Report - id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

Report Overview

URL

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/
IP

198.199.109.95

ASN

#14061 DIGITALOCEAN-ASN
Submitted

2023-02-09T15:35:12Z

Access
Tags

dhl logistics phishing suspicious
urlquery detections

Phishing - DHL

Suspicious - Suspicious JS code

Detections

urlquery

28
Network Intrusion Detection

0
Threat Detection Systems

9

Domain Summary

Domain	Rank	First Seen	Last Seen	Sent	Received	IP
id-purple-lion-benfrejchadi350704.codeanyapp.com (13)	unknown	2023-02-09T09:24:44Z	2023-03-12T11:27:39Z	5717	101066	198.199.109.95
r3.o.lencr.org (9)	344	2020-12-02T09:52:13Z	2023-03-13T05:09:07Z	3042	7977	23.36.77.32
firefox.settings.services.mozilla.com (1)	867	2020-06-04T22:08:41Z	2023-03-13T05:09:10Z	337	1429	35.241.9.150
img-getpocket.cdn.mozilla.net (6)	1631	2018-06-22T01:36:00Z	2023-03-13T05:09:16Z	3246	61527	34.120.237.76
contile.services.mozilla.com (1)	1114	2021-05-27T20:32:35Z	2023-03-13T05:09:13Z	333	391	34.117.237.239
ka-f.fontawesome.com (4)	3598	2019-12-17T07:36:13Z	2023-03-13T05:10:17Z	2126	95671	172.64.168.22
ocsp.digicert.com (3)	86	2012-05-21T09:02:23Z	2023-03-13T06:00:13Z	1023	1947	93.184.220.29
push.services.mozilla.com (1)	2140	2014-10-24T10:27:06Z	2023-03-13T05:09:14Z	606	127	54.149.213.50
content-signature-2.cdn.mozilla.net (1)	1152	2020-11-03T13:26:46Z	2023-03-13T05:09:35Z	413	5844	34.160.144.191
cdnjs.cloudflare.com (1)	235	2015-04-17T22:46:33Z	2023-03-13T05:09:21Z	343	31245	104.17.25.14
s3-us-west-2.amazonaws.com (1)	unknown	2017-01-29T12:21:01Z	2023-03-13T08:49:35Z	432	176883	52.218.224.64
stackpath.bootstrapcdn.com (1)	2467	2018-06-15T22:36:43Z	2023-03-13T07:25:30Z	507	945	104.18.11.207
kit.fontawesome.com (1)	1868	2019-12-16T20:51:31Z	2023-03-13T05:10:17Z	462	650	104.18.23.52
ajax.googleapis.com (1)	12905	2013-08-16T11:51:31Z	2023-03-13T08:37:09Z	342	31930	142.250.74.74
ocsp.sca1b.amazontrust.com (1)	1015	2017-03-03T16:20:51Z	2019-03-27T05:05:54Z	350	944	54.230.245.100

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-02-09	medium	id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/	Phishing
2023-02-09	medium	id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/Java_onfunc_carding.js	Phishing
2023-02-09	medium	id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/jquery-3.5.1.min.js	Phishing
2023-02-09	medium	id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/facebook-new.svg	Phishing
2023-02-09	medium	id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/youtube-new.svg	Phishing
2023-02-09	medium	id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/dhl-logo.svg	Phishing
2023-02-09	medium	id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/instagram-new.svg	Phishing
2023-02-09	medium	id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/linkedIn-new.svg	Phishing
2023-02-09	medium	id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/03f859bf58e4d37841070de34be7d978.woff	Phishing

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (7)

HTTP Transactions (45)

URL IP Response Size

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

b7407cc102d62a5acd5e61f8a79bed36

c2f4890a62454e514962b55b7fc14228339c8e90

be282de92da261128a7c8471f3067466aa9930fd0ab2a2cdda8cd2d6ce2bbd74

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "BE282DE92DA261128A7C8471F3067466AA9930FD0AB2A2CDDA8CD2D6CE2BBD74"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13547
Expires: Thu, 09 Feb 2023 19:20:48 GMT
Date: Thu, 09 Feb 2023 15:35:01 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

565c1bbc5c1c40be1988b3bf6fd9dc1a

cfdba5bc597130461dd67bf6cda53183be592493

60ceb36a8329c92fc49a3caf50daf511a38e01eac21a07d7a0a838166bea058d

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "60CEB36A8329C92FC49A3CAF50DAF511A38E01EAC21A07D7A0A838166BEA058D"
Last-Modified: Mon, 06 Feb 2023 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2268
Expires: Thu, 09 Feb 2023 16:12:49 GMT
Date: Thu, 09 Feb 2023 15:35:01 GMT
Connection: keep-alive

firefox.settings.services.mozilla.com/v1/

35.241.9.150

200 OK

939

URL HTTP/2

firefox.settings.services.mozilla.com/v1/
IP

35.241.9.150:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with very long lines (939), with no line terminators

