Report - saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email

Report Overview

Visited public
2024-08-12 12:51:17
Tags
URL
saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email
Finishing URL
saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email
IP / ASN
172.93.120.138
#393960 HOST4GEEKS-LLC
Title
saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
r10.o.lencr.org	unknown				2.3 kB	6.2 kB	23.33.119.27
saluhallensvinesund.se	unknown				1.5 kB	15 kB	172.93.120.138

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-08-12	medium	saluhallensvinesund.se	Sinkholed
2024-08-12	medium	saluhallensvinesund.se	Sinkholed
2024-08-12	medium	saluhallensvinesund.se	Sinkholed

ThreatFox

No alerts detected

JavaScript (8)

	URL	From	Size	First Seen	Last Seen
	saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email	ScriptElement	3.6 kB	2023-03-07	2024-08-21
Pretty URL saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email IP 172.93.120.138 ASN #393960 HOST4GEEKS-LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 06:46 Times Seen82 Hash e5da1f2764301ac1edd3453e7d43d9f0 726dcc8165caffecf708e40821ed03d0937ad762 1b46a674fd06b30d4300cef321d5757d6314dce2aae1a0ad8d60fbeb7f92d3e8 Loading...

	saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email	ScriptElement	2.0 kB	2023-03-07	2024-08-21
Pretty URL saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email IP 172.93.120.138 ASN #393960 HOST4GEEKS-LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 06:46 Times Seen80 Hash f8af2a381574ffdbf2327b1c9fec599f e13f00894908b45e817dae5f00c87182e224f8e5 40b8c6fccce180c18c91963ce93213368b8bbe63e5ba19d50923811e693749ed Loading...

	saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email	ScriptElement	3.9 kB	2023-03-07	2024-08-21
Pretty URL saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email IP 172.93.120.138 ASN #393960 HOST4GEEKS-LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 06:46 Times Seen82 Hash a3cf7dd06b7a0406f4c82c4408b1a903 6f51185dc1d894eae3d5d121f3e3a83379435305 62f1f19a04b6d24a245b21e497ac0c730da78a8dcfee6a7a869458e9f1be422f Loading...

	saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email	ScriptElement	564 B	2023-03-07	2024-08-21
Pretty URL saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email IP 172.93.120.138 ASN #393960 HOST4GEEKS-LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 06:46 Times Seen83 Hash 4069f8c979f654519aebbd30247f15e3 6337a08f4f6854b041446eedb2ad7d830d1d181f e205ee9b9397f40605b28973f21620853b5a502c7e251c8e653ce4c923f3464e Loading...

		Size	First Seen	Last Seen
	#1 Write - e835232339500c39f2176849cacfcb22	1.2 kB	2023-03-07 12:05	2024-08-21 06:46
Pretty Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 06:46 Times Seen82 Hash e835232339500c39f2176849cacfcb22 9c86468bc420cc4d428904166c843ce3e0eb9e1a 35a077b714fba1f1aeceed4f72192e47dda6df12ee145dacfcaa2e2ceda90851 Loading...

	#2 Write - eb771a99505381ee59ae13547d17176d	663 B	2023-03-07 12:05	2024-08-21 06:46
Pretty Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 06:46 Times Seen80 Hash eb771a99505381ee59ae13547d17176d 4d59888e5044428d5abca3534b7ded06c615335a baa8d9add7ba1e94f4e1e7e93afb698c75262b5683e054d105404d345bbb6d45 Loading...

	#3 Write - 1530d5d1c773b3d7fadcb57ce5fb0dc0	1.3 kB	2023-03-07 12:05	2024-08-21 06:46
Pretty Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 06:46 Times Seen82 Hash 1530d5d1c773b3d7fadcb57ce5fb0dc0 af56bc837d87abf4b7b8dbd416230ee5994a2983 86c7fd6a41e8f532dd6452d4d3e5c4943548df7c7c64e62cfd1ed0c4548fbfda Loading...

