Windows Analysis Report
https://uch.mrn.mybluehost.me/MS/DHLM/

Overview

General Information

Sample URL:	https://uch.mrn.mybluehost.me/MS/DHLM/
Analysis ID:	1447542
Infos:

Detection

HTMLPhisher

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Phishing site detected (based on logo match)

HTML body contains low number of good links

HTML body with high number of embedded SVGs detected

HTML title does not match URL

Suspicious form URL found

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://uch.mrn.mybluehost.me/MS/DHLM/	Avira URL Cloud: detection malicious, Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/	SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/socio.png	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/font-awesome.min.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Light.774e3ae02978a9a76de6.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/LOGA.svg	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Regular.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/bootstrap-icons.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/camion.png	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/titiza.png	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/group.svg	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/assets/fonts/FedExSans_W-Regular.woff?6wo4i3	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Condensed-Bold-Italic.4c1d6f58b86d3a9d2c37.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/LOGAA.svg	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Italic.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Regular.475f432261db6051bb40.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/US.png	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/style.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold-Italic.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/dhl-logo.svg	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Light.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Italic.293f6c351bb0f40c453f.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/X911.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Bold.4659c1d4ddc84b4a3898.woff	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for submitted file

Source: https://uch.mrn.mybluehost.me/MS/DHLM/

Virustotal: Detection: 12%

Perma Link

Phishing

AI detected phishing page

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

LLM: Score: 9 brands: DHL Reasons: The URL 'https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS' is suspicious as it does not match the legitimate domain name for DHL, which is typically 'dhl.com'. The URL structure and the use of 'mybluehost.me' suggest it is hosted on a generic hosting service, which is often used in phishing attacks. The page requests personal information such as full name, address, and phone number, which is a common social engineering technique used in phishing. The presence of a message urging the user to enter information to resolve an 'On Hold' shipment status is another red flag. Therefore, this site is highly likely to be a phishing site. DOM: 2.2.pages.csv

Phishing site detected (based on favicon image match)

Source: https://mybluehost.me	Matcher: Template: dhl matched with high similarity
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1#HDHKJDJDSSJDSJKJDSJDSDJJDSHYKJHGFG	Matcher: Template: dhl matched with high similarity
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS	Matcher: Template: dhl matched with high similarity

Yara detected HtmlPhish10

Source: Yara match

File source: 2.2.pages.csv, type: HTML

Phishing site detected (based on logo match)

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

Matcher: Template: dhl matched

HTML body contains low number of good links

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: Number of links: 0

HTML body with high number of embedded SVGs detected

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1#HDHKJDJDSSJDSJKJDSJDSDJJDSHYKJHGFG

HTTP Parser: Total embedded SVG size: 737974

HTML title does not match URL

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: Title: | DHL | does not match URL

Suspicious form URL found

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: Form action: ./siftA/Abilli.php

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/adrum-xd.99c2fcc5ccc30ea4d38a1a74eeb7a6a6.html

HTTP Parser: No favicon

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: No <meta name="author".. found

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /MS/DHLM/ HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/index.php?FGDD=1 HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/common-core_SHF.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/X911.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/font-awesome.min.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/style.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/bootstrap-icons.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/adrum-xd.99c2fcc5ccc30ea4d38a1a74eeb7a6a6.html HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/US.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/dhl-logo.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.2.0/js/all.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/LOGA.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/LOGAA.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/bootstrap-icons.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Regular.475f432261db6051bb40.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Bold.4659c1d4ddc84b4a3898.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Italic.293f6c351bb0f40c453f.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/dhl-logo.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/US.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Light.774e3ae02978a9a76de6.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Regular.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/LOGAA.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/LOGA.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Italic.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Light.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold-Italic.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /assets/fonts/FedExSans_W-Regular.woff?6wo4i3 HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Condensed-Bold-Italic.4c1d6f58b86d3a9d2c37.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/favicon.ico HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/favicon.ico HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/A.php?Billi=1 HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/camion.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.0.0/dist/css/bootstrap.min.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/group.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/socio.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/titiza.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/camion.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/socio.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/group.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/titiza.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09

Source: global traffic	DNS traffic detected: DNS query: uch.mrn.mybluehost.me
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:15 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:19 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:19 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:22 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:22 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_77.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_77.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_69.2.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_69.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_90.2.dr, chromecache_96.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_90.2.dr, chromecache_96.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_90.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: classification engine