Size

939
Hash

ff250d3ef3fa45322bf05039a0122a9f

b3e7a2c383bce1bab807dbe1a03c375258b51f1d

d07f109a96e0ae6ec7b1d46ce8761b3f06fe845769ce65d69e053dd40aa561ba

HTTP Headers

                                        GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Retry-After, Content-Length, Content-Type, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 09 Feb 2023 15:34:16 GMT
content-type: application/json
age: 45
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

50a2f8cdbbd1059f5318753155bba7ef

405e63ea4683be44f876feae34b5cb645ff751f2

f6ac743a5a17d64d2858fec5791050d2dc8074ddd823826c93e67bffdb2f0868

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F6AC743A5A17D64D2858FEC5791050D2DC8074DDD823826C93E67BFFDB2F0868"
Last-Modified: Thu, 09 Feb 2023 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8387
Expires: Thu, 09 Feb 2023 17:54:48 GMT
Date: Thu, 09 Feb 2023 15:35:01 GMT
Connection: keep-alive

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain

34.160.144.191

200 OK

5348

URL HTTP/2

content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain
IP

34.160.144.191:0
ASN

#15169 GOOGLE

Magic

PEM certificate\012- , ASCII text

Size

5348
Hash

e76071a28ee566dababb3834f46d68ed

aebb4e68c1ba2de0f90025283e8ed8470944fde0

78b6df2627172e5b35476bc31020f02898cdc412aaf4337af2c3b049a60912b6

HTTP Headers

                                        GET /chains/remote-settings.content-signature.mozilla.org-2023-03-20-18-44-46.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
x-amz-id-2: FFGGiMiK5khpENjF6/0689mMVLip3zav6qpHqn87xcRBc7mpei3jF78PRB1P3LcFAbbdEsRdWvY=
x-amz-request-id: W1QENJ7PMPSS8K0V
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 09 Feb 2023 14:36:24 GMT
age: 3517
last-modified: Sun, 29 Jan 2023 18:44:47 GMT
etag: "e76071a28ee566dababb3834f46d68ed"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

198.199.109.95

200 OK

2067

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (311), with CRLF line terminators

Size

2067
Hash

2237d1b0943222e8ac6563beff732161

c63e75f6caebdff85b5f25109698f19b72242c84

ef590a2ad9224b3170b0e104d9862017e13a4933b700f2bebde581aee4b93b05

Detections

Analyzer	Verdict	Alert
fortinet	Phishing

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/ HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:22 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 2067
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

contile.services.mozilla.com/v1/tiles

34.117.237.239

200 OK

URL HTTP/2

contile.services.mozilla.com/v1/tiles
IP

34.117.237.239:0
ASN

#15169 GOOGLE

Magic

JSON data\012- , ASCII text, with no line terminators

Size

12
Hash

23e88fb7b99543fb33315b29b1fad9d6

a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce

7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3

HTTP Headers

                                        GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
date: Thu, 09 Feb 2023 15:35:01 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js

104.17.25.14

200 OK

30244

URL HTTP/1.1

cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js
IP

104.17.25.14:0
ASN

#13335 CLOUDFLARENET

Magic

ASCII text, with very long lines (32030)

Size

30244
Hash

04ba0252a9f264db106d4eaab8df4ccb

cf52d9b3df7839c5c64fbf33aafeced74b3db750

397852429e768ffbd12a78ce4b94f14e3ab4afabf84acb07c0bb5b7798e6e0b2

HTTP Headers

                                        GET /ajax/libs/jquery/3.1.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/

                                        HTTP/1.1 200 OK
Date: Thu, 09 Feb 2023 15:35:02 GMT
Content-Type: application/javascript; charset=utf-8
Content-Length: 30244
Connection: keep-alive
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=30672000
Content-Encoding: gzip
ETag: "5eb03ec4-152b5"
Last-Modified: Mon, 04 May 2020 16:11:48 GMT
cf-cdnjs-via: cfworker/kv
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Vary: Accept-Encoding
CF-Cache-Status: HIT
Age: 423357
Expires: Tue, 30 Jan 2024 15:35:02 GMT
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XIGkdQohF1tukKWkxDaTExS13fYXpwWCGt3erIWlSC5I9Ui8DdNILsM%2FsvHyLyXx5eKixT4LwaHiGmj5lcMQwQmttsVpZh5wVAQhJbgvNSXfhGEvAx0A8yYzYxv4GQ6EMiK%2FBvBm"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 796dac2e8feab4f3-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

