backoff, Retry-After, Content-Length, Last-Modified, Expires, Cache-Control, ETag, Alert, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 03 Feb 2023 06:07:19 GMT
age: 3223
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
acbfd1d5f70f7354bf2f0377344d1a08
5b2b151cbfb6c57bfbe8c58b669cfd41b3feef80
2006b7a8919d125f328563edae0bd8934112292c1de4a2e9ede58e9eb86ad732

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "2006B7A8919D125F328563EDAE0BD8934112292C1DE4A2E9EDE58E9EB86AD732"
Last-Modified: Thu, 02 Feb 2023 12:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21524
Expires: Fri, 03 Feb 2023 12:59:46 GMT
Date: Fri, 03 Feb 2023 07:01:02 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
8913af0be619500295008bb91f506660
a7b8068ba9aa506205a295b24458c2616997a0d1
6a9838d00256431807ca382fc205064b07c08d5054f2895c2ae3cc4e9094179a

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "6A9838D00256431807CA382FC205064B07C08D5054F2895C2AE3CC4E9094179A"
Last-Modified: Wed, 01 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4083
Expires: Fri, 03 Feb 2023 08:09:05 GMT
Date: Fri, 03 Feb 2023 07:01:02 GMT
Connection: keep-alive

push.services.mozilla.com/

52.35.120.215

101 Switching Protocols

0 B

URL HTTP/1.1
push.services.mozilla.com/
IP
52.35.120.215:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: Rh3EEo+yjYfN5R5LJNCnnA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: JarbX/fg93H82z5WbGqZeX8J+3I=

tracking-75403.laforma.co.za/verfolgung/ef26e96ccca611ecaebeb178?page=u2.3

185.38.142.20

302 Found

88 B

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/ef26e96ccca611ecaebeb178?page=u2.3
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
HTML document, ASCII text, with no line terminators
Size
88 B (88 bytes)
Hash
adfd4a4bc4eba542097e9b3463d0b2c8
0a1ff56e1747044e071fced92c24cf7f880a62cb
bd1ebacd1fe3544012481bb565470df7cd85281249f9aee91750b6f2ef94e80a

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

GET /verfolgung/ef26e96ccca611ecaebeb178?page=u2.3 HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 302 Found
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:03 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 88
Connection: keep-alive
X-Powered-By: PHP/5.4.16
location: tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17597
Expires: Fri, 03 Feb 2023 11:54:20 GMT
Date: Fri, 03 Feb 2023 07:01:03 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17597
Expires: Fri, 03 Feb 2023 11:54:20 GMT
Date: Fri, 03 Feb 2023 07:01:03 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17597
Expires: Fri, 03 Feb 2023 11:54:20 GMT
Date: Fri, 03 Feb 2023 07:01:03 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17597
Expires: Fri, 03 Feb 2023 11:54:20 GMT
Date: Fri, 03 Feb 2023 07:01:03 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503 B

URL HTTP/1.1
r3.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
503 B (503 bytes)
Hash
d719402de0cd695e55dab2767247da49
f12f4795987a284820f6785ec16b5032b9861d79
98a14bd950cec10aeb3d76fa956fe13514f52c742adbded7a0fcef218c7195ba

HTTP Headers

POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "98A14BD950CEC10AEB3D76FA956FE13514F52C742ADBDED7A0FCEF218C7195BA"
Last-Modified: Wed, 01 Feb 2023 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17597
Expires: Fri, 03 Feb 2023 11:54:20 GMT
Date: Fri, 03 Feb 2023 07:01:03 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F64144d1c-f524-496f-8b52-ba63714dbfc5.jpeg

34.120.237.76

200 OK

12 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F64144d1c-f524-496f-8b52-ba63714dbfc5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
12 kB (11565 bytes)
Hash
e366b32074025aaf60bbae8bdb08d330
a52c2883bad98fa20333aa639a5dd3a5bf544c8e
9d661c26effaec9efee16833f6459d6ecbe4f77b822c9c46e2a6433bda816e5c