Classification label: mal100.phis.win@17/71@12/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1976,i,15305913582776301799,1729019655534027141,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://uch.mrn.mybluehost.me/MS/DHLM/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1976,i,15305913582776301799,1729019655534027141,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
151.101.193.229	jsdelivr.map.fastly.net	United States	54113	FASTLYUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
50.87.170.127	uch.mrn.mybluehost.me	United States	46606	UNIFIEDLAYER-AS-1US	true
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4
192.168.2.5

Contacted Domains

Name	IP	Active
jsdelivr.map.fastly.net	151.101.193.229	true
bg.microsoft.map.fastly.net	199.232.214.172	true
code.jquery.com	151.101.2.137	true
uch.mrn.mybluehost.me	50.87.170.127	true
cdnjs.cloudflare.com	104.17.25.14	true
www.google.com	142.250.184.196	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
cdn.jsdelivr.net	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/socio.png	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/LOGA.svg	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Light.774e3ae02978a9a76de6.woff	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/font-awesome.min.css	false	Avira URL Cloud: phishing	unknown
https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Regular.woff	false	Avira URL Cloud: phishing	unknown
https://cdn.jsdelivr.net/npm/bootstrap@5.0.0/dist/css/bootstrap.min.css	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/bootstrap-icons.css	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1#HDHKJDJDSSJDSJKJDSJDSDJJDSHYKJHGFG	true		unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/camion.png	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.css	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold.woff	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/titiza.png	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/group.svg	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/assets/fonts/FedExSans_W-Regular.woff?6wo4i3	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1	false	14%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Condensed-Bold-Italic.4c1d6f58b86d3a9d2c37.woff	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1	true	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/LOGAA.svg	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Italic.woff	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Regular.475f432261db6051bb40.woff	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/US.png	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/adrum-xd.99c2fcc5ccc30ea4d38a1a74eeb7a6a6.html	false		unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/style.css	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold-Italic.woff	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/	true		unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.css	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/dhl-logo.svg	false	Avira URL Cloud: phishing	unknown
https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.1.min.js	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Light.woff	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Italic.293f6c351bb0f40c453f.woff	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS	true		unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.2.0/js/all.min.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/X911.css	false	Avira URL Cloud: phishing	unknown
https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Bold.4659c1d4ddc84b4a3898.woff	false	Avira URL Cloud: phishing	unknown