142.250.74.74

200 OK

31021

URL HTTP/1.1

ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP

142.250.74.74:0
ASN

#15169 GOOGLE

Magic

ASCII text, with very long lines (65451)

Size

31021
Hash

903bc7a7e510f87aa5d0201eb59a0832

ac9aa4dd94cde1bcba9037e94087138b127e41fc

41a7ac8150cc9f38421451d5143c1ffec7a1f1fafbf7a7fc0f51b98ad699cf8f

HTTP Headers

                                        GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Timing-Allow-Origin: *
Content-Length: 31021
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 03 Feb 2023 10:54:54 GMT
Expires: Sat, 03 Feb 2024 10:54:54 GMT
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Age: 535208
Last-Modified: Fri, 08 May 2020 07:05:03 GMT
Content-Type: text/javascript; charset=UTF-8

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

8ba328ca1dafc69ce7b7537cdc89616d

7ff4ddc85601ddb20d852b3b70e152ebb63e439d

27a975bedc82774262e4da67a21436afb618fc1ba3a9a29ca78401e812266929

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4541
Cache-Control: max-age=131387
Content-Type: application/ocsp-response
Date: Thu, 09 Feb 2023 15:35:02 GMT
Etag: "63e45f24-117"
Expires: Sat, 11 Feb 2023 04:04:49 GMT
Last-Modified: Thu, 09 Feb 2023 02:49:08 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 279

ocsp.digicert.com/

93.184.220.29

200 OK

471

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

471
Hash

2a874fda7c9a71bbc4ab8c05257a9ae0

02d2cfed46f96ca0a34975f9b19815687c97e0c0

58b5044e2ccc9c164403b500e79a24c1c08310e29f47b75fd3751255d7a783f1

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2770
Cache-Control: max-age=163080
Content-Type: application/ocsp-response
Date: Thu, 09 Feb 2023 15:35:02 GMT
Etag: "63e4e1dc-1d7"
Expires: Sat, 11 Feb 2023 12:53:02 GMT
Last-Modified: Thu, 09 Feb 2023 12:06:52 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 471

ocsp.digicert.com/

93.184.220.29

200 OK

279

URL HTTP/1.1

ocsp.digicert.com/
IP

93.184.220.29:0
ASN

#15133 EDGECAST

Magic

data

Size

279
Hash

8ba328ca1dafc69ce7b7537cdc89616d

7ff4ddc85601ddb20d852b3b70e152ebb63e439d

27a975bedc82774262e4da67a21436afb618fc1ba3a9a29ca78401e812266929

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3257
Cache-Control: 'max-age=158059'
Content-Type: application/ocsp-response
Date: Thu, 09 Feb 2023 15:35:02 GMT
Last-Modified: Thu, 09 Feb 2023 14:40:45 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 279

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/style_019.css

198.199.109.95

200 OK

1164

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/style_019.css
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

assembler source, ASCII text, with CRLF line terminators

Size

1164
Hash

9ee23849f7c60087eada6b82c3f75e47

b93ed13dbdb11d37301c37caed812bef9246b6d3

d8f1c388fdc37694ecd8c8af9dc07243b47f24c07622e53e7f70cda9fcc71122

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/style_019.css HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: text/css
Content-Length: 1164
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "112b-5f43ecf8afdbd-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/style_022.css

198.199.109.95

200 OK

468

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/style_022.css
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

ASCII text, with CRLF line terminators

Size

468
Hash

00d28f6ef97e27a46db91b086e85d14c

838b26a25dd9b9ad210ee368fecce85f7b06db59

cd6bbe8969e7620528b79e08eea6780ab830ceac8176b9346212ab00f9f28cbf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/style_022.css HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: text/css
Content-Length: 468
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "646-5f43ecf8b058d-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=8cb6f1f1f2

172.64.168.22

200 OK

13222

URL HTTP/2

ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=8cb6f1f1f2
IP

172.64.168.22:0
ASN

#13335 CLOUDFLARENET

Magic

ASCII text, with very long lines (60130)

Size

13222
Hash

5b55a0f80aeedb4a37c77decaed4f5f9

fc9263e3c1a0c8143bfec9ab270863839cdfa19e

ce6d8bac53381a325c1ec12fced041d5718ad2e86e4afe6849813c546190d6b1

HTTP Headers

                                        GET /releases/v5.15.4/css/free.min.css?token=8cb6f1f1f2 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/
Origin: http://id-purple-lion-benfrejchadi350704.codeanyapp.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
date: Thu, 09 Feb 2023 15:35:02 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 f73d71dfa047571774d2c0460e5108ec.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P1
x-amz-cf-id: tGi_FzfAF_SKd06D8t-2bd0i-vlhwuELgT9SgkWvYZ8V3B-LG4IOWA==
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v4Bh2r3raTF3L1iF3U3Zp5EyxfNRPAA8Vr%2BWhBh7zbTHWkbZwjsZcOMk%2B1gr8waRYZnfw%2F9Xl8nwQRn6i%2B3eEMcoy6QNnMgm%2FoEH2nSxM2c2VXSpdccJX0qcT0Q9eUIevWy75Iedhg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 796dac2fc8d423dd-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/Java_onfunc_carding.js

