Report - dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307

Report Overview

Visited public
2023-12-05 06:43:16
Tags
dhl logistics phishing
URL
dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Finishing URL
dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
IP / ASN
91.212.166.71
#0
Title
Tracking, delivery status for DHL Express shipments | DHL
Phishing - DHL

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
dhl.3204.thebagshelf.com	unknown	2019-03-26	2023-09-16 10:54:51	2023-11-21 05:36:55	14 kB	466 kB	91.212.166.71

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-12-05 06:43:03	medium	91.212.166.71	Client IP	ET DROP Spamhaus DROP Listed Traffic Inbound group 7

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (4)

	URL	From	Size	First Seen	Last Seen
	dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307	ScriptElement	943 B	2023-12-05	2024-08-20
Pretty URL dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307 IP 91.212.166.71 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-12-05 07:43 Last Seen2024-08-20 16:43 Times Seen2 Hash 7059302f9a2bd42c4791bb5fdd264065 c8d76bc817d3f3b1811b979b7523e05ad1235704 ebe108c7791410b33055956da518a2ed9af23cff222f3b448123e72efde7b860 Loading...

	dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307	ScriptElement	141 B	2023-03-07	2024-08-21
Pretty URL dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307 IP 91.212.166.71 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:42 Last Seen2024-08-21 09:44 Times Seen11779 Hash 42f8700a35ca70b82cd749f20e7bf849 bbeea25f4f83161e23997dbf4e0fa8a909825a05 ee3ffd02317a94b02acb151698827b68d47896b38ae53f6918703557f9a938c6 Loading...

	dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307	ScriptElement	214 B	2023-03-07	2024-08-21
Pretty URL dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307 IP 91.212.166.71 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:29 Last Seen2024-08-21 09:44 Times Seen11772 Hash 60480af0c7b84a8db11f568bdfc1f343 c0289fa1764697be2aba314e6b743ef0f33d40c2 8fc08ef287bb85ed813cab365db65493074410cc07ade1993e6a666dd0d9cf8e Loading...

	dhl.3204.thebagshelf.com/tracking/js/jquery-1.12.2.min.js	ScriptElement	97 kB	2023-03-07	2025-05-10
Pretty URL dhl.3204.thebagshelf.com/tracking/js/jquery-1.12.2.min.js IP 91.212.166.71 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:39 Last Seen2025-05-10 21:45 Times Seen16177 Hash bdc2b7efb1faf219d65edfe253a103e9 4921529fc15b8133f2fe65b3bebf53d1e9ef8579 95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9 Loading...

HTTP Transactions (27)

URL IP Response Size

dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307

91.212.166.71

200 OK

19 kB

URL User Request GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
IP
91.212.166.71:443
ASN
#0

Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1304)
Size
19 kB (19355 bytes)
Hash
25e70f6a9e4c09f1a927de33dd169f25
9bb1262640df6b66ec4a9e9097e1473ad4a5fd8f
f4a48b259d0b764cc4ba7735397396051d2b74c0a1e802b0806ade71b3ad6c68

HTTP Headers

GET /tracking/tracking.php?id=1480939&page=307 HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 19355
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

dhl.3204.thebagshelf.com/tracking/css/5.css

91.212.166.71

200 OK

9.6 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/css/5.css
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
ASCII text, with very long lines (661), with CRLF line terminators
Size
9.6 kB (9643 bytes)
Hash
24dc3728ee00aff8a8efb930c642ace7
efc9e641255ea868b5875dc120d0f85a3cfb462c
5c0adb34716b331b834120937a8f6c9d1dd34fa9f4a1b24a6ad3b54e86b8c994

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/css/5.css HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: text/css
Content-Length: 9643
Connection: keep-alive
Last-Modified: Mon, 12 Jun 2023 17:20:08 GMT
ETag: "be26-5fdf1ee268200-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

dhl.3204.thebagshelf.com/tracking/css/3.css

91.212.166.71

200 OK

4.3 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/css/3.css
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
ASCII text, with CRLF line terminators
Size
4.3 kB (4339 bytes)
Hash
c54f6668454402879168d2782296d35e
dd3c72855079f3d074cfe6fd500959874650c736
d40a85d0988ad1b83645365ac9bd5ef15ed33517733d847317f86c6ea271ad32