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F64144d1c-f524-496f-8b52-ba63714dbfc5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 11565
x-amzn-requestid: 87a84ffd-1176-4656-aac4-e98f38ec2cd9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fboIrFGboAMFyyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d48704-162ed8114aa1809204500548;Sampled=0
x-amzn-remapped-date: Sat, 28 Jan 2023 02:23:00 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: w0Zm5V0TQxsQ7917U3fdhS_n7qKE143PuhI2JmNCDM_Pf0yPLyW6yA==
via: 1.1 d83ae0e1ba84e92e58bc1efc23a0c652.cloudfront.net (CloudFront), 1.1 32c16f33c8f5601364fa8229b0d74dc2.cloudfront.net (CloudFront), 1.1 google
date: Thu, 02 Feb 2023 21:48:01 GMT
age: 33182
etag: "a52c2883bad98fa20333aa639a5dd3a5bf544c8e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

6.8 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffda40dcf-1e5b-4e49-bd65-084935f52db9.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
6.8 kB (6791 bytes)
Hash
e706db8a6107758a148463e916f2532d
4b0b8cb5ced3e3e67b0320a3bbaecd2176e21b81
673f18036a53f8ff297ef6a63fd094e7c41d90f3960f0e687a741cc7dd3f6172

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ffda40dcf-1e5b-4e49-bd65-084935f52db9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 6791
x-amzn-requestid: 665115ea-728e-4a55-aaf8-b09db3fa67a2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: ffl96FIzIAMFYGg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d61d25-0abbd7262ca10b7a7d2bf9eb;Sampled=0
x-amzn-remapped-date: Sun, 29 Jan 2023 07:15:49 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: nPgaBSGyLJQnN0ofVRFniW2LqzgKVWchSKYSjYCmuPtpL9Ner81ARQ==
via: 1.1 446313511980eb02f28ff5a9a4147c0a.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Thu, 02 Feb 2023 22:14:03 GMT
age: 31620
etag: "4b0b8cb5ced3e3e67b0320a3bbaecd2176e21b81"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

3.1 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3c9d26d7-b28f-485c-91d6-67a0813a0f3c.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
3.1 kB (3083 bytes)
Hash
0c1c2a5a291f23be6591c9b19db47b47
2f67cdba4a3d5a8cf6f6eb7951d2a1bda6e01619
327efb8c72421819992900ab0f8f267da7d28122c710b8694979116579d512c6

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3c9d26d7-b28f-485c-91d6-67a0813a0f3c.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 3083
x-amzn-requestid: 7a4f094b-a423-401e-a9e7-8d9f130e2e40
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fi1drEtKIAMFuYQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d76924-66751080608a6cd2650b853d;Sampled=0
x-amzn-remapped-date: Mon, 30 Jan 2023 06:52:20 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: UoXATdGOgEK3Unxszcp4ulAK3b1BuHS2MbUzTHe-qxjNZkb2eoxE-A==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Thu, 02 Feb 2023 21:44:49 GMT
age: 33374
etag: "2f67cdba4a3d5a8cf6f6eb7951d2a1bda6e01619"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fedd456a0-d42f-4b40-ad63-ea1dcfaf69eb.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
10 kB (10166 bytes)
Hash
2a6aaf87a867f93dc9268a8b27973b97
f52ccbe6cbced1994acb13a00b05436553b6813e
3fbd7441712035f4d53c17eec93bc278e6c072043f3b5a721cac349fc0dabe77

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fedd456a0-d42f-4b40-ad63-ea1dcfaf69eb.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 10166
x-amzn-requestid: 54fe0d12-360f-4d97-bcf3-b24747d956aa
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fY_4zHEcoAMF1iA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d379d1-4ba89e44005f616a0ed3ed24;Sampled=0
x-amzn-remapped-date: Fri, 27 Jan 2023 07:14:25 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: hSyEfSDToqgfnFIW68Krz-ANYUNQoUPWhyb-8xDUarI6mnVLXriHDQ==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 476c2ba6d9f6cd69dbcedbd65688cbc0.cloudfront.net (CloudFront), 1.1 google
date: Thu, 02 Feb 2023 21:59:54 GMT
age: 32469
etag: "f52ccbe6cbced1994acb13a00b05436553b6813e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