198.199.109.95

200 OK

568

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/Java_onfunc_carding.js
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

ASCII text, with CRLF line terminators

Size

568
Hash

65717097e71f785c5db6bdc9f8da91e8

e818952fcfcaf5fff885ba68d44be209b24cead7

a9ef5e413f930293c2d758890407ae2cc02aaaa960c505b72b8ba15a6b57d7a2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/Java_onfunc_carding.js HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: application/javascript
Content-Length: 568
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "9d2-5f43ecf8b058d-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

ocsp.sca1b.amazontrust.com/

54.230.245.100

200 OK

471

URL HTTP/1.1

ocsp.sca1b.amazontrust.com/
IP

54.230.245.100:0
ASN

#16509 AMAZON-02

Magic

data

Size

471
Hash

2d19cde9142521fb1de1aa32082dfa6c

cec0ecec509b94a925a1e02ac605ca6355ca040a

d2f46dfd1798d84038737b499ed2476fb815b9b11e858bc7e3bc2f04eaf21127

HTTP Headers

                                        POST / HTTP/1.1
Host: ocsp.sca1b.amazontrust.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Thu, 09 Feb 2023 15:35:02 GMT
Last-Modified: Thu, 09 Feb 2023 15:03:13 GMT
Server: ECS (nyb/1D2E)
X-Cache: Miss from cloudfront
Via: 1.1 4bbc14b5834fc74ccd249b954b43a08c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: heTlhyiTI6TINFNOkOaaiFItZM_mcVkcd0XpGxdLNYhShAynkKlzIg==
Age: 1909

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

248ce16379b12f11927ecc3142aec450

fa5b189f2d9182479170cb61cc1723571e437bd2

a8d259b331bdefb00625b9bf057d44d0b3290fda0734c57eda187b04e23d59d4

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A8D259B331BDEFB00625B9BF057D44D0B3290FDA0734C57EDA187B04E23D59D4"
Last-Modified: Wed, 08 Feb 2023 20:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=12616
Expires: Thu, 09 Feb 2023 19:05:18 GMT
Date: Thu, 09 Feb 2023 15:35:02 GMT
Connection: keep-alive

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/jquery-3.5.1.min.js

198.199.109.95

200 OK

37523

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/jquery-3.5.1.min.js
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

Unicode text, UTF-8 text, with very long lines (755)

Size

37523
Hash

7b525bf977f37f7cff63ad7e064c0fa4

5c2e98697c401300f6020de1ef38bab2f09635ef

e7698aafd7d6125cea1ff751c76cd278570bbc6cf2c991d0595ea29fc5858049

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
urlquery	suspicious	Suspicious - Suspicious JS code
fortinet	Phishing

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/jquery-3.5.1.min.js HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: application/javascript
Content-Length: 37523
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "255e1-5f43ecf8b01a5-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2

172.64.168.22

200 OK

78168

URL HTTP/2

ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2
IP

172.64.168.22:0
ASN

#13335 CLOUDFLARENET

Magic

Web Open Font Format (Version 2), TrueType, length 78168, version 331.-31196\012- data

Size

78168
Hash

a9fd1225fb2cd32320e2b931dca01089

44ec5c6a868b4ce62350d9f040ed8e18f7a1d128

c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7

HTTP Headers

                                        GET /releases/v5.15.4/webfonts/free-fa-solid-900.woff2 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://id-purple-lion-benfrejchadi350704.codeanyapp.com
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
date: Thu, 09 Feb 2023 15:35:02 GMT
content-type: font/woff2
content-length: 78168
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:58:24 GMT
etag: "a9fd1225fb2cd32320e2b931dca01089"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
x-cache: Hit from cloudfront
via: 1.1 eb3d2bd89447108973b8d2779fc789e4.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P1
x-amz-cf-id: Rb-mJJcMgkGJCvhKDxO9nslpxPxiDpvjAvpaKfjNrUGBe3wpr4UjaQ==
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VOtQ5oPVShWbNFmsIi3f64Rk7ElgBYtakjWgpuVc4Tx0ohutlhvb62M9S5VUuKCQFqiN88DxlTO5eWFfxH9NKoZ4THEh1OWNPepe9o%2F3VverOohfKQhVRXbQju4HPCau%2B4oas9iRbw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 796dac32fd3423dd-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

push.services.mozilla.com/

54.149.213.50

101 Switching Protocols

URL HTTP/1.1

push.services.mozilla.com/
IP

54.149.213.50:0
ASN

#16509 AMAZON-02

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

                                        GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: WIde+aI6WpQtuiernOj8eQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