Name	Type	MD5	SHA1	SHA256
Chrome Cache Entry: 100	ASCII text, with very long lines (65447)	00727D1D5D9C90F7DE826F1A4A9CC632	EA61688671D0C3044F2C5B2F2C4AF0A6620AC6C2	A3CF00C109D907E543BC4F6DBC85EB31068F94515251347E9E57509B52EE3D74
Chrome Cache Entry: 61	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	4D6C500F19032F9AD24F0C20751EB16C	41E562ED29A58274F0871409BC4DC29E07AB0314	9749654BDFCCE79BC06740ED18CE854C5BC56FD419A8D59FC590777BA942105E
Chrome Cache Entry: 62	PNG image data, 172 x 33, 8-bit/color RGBA, non-interlaced	85FCC8DB797DED15A1E7736D80A98026	6167FD8C4EA5BC75AD6E668CD967D0A3715BEC20	39B5E1FDC845A00E044F1D5136D4D365E319D79CAAE542B2ABEF7E9A7EB7D786
Chrome Cache Entry: 63	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 64	SVG Scalable Vector Graphics image	D1B0E043744FD642282117A03D308B17	D8ABE7A0887B804E516C45A344C542E291A1A84B	5162DE2EE844A80D76B7D7514C02AB7D5DE72A5966113323D80EB56BF6DED038
Chrome Cache Entry: 65	SVG Scalable Vector Graphics image	4CDF5B1922FE350E679B7B616AF21BD3	2EA65118EC5E1E365791E38B8EBDC1CFE3EC2DBE	304213033F2A03071409043919D5D27D9847E0FB96C8433871DDCD7AD93FCB39
Chrome Cache Entry: 66	ASCII text, with very long lines (565), with CRLF line terminators	D2AC10C9480A73FC1536CE37F064C059	235EE99FA985A93A9024931DB0F1FAD4DE6AD05F	97F4246771D44F0D6EE285EC8C1D5E8231D6E9769B159E88C2E73CFBED7D6ACB
Chrome Cache Entry: 67	PNG image data, 92 x 92, 8-bit colormap, non-interlaced	1DD1294626ED93546580A9FC228081CB	FC6E969E542A2D02F4F51134BB45FEC58571A6B2	3AFF52960928BDCFAF23C033A61D686F4E5486F43F821FF8E97A5C8BB50560BD
Chrome Cache Entry: 68	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 69	ASCII text, with very long lines (65317)	D5BEB8FA265F90BE5CCADD6B32B8672F	7BDC23C06B51E7E42C05DE486680A3C18AA5CE5A	6A769E18B06859751EAA2259044A6FF76E3DDCD6572A516D8CE3A2D7B8C7538E
Chrome Cache Entry: 70	SVG Scalable Vector Graphics image	3FECC9DB35D5D2A9E6E71AB4B02D22E5	628BA2F505B480097445AAF08649A08242BD6847	362BCAA42090E36611031BEC6BDAA0600375EF847092CCA195C58D3BAE9B4419
Chrome Cache Entry: 71	PNG image data, 92 x 92, 8-bit colormap, non-interlaced	1DD1294626ED93546580A9FC228081CB	FC6E969E542A2D02F4F51134BB45FEC58571A6B2	3AFF52960928BDCFAF23C033A61D686F4E5486F43F821FF8E97A5C8BB50560BD
Chrome Cache Entry: 72	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 73	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 74	ASCII text	1A264F8A938F1BAFD771567199EB3662	D0AFFD8C41B450D30D2BD71AE2B852AC073E960C	DB3BDDF54DEA690AA25839265E3BA48668AA86636DA378EDF0EBA51FCD783DAA
Chrome Cache Entry: 75	ASCII text, with CRLF line terminators	F060BA05AAED8752D276684109FCCD9A	86B930B9C7D28D9D19C80D1C1FA4B83ED9E0501A	06FE84FFC7A3FB802FA06421457F4C2120C862286956E26CB1E4B5316A220706
Chrome Cache Entry: 76	PNG image data, 172 x 33, 8-bit/color RGBA, non-interlaced	85FCC8DB797DED15A1E7736D80A98026	6167FD8C4EA5BC75AD6E668CD967D0A3715BEC20	39B5E1FDC845A00E044F1D5136D4D365E319D79CAAE542B2ABEF7E9A7EB7D786
Chrome Cache Entry: 77	ASCII text, with very long lines (30837)	269550530CC127B6AA5A35925A7DE6CE	512C7D79033E3028A9BE61B540CF1A6870C896F8	799AEB25CC0373FDEE0E1B1DB7AD6C2F6A0E058DFADAA3379689F583213190BD
Chrome Cache Entry: 78	Web Open Font Format (Version 2), TrueType, length 85044, version 1.0	316400C09C0560B3812E58B3124BBF15	2314D4D73DD9ED7AA2F9D18D45E71CA0440AC0A9	856B3F9E0DF4F7061C8948021C7CC6E6263D96C48161E7FE9E4FBEFD0C69A085
Chrome Cache Entry: 79	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	4D6C500F19032F9AD24F0C20751EB16C	41E562ED29A58274F0871409BC4DC29E07AB0314	9749654BDFCCE79BC06740ED18CE854C5BC56FD419A8D59FC590777BA942105E
Chrome Cache Entry: 80	SVG Scalable Vector Graphics image	D1B0E043744FD642282117A03D308B17	D8ABE7A0887B804E516C45A344C542E291A1A84B	5162DE2EE844A80D76B7D7514C02AB7D5DE72A5966113323D80EB56BF6DED038
Chrome Cache Entry: 81	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	D8106BF3A1D00AB43B01E6E3C92500EB	202B5E8654AB1B28351378293BCA3B9D844CC29B	9ADA5709E264C31B04A05BD85448A9BD5E91925E8D83DF5CEF0762EC97CC283E
Chrome Cache Entry: 82	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 83	SVG Scalable Vector Graphics image	3FECC9DB35D5D2A9E6E71AB4B02D22E5	628BA2F505B480097445AAF08649A08242BD6847	362BCAA42090E36611031BEC6BDAA0600375EF847092CCA195C58D3BAE9B4419
Chrome Cache Entry: 84	SVG Scalable Vector Graphics image	0308F4A1104011DB933C61A3BD39023B	33174699EFFE0D92A85BE40846052C2AE482C4BE	3FBEBBCC1EBF48EBE492E6080CF7C618C15B9A23D5AE6D771B0BCE47AD5753EB
Chrome Cache Entry: 85	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 86	HTML document, ASCII text, with very long lines (65025), with CRLF line terminators	6A8716F7A4BA08B1421E13E41F284AD2	6EDDBF64B74DC15129830EECE1BC79EC60CE81C4	F6910BFDEB4A911E0D7F3AFAA092C4C1BB4520FDA38651C807E07292D2C9CAE1
Chrome Cache Entry: 87	PNG image data, 1365 x 426, 8-bit colormap, non-interlaced	6BCA8F7256286A08770C3EDF34F27B05	73C9CACAB54C792976B8D806C41F0D14DC3517E1	3D8458695FA1A2ADB9DD9F5AF4B7AB4D47727CEA8DF0D894A8B17218C3360052
Chrome Cache Entry: 88	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 89	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	D8106BF3A1D00AB43B01E6E3C92500EB	202B5E8654AB1B28351378293BCA3B9D844CC29B	9ADA5709E264C31B04A05BD85448A9BD5E91925E8D83DF5CEF0762EC97CC283E
Chrome Cache Entry: 90	ASCII text, with very long lines (65299)	0AA8D64E726C4A57ADB5C88F9115996B	901169527507FF9E662CF64D8E361F359308970D	7E1F1503DF765CCA5E099891B94E318A2EF95081BA2AF1EB6D417CC884BFDBFE
Chrome Cache Entry: 91	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 92	PNG image data, 1365 x 426, 8-bit colormap, non-interlaced	6BCA8F7256286A08770C3EDF34F27B05	73C9CACAB54C792976B8D806C41F0D14DC3517E1	3D8458695FA1A2ADB9DD9F5AF4B7AB4D47727CEA8DF0D894A8B17218C3360052
Chrome Cache Entry: 93	ASCII text, with very long lines (542)	CC290E6C3AEECF5021DD82AD8DF2512A	FB983AECD3940E8EBBFE5E74C8099CEE9223C957	2A0DB34DC14EF4B5CE73B230701C7561E5012667A4C9CB274ECAB646E1474995
Chrome Cache Entry: 94	HTML document, ASCII text	A34AC19F4AFAE63ADC5D2F7BC970C07F	A82190FC530C265AA40A045C21770D967F4767B8	D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
Chrome Cache Entry: 95	ASCII text, with no line terminators	5E4E656860A2668304F71807FB72A1AC	1A79EF4B28A49CAA68F3F3FC927F174398A870B0	8E5932410FF17D8861824DC41A42A4F4D3B87965107410153536E9C20EA8E8EF
Chrome Cache Entry: 96	Unicode text, UTF-8 text, with very long lines (65306)	5A301AEBE1EEB495159C9CFD07ACCE16	C453A93F29978A4994A872250BBD748977B04A11	04083FCECDD9E19B2ACD1E0073437AA07C98D230F0198D7F1FD470AB220FEF64
Chrome Cache Entry: 97	SVG Scalable Vector Graphics image	0308F4A1104011DB933C61A3BD39023B	33174699EFFE0D92A85BE40846052C2AE482C4BE	3FBEBBCC1EBF48EBE492E6080CF7C618C15B9A23D5AE6D771B0BCE47AD5753EB
Chrome Cache Entry: 98	SVG Scalable Vector Graphics image	4CDF5B1922FE350E679B7B616AF21BD3	2EA65118EC5E1E365791E38B8EBDC1CFE3EC2DBE	304213033F2A03071409043919D5D27D9847E0FB96C8433871DDCD7AD93FCB39
Chrome Cache Entry: 99	ASCII text, with CRLF line terminators	A232C9FAE6AFF02602C035AF8FB86CC2	C9F2D7A763B59A3C180C3C264136BC554D4B6B6F	14729C59502ABB87037D5091477AB5E820672AA07BD8BCF6EFBE67DF27E1D9FB