7.2 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F91a53e95-81db-4f71-84bc-169a72e11b24.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
7.2 kB (7237 bytes)
Hash
d4242d4999b7b033873b81a482c319c2
bc4c004065ce9f558f210d508844c123a85737a1
ab35a5c1a7c1a0a548aee3b9c301893799680ec1922c13e7a16d44ca457cd91d

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F91a53e95-81db-4f71-84bc-169a72e11b24.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 7237
x-amzn-requestid: f6aa0d26-8df4-40fe-8984-1aac7c76097e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fVr4jEdeIAMFTYA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d2269c-58a038d6491d8f461e9168d4;Sampled=0
x-amzn-remapped-date: Thu, 26 Jan 2023 07:07:08 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: XNO6ArxsjiZTxcoSn1Fmhso5bpWNIvzT9nplF6UGTiHVxXlJiv7bJA==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 ce71f64ad5dca81beca846466f2d5008.cloudfront.net (CloudFront), 1.1 google
date: Thu, 02 Feb 2023 21:58:40 GMT
age: 32543
etag: "bc4c004065ce9f558f210d508844c123a85737a1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

5.3 kB

URL HTTP/2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8458d532-a4e7-4e54-9165-f01ff92729f5.jpeg
IP
34.120.237.76:0
ASN
#15169 GOOGLE

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size
5.3 kB (5256 bytes)
Hash
fe87e986c62630127a7fdd979c802947
28ce91c8643c4bc4dcc4cd26dfc69dc6219ce5bf
770a765c927c0f81d0c41acd45a7a24f5799f9497fcc73489cab4fafbf994bdb

HTTP Headers

GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8458d532-a4e7-4e54-9165-f01ff92729f5.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
content-length: 5256
x-amzn-requestid: b0455eb8-b10c-4328-8abe-65c5184f6654
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: frx7uFcooAMFpxQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dafd17-553139816e1fb7b65e683dc6;Sampled=0
x-amzn-remapped-date: Thu, 02 Feb 2023 00:00:23 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: pwRBB72InX8OP4KXpQKTs9T4iMY0E3hPX8Nko9gd7m1BOm8_DqbRaA==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Fri, 03 Feb 2023 00:37:24 GMT
age: 23019
etag: "28ce91c8643c4bc4dcc4cd26dfc69dc6219ce5bf"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

tracking-75403.laforma.co.za/verfolgung/css/6.css

185.38.142.20

200 OK

4.3 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/css/6.css
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
ASCII text, with CRLF line terminators
Size
4.3 kB (4271 bytes)
Hash
8eb7809b45d4079fbaa48175f64c7441
f865a99867d1eac58a575a518996ae2e9ca1de95
00d16054bb78393fecfbeff7eed0d44e005ebe51f034c838c1f69bdfddf40b01

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /verfolgung/css/6.css HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:05 GMT
Content-Type: text/css
Content-Length: 4271
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:18:34 GMT
ETag: "10af-5edc1e53cee80"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/css/3.css

185.38.142.20

200 OK

22 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/css/3.css
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
ASCII text, with CRLF line terminators
Size
22 kB (22046 bytes)
Hash
c54f6668454402879168d2782296d35e
dd3c72855079f3d074cfe6fd500959874650c736
d40a85d0988ad1b83645365ac9bd5ef15ed33517733d847317f86c6ea271ad32

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /verfolgung/css/3.css HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:05 GMT
Content-Type: text/css
Content-Length: 22046
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "561e-5edc1b80ec500"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3

185.38.142.20

200 OK

121 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1304), with CRLF line terminators
Size
121 kB (120762 bytes)
Hash
526161b83fba08abf96ec360bbabf904
467eca3bf184719ecce86eca754426b39d8af293
f10067a762ff00c85aa6a632b323a8e2e37c18e59df9f83108c45c3c0d1d69f6