                                        HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 0qpYQy7Nm+9Q4guYJZczoKXi9/I=

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/facebook-new.svg

198.199.109.95

200 OK

1406

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/facebook-new.svg
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (963)

Size

1406
Hash

259d8928a7fd5329b3d7fd80eca2ea2f

a6337de5ff5761b39a319cd7ec3f8b10f201d066

43027752f5a04142e6518a4fd8ef54e7e73cfba7820da9c03c1ad38835f04fe2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/facebook-new.svg HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: image/svg+xml
Content-Length: 1406
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "57e-5f43ecf8afdbd"
Accept-Ranges: bytes

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/youtube-new.svg

198.199.109.95

200 OK

1412

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/youtube-new.svg
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (971)

Size

1412
Hash

376247a0b06e705c758fe04978ea9df5

90d50c682c2ea23a9d26926c6eb3d849b7b94661

acd3eaf2b608fb48f9915964c36772b322ad91106508c4490e2a72122db4d347

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/youtube-new.svg HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: image/svg+xml
Content-Length: 1412
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "584-5f43ecf8afdbd"
Accept-Ranges: bytes

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/dhl-logo.svg

198.199.109.95

200 OK

1603

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/dhl-logo.svg
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text

Size

1603
Hash

3fecc9db35d5d2a9e6e71ab4b02d22e5

628ba2f505b480097445aaf08649a08242bd6847

362bcaa42090e36611031bec6bdaa0600375ef847092cca195c58d3bae9b4419

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/dhl-logo.svg HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: image/svg+xml
Content-Length: 1603
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "643-5f43ecf8afdbd"
Accept-Ranges: bytes

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/instagram-new.svg

198.199.109.95

200 OK

4508

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/instagram-new.svg
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (4063)

Size

4508
Hash

056511aeb5282ecaab9fbf10ed2273e5

fc29c2c37c4b4a31ad13e80356371e338aef5894

f01c2e1870fcd75ceca3b4c42c3110cb0aa4b933b562cf3d2c7ddd20ce03c7ee

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/instagram-new.svg HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: image/svg+xml
Content-Length: 4508
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "119c-5f43ecf8b01a5"
Accept-Ranges: bytes

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/linkedIn-new.svg

198.199.109.95

200 OK

1647

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/linkedIn-new.svg
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

SVG Scalable Vector Graphics image\012- XML 1.0 document text\012- XML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1204)

Size

1647
Hash

43efff953a2a3baf6a2ef0528f55dc07

b510bc0512da7d96cdf29a0f1e343319095776de

c32f1a0f5b093b6b2c8f5df0bf93856359769ee6bbab40975043cd133711d528

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/linkedIn-new.svg HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: image/svg+xml
Content-Length: 1647
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "66f-5f43ecf8b01a5"
Accept-Ranges: bytes

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/03f859bf58e4d37841070de34be7d978.woff

198.199.109.95

200 OK

41084

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/03f859bf58e4d37841070de34be7d978.woff
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

Web Open Font Format, TrueType, length 41084, version 1.66\012- data

Size

41084
Hash

03f859bf58e4d37841070de34be7d978

3436d4fa17e7ee470c3d62b08787cfa7de408408

5af5c3746b03792640b9cafdabddfb2c5407f72988e128541a88fa439607d940

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL
fortinet	Phishing

HTTP Headers

                                        GET /cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/03f859bf58e4d37841070de34be7d978.woff HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/sourecApp/style/style_019.css

                                        HTTP/1.1 200 OK
Server: openresty
Date: Thu, 09 Feb 2023 15:16:23 GMT
Content-Type: application/font-woff
Content-Length: 41084
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2023 06:51:30 GMT
ETag: "a07c-5f43ecf8afdbd"
Accept-Ranges: bytes

s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js

52.218.224.64

200 OK

176433

URL HTTP/1.1

s3-us-west-2.amazonaws.com/s.cdpn.io/3/jquery.inputmask.bundle.js
IP

52.218.224.64:0
ASN

#16509 AMAZON-02

Magic

ASCII text, with very long lines (544)