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/css/3.css HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: text/css
Content-Length: 4339
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 09:05:56 GMT
ETag: "561e-5edcf21490500-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

dhl.3204.thebagshelf.com/tracking/css/2.css

91.212.166.71

200 OK

9.6 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/css/2.css
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
ASCII text, with very long lines (661), with CRLF line terminators
Size
9.6 kB (9568 bytes)
Hash
68bb9d41de0ac82959f8f90c552e4948
fb4e7fd67a692ae70e6b3813fe7913f0c3800103
a0879b822817892ccecb11bc4c475d4bf3aad5e03a37a49eae46dfbdcf9e8fb3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/css/2.css HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: text/css
Content-Length: 9568
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 09:05:56 GMT
ETag: "bd77-5edcf21490500-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

dhl.3204.thebagshelf.com/tracking/css/6.css

91.212.166.71

200 OK

1.2 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/css/6.css
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
ASCII text, with CRLF line terminators
Size
1.2 kB (1188 bytes)
Hash
8eb7809b45d4079fbaa48175f64c7441
f865a99867d1eac58a575a518996ae2e9ca1de95
00d16054bb78393fecfbeff7eed0d44e005ebe51f034c838c1f69bdfddf40b01

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/css/6.css HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: text/css
Content-Length: 1188
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 09:18:34 GMT
ETag: "10af-5edcf4e772e80-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

dhl.3204.thebagshelf.com/tracking/css/1.css

91.212.166.71

200 OK

8.0 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/css/1.css
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
ASCII text, with very long lines (23076), with CRLF line terminators
Size
8.0 kB (7979 bytes)
Hash
c773c2e44cb33bd02d04987a8017056b
af122938b5fab20abed2fd9df00af09e66294222
a116a577d744fd0c240b7f1c1b3139cc0d61b953d36fe2b61506e379e9c8bc0a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/css/1.css HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: text/css
Content-Length: 7979
Connection: keep-alive
Last-Modified: Sat, 19 Nov 2022 09:05:56 GMT
ETag: "d1f7-5edcf21490500-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

dhl.3204.thebagshelf.com/tracking/js/jquery-1.12.2.min.js

91.212.166.71

200 OK

34 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/js/jquery-1.12.2.min.js
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
ASCII text, with very long lines (32029)
Size
34 kB (33809 bytes)
Hash
bdc2b7efb1faf219d65edfe253a103e9
4921529fc15b8133f2fe65b3bebf53d1e9ef8579
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/js/jquery-1.12.2.min.js HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: application/javascript
Content-Length: 33809
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "17bdc-5e8a4c3deea80-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

dhl.3204.thebagshelf.com/tracking/img/1.png

91.212.166.71

200 OK

23 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/1.png
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 500x375, components 3\012- data
Size
23 kB (23440 bytes)
Hash
b81b4f0bce1b456b53d4055f8369f989
5062099cea65bfe1fbfe641c0f171ed13e83f5e1
dd84eab37e7850c800fa91bf7d70e1b80958a8d5527f946a4f8a70cbdba7425a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/img/1.png HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/png
Content-Length: 23440
Connection: keep-alive
Last-Modified: Thu, 27 Apr 2023 10:31:50 GMT
ETag: "5b90-5fa4edd417180"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/dhl-ssl-logo.svg

91.212.166.71

200 OK

4.5 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/dhl-ssl-logo.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (403)
Size
4.5 kB (4470 bytes)
Hash
f0e3cb96921af370a3ce18d1a1ded9b9
1fedecbb71184bc23dfdac38ef5b27d31da7f420
dc0fa4b8eaff05882b34c64260a6f630a3398a3a77584ef2ae6297ef10353578

HTTP Headers

GET /tracking/img/dhl-ssl-logo.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 4470
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "1176-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/giropay.svg

91.212.166.71

200 OK

2.4 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/giropay.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (2396), with no line terminators
Size
2.4 kB (2396 bytes)
Hash
9b9e19be4be87ab5a0b96cd99754747e
edc3926e9431d362d794de7388fb4d78b156c4e8
2ef06fae9ac89777a220421e87980ef61b2a914e3eb1dec5b5c06a93531a9e38

HTTP Headers

GET /tracking/img/giropay.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 2396
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "95c-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/paypal.svg

91.212.166.71

200 OK

3.4 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/paypal.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (3369), with no line terminators
Size
3.4 kB (3369 bytes)
Hash
4ac4e26be0277fab62f57835bca7ee1e
edef7e834db1d63bd5290adf1f0308522cced7e0
5e9402048b0efae8235057fc5db4276b0472c9a42c59c0b759e059ffbdafb32b

HTTP Headers

GET /tracking/img/paypal.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 3369
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "d29-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/amex.svg