HTTP Headers

GET /verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3 HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:04 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.16

tracking-75403.laforma.co.za/verfolgung/css/2.css

185.38.142.20

200 OK

48 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/css/2.css
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
ASCII text, with very long lines (661), with CRLF line terminators
Size
48 kB (48503 bytes)
Hash
68bb9d41de0ac82959f8f90c552e4948
fb4e7fd67a692ae70e6b3813fe7913f0c3800103
a0879b822817892ccecb11bc4c475d4bf3aad5e03a37a49eae46dfbdcf9e8fb3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /verfolgung/css/2.css HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:05 GMT
Content-Type: text/css
Content-Length: 48503
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "bd77-5edc1b80ec500"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/css/5.css

185.38.142.20

200 OK

48 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/css/5.css
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
ASCII text, with very long lines (661), with CRLF line terminators
Size
48 kB (48507 bytes)
Hash
67f662870fef3deea83c75f68622a1e4
45bdedb38dca005081238b4cf80fa10c90778465
8fd91a16c9b120c1f43fecdb1d40a9adf7e6dc05b69c3261c342ea76ecc50c2d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /verfolgung/css/5.css HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:05 GMT
Content-Type: text/css
Content-Length: 48507
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "bd7b-5edc1b80ec500"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/css/1.css

185.38.142.20

200 OK

54 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/css/1.css
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
ASCII text, with very long lines (23076), with CRLF line terminators
Size
54 kB (53751 bytes)
Hash
c773c2e44cb33bd02d04987a8017056b
af122938b5fab20abed2fd9df00af09e66294222
a116a577d744fd0c240b7f1c1b3139cc0d61b953d36fe2b61506e379e9c8bc0a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /verfolgung/css/1.css HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:05 GMT
Content-Type: text/css
Content-Length: 53751
Connection: keep-alive
Last-Modified: Fri, 18 Nov 2022 17:05:56 GMT
ETag: "d1f7-5edc1b80ec500"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/js/jquery-1.12.2.min.js

185.38.142.20

200 OK

97 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/js/jquery-1.12.2.min.js
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
ASCII text, with very long lines (32029)
Size
97 kB (97244 bytes)
Hash
bdc2b7efb1faf219d65edfe253a103e9
4921529fc15b8133f2fe65b3bebf53d1e9ef8579
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/js/jquery-1.12.2.min.js HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:05 GMT
Content-Type: application/javascript
Content-Length: 97244
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "17bdc-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/paypal.svg

185.38.142.20

200 OK

3.4 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/paypal.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (3369), with no line terminators
Size
3.4 kB (3369 bytes)
Hash
4ac4e26be0277fab62f57835bca7ee1e
edef7e834db1d63bd5290adf1f0308522cced7e0
5e9402048b0efae8235057fc5db4276b0472c9a42c59c0b759e059ffbdafb32b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/paypal.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:06 GMT
Content-Type: image/svg+xml
Content-Length: 3369
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "d29-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/visa.svg

185.38.142.20

200 OK

4.6 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/visa.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1577)
Size
4.6 kB (4586 bytes)
Hash
09d8b96a0853e0bc8cec7c677c0da93b
a6aebdb9c339cac93762338353517b67e23f1903
a60079ce89803190740ddcf6e03eace0492b8f73ec57ffb4132b72a9736b68fe

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/visa.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:06 GMT
Content-Type: image/svg+xml
Content-Length: 4586
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "11ea-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/dhl-official.svg

185.38.142.20

200 OK

2.0 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/dhl-official.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (2040), with no line terminators
Size
2.0 kB (2040 bytes)
Hash
d5a053f0005dd58489a461f599b5a508
ba71dd77800ef3d410beb8282d790642bec8193b
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/dhl-official.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:06 GMT
Content-Type: image/svg+xml
Content-Length: 2040
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "7f8-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/amex.svg

185.38.142.20

200 OK

734 B

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/amex.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (565)
Size
734 B (734 bytes)
Hash
1c003076f46fc215f19de22568f3b5a1
112caa9374e6c1d0f8325cdcf2bde5b073f0f1ad
b64feafef2104c77f092f2bbfa526bad76e17fb053591284984e86a28ed721a2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/amex.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:06 GMT
Content-Type: image/svg+xml
Content-Length: 734
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "2de-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/dhl-group.svg