Size

176433
Hash

f0b02d9f2d3c6679556e63935ac23320

384bb74cdb2840da6eaa9400242faf4a2fac3daa

f708ad894d421f32ed297a914632db6bc1577841d1c210b34f1a0821ea0aaa4b

HTTP Headers

                                        GET /s.cdpn.io/3/jquery.inputmask.bundle.js HTTP/1.1
Host: s3-us-west-2.amazonaws.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/1.1 200 OK
x-amz-id-2: 70uY2kXJ6AApuzbQyGmDubZ1OHqgs04TzQ6kzxgSoxWR9zeRuDrIfCsI3jEK2C5fT+A7vFpstgQ=
x-amz-request-id: 97ZE0G2FJ51NN86T
Date: Thu, 09 Feb 2023 15:35:03 GMT
Last-Modified: Wed, 30 Nov 2016 13:28:36 GMT
ETag: "f0b02d9f2d3c6679556e63935ac23320"
Cache-Control: public
Expires: Mon, 30 Nov 2026 13:28:34 GMT
x-amz-version-id: null
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Content-Length: 176433

id-purple-lion-benfrejchadi350704.codeanyapp.com/favicon.ico

198.199.109.95

302 Found

URL HTTP/1.1

id-purple-lion-benfrejchadi350704.codeanyapp.com/favicon.ico
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

Size

0
Hash

d41d8cd98f00b204e9800998ecf8427e

da39a3ee5e6b4b0d3255bfef95601890afd80709

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

                                        GET /favicon.ico HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/cy/dhl/DH2tAyUe9AsUx7b339/

                                        HTTP/1.1 302 Found
Server: openresty
Date: Thu, 09 Feb 2023 15:16:24 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Link: <https://id-purple-lion-benfrejchadi350704.codeanyapp.com/wp-json/>; rel="https://api.w.org/"
X-Redirect-By: WordPress
Location: https://id-purple-lion-benfrejchadi350704.codeanyapp.com/wp-includes/images/w-logo-blue-white-bg.png

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

fdc443de940b2363cc53a8a9fc0518e8

6a14977e9a24b9e017b8e0d54f7bfc9d2bbe523d

85cd64a95c6a8d08c294b065e0c1c7acabae5a766d23832bf1a9ee7a075b390f

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "85CD64A95C6A8D08C294B065E0C1C7ACABAE5A766D23832BF1A9EE7A075B390F"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18436
Expires: Thu, 09 Feb 2023 20:42:20 GMT
Date: Thu, 09 Feb 2023 15:35:04 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

1d885cfc22a04f1216c98dd64df5338a

589916a844b81fac40af88a772865b8e28dfb64e

40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4799
Expires: Thu, 09 Feb 2023 16:55:03 GMT
Date: Thu, 09 Feb 2023 15:35:04 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

1d885cfc22a04f1216c98dd64df5338a

589916a844b81fac40af88a772865b8e28dfb64e

40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4799
Expires: Thu, 09 Feb 2023 16:55:03 GMT
Date: Thu, 09 Feb 2023 15:35:04 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

1d885cfc22a04f1216c98dd64df5338a

589916a844b81fac40af88a772865b8e28dfb64e

40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4799
Expires: Thu, 09 Feb 2023 16:55:03 GMT
Date: Thu, 09 Feb 2023 15:35:04 GMT
Connection: keep-alive

r3.o.lencr.org/

23.36.77.32

200 OK

503

URL HTTP/1.1

r3.o.lencr.org/
IP

23.36.77.32:0
ASN

#20940 Akamai International B.V.

Magic

data

Size

503
Hash

1d885cfc22a04f1216c98dd64df5338a

589916a844b81fac40af88a772865b8e28dfb64e

40c0e55533794d72bbba4bc9d0f07fe0741e24ca23fd9b3e31d2830c77a51bf3

HTTP Headers

                                        POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

                                        HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "40C0E55533794D72BBBA4BC9D0F07FE0741E24CA23FD9B3E31D2830C77A51BF3"
Last-Modified: Wed, 08 Feb 2023 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4799
Expires: Thu, 09 Feb 2023 16:55:03 GMT
Date: Thu, 09 Feb 2023 15:35:04 GMT
Connection: keep-alive

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac74c9c-b95e-40f4-a5ca-7180c40cc241.jpeg

34.120.237.76

200 OK

7450

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac74c9c-b95e-40f4-a5ca-7180c40cc241.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

7450
Hash

ce710ab5746832fe637fada3e6d63abf

d545c85d4a8cf92dc8b88db0a056623d1ef7a943

40bae4a2fb9dd60e9339d15ad0838f3ca83b5b6275c35cd22878b6783fcd6247

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F0ac74c9c-b95e-40f4-a5ca-7180c40cc241.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 7450
x-amzn-requestid: c3dabd4b-797b-4bbe-8824-5f502ff477b0
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fmJ2aG-IoAMFfnQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63d8bcf5-68de905b2ed5bfe46a87e688;Sampled=0
x-amzn-remapped-date: Tue, 31 Jan 2023 07:02:13 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: AX-TsURes3Bn0RrAnH7TnsouJdkcOpbq7f7KAzPMWq4RMBH8FWMz7g==
via: 1.1 1cc6ed0d2d3dd9529ce544f9dfe61a52.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 17:45:22 GMT
age: 78582
etag: "d545c85d4a8cf92dc8b88db0a056623d1ef7a943"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8637