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://uch.mrn.mybluehost.me/MS/DHLM/	Avira URL Cloud: detection malicious, Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/	SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/socio.png	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/font-awesome.min.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Light.774e3ae02978a9a76de6.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/LOGA.svg	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Regular.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/bootstrap-icons.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/camion.png	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/titiza.png	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/group.svg	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/assets/fonts/FedExSans_W-Regular.woff?6wo4i3	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Condensed-Bold-Italic.4c1d6f58b86d3a9d2c37.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/LOGAA.svg	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Italic.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Regular.475f432261db6051bb40.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/US.png	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/style.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold-Italic.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/dhl-logo.svg	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Light.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Italic.293f6c351bb0f40c453f.woff	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/X911.css	Avira URL Cloud: Label: phishing
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/FedExSans_W-Bold.4659c1d4ddc84b4a3898.woff	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for submitted file

Source: https://uch.mrn.mybluehost.me/MS/DHLM/

Virustotal: Detection: 12%

Perma Link

Phishing

AI detected phishing page

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

Phishing site detected (based on favicon image match)

Source: https://mybluehost.me	Matcher: Template: dhl matched with high similarity
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1#HDHKJDJDSSJDSJKJDSJDSDJJDSHYKJHGFG	Matcher: Template: dhl matched with high similarity
Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS	Matcher: Template: dhl matched with high similarity

Yara detected HtmlPhish10

Source: Yara match

File source: 2.2.pages.csv, type: HTML

Phishing site detected (based on logo match)

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

Matcher: Template: dhl matched

HTML body contains low number of good links

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: Number of links: 0

HTML body with high number of embedded SVGs detected

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1#HDHKJDJDSSJDSJKJDSJDSDJJDSHYKJHGFG

HTTP Parser: Total embedded SVG size: 737974

HTML title does not match URL

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: Title: | DHL | does not match URL

Suspicious form URL found

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: Form action: ./siftA/Abilli.php

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/adrum-xd.99c2fcc5ccc30ea4d38a1a74eeb7a6a6.html

HTTP Parser: No favicon

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: No <meta name="author".. found

Source: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1#KJSDKJhjghtyuUJSUSQUIQSIklklsisiiIUZIUZEJQSJkkjsJSJS

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /MS/DHLM/ HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/index.php?FGDD=1 HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/common-core_SHF.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/X911.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/font-awesome.min.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/style.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/bootstrap-icons.css HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/adrum-xd.99c2fcc5ccc30ea4d38a1a74eeb7a6a6.html HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/US.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/dhl-logo.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.2.0/js/all.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/LOGA.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/LOGAA.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/bootstrap-icons.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Regular.475f432261db6051bb40.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Bold.4659c1d4ddc84b4a3898.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Italic.293f6c351bb0f40c453f.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/dhl-logo.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/US.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Light.774e3ae02978a9a76de6.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Regular.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/LOGAA.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/LOGA.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Italic.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Light.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/assets/fonts/FedExSans_W-Bold-Italic.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/common-core_SHF.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /assets/fonts/FedExSans_W-Regular.woff?6wo4i3 HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/FedExSans_W-Condensed-Bold-Italic.4c1d6f58b86d3a9d2c37.woff HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://uch.mrn.mybluehost.mesec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/styles.5b3e5351d5009950b08d.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/favicon.ico HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/index.php?FGDD=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/favicon.ico HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/A.php?Billi=1 HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/camion.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /npm/bootstrap@5.0.0/dist/css/bootstrap.min.css HTTP/1.1Host: cdn.jsdelivr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://uch.mrn.mybluehost.me/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/group.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/socio.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/A.php?Billi=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/titiza.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uch.mrn.mybluehost.me/MS/DHLM/TU17HLK/X911/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/camion.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/socio.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/group.svg HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09
Source: global traffic	HTTP traffic detected: GET /MS/DHLM/TU17HLK/X911/titiza.png HTTP/1.1Host: uch.mrn.mybluehost.meConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5f6b6eb37fa68f934f1513b57c475d09

Source: global traffic	DNS traffic detected: DNS query: uch.mrn.mybluehost.me
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:15 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:19 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:19 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:22 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 25 May 2024 22:14:22 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_77.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_77.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_69.2.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_69.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_90.2.dr, chromecache_96.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_90.2.dr, chromecache_96.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_90.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: classification engine

Classification label: mal100.phis.win@17/71@12/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1976,i,15305913582776301799,1729019655534027141,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://uch.mrn.mybluehost.me/MS/DHLM/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1976,i,15305913582776301799,1729019655534027141,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

ID:	1447542
Product:	CloudBasic
Start time:	00:13:16
Start date:	26.05.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://uch.mrn.mybluehost.me/MS/DHLM/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://uch.mrn.mybluehost.me/MS/DHLM/

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://uch.mrn.mybluehost.me/MS/DHLM/