185.38.142.20

200 OK

8.7 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/dhl-group.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (724)
Size
8.7 kB (8715 bytes)
Hash
56ceadc8919cd52c7b19d6bfd2ed1a96
5716fe99efb512515553b02fc4ca7f858aa5c980
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/dhl-group.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:06 GMT
Content-Type: image/svg+xml
Content-Length: 8715
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "220b-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/phplib/ajax.php?id=ef26e96ccca611ecaebeb178

185.38.142.20

200 OK

0 B

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/phplib/ajax.php?id=ef26e96ccca611ecaebeb178
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

POST /verfolgung/phplib/ajax.php?id=ef26e96ccca611ecaebeb178 HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 17
Origin: https://tracking-75403.laforma.co.za
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Set-Cookie: PHPSESSID=m47m8r4edrbui08001f4ena6u5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache

tracking-75403.laforma.co.za/verfolgung/fonts/delivery-bd.woff2

185.38.142.20

200 OK

34 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/fonts/delivery-bd.woff2
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
Web Open Font Format (Version 2), TrueType, length 33840, version 1.0\012- data
Size
34 kB (33840 bytes)
Hash
682ea1d6962cd47974cd715fa3b80b4a
94a563948862a70f4d1be0a3aebc3a9f7aa800a6
4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/fonts/delivery-bd.woff2 HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Length: 33840
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "8430-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/fonts/delivery-rg.woff2

185.38.142.20

200 OK

34 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/fonts/delivery-rg.woff2
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
Web Open Font Format (Version 2), TrueType, length 33580, version 1.0\012- data
Size
34 kB (33580 bytes)
Hash
1a05a4d2566dc2490cae801e9d885ec6
2fae1307a017a9afe73d351cf15932e51dc57887
2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/fonts/delivery-rg.woff2 HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Length: 33580
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "832c-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/fonts/delivery-cdblk.woff2

185.38.142.20

200 OK

37 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/fonts/delivery-cdblk.woff2
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
Web Open Font Format (Version 2), TrueType, length 36652, version 1.0\012- data
Size
37 kB (36652 bytes)
Hash
774e0efbb9da45395efa24c9ca4248de
04eab63ba86f912514fc0ea04b025b7f2df6145b
ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/fonts/delivery-cdblk.woff2 HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Length: 36652
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "8f2c-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/sprite.svg

185.38.142.20

200 OK

41 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/sprite.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (28844), with CRLF line terminators
Size
41 kB (41430 bytes)
Hash
cebbc77896c22e29f2a223a9efe685e3
ab3e7dc74207c4bb1f45a712d334c3d3ef8bdce8
07908237900ec13b078abee11041a05af9a7c8930a9a0e1c7d85f2c5f8ca9425

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/sprite.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Type: image/svg+xml
Content-Length: 41430
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "a1d6-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/1.png

185.38.142.20

200 OK

108 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/1.png
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
PNG image data, 366 x 206, 8-bit/color RGB, non-interlaced\012- data
Size
108 kB (108508 bytes)
Hash
634c39f2a51e26d2ac85598a2103e16d
1badf4773207d7238f8808f1bd42e355dd4b3a01
afcc3febb5b047b9f7d691e6e92c2239c2feee6cdb5e56a910e8a9e62387d430

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /verfolgung/img/1.png HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:06 GMT
Content-Type: image/png
Content-Length: 108508
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1a7dc-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/dhl-ssl-logo.svg

185.38.142.20

200 OK

4.5 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/dhl-ssl-logo.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (403)
Size
4.5 kB (4470 bytes)
Hash
f0e3cb96921af370a3ce18d1a1ded9b9
1fedecbb71184bc23dfdac38ef5b27d31da7f420
dc0fa4b8eaff05882b34c64260a6f630a3398a3a77584ef2ae6297ef10353578

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/dhl-ssl-logo.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Type: image/svg+xml
Content-Length: 4470
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1176-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/mastercard.svg

185.38.142.20

200 OK

15 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/mastercard.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1435)
Size
15 kB (14915 bytes)
Hash
b81045f3a463d4aabc0a41fef3bc55ef
0cf6c882fac621b65b627cb39c3bbc9d669e20d3
f4551892c81a15874332cfa9639f76a41356c9ed4ca79ff682c9114aeb12563e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/mastercard.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Type: image/svg+xml
Content-Length: 14915
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "3a43-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/sepapay.svg