	#4 Write - 1f8938192c99716b0bb4d8ed79936b78	174 B	2023-03-07 12:05	2024-08-21 06:46
Pretty Observations First Seen2023-03-07 12:05 Last Seen2024-08-21 06:46 Times Seen83 Hash 1f8938192c99716b0bb4d8ed79936b78 642c0bf831f022d73a57dc236495c742ffb2ec96 3d6b10960aac86b66534f6cf13f13fa2de708e5ed8d7531a8dd5e52fb32e2e97 Loading...

HTTP Transactions (10)

URL IP Response Size

r10.o.lencr.org/

23.33.119.27

504 B

URL
r10.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
14927ac0fa718432ac5839f70891b90c
fa1224f50929eaf13800f1cefb874e57ebdd9c12
83614f2bb6b89c6f08c23a06ca037a68eb6557d42829cd1504eae2ddca77739a

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "83614F2BB6B89C6F08C23A06CA037A68EB6557D42829CD1504EAE2DDCA77739A"
Last-Modified: Sun, 11 Aug 2024 06:27:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4791
Expires: Mon, 12 Aug 2024 14:10:43 GMT
Date: Mon, 12 Aug 2024 12:50:52 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL
r10.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
c2c08f8e2c667f91e7ee939f41a7ca06
159557c63c8c8ef725ae9b3fec75d5f1810b40d8
68059941cc11a454898b59b485e702d97abe8025bd02657174e26ec24eb68c81

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "68059941CC11A454898B59B485E702D97ABE8025BD02657174E26EC24EB68C81"
Last-Modified: Sun, 11 Aug 2024 06:56:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5783
Expires: Mon, 12 Aug 2024 14:27:15 GMT
Date: Mon, 12 Aug 2024 12:50:52 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL
r10.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
920e4f3a49784056e5c5faa263b2f6a7
5070431826e2f4b1988fff3b3e6ff8a4e1a97919
037a14a94c65f88afcab57eae3fc805e8115b35825ec9659f173442b45918e8e

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "037A14A94C65F88AFCAB57EAE3FC805E8115B35825EC9659F173442B45918E8E"
Last-Modified: Sun, 11 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6166
Expires: Mon, 12 Aug 2024 14:33:39 GMT
Date: Mon, 12 Aug 2024 12:50:53 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.27

504 B

URL
r10.o.lencr.org/
IP
23.33.119.27:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
fa9d9a7703999cfc274f02dcaadb4561
eb147c3d5cebb3001dfeb1e60aa7054d1f2ca51c
1f147459e31f4e1f2f37449a98c122615b2ad8051ac691d52f0fb1cf2892a35c

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "1F147459E31F4E1F2F37449A98C122615B2AD8051AC691D52F0FB1CF2892A35C"
Last-Modified: Sun, 11 Aug 2024 06:57:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10283
Expires: Mon, 12 Aug 2024 15:42:16 GMT
Date: Mon, 12 Aug 2024 12:50:53 GMT
Connection: keep-alive

saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email

172.93.120.138

200 OK

10 kB

URL User Request GET HTTP/1.1
saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email
IP
172.93.120.138:443
ASN
#393960 HOST4GEEKS-LLC

Certificate
IssuerLet's Encrypt
Subjectsaluhallensvinesund.se
FingerprintFC:EA:F9:2E:9A:2B:D5:96:6E:83:9E:0D:AD:89:1F:69:08:2D:97:60
ValiditySun, 04 Aug 2024 15:18:14 GMT - Sat, 02 Nov 2024 15:18:13 GMT

File type
HTML document, ASCII text, with very long lines (3848), with CRLF line terminators
Size
10 kB (10283 bytes)
Hash
82fe93801c1017d6fd0ac6e6253fe12c
49d728ab2fbcc3f8218b091e11faba9d0267395e
40d1787c961bec341f1298928f1283a9411aa15050d12d322df99303f7019062

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /DHLEx/dhl_top/source/content/login.php?email HTTP/1.1
Host: saluhallensvinesund.se
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Mon, 12 Aug 2024 12:50:53 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

saluhallensvinesund.se/DHLEx/dhl_top/source/content/photos/logo.jpg

172.93.120.138

200 OK

3.9 kB

URL GET HTTP/1.1
saluhallensvinesund.se/DHLEx/dhl_top/source/content/photos/logo.jpg
IP
172.93.120.138:443
ASN
#393960 HOST4GEEKS-LLC