91.212.166.71

200 OK

734 B

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/amex.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (565)
Size
734 B (734 bytes)
Hash
1c003076f46fc215f19de22568f3b5a1
112caa9374e6c1d0f8325cdcf2bde5b073f0f1ad
b64feafef2104c77f092f2bbfa526bad76e17fb053591284984e86a28ed721a2

HTTP Headers

GET /tracking/img/amex.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 734
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "2de-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/visa.svg

91.212.166.71

200 OK

4.6 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/visa.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1577)
Size
4.6 kB (4586 bytes)
Hash
09d8b96a0853e0bc8cec7c677c0da93b
a6aebdb9c339cac93762338353517b67e23f1903
a60079ce89803190740ddcf6e03eace0492b8f73ec57ffb4132b72a9736b68fe

HTTP Headers

GET /tracking/img/visa.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 4586
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "11ea-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/dhl-official.svg

91.212.166.71

200 OK

2.0 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/dhl-official.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (2040), with no line terminators
Size
2.0 kB (2040 bytes)
Hash
d5a053f0005dd58489a461f599b5a508
ba71dd77800ef3d410beb8282d790642bec8193b
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/img/dhl-official.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 2040
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "7f8-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/rating-play-store.svg

91.212.166.71

200 OK

904 B

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/rating-play-store.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (512)
Size
904 B (904 bytes)
Hash
19a24c818ad0e0eab9418b77ff8e7c1c
3787691d98fd4b9f494664274a641226e33c1588
a6b35b6b7cabb9d33c2e1d6afef2d5f546a2fd3912f5f3e96495cd64218b9251

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/img/rating-play-store.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 904
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "388-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/dhl-group.svg

91.212.166.71

200 OK

8.7 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/dhl-group.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (724)
Size
8.7 kB (8715 bytes)
Hash
56ceadc8919cd52c7b19d6bfd2ed1a96
5716fe99efb512515553b02fc4ca7f858aa5c980
55de7fa1d7d120cab791bbbeadf10fe0f15783b296aceee56dc72c80896e4114

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/img/dhl-group.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 8715
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "220b-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/mastercard.svg

91.212.166.71

200 OK

15 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/mastercard.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document, ASCII text, with very long lines (1435)
Size
15 kB (14915 bytes)
Hash
b81045f3a463d4aabc0a41fef3bc55ef
0cf6c882fac621b65b627cb39c3bbc9d669e20d3
f4551892c81a15874332cfa9639f76a41356c9ed4ca79ff682c9114aeb12563e

HTTP Headers

GET /tracking/img/mastercard.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 14915
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "3a43-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/sepapay.svg

91.212.166.71

200 OK

12 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/sepapay.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (12024), with no line terminators
Size
12 kB (12024 bytes)
Hash
176e69bbf00a8da5fe4921dbff1a30eb
384bbdee655135ef9a290f1365902ed6c9316969
b1764022abfe9e716542e55a05b94b851e369cd75407474874a439c61f5bd982

HTTP Headers

GET /tracking/img/sepapay.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 12024
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "2ef8-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/sprite.svg

91.212.166.71

200 OK

41 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/sprite.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (28844), with CRLF line terminators
Size
41 kB (41430 bytes)
Hash
cebbc77896c22e29f2a223a9efe685e3
ab3e7dc74207c4bb1f45a712d334c3d3ef8bdce8
07908237900ec13b078abee11041a05af9a7c8930a9a0e1c7d85f2c5f8ca9425

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/img/sprite.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 41430
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "a1d6-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/icon-sprite.svg

91.212.166.71

200 OK

116 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/icon-sprite.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Size
116 kB (116511 bytes)
Hash
a2f73421956e77814bc75b9f1ef7978c
76fff6b10243ee8b0d9f2b8c281e5023bef29816
616309a0321797f048d134f8c83c2ad6a94170f166093baa5fa6fd999461772e

HTTP Headers

GET /tracking/img/icon-sprite.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 116511
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "1c71f-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/img/icons-nepal.svg

91.212.166.71

200 OK

26 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/img/icons-nepal.svg
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
SVG Scalable Vector Graphics image\012- SVG XML document\012- XML 1.0 document text\012- SVG XML document\012- XML document text\012- exported SGML document, ASCII text, with very long lines (25753), with CRLF line terminators
Size
26 kB (25893 bytes)
Hash
953dd00cb38ca1767d1145caf35a035b
8510eeee5a546b92d2cb4413f065aa5d49d0bfdb
2691d1e5392f267802498adb1ddc58e4d8a95a5fc69de8380e0d4ae7850c2e1c