185.38.142.20

200 OK

12 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/sepapay.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (12024), with no line terminators
Size
12 kB (12024 bytes)
Hash
176e69bbf00a8da5fe4921dbff1a30eb
384bbdee655135ef9a290f1365902ed6c9316969
b1764022abfe9e716542e55a05b94b851e369cd75407474874a439c61f5bd982

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/sepapay.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Type: image/svg+xml
Content-Length: 12024
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "2ef8-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/icons-nepal.svg

185.38.142.20

200 OK

26 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/icons-nepal.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (25753), with CRLF line terminators
Size
26 kB (25893 bytes)
Hash
953dd00cb38ca1767d1145caf35a035b
8510eeee5a546b92d2cb4413f065aa5d49d0bfdb
2691d1e5392f267802498adb1ddc58e4d8a95a5fc69de8380e0d4ae7850c2e1c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/icons-nepal.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Type: image/svg+xml
Content-Length: 25893
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "6525-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/giropay.svg

185.38.142.20

200 OK

2.4 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/giropay.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2396), with no line terminators
Size
2.4 kB (2396 bytes)
Hash
9b9e19be4be87ab5a0b96cd99754747e
edc3926e9431d362d794de7388fb4d78b156c4e8
2ef06fae9ac89777a220421e87980ef61b2a914e3eb1dec5b5c06a93531a9e38

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/giropay.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:08 GMT
Content-Type: image/svg+xml
Content-Length: 2396
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "95c-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/rating-play-store.svg

185.38.142.20

200 OK

904 B

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/rating-play-store.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (512)
Size
904 B (904 bytes)
Hash
19a24c818ad0e0eab9418b77ff8e7c1c
3787691d98fd4b9f494664274a641226e33c1588
a6b35b6b7cabb9d33c2e1d6afef2d5f546a2fd3912f5f3e96495cd64218b9251

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/rating-play-store.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:08 GMT
Content-Type: image/svg+xml
Content-Length: 904
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "388-5e89907cbf280"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/favicon.ico

185.38.142.20

200 OK

7.4 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/favicon.ico
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel\012- data
Size
7.4 kB (7406 bytes)
Hash
bbba65f5c0e656750df8c649749447c8
107d1dc536e768776a10d20b362e253ec684832a
c4caa8b38ca6962dfeaa34445597ba59d691d60633f4dda63630f27738c06497

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /verfolgung/favicon.ico HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Cookie: PHPSESSID=m47m8r4edrbui08001f4ena6u5
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:08 GMT
Content-Type: image/vnd.microsoft.icon
Content-Length: 7406
Connection: keep-alive
Last-Modified: Fri, 28 Oct 2022 12:03:10 GMT
ETag: "1cee-5ec170a9cbb80"
Accept-Ranges: bytes

tracking-75403.laforma.co.za/verfolgung/img/icon-sprite.svg

185.38.142.20

200 OK

116 kB

URL HTTP/1.1
tracking-75403.laforma.co.za/verfolgung/img/icon-sprite.svg
IP
185.38.142.20:0
ASN
#47674 Net Solutions - Consultoria Em Tecnologias De Informacao, Sociedade Unipessoal LDA

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Size
116 kB (116511 bytes)
Hash
a2f73421956e77814bc75b9f1ef7978c
76fff6b10243ee8b0d9f2b8c281e5023bef29816
616309a0321797f048d134f8c83c2ad6a94170f166093baa5fa6fd999461772e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

GET /verfolgung/img/icon-sprite.svg HTTP/1.1
Host: tracking-75403.laforma.co.za
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://tracking-75403.laforma.co.za/verfolgung/tracking.php?id=ef26e96ccca611ecaebeb178&page=u2.3
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 03 Feb 2023 07:01:07 GMT
Content-Type: image/svg+xml
Content-Length: 116511
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 01:27:22 GMT
ETag: "1c71f-5e89907cbf280"
Accept-Ranges: bytes

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (49)

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

File type

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

File type