Requested by
https://saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email
Certificate
IssuerLet's Encrypt
Subjectsaluhallensvinesund.se
FingerprintFC:EA:F9:2E:9A:2B:D5:96:6E:83:9E:0D:AD:89:1F:69:08:2D:97:60
ValiditySun, 04 Aug 2024 15:18:14 GMT - Sat, 02 Nov 2024 15:18:13 GMT

File type
PNG image data, 425 x 125, 8-bit colormap, non-interlaced
Size
3.9 kB (3902 bytes)
Hash
d8b38bb6321bd45ff42ed6931a870bb5
483fa5870b17eae93e8251dd50e694da5b0297a0
26933abb67839e269d8fc9d49b5ff722a1f48646776a8bdfb25e572d10996b41

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /DHLEx/dhl_top/source/content/photos/logo.jpg HTTP/1.1
Host: saluhallensvinesund.se
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Mon, 12 Aug 2024 12:50:53 GMT
Server: Apache
Last-Modified: Fri, 17 Jan 2020 05:21:40 GMT
Accept-Ranges: bytes
Content-Length: 3902
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: image/jpeg

saluhallensvinesund.se/favicon.ico

172.93.120.138

404 Not Found

315 B

URL GET HTTP/1.1
saluhallensvinesund.se/favicon.ico
IP
172.93.120.138:443
ASN
#393960 HOST4GEEKS-LLC

Requested by
https://saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email
Certificate
IssuerLet's Encrypt
Subjectsaluhallensvinesund.se
FingerprintFC:EA:F9:2E:9A:2B:D5:96:6E:83:9E:0D:AD:89:1F:69:08:2D:97:60
ValiditySun, 04 Aug 2024 15:18:14 GMT - Sat, 02 Nov 2024 15:18:13 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: saluhallensvinesund.se
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://saluhallensvinesund.se/DHLEx/dhl_top/source/content/login.php?email
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Mon, 12 Aug 2024 12:50:54 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

r10.o.lencr.org/

23.33.119.57

504 B

URL
r10.o.lencr.org/
IP
23.33.119.57:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9aa662226d7b18a23283cfe7605bcb7d
b243e9abad3842d657e672f59ca7f32f1b8ef21f
035ebc0d3fd22b0908637eadb8d85088638857552fa21276067a48275cc5c0fa

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "035EBC0D3FD22B0908637EADB8D85088638857552FA21276067A48275CC5C0FA"
Last-Modified: Sun, 11 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8508
Expires: Mon, 12 Aug 2024 15:12:43 GMT
Date: Mon, 12 Aug 2024 12:50:55 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL
r10.o.lencr.org/
IP
23.33.119.57:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9aa662226d7b18a23283cfe7605bcb7d
b243e9abad3842d657e672f59ca7f32f1b8ef21f
035ebc0d3fd22b0908637eadb8d85088638857552fa21276067a48275cc5c0fa

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "035EBC0D3FD22B0908637EADB8D85088638857552FA21276067A48275CC5C0FA"
Last-Modified: Sun, 11 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8508
Expires: Mon, 12 Aug 2024 15:12:43 GMT
Date: Mon, 12 Aug 2024 12:50:55 GMT
Connection: keep-alive

r10.o.lencr.org/

23.33.119.57

504 B

URL
r10.o.lencr.org/
IP
23.33.119.57:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
9aa662226d7b18a23283cfe7605bcb7d
b243e9abad3842d657e672f59ca7f32f1b8ef21f
035ebc0d3fd22b0908637eadb8d85088638857552fa21276067a48275cc5c0fa

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "035EBC0D3FD22B0908637EADB8D85088638857552FA21276067A48275CC5C0FA"
Last-Modified: Sun, 11 Aug 2024 06:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8508
Expires: Mon, 12 Aug 2024 15:12:43 GMT
Date: Mon, 12 Aug 2024 12:50:55 GMT
Connection: keep-alive

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (8)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (10)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/1.1

IP