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb92005b3-7a69-411c-9afb-60b86ab8c5da.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

8637
Hash

b0c5e12696e3ee13041d043084828210

c48927fb23f59e0949d388086c197699c8f19d1b

47838e958555ff6799d4d1d3994913943726daba5294cd89afe9036628ef6fdb

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb92005b3-7a69-411c-9afb-60b86ab8c5da.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 8637
x-amzn-requestid: fa797448-32c3-4438-a192-5291c48b1d85
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AChJKFq9oAMFgog=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e4156d-46ff32923a2763b45a5194f4;Sampled=0
x-amzn-remapped-date: Wed, 08 Feb 2023 21:34:37 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 2olwTLHKbCas7GcQiRz22bk_I646VcTxN3Yv_ObBVgeGC0l73GNh8A==
via: 1.1 efe54e8b68e074d39b2ecd249f85100a.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:42:27 GMT
age: 64357
etag: "c48927fb23f59e0949d388086c197699c8f19d1b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8717

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F844d5320-b850-4dd9-87c4-2b4f17eb895e.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

8717
Hash

82ed633b05ccadc8b87e83413641f1ef

aafed39990cf6a3391d53355085d816167a500fa

c9202e36b231d0a9a9cba1ff8f570e5b0fbba215eb6b28e3989fd442ee7f5835

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F844d5320-b850-4dd9-87c4-2b4f17eb895e.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 8717
x-amzn-requestid: dbb8b5a2-d3f6-42e2-8778-da19de081cb8
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: f2c0LHaiIAMF5cA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63df41b4-309b6b1f651f68453dd52f55;Sampled=0
x-amzn-remapped-date: Sun, 05 Feb 2023 05:42:12 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: hBfl0rPzn_iOD9xRlc236_IEvyGlK5WteH1y4cd0aYxlFzd3RVfgkQ==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 64f86ae1c24221f3a2e4d653d6dbc416.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:42:47 GMT
age: 64337
etag: "aafed39990cf6a3391d53355085d816167a500fa"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

11760

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3ab2faf0-d9a7-41a6-b5cf-bf6189f66342.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

11760
Hash

9203cfb9f0c1c958dd008eac55a9d3c4

6bdd1047590dd3fb54c15d5d6d38e7c86274b203

09770229be5ff3037708543e3204c66de84253b3a858a83a0e1672a04c0e9cb1

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F3ab2faf0-d9a7-41a6-b5cf-bf6189f66342.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 11760
x-amzn-requestid: b2863a01-4714-4554-a478-5402467b3448
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: AChJKHc_oAMFwlw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63e4156d-1c5a3edf37bc7cc937c800d2;Sampled=0
x-amzn-remapped-date: Wed, 08 Feb 2023 21:34:37 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: euok7HXthk9GEynD8n9wXgf85lD0shxOdtT5VZvj-xHkoxEMxuohmA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 570075675953459325e00b7bcd171df2.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 21:42:38 GMT
age: 64346
etag: "6bdd1047590dd3fb54c15d5d6d38e7c86274b203"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

8150

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc03326d1-bbfd-4654-a9db-ac431757b9f6.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

8150
Hash

764b732e88dd1e9c1824529b24b3dffc

2ba954a51c2972b267ae0536e343e608aa9aa7f4

a1efdf03b14bb05cf8e407b92476592c35fa2d27c5e66705322abdb4c6412a06

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc03326d1-bbfd-4654-a9db-ac431757b9f6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 8150
x-amzn-requestid: 3834493a-4162-4cc9-b67c-541cc9be895b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fwD8IH0TIAMFWqQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dcb380-3746ff7b0a6894366efa848e;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 07:10:56 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: HNuUU4SaVvuPbW0clgJa6UZ-0zefgWJWfIJEsz_yCfKiCrx2wsu6vA==
via: 1.1 0c96ded7ff282d2dbcf47c918b6bb500.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Thu, 09 Feb 2023 09:31:09 GMT
age: 21835
etag: "2ba954a51c2972b267ae0536e343e608aa9aa7f4"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

34.120.237.76

200 OK

10472

URL HTTP/2

img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ec996f6-8867-41f0-9850-ad04d05e22e6.jpeg
IP

34.120.237.76:0
ASN

#15169 GOOGLE

Magic

JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data

Size

10472
Hash

464812429ec9f5c766def4ac26e86e4f

170a5d6fcaa69c78896ed8a37442a27c6309c09a

1248df6127626b254420b6ddabba6fba12066c9b7f314386c25ac51781f59060

HTTP Headers

                                        GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F6ec996f6-8867-41f0-9850-ad04d05e22e6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: nginx
content-length: 10472
x-amzn-requestid: f43c32c6-0bb3-4154-934d-cd0ad1e3edf7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: fv73mHmooAMFRFA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63dca696-700ab104674033036aba0878;Sampled=0
x-amzn-remapped-date: Fri, 03 Feb 2023 06:15:50 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: 2kp0tBfU8v-pe5Tft8WnSQKV5deSlUbRVEGthGejjT4uXlbbv1IiAg==
via: 1.1 c7c3cdef911c9ee3c1a83a78f425dc5a.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 08 Feb 2023 19:00:11 GMT
age: 74093
etag: "170a5d6fcaa69c78896ed8a37442a27c6309c09a"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2

id-purple-lion-benfrejchadi350704.codeanyapp.com/wp-includes/images/w-logo-blue-white-bg.png

198.199.109.95

200 OK

4119

URL HTTP/2

id-purple-lion-benfrejchadi350704.codeanyapp.com/wp-includes/images/w-logo-blue-white-bg.png
IP

198.199.109.95:0
ASN

#14061 DIGITALOCEAN-ASN

Magic

PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced\012- data

Size

4119
Hash

000bf649cc8f6bf27cfb04d1bcdcd3c7

d73d2f6d74ec6cdcbae07955592962e77d8ae814

6bdb369337ac2496761c6f063bffea0aa6a91d4662279c399071a468251f51f0

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - DHL
urlquery	phishing	Phishing - DHL

HTTP Headers

                                        GET /wp-includes/images/w-logo-blue-white-bg.png HTTP/1.1
Host: id-purple-lion-benfrejchadi350704.codeanyapp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

                                        HTTP/2 200 OK
server: openresty
date: Thu, 09 Feb 2023 15:16:25 GMT
content-type: image/png
content-length: 4119
last-modified: Mon, 20 Dec 2021 15:24:56 GMT
etag: "1017-5d3957db2a200"
accept-ranges: bytes
X-Firefox-Spdy: h2

ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-font-face.min.css?token=8cb6f1f1f2

172.64.168.22

200 OK

URL HTTP/2

ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-font-face.min.css?token=8cb6f1f1f2
IP

172.64.168.22:0
ASN

#13335 CLOUDFLARENET

Magic

Size

0
Hash

HTTP Headers

                                        GET /releases/v5.15.4/css/free-v4-font-face.min.css?token=8cb6f1f1f2 HTTP/1.1
Host: ka-f.fontawesome.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://id-purple-lion-benfrejchadi350704.codeanyapp.com/
Origin: http://id-purple-lion-benfrejchadi350704.codeanyapp.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
TE: trailers

                                        HTTP/2 200 OK
date: Thu, 09 Feb 2023 15:35:02 GMT
content-type: text/css
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-max-age: 3000
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
etag: W/"f2e0b2680d9b0bcb6e0039c4424e5a59"
cache-control: max-age=31556926
access-control-allow-headers: fa-kit-token
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 17a77a72dc1e9981253a822e540e37c2.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P1
x-amz-cf-id: 3svgu9V90Lo28G16wCJiKISgL5S81TFnFN1-j4BTZwod9z_-JCQx5Q==
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3EIARmwz0J3hDNyQfdx6%2FxWYQjkozjxy3CYOXSLprFHXPWEoIGyZrrY7%2BqdpfwwKfFT7pHdWDHv7zE6ff7IXojovTQiA4ti%2BYyXBwv3rK8cfzZZi6rn2qrAcpb827%2FTWducj7SdpZw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 796dac2fc8cd23dd-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2

stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

104.18.11.207

200 OK

URL HTTP/2

stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
IP

104.18.11.207:0
ASN

#13335 CLOUDFLARENET

Magic

Size

0
Hash

Report Overview

URL

IP

ASN

Submitted

Access

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

#1 JS:Script (size: 2514)

#2 JS:Script (size: 89476)

#3 JS:Script (size: 86709)

#4 JS:Script (size: 11025)

#5 JS:Script (size: 153057)

#6 JS:Script (size: 176433)

#7 JS:Script (size: 248)

HTTP Transactions (45)

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size

Hash

HTTP Headers

URL HTTP/1.1

IP

ASN

Magic

Size

Hash

Detections

HTTP Headers

URL HTTP/2

IP

ASN

Magic

Size