HTTP Headers

GET /tracking/img/icons-nepal.svg HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/svg+xml
Content-Length: 25893
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "6525-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/fonts/delivery-rg.woff2

91.212.166.71

200 OK

34 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/fonts/delivery-rg.woff2
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
Web Open Font Format (Version 2), TrueType, length 33580, version 1.0\012- data
Size
34 kB (33580 bytes)
Hash
1a05a4d2566dc2490cae801e9d885ec6
2fae1307a017a9afe73d351cf15932e51dc57887
2a2dc315ce559a3636bcbfaf666ee1ac382222798eceeef8d464c8d1e4e18de7

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/fonts/delivery-rg.woff2 HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: font/woff2
Content-Length: 33580
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "832c-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/fonts/delivery-bd.woff2

91.212.166.71

200 OK

34 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/fonts/delivery-bd.woff2
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
Web Open Font Format (Version 2), TrueType, length 33840, version 1.0\012- data
Size
34 kB (33840 bytes)
Hash
682ea1d6962cd47974cd715fa3b80b4a
94a563948862a70f4d1be0a3aebc3a9f7aa800a6
4d5879466a996b0bc74a71e513a743e240b69199449fa59e51d32d133b99576f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/fonts/delivery-bd.woff2 HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: font/woff2
Content-Length: 33840
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "8430-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/fonts/delivery-cdblk.woff2

91.212.166.71

200 OK

37 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/fonts/delivery-cdblk.woff2
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
Web Open Font Format (Version 2), TrueType, length 36652, version 1.0\012- data
Size
37 kB (36652 bytes)
Hash
774e0efbb9da45395efa24c9ca4248de
04eab63ba86f912514fc0ea04b025b7f2df6145b
ccdf7761ca4d7eaa78f7135627c83d85ed7324d9e12a36258f1f21a5842c27b1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/fonts/delivery-cdblk.woff2 HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: font/woff2
Content-Length: 36652
Connection: keep-alive
Last-Modified: Wed, 14 Sep 2022 15:27:22 GMT
ETag: "8f2c-5e8a4c3deea80"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/favicon.ico

91.212.166.71

200 OK

7.4 kB

URL GET HTTP/1.1
dhl.3204.thebagshelf.com/tracking/favicon.ico
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type
MS Windows icon resource - 3 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel\012- data
Size
7.4 kB (7406 bytes)
Hash
bbba65f5c0e656750df8c649749447c8
107d1dc536e768776a10d20b362e253ec684832a
c4caa8b38ca6962dfeaa34445597ba59d691d60633f4dda63630f27738c06497

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL

HTTP Headers

GET /tracking/favicon.ico HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:58 GMT
Content-Type: image/vnd.microsoft.icon
Content-Length: 7406
Connection: keep-alive
Last-Modified: Sat, 29 Oct 2022 02:03:10 GMT
ETag: "1cee-5ec22c6afb380"
Accept-Ranges: bytes

dhl.3204.thebagshelf.com/tracking/phplib/ajax.php?id=1480939

91.212.166.71

200 OK

0 B

URL POST HTTP/1.1
dhl.3204.thebagshelf.com/tracking/phplib/ajax.php?id=1480939
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /tracking/phplib/ajax.php?id=1480939 HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 17
Origin: https://dhl.3204.thebagshelf.com
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:42:59 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Set-Cookie: PHPSESSID=lnccnrle2j0gb5alnj84q0a580; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache

dhl.3204.thebagshelf.com/tracking/phplib/ajax.php?id=1480939

91.212.166.71

200 OK

0 B

URL POST HTTP/1.1
dhl.3204.thebagshelf.com/tracking/phplib/ajax.php?id=1480939
IP
91.212.166.71:443
ASN
#0

Requested by
https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Certificate
IssuerLet's Encrypt
Subjectdhl.3204.thebagshelf.com
Fingerprint0F:0D:86:60:1A:CB:B0:ED:3C:E4:1E:87:96:EA:B2:16:D8:DF:49:45
ValiditySat, 16 Sep 2023 07:54:04 GMT - Fri, 15 Dec 2023 07:54:03 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /tracking/phplib/ajax.php?id=1480939 HTTP/1.1
Host: dhl.3204.thebagshelf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 17
Origin: https://dhl.3204.thebagshelf.com
DNT: 1
Connection: keep-alive
Referer: https://dhl.3204.thebagshelf.com/tracking/tracking.php?id=1480939&page=307
Cookie: PHPSESSID=lnccnrle2j0gb5alnj84q0a580
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Tue, 05 Dec 2023 06:43:09 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (27)

URL User Request GET HTTP/1.1

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers