| dubaidunetours.com/new/review/2WcWqj/2WcWqj/eW1hcnV5YW1hQHRvY2Fmb290YmFsbC5jb20= |  66.29.141.3 | | 0 B |
URL dubaidunetours.com/new/review/2WcWqj/2WcWqj/eW1hcnV5YW1hQHRvY2Fmb290YmFsbC5jb20= IP66.29.141.3:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /new/review/2WcWqj/2WcWqj/eW1hcnV5YW1hQHRvY2Fmb290YmFsbC5jb20= HTTP/1.1
Host: dubaidunetours.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-powered-by: PHP/8.0.30
refresh: 0;url=https://fishincapital.com/?pawcnsgb&qrc=ymaruyama@tocafootball.com
content-type: text/html; charset=UTF-8
content-length: 0
date: Wed, 08 May 2024 22:52:21 GMT
server: LiteSpeed
x-turbo-charged-by: LiteSpeed
X-Firefox-Spdy: h2
|
|
| fishincapital.com/?pawcnsgb&qrc=ymaruyama@tocafootball.com |  5.230.252.96 | 302 Found | 0 B |
URL User Request GET HTTP/1.1fishincapital.com/?pawcnsgb&qrc=ymaruyama@tocafootball.com IP5.230.252.96:443
CertificateIssuerLet's Encrypt Subjectfishincapital.com Fingerprint4F:C7:78:2F:92:93:75:6D:6C:BB:92:AE:63:D8:DA:75:DE:E0:5B:58 ValidityWed, 08 May 2024 17:18:02 GMT - Tue, 06 Aug 2024 17:18:01 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?pawcnsgb&qrc=ymaruyama@tocafootball.com HTTP/1.1
Host: fishincapital.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Set-Cookie: qPdM=l70aGY6tpnE0; path=/; samesite=none; secure; httponly
qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; path=/; samesite=none; secure; httponly
location: /?pawcnsgb=ae4924a4179dded34526b3e657f990da253e252512a7b84e7c21f72377ab5330be376df4f0f4513e3c2d6decb747a342fb150126671fc8930cbfc76a91bd2373&qrc=ymaruyama%40tocafootball.com
Date: Wed, 08 May 2024 22:52:22 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
|
|
| fishincapital.com/?pawcnsgb=ae4924a4179dded34526b3e657f990da253e252512a7b84e7c21f72377ab5330be376df4f0f4513e3c2d6decb747a342fb150126671fc8930cbfc76a91bd2373&qrc=ymaruyama%40tocafootball.com | 5.230.252.96 | 200 OK | 3.3 kB |
URL User Request GET HTTP/1.1fishincapital.com/?pawcnsgb=ae4924a4179dded34526b3e657f990da253e252512a7b84e7c21f72377ab5330be376df4f0f4513e3c2d6decb747a342fb150126671fc8930cbfc76a91bd2373&qrc=ymaruyama%40tocafootball.com IP5.230.252.96:443
CertificateIssuerLet's Encrypt Subjectfishincapital.com Fingerprint4F:C7:78:2F:92:93:75:6D:6C:BB:92:AE:63:D8:DA:75:DE:E0:5B:58 ValidityWed, 08 May 2024 17:18:02 GMT - Tue, 06 Aug 2024 17:18:01 GMT
File typeHTML document, ASCII text, with very long lines (1928) Hashd5932c031664b9038218543ca6f9714a 4486f3db2d784a68eb85510c9a04725fe5d30735 5d8c6e30c50ba8e9180a372eac7127d195ba7815ea6a2eede0868b6c1096512c
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?pawcnsgb=ae4924a4179dded34526b3e657f990da253e252512a7b84e7c21f72377ab5330be376df4f0f4513e3c2d6decb747a342fb150126671fc8930cbfc76a91bd2373&qrc=ymaruyama%40tocafootball.com HTTP/1.1
Host: fishincapital.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html;charset=UTF-8
Date: Wed, 08 May 2024 22:52:22 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
|
|
| challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback |  104.17.2.184 | 302 Found | 0 B |
URL GET HTTP/2challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback IP104.17.2.184:443
Requested byhttps://fishincapital.com/?pawcnsgb=ae4924a4179dded34526b3e657f990da253e252512a7b84e7c21f72377ab5330be376df4f0f4513e3c2d6decb747a342fb150126671fc8930cbfc76a91bd2373&qrc=ymaruyama%40tocafootball.com CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fishincapital.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Wed, 08 May 2024 22:52:22 GMT
content-length: 0
location: /turnstile/v0/b/ce7818f50e39/api.js
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cache-control: max-age=300, public
vary: Accept-Encoding
server: cloudflare
cf-ray: 880d050f18a1b512-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/api.js | 104.17.2.184 | 200 OK | 14 kB |
URL GET HTTP/2challenges.cloudflare.com/turnstile/v0/b/ce7818f50e39/api.js IP104.17.2.184:443
Requested byhttps://fishincapital.com/?pawcnsgb=ae4924a4179dded34526b3e657f990da253e252512a7b84e7c21f72377ab5330be376df4f0f4513e3c2d6decb747a342fb150126671fc8930cbfc76a91bd2373&qrc=ymaruyama%40tocafootball.com CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (42565) Hasha5b92920e25651d2058f4982a108347b caeeadd68d38fdb681c52006c68880abc2e8a1a6 49a5abedf03eb8ad9a66eca7c5ccb8e59a440e06958e1e7b71d078f494178dc5
GET /turnstile/v0/b/ce7818f50e39/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://fishincapital.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 08 May 2024 22:52:22 GMT
content-type: application/javascript; charset=UTF-8
cross-origin-resource-policy: cross-origin
cache-control: max-age=604800, public
access-control-allow-origin: *
vary: Accept-Encoding
server: cloudflare
cf-ray: 880d050f48c6b512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal | 104.17.2.184 | 200 OK | 26 kB |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal IP104.17.2.184:443
Requested byhttps://fishincapital.com/?pawcnsgb=ae4924a4179dded34526b3e657f990da253e252512a7b84e7c21f72377ab5330be376df4f0f4513e3c2d6decb747a342fb150126671fc8930cbfc76a91bd2373&qrc=ymaruyama%40tocafootball.com CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (41702) Hash70463b00946d29ddd89cae7d606bf1cd 25b98a6f04cba8f18bad1a82cce64a73906ba951 a9e4e12abda4127b655c0e7f7a478ae8f923cb2e7c5018e5eeb5c965beba4e17
GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fishincapital.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 22:52:22 GMT
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
referrer-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
vary: accept-encoding
server: cloudflare
cf-ray: 880d05100f3a5690-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880d05100f3a5690/1715208742801/rg4b4lybrXj4voN | 104.17.2.184 | 200 OK | 61 B |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880d05100f3a5690/1715208742801/rg4b4lybrXj4voN IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typePNG image data, 62 x 89, 8-bit/color RGB, non-interlaced Hash24d75db850ab1d1c2741dcebba3134c2 cd6b33c50a17ad3efa437139c769440cc2aff48b 518d48aa3bdd8987b219fb68debc8e9316b2ad1c56f14281975aadc3cb559bd1
GET /cdn-cgi/challenge-platform/h/b/i/880d05100f3a5690/1715208742801/rg4b4lybrXj4voN HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 22:52:23 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 880d0515aacc5690-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/880d05100f3a5690/1715208742802/e730ce2c646664a5159fc34b853351b5edb3b1360bb28699a27cc70aca6419b6/-A1lXuZYq_rwdTz | 104.17.2.184 | 401 Unauthorized | 1 B |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/880d05100f3a5690/1715208742802/e730ce2c646664a5159fc34b853351b5edb3b1360bb28699a27cc70aca6419b6/-A1lXuZYq_rwdTz IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typevery short file (no magic) Hashff44570aca8241914870afbc310cdb85 58668e7669fd564d99db5d581fcdb6a5618440b5 6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
GET /cdn-cgi/challenge-platform/h/b/pat/880d05100f3a5690/1715208742802/e730ce2c646664a5159fc34b853351b5edb3b1360bb28699a27cc70aca6419b6/-A1lXuZYq_rwdTz HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 401 Unauthorized
date: Wed, 08 May 2024 22:52:23 GMT
content-type: text/plain; charset=UTF-8
content-length: 1
www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20g5zDOLGRmZKUVn8NLhTNRte2zsTYLsoaZonzHCspkGbYAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAwJNLx-F--HQ4G6w81Lqhm55Wqle9iE4E64E37YL7QkK_ylJ-Dsmf1v3knq_MpBi8JncpUaWMssdL2Aha6xVtTuit-n3zEDZCW0VR_73N-Mc6DxdptQ_jsmIxis7apwux2f5L0gN0Z4K9C36tRcIL-chm-gijHvxrbhcCYusNwrgAlFaiqNWBqxKTiuPduHX4CNzNb7BAiNPz7ppY7Xn1WjmxSB-BaqSVLCYtDy-Mw41UBzE3QEcVUcRH9er-MksFvohzvhlnTTonFaMyAUYx3d_uCdDannmVQhRsm-aJs_P_GGe1TX3e9g5Sy-NmhGrro0kncbPlfTwFxa8SwJ5-8QIDAQAB", max-age=20, PrivateToken challenge="AAIALHBwLWlzc3Vlci1wcm9kdWN0aW9uLnJlc2VhcmNoLmNsb3VkZmxhcmUuY29tIOcwzixkZmSlFZ_DS4UzUbXts7E2C7KGmaJ8xwrKZBm2ABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAi_Bv1vvWWnyuOfVJgRV-AQLxEJECUUmMRrMnYz-gJA-oMd79ajvP3atoTZqB_EsZIq7SMmpbCRFhPolqzIrtXh7AF1Q-ZWY2RoRVRgKr7d6iJMZ49iZUmbz837eqBZJrEMuXftZmY35str5sb0GjzklF8z_hcQJC9vancYXncsYoiMDaROW0tLwSQA9BGfbmA6GlbVj4XH8DH19cKifxmO6RlIPPKlL1KmZbrRakkpuqvJO2-x1Zc2S5GCpponuvQTqJQH8Ud9loZLI75e-Xa9KAUNtBTM0t9WSEsv8cSJLV1BPBVTy1lOnwghofw4fqmlYv6CXClzAUqWouSTJ7uwIDAQAB", max-age=20
server: cloudflare
cf-ray: 880d0515fafc5690-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/437566986:1715207623:h7Yr1UfulBkUtRmUKX6i54Hiy1rOk6xlQ4Xvwp5jwsg/880d05100f3a5690/00a3c6a079a457a | 104.17.2.184 | 200 OK | 104 kB |
URL POST HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/437566986:1715207623:h7Yr1UfulBkUtRmUKX6i54Hiy1rOk6xlQ4Xvwp5jwsg/880d05100f3a5690/00a3c6a079a457a IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeASCII text, with very long lines (65536), with no line terminators Size104 kB (103826 bytes) Hashaf7060114f1ac0b3f468b5fa3200c4b8 74175048f4829bafdbd6da5253caea6d14cf2780 9818c50fd3e03f6c8052858153d7f9b461c4374645d2044f8abf0eddb0e727e9
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/437566986:1715207623:h7Yr1UfulBkUtRmUKX6i54Hiy1rOk6xlQ4Xvwp5jwsg/880d05100f3a5690/00a3c6a079a457a HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 00a3c6a079a457a
Content-Length: 2747
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Wed, 08 May 2024 22:52:22 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: vIs/1XETj2slQMU1tZIPVmvO2+gHFt4KauB9X+BfQKCRjIFhjIJBoBtxqsPKm2sq7t+Bj3qivew/A3rTZQmCoaahjioLiY3ZfB/NitdHaaFRwZnN0C2TOai7FQFFo0VmmRh4IsI2yOkFr7ZHDqH/CVKXF0qaWJBjyf1QF1Y+iTuTykq/MPQ/W9IAtjegJCh6zO7CTeiJPYHVLcn8IMxlrT5T17sFDPDGGovNTi6EEhe3dLPq5g48E1a4Rpz61KHYy5gsC+SjEX7I3OL6SNTcKYDVvsiWKjb8H27IX8aUxj0wwYsvTS9/Mf2REsHfoZInnTgsMEqMw5rDGQtvraXPPBYzFWLwzAUv1RyN8ER04VL/fAc2nFxIIZVK53I+sgo5oClNdc6a62pAjAzc8gxk/nNC8OFzx//9YDyzMp9hhLYg4oiV3xQpoWoql9JNmZr1qTStpPbVQYResKPT6m8QRNjlmSrzxZ+0XQA8U/kng2/QG07nNglVhxnREojw0my2$p6Bt6L5wCC1eYQDagrWBeA==
vary: accept-encoding
server: cloudflare
cf-ray: 880d0512687a5690-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| capitalflashes.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2NhcGl0YWxmbGFzaGVzLmNvbSIsImRvbWFpbiI6ImNhcGl0YWxmbGFzaGVzLmNvbSIsImtleSI6Imw3MGFHWTZ0cG5FMCIsInFyYyI6InltYXJ1eWFtYUB0b2NhZm9vdGJhbGwuY29tIiwiaWF0IjoxNzE1MjA4NzUwLCJleHAiOjE3MTUyMDg4NzB9.qLeL7Ofbl3saq_vvHC5yVe9jfh-VkyrnTHWVnOqp7_U | 5.230.252.96 | 302 Found | 0 B |
URL User Request GET HTTP/1.1capitalflashes.com/?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2NhcGl0YWxmbGFzaGVzLmNvbSIsImRvbWFpbiI6ImNhcGl0YWxmbGFzaGVzLmNvbSIsImtleSI6Imw3MGFHWTZ0cG5FMCIsInFyYyI6InltYXJ1eWFtYUB0b2NhZm9vdGJhbGwuY29tIiwiaWF0IjoxNzE1MjA4NzUwLCJleHAiOjE3MTUyMDg4NzB9.qLeL7Ofbl3saq_vvHC5yVe9jfh-VkyrnTHWVnOqp7_U IP5.230.252.96:443
CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?dataXX0=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1cmwiOiJodHRwczovL2NhcGl0YWxmbGFzaGVzLmNvbSIsImRvbWFpbiI6ImNhcGl0YWxmbGFzaGVzLmNvbSIsImtleSI6Imw3MGFHWTZ0cG5FMCIsInFyYyI6InltYXJ1eWFtYUB0b2NhZm9vdGJhbGwuY29tIiwiaWF0IjoxNzE1MjA4NzUwLCJleHAiOjE3MTUyMDg4NzB9.qLeL7Ofbl3saq_vvHC5yVe9jfh-VkyrnTHWVnOqp7_U HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://fishincapital.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Set-Cookie: qPdM=l70aGY6tpnE0; path=/; samesite=none; secure; httponly
qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; path=/; samesite=none; secure; httponly
location: /?qrc=ymaruyama%40tocafootball.com
Date: Wed, 08 May 2024 22:52:30 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
|
|
| capitalflashes.com/?qrc=ymaruyama%40tocafootball.com | 5.230.252.96 | 302 Moved Temporarily | 0 B |
URL User Request GET HTTP/1.1capitalflashes.com/?qrc=ymaruyama%40tocafootball.com IP5.230.252.96:443
CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?qrc=ymaruyama%40tocafootball.com HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://fishincapital.com/
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-cache
Pragma: no-cache
Location: https://capitalflashes.com/owa/?login_hint=ymaruyama%40tocafootball.com
Server: Microsoft-IIS/10.0
request-id: e9a04740-0cb1-99f0-ebe3-775599be0b0c
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-FEServer: FR0P281CA0105, FR0P281CA0105
X-RequestId: da5f58b7-c84d-4cc2-9ee1-b45ede2e3258
X-FEProxyInfo: FR0P281CA0105.DEUP281.PROD.OUTLOOK.COM
X-FEEFZInfo: HHN
MS-CV: QEeg6bEM8Jnr43dVmb4LDA.0
X-Powered-By: ASP.NET
Date: Wed, 08 May 2024 22:52:30 GMT
Connection: close
Content-Length: 0
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/owa/?login_hint=ymaruyama%40tocafootball.com | 5.230.252.96 | 302 Found | 1.4 kB |
URL User Request GET HTTP/1.1capitalflashes.com/owa/?login_hint=ymaruyama%40tocafootball.com IP5.230.252.96:443
CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeHTML document, ASCII text, with very long lines (801), with CRLF, LF line terminators Hash92b813c43e65cc4fb6be9424e4903b2c e69db84c1382416a287f9dc6f10767a0fdb7fd8d b7ef063c4b6c356276eb4f7ff7357e2fbddd0e9c8a36a7b9c541bec2e148d0fd
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /owa/?login_hint=ymaruyama%40tocafootball.com HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://fishincapital.com/
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
content-length: 1381
Content-Type: text/html; charset=utf-8
Location: https://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDgwNTU1MTA1NzExMTcuZDJjNWYyYzctYTgxMi00MjEwLWI3OWYtNGY2MDUzNTIyYTQ1JnN0YXRlPURjdEJEc0lnRUVCUjBMTzRwSjJaTW9VdWpFY3hVd3phQkRxSndaamV2aXplMzMxcmpMbDJsODVDanduekZCa2lNRE1DQjBRTXc0c1NaMHJCU1VSeW5oRGNHcGJzZko2Qkp5WVN6N2FfYnRTX2pJLWk3MjFfZnJhOTNZOHEzOThoVlc0ZW1pYkpxbTJWVW9hazlRUQ==
Server: Microsoft-IIS/10.0
request-id: 901e4cc2-23d1-6a53-d152-8d8bf4bb8240
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000
X-CalculatedFETarget: FR4P281CU025.internal.outlook.com
X-BackEndHttpStatus: 302, 302
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Set-Cookie: ClientId=693537322D39450A833B491DF3AA7B0C; expires=Thu, 08-May-2025 22:52:31 GMT; path=/;SameSite=None; secure
ClientId=693537322D39450A833B491DF3AA7B0C; expires=Thu, 08-May-2025 22:52:31 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Fri, 08-Nov-2024 22:52:31 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; expires=Wed, 08-May-2024 23:52:31 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OptInPrg=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
ClientId=693537322D39450A833B491DF3AA7B0C; expires=Thu, 08-May-2025 22:52:31 GMT; path=/;SameSite=None; secure
OIDC=1; expires=Fri, 08-Nov-2024 22:52:31 GMT; path=/;SameSite=None; secure; HttpOnly
RoutingKeyCookie=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.token.v1=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.token.v1=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.id_token.v1=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.code.v1=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.id_token.v1=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.code.v1=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.idp_nonce.v1=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.idp_correlation_id=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.tokenPostPath=; domain=capitalflashes.com; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; expires=Wed, 08-May-2024 23:52:31 GMT; path=/;SameSite=None; secure; HttpOnly
HostSwitchPrg=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
OptInPrg=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
SuiteServiceProxyKey=; expires=Sun, 08-May-1994 22:52:31 GMT; path=/; secure
X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; expires=Thu, 09-May-2024 04:54:31 GMT; path=/;SameSite=None; secure; HttpOnly
X-CalculatedBETarget: FRYP281MB2906.DEUP281.PROD.OUTLOOK.COM
X-RUM-Validated: 1
X-RUM-NotUpdateQueriedPath: 1
X-RUM-NotUpdateQueriedDbCopy: 1
X-BeSku: WCS7
X-OWA-DiagnosticsInfo: 2;0;0
X-IIDs: 0
X-BackEnd-Begin: 2024-05-08T22:52:31.057
X-BackEnd-End: 2024-05-08T22:52:31.057
X-DiagInfo: FRYP281MB2906
X-BEServer: FRYP281MB2906
X-UA-Compatible: IE=EmulateIE7
X-Proxy-RoutingCorrectness: 1
X-Proxy-BackendServerStatus: 302
X-FEProxyInfo: FR0P281CA0100.DEUP281.PROD.OUTLOOK.COM
X-FEEFZInfo: HHN
X-FEServer: FR4P281CA0367, FR0P281CA0100
NEL: {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
X-FirstHopCafeEFZ: HHN
Date: Wed, 08 May 2024 22:52:30 GMT
Connection: close
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== | 5.230.252.96 | 200 OK | 48 kB |
URL User Request GET HTTP/1.1capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== IP5.230.252.96:443
CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (31337) Hashf4461647d48b18dcd94ffa1a92bae3f6 0b0a33a938293a0d81b9cd506a39f35d61eb6670 63f043b3522b780fae7e9702efd3d5d9c24521c7ace2d4e7cf68fd96377ee497
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://fishincapital.com/
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
expect-ct: max-age=0
strict-transport-security: max-age=15552000; includeSubDomains
x-download-options: noopen
referrer-policy: no-referrer
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
x-envoy-upstream-service-time: 22
Server: envoy
Vary: Accept-Encoding
Content-Encoding: gzip
Expires: Wed, 08 May 2024 22:52:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 08 May 2024 22:52:32 GMT
Transfer-Encoding: chunked
Connection: close, Transfer-Encoding
Set-Cookie: pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; Domain=capitalflashes.com; Path=/; Expires=Wed, 08 May 2024 23:12:32 GMT
fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; Domain=capitalflashes.com; Path=/; Expires=Wed, 08 May 2024 23:12:32 GMT
visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; Domain=capitalflashes.com; Path=/; Expires=Thu, 08 May 2025 22:52:32 GMT
|
|
| capitalflashes.com/wrhs/65e723d1323a15a62b64824a8d885bac/uxcore2.min.css | 5.230.252.96 | 200 OK | 19 kB |
URL GET HTTP/1.1capitalflashes.com/wrhs/65e723d1323a15a62b64824a8d885bac/uxcore2.min.css IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeUnicode text, UTF-8 text, with very long lines (65527), with no line terminators Hashb2b4f015b4e7eb5a7730bcad24929852 5123fd2262ca04ef1e588b87257991fe5c8df876 a7cd1bba025dd4dd612cbfd1641e4292152a04e2ebbf6af5bcd7b4a5eeefe037
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /wrhs/65e723d1323a15a62b64824a8d885bac/uxcore2.min.css HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Accept-Ranges: bytes
Content-Encoding: br
ETag: "b2b4f015b4e7eb5a7730bcad24929852"
Last-Modified: Wed, 03 Jan 2024 22:00:31 GMT
Vary: Accept-Encoding
x-amz-id-2: RP2UcXvYeYqQrWReGW+luKCXKeapJxR8zaB92yHncaCnQcAszAxA5ipynxvoGLCT0Yq4myCG8ws=
x-amz-request-id: KP8P9N7G379F6RA4
x-amz-server-side-encryption: AES256
x-amz-version-id: hK0AYa.pD1smdrzkiw78Iqlw5RsZ6YGZ
Content-Length: 18600
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:32 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208752856_34830099_406885597_17_1040_35_36_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
|
|
| capitalflashes.com/identity-static-assets/_next/static/css/95c2f81e5812e203.css | 5.230.252.96 | 200 OK | 418 B |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/css/95c2f81e5812e203.css IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeASCII text, with very long lines (2521), with no line terminators Hash798aacb1ff37348b6f7bfbb362fb7bcd 4640d8ad40d3676ace09ddc27d88b5a68556c0a0 565515d221be71be8857e7865e473279a4524f76f312dcb4f3a5851bce1420f5
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/css/95c2f81e5812e203.css HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Accept-Ranges: bytes
Content-Encoding: br
ETag: "798aacb1ff37348b6f7bfbb362fb7bcd:1711610659.142134"
Last-Modified: Thu, 28 Mar 2024 08:18:24 GMT
Vary: Accept-Encoding
Content-Length: 418
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:32 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208752893_34830099_406885618_12_1117_37_42_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
|
|
| capitalflashes.com/ux-assets/@ux/fonts/4.5.0/GDSage-bold.woff2 | 5.230.252.96 | 200 OK | 40 kB |
URL GET HTTP/1.1capitalflashes.com/ux-assets/@ux/fonts/4.5.0/GDSage-bold.woff2 IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeWeb Open Font Format (Version 2), CFF, length 40132, version 1.66 Hash162c9e176014c90e76618bd4b7a8a3f0 7fec64f1167b3086a533379a307f257eb777c129 89e3135e8430b71c9470eebafc1bb498233cdde661240a03d3e864fb59a890be
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /ux-assets/@ux/fonts/4.5.0/GDSage-bold.woff2 HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: BsrwDfCkFGg869r0WLubmWMxcJtPGz81FFTfo2BwFnVOpIrtobTo199Ubpjgu9tQioTSKidzRfapCHh5eMzQig==
x-amz-request-id: H9FSXWH2NFWD1BGP
Last-Modified: Thu, 15 Feb 2024 19:20:15 GMT
ETag: "162c9e176014c90e76618bd4b7a8a3f0"
x-amz-server-side-encryption: AES256
x-amz-version-id: iHVT1MQFNAfNwelT_If4D_6XL.BVTLz.
Accept-Ranges: bytes
Content-Type: font/woff2
Content-Length: 40132
Cache-Control: public, max-age=2592000
Date: Wed, 08 May 2024 22:52:33 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208753284_34830099_406886407_12_1015_75_310_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
|
|
| capitalflashes.com/ux-assets/@ux/fonts/4.5.0/GDSherpa-vf4.woff2 | 5.230.252.96 | 200 OK | 103 kB |
URL GET HTTP/1.1capitalflashes.com/ux-assets/@ux/fonts/4.5.0/GDSherpa-vf4.woff2 IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 103388, version 1.0 Size103 kB (103388 bytes) Hashff3f79fc43d0bcfd04d8cac73f56d8c7 0854a53b94336710dc505a459c66dae72a73d6c7 07d6825e414a3a09444251ae7def1c796ed2fcefe9e1c0838adab86270d346fa
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /ux-assets/@ux/fonts/4.5.0/GDSherpa-vf4.woff2 HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: 4RGIiMkez1uT6EG9sVgSJb6btAwqmFOW85T+iDeRLPBJ7YLyQMYJHSVO+yIl7XHMe9LQKHnzFF4eWmYNREiWMA==
x-amz-request-id: H9FKYDWK4PVWB3W1
Last-Modified: Thu, 15 Feb 2024 19:20:15 GMT
ETag: "ff3f79fc43d0bcfd04d8cac73f56d8c7"
x-amz-server-side-encryption: AES256
x-amz-version-id: gtDXqN6ljHBNqetR3srXwgG1vEcyDy8y
Accept-Ranges: bytes
Content-Type: font/woff2
Content-Length: 103388
Cache-Control: public, max-age=2592000
Date: Wed, 08 May 2024 22:52:33 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208753284_34830099_406886406_13_1099_74_310_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
|
|
| capitalflashes.com/ux-assets/@ux/fonts/4.5.0/GDSage-regular.woff2 | 5.230.252.96 | 200 OK | 39 kB |
URL GET HTTP/1.1capitalflashes.com/ux-assets/@ux/fonts/4.5.0/GDSage-regular.woff2 IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeWeb Open Font Format (Version 2), CFF, length 38559, version 1.66 Hash65bd0f4edeaa0e243cdca23ec72a5ae6 a94449be1a5531fc7970bd8688a93f08ecde68ad 400d3e1ebc917911020d89b505933e1816e138f4163d71575a707f93b6cc302f
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /ux-assets/@ux/fonts/4.5.0/GDSage-regular.woff2 HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: rmUbm9kF/09TRoD6PtVxGcjoZFNN+E4/Pj7dZbBK1WqqDoWMw7zgr7TmFyyzPXvfGIdoRem5UpM=
x-amz-request-id: H9FH5PC2N6WFT6DT
Last-Modified: Thu, 15 Feb 2024 19:20:15 GMT
ETag: "65bd0f4edeaa0e243cdca23ec72a5ae6"
x-amz-server-side-encryption: AES256
x-amz-version-id: dCoH6yD4MUvPT0SEiulwN8LbovYUHGnt
Accept-Ranges: bytes
Content-Type: font/woff2
Content-Length: 38559
Cache-Control: public, max-age=2592000
Date: Wed, 08 May 2024 22:52:33 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208753874_34830099_406886823_13_1015_46_64_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
|
|
| capitalflashes.com/wrhs-next/e7f82d9a309ba3cd2d3ed91c2f600423/utility-header.css | 5.230.252.96 | 200 OK | 14 kB |
URL GET HTTP/1.1capitalflashes.com/wrhs-next/e7f82d9a309ba3cd2d3ed91c2f600423/utility-header.css IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeASCII text, with very long lines (65536), with no line terminators Hashe7f82d9a309ba3cd2d3ed91c2f600423 337ab504a501ac44df7e95a0b84069abfed434fe a7906df2b698f34d2940441e65f3283f42d34735ecc66c7218cbb568cdf3bce6
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /wrhs-next/e7f82d9a309ba3cd2d3ed91c2f600423/utility-header.css HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/css
Accept-Ranges: bytes
Content-Encoding: br
ETag: "e7f82d9a309ba3cd2d3ed91c2f600423"
Last-Modified: Tue, 23 Apr 2024 20:06:34 GMT
Vary: Accept-Encoding
x-amz-id-2: l7QCUgMH28rXfO1Bj2OP01VwyniH8pOefOadCBa6fB3WIaKFlxg7lzseGESMlSTOPQqj+kToYSo=
x-amz-request-id: KHBGBBYB89MSMMEW
x-amz-server-side-encryption: AES256
x-amz-version-id: aEeWLKjzKGgiXKcPjA9jDHoD50BNkdXU
Content-Length: 14303
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:34 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208754061_34830099_406886997_12_921_110_78_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
|
|
| capitalflashes.com/hivemind/hivemind-3.1.0.js | 5.230.252.96 | 302 Moved Temporarily | 0 B |
URL GET HTTP/1.1capitalflashes.com/hivemind/hivemind-3.1.0.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /hivemind/hivemind-3.1.0.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=utf-8
Content-Length: 0
Server: envoy
Location: https://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ=
x-request-id: 4bf7e3ec-2456-9213-9193-a74c0fca5baf
x-amzn-trace-id: Root=1-663c0236-3554de4b2a7717706136af34
apm-trace-id: 8fe3e6aeef8492b824600da3e26b5369
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Vary: Accept-Language
Content-Language: en_US
x-envoy-upstream-service-time: 7
Expires: Wed, 08 May 2024 22:52:38 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 08 May 2024 22:52:38 GMT
Connection: close
|
|
| capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ= | 5.230.252.96 | 403 Forbidden | 379 B |
URL GET HTTP/1.1capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ= IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeHTML document, ASCII text Hash6dc8efa74ebd4343af033c2a14c8b052 93a6ce64c360fb8df4963141c41403a37fbd2f54 a6e3c9ea10123a55100e439268822812c766051797a184c33d9b51f2016fef52
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ= HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: AkamaiGHost
Mime-Version: 1.0
Content-Type: text/html
content-length: 379
Expires: Wed, 08 May 2024 22:52:38 GMT
Date: Wed, 08 May 2024 22:52:38 GMT
Connection: close
Set-Cookie: market=de-DE; expires=Thu, 08-May-2025 22:52:38 GMT; path=/; domain=capitalflashes.com
X-ORIGIN-TAG: frontdoor
X-ARC: 2, 6a
Server-Timing: ak_p; desc="1715208758720_34831283_181123134_27_23515_80_148_-";dur=1
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/ux-assets/@ux/fonts/4.5.0/GDSherpa-vf4.woff2 | 5.230.252.96 | 200 OK | 103 kB |
URL GET HTTP/1.1capitalflashes.com/ux-assets/@ux/fonts/4.5.0/GDSherpa-vf4.woff2 IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 103388, version 1.0 Size103 kB (103388 bytes) Hashff3f79fc43d0bcfd04d8cac73f56d8c7 0854a53b94336710dc505a459c66dae72a73d6c7 07d6825e414a3a09444251ae7def1c796ed2fcefe9e1c0838adab86270d346fa
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /ux-assets/@ux/fonts/4.5.0/GDSherpa-vf4.woff2 HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: 4RGIiMkez1uT6EG9sVgSJb6btAwqmFOW85T+iDeRLPBJ7YLyQMYJHSVO+yIl7XHMe9LQKHnzFF4eWmYNREiWMA==
x-amz-request-id: H9FKYDWK4PVWB3W1
Last-Modified: Thu, 15 Feb 2024 19:20:15 GMT
ETag: "ff3f79fc43d0bcfd04d8cac73f56d8c7"
x-amz-server-side-encryption: AES256
x-amz-version-id: gtDXqN6ljHBNqetR3srXwgG1vEcyDy8y
Accept-Ranges: bytes
Content-Type: font/woff2
Content-Length: 103388
Cache-Control: public, max-age=2592000
Date: Wed, 08 May 2024 22:52:38 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208758645_34830099_406890080_14_1151_27_74_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
|
|
| capitalflashes.com/identity-static-assets/_next/static/Y7ajyRvRjQClI4_DcMCYp/_buildManifest.js | 5.230.252.96 | 200 OK | 2.7 kB |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/Y7ajyRvRjQClI4_DcMCYp/_buildManifest.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeASCII text, with very long lines (10154), with no line terminators Hash688a5737f19c30aa0f2db94c858dca3e ff21349413d5d3b7c418e24b02d05d2b745f6eb0 f1aa4d9d0f0f5f694a96c4f62f9c034069bf2420d1213d33510ab230252a3260
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/Y7ajyRvRjQClI4_DcMCYp/_buildManifest.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "688a5737f19c30aa0f2db94c858dca3e:1715076909.62269"
Last-Modified: Tue, 07 May 2024 11:01:04 GMT
Vary: Accept-Encoding
content-length: 10154
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:38 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208758160_34830099_406889717_13_955_36_34_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/ux/favicon/android-icon-192x192.png | 5.230.252.96 | 302 Moved Temporarily | 0 B |
URL GET HTTP/1.1capitalflashes.com/ux/favicon/android-icon-192x192.png IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /ux/favicon/android-icon-192x192.png HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=utf-8
Content-Length: 0
Server: envoy
Location: https://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ=
x-request-id: 1b0e9454-e9f6-984f-a4ed-516c1c43482d
x-amzn-trace-id: Root=1-663c0239-6bd1ded340ae24b43cb57dff
apm-trace-id: 220a1dea4b08d44f875bc2afadb66952
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Vary: Accept-Language
Content-Language: de_DE
x-envoy-upstream-service-time: 10
Expires: Wed, 08 May 2024 22:52:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 08 May 2024 22:52:41 GMT
Connection: close
|
|
| capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ= | 5.230.252.96 | 403 Forbidden | 379 B |
URL GET HTTP/1.1capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ= IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeHTML document, ASCII text Hash09e7223d04a4948c807ea7fc8e4dbd03 e56fe844f3e5c0fa94bc9a5c2574eed41d7b720a 1e2adb5d30510cb5ea7358373a0965a4278fc83bc2ed09b9cd0c6d8abc2f0baa
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ= HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: AkamaiGHost
Mime-Version: 1.0
Content-Type: text/html
content-length: 379
Expires: Wed, 08 May 2024 22:52:42 GMT
Date: Wed, 08 May 2024 22:52:42 GMT
Connection: close
Set-Cookie: currency=USD; expires=Thu, 08-May-2025 22:52:42 GMT; path=/; domain=capitalflashes.com
X-ORIGIN-TAG: frontdoor
X-ARC: 4, 6a
Server-Timing: ak_p; desc="1715208761979_34831283_181125443_23_20014_38_29_-";dur=1
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ= | 5.230.252.96 | 403 Forbidden | 379 B |
URL GET HTTP/1.1capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ= IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeHTML document, ASCII text Hash72f01f3bcca2e01dd9b65dba8a1b039a 7713148e1180aacaf309438c67e218adddb9bae1 46d8173e04c07a578f2a24b47a9c08e5967a939e285d6b210718e9c1cac7a329
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ= HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 403 Forbidden
Server: AkamaiGHost
Mime-Version: 1.0
Content-Type: text/html
content-length: 379
Expires: Wed, 08 May 2024 22:52:42 GMT
Date: Wed, 08 May 2024 22:52:42 GMT
Connection: close
Set-Cookie: currency=USD; expires=Thu, 08-May-2025 22:52:42 GMT; path=/; domain=capitalflashes.com
X-ORIGIN-TAG: frontdoor
X-ARC: 4, 6a
Server-Timing: ak_p; desc="1715208761980_34831283_181125448_24_20917_40_39_-";dur=1
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243/intake/v2/rum/events | 54.212.23.110 | 200 OK | 0 B |
URL OPTIONS HTTP/2cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243/intake/v2/rum/events IP54.212.23.110:9243
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subject*.us-west-2.aws.elastic-cloud.com Fingerprint1A:4A:02:71:78:77:AA:D9:97:FC:A4:20:FD:B0:81:8F:68:2B:DC:BE ValidityMon, 06 May 2024 00:35:13 GMT - Sun, 04 Aug 2024 00:35:12 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /intake/v2/rum/events HTTP/1.1
Host: cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://capitalflashes.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-headers: Content-Type, Content-Encoding, Accept
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: https://capitalflashes.com
access-control-expose-headers: Etag
access-control-max-age: 3600
date: Wed, 08 May 2024 22:52:42 GMT
vary: Origin
x-cloud-request-id: TUaGMwZhR--_dLFFWjDYiA
x-content-type-options: nosniff
x-found-handling-cluster: cca039482a104d5d9b04bd2e20f6bb64
x-found-handling-instance: instance-0000000005
content-length: 0
X-Firefox-Spdy: h2
|
|
| cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243/intake/v2/rum/events | 54.212.23.110 | 200 OK | 0 B |
URL OPTIONS HTTP/2cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243/intake/v2/rum/events IP54.212.23.110:9243
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subject*.us-west-2.aws.elastic-cloud.com Fingerprint1A:4A:02:71:78:77:AA:D9:97:FC:A4:20:FD:B0:81:8F:68:2B:DC:BE ValidityMon, 06 May 2024 00:35:13 GMT - Sun, 04 Aug 2024 00:35:12 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /intake/v2/rum/events HTTP/1.1
Host: cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-ndjson
Content-Length: 7256
Origin: https://capitalflashes.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 202 Accepted
access-control-allow-origin: https://capitalflashes.com
date: Wed, 08 May 2024 22:52:42 GMT
x-cloud-request-id: k1ktxuLqQqO8LT8Lw2_7zg
x-content-type-options: nosniff
x-found-handling-cluster: cca039482a104d5d9b04bd2e20f6bb64
x-found-handling-instance: instance-0000000006
content-length: 0
X-Firefox-Spdy: h2
|
|
| img1.wsimg.com/signals/js/clients/tti/tti.min.js |  23.36.79.43 | | 7.6 kB |
URL img1.wsimg.com/signals/js/clients/tti/tti.min.js IP23.36.79.43:0 ASN#20940 Akamai International B.V.
File typeJavaScript source, ASCII text, with very long lines (21556) Hash1c56940a864f144fae2eb40ee952cb94 ebfc754ce962a1f9025853f2995b3987f0383d87 3c37a4aa3cf6aaae6921a4b750c0e4f81fd338d6878be90b0faf2f921039cb23
GET /signals/js/clients/tti/tti.min.js HTTP/1.1
Host: img1.wsimg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-amz-id-2: 6PcsAHZPiPOccGhvx2HJv749gqji21pF5g0gK3p6AZHdLu1YGPO3Pv+nAmBOg8sFNi35G5X66s8=
x-amz-request-id: 2AZJZ5CQ91RFJB3F
last-modified: Wed, 18 Oct 2023 13:46:08 GMT
etag: "1c56940a864f144fae2eb40ee952cb94"
x-amz-server-side-encryption: AES256
x-amz-meta-version: 0.2.1
x-amz-version-id: 7jzjltvngWPxR10aGBgezMSyuI8q8r0u
accept-ranges: bytes
content-type: text/javascript
vary: Accept-Encoding
content-encoding: gzip
content-length: 7570
cache-control: max-age=1800
expires: Wed, 08 May 2024 23:22:43 GMT
date: Wed, 08 May 2024 22:52:43 GMT
timing-allow-origin: *
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
|
| reporting.cdndex.io/error | 143.204.55.61 | | 2 B |
URL reporting.cdndex.io/error IP143.204.55.61:0
Hash99914b932bd37a50b983c5e7c90ae93b bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
OPTIONS /error HTTP/1.1
Host: reporting.cdndex.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://capitalflashes.com/
Origin: https://capitalflashes.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/json
content-length: 2
server: CloudFront
date: Wed, 08 May 2024 22:52:43 GMT
access-control-allow-origin: *
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-expose-headers: *
access-control-allow-methods: GET,POST,OPTIONS
x-cache: LambdaGeneratedResponse from cloudfront
via: 1.1 80d21802b1b80c40e55ccf83433b8eac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: m2r-JQbkvEnEkC-beehP2jdjVmr_viTy7OXM-MACzZeDT9WsROu-xg==
X-Firefox-Spdy: h2
|
|
| reporting.cdndex.io/error | 143.204.55.61 | | 2 B |
URL reporting.cdndex.io/error IP143.204.55.61:0
Hash99914b932bd37a50b983c5e7c90ae93b bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
OPTIONS /error HTTP/1.1
Host: reporting.cdndex.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://capitalflashes.com/
Origin: https://capitalflashes.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/json
content-length: 2
server: CloudFront
date: Wed, 08 May 2024 22:52:43 GMT
access-control-allow-origin: *
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-expose-headers: *
access-control-allow-methods: GET,POST,OPTIONS
x-cache: LambdaGeneratedResponse from cloudfront
via: 1.1 80d21802b1b80c40e55ccf83433b8eac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: hgR49KqCLkNZj1LwOFcYo5Z_J5KymAkp37CJQTNDb2ljbUIKjDF3nA==
X-Firefox-Spdy: h2
|
|
| capitalflashes.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/tl | 5.230.252.96 | | 0 B |
URL capitalflashes.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/tl IP5.230.252.96:0
CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
POST /149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/tl HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/octet-stream
x-kpsdk-ct: 02gj80m4D9QJcB0hhjuXh64wbSd4VOFy1Ven00SIqvJJB8YYTsyW6i2o9lqL5t2X1acfnxDV04JncOhgmg5aeNkSdXjZa9HTq3jnhkzmBY3Dgu7tS6urPlmam0dqVidJyyZqR8Wgvm3Vixc22Z35H0pUJrIAnkVrT2qsCw
x-kpsdk-v: j-0.0.0
x-kpsdk-im: CiQ2YjhjNjM3MC01YmY5LTQ2ZGQtYmJhYi1iZGIxMTlhMTZjZDE
x-kpsdk-dt: 1437y10z52jz3qw0fsz217w7iy67f
Content-Length: 13978
Origin: https://capitalflashes.com
DNT: 1
Connection: keep-alive
Referer: https://capitalflashes.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/fp?x-kpsdk-v=j-0.0.0
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D; currency=USD; akm_lmprb-ssn=02gj80m4D9QJcB0hhjuXh64wbSd4VOFy1Ven00SIqvJJB8YYTsyW6i2o9lqL5t2X1acfnxDV04JncOhgmg5aeNkSdXjZa9HTq3jnhkzmBY3Dgu7tS6urPlmam0dqVidJyyZqR8Wgvm3Vixc22Z35H0pUJrIAnkVrT2qsCw; akm_lmprb=02gj80m4D9QJcB0hhjuXh64wbSd4VOFy1Ven00SIqvJJB8YYTsyW6i2o9lqL5t2X1acfnxDV04JncOhgmg5aeNkSdXjZa9HTq3jnhkzmBY3Dgu7tS6urPlmam0dqVidJyyZqR8Wgvm3Vixc22Z35H0pUJrIAnkVrT2qsCw
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 0
x-kpsdk-cr: true
x-kpsdk-st: 1715208763980
Access-Control-Allow-Origin: https://sso.godaddy.com
Access-Control-Allow-Credentials: true
x-kpsdk-r: 1-AQ
Access-Control-Expose-Headers: x-kpsdk-ct,x-kpsdk-r,x-kpsdk-c
x-kpsdk-ct: 02dUbdht5hkeLTJKeSJWCpvkDMdomgTWDrxVhOBypcF4ieyBCY41kuDgNMcFz1mZaVq2tP2WcZsY2StJ5R0mzGm66oCmDAx4x2l9VKv3mL2cwY8eCACgnNay7yhNAp0htKuKAjqB5dG1lR3MlBbP2qiMKwnAe4aEFjRClR
p3p: CP="This site does not specify a policy in the P3P header"
x-envoy-upstream-service-time: 5
Server: envoy
Expires: Wed, 08 May 2024 22:52:44 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 08 May 2024 22:52:44 GMT
Connection: close
Set-Cookie: akm_lmprb-ssn=02dUbdht5hkeLTJKeSJWCpvkDMdomgTWDrxVhOBypcF4ieyBCY41kuDgNMcFz1mZaVq2tP2WcZsY2StJ5R0mzGm66oCmDAx4x2l9VKv3mL2cwY8eCACgnNay7yhNAp0htKuKAjqB5dG1lR3MlBbP2qiMKwnAe4aEFjRClR; Max-Age=86400; Path=/; Expires=Thu, 09 May 2024 22:52:43 GMT; HttpOnly; Secure; SameSite=None
akm_lmprb=02dUbdht5hkeLTJKeSJWCpvkDMdomgTWDrxVhOBypcF4ieyBCY41kuDgNMcFz1mZaVq2tP2WcZsY2StJ5R0mzGm66oCmDAx4x2l9VKv3mL2cwY8eCACgnNay7yhNAp0htKuKAjqB5dG1lR3MlBbP2qiMKwnAe4aEFjRClR; Max-Age=86400; Path=/; Expires=Thu, 09 May 2024 22:52:43 GMT; HttpOnly
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243/intake/v2/rum/events | 54.212.23.110 | 200 OK | 0 B |
URL OPTIONS HTTP/2cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243/intake/v2/rum/events IP54.212.23.110:9243
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subject*.us-west-2.aws.elastic-cloud.com Fingerprint1A:4A:02:71:78:77:AA:D9:97:FC:A4:20:FD:B0:81:8F:68:2B:DC:BE ValidityMon, 06 May 2024 00:35:13 GMT - Sun, 04 Aug 2024 00:35:12 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /intake/v2/rum/events HTTP/1.1
Host: cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://capitalflashes.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
access-control-allow-headers: Content-Type, Content-Encoding, Accept
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: https://capitalflashes.com
access-control-expose-headers: Etag
access-control-max-age: 3600
date: Wed, 08 May 2024 22:52:44 GMT
vary: Origin
x-cloud-request-id: W09iZJtqSiq406DmBchE9A
x-content-type-options: nosniff
x-found-handling-cluster: cca039482a104d5d9b04bd2e20f6bb64
x-found-handling-instance: instance-0000000007
content-length: 0
X-Firefox-Spdy: h2
|
|
| cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243/intake/v2/rum/events | 54.212.23.110 | 200 OK | 0 B |
URL OPTIONS HTTP/2cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243/intake/v2/rum/events IP54.212.23.110:9243
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subject*.us-west-2.aws.elastic-cloud.com Fingerprint1A:4A:02:71:78:77:AA:D9:97:FC:A4:20:FD:B0:81:8F:68:2B:DC:BE ValidityMon, 06 May 2024 00:35:13 GMT - Sun, 04 Aug 2024 00:35:12 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
POST /intake/v2/rum/events HTTP/1.1
Host: cca039482a104d5d9b04bd2e20f6bb64.apm.us-west-2.aws.found.io:9243
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-ndjson
Content-Length: 38866
Origin: https://capitalflashes.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 202 Accepted
access-control-allow-origin: https://capitalflashes.com
date: Wed, 08 May 2024 22:52:44 GMT
x-cloud-request-id: 6OS1XR6eS9aNjWIawNtcdg
x-content-type-options: nosniff
x-found-handling-cluster: cca039482a104d5d9b04bd2e20f6bb64
x-found-handling-instance: instance-0000000008
content-length: 0
X-Firefox-Spdy: h2
|
|
| capitalflashes.com/ux/favicon/favicon-16x16.png | 5.230.252.96 | 302 Moved Temporarily | 379 B |
URL GET HTTP/1.1capitalflashes.com/ux/favicon/favicon-16x16.png IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /ux/favicon/favicon-16x16.png HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=utf-8
Content-Length: 0
Server: envoy
Location: https://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly93d3cuZ29kYWRkeS5jb20vZ29kYWRkeS00MDQ=
x-request-id: 9fe6009a-0913-9cb1-9cdd-0325c552cf52
x-amzn-trace-id: Root=1-663c0239-78b559c56035d4c510acbc82
apm-trace-id: f8e2786e12c066ee2098e9fa25de88ba
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Vary: Accept-Language
Content-Language: de_DE
x-envoy-upstream-service-time: 6
Expires: Wed, 08 May 2024 22:52:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 08 May 2024 22:52:41 GMT
Connection: close
|
|
| capitalflashes.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/p.js | 5.230.252.96 | 200 OK | 218 kB |
URL GET HTTP/1.1capitalflashes.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/p.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size218 kB (217589 bytes) Hashb461e1fe6fd4dd3ca04b758d865b3ad6 c739d943aaeb783d2edbd1fb10ab3f1a701e9810 cb987e0696339ce11e97883c46013a7d795f5f576bc0bcb427012146705f425d
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/p.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
content-length: 217589
Content-Encoding: br
ETag: 5a0e46117a4d40bd943c56fef1d629f73e2c5d1a-+PH6+WrvmSW6ElFovJ4YjZ+kUlk=-Mj90VmeMSdq4D2Rx+lHbXSzOfEw=-U86/Nk/jE5ss+7l1ZEfWbVdXOOQ=
Last-Modified: Wed, 08 May 2024 13:35:44 GMT
Access-Control-Allow-Origin:
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-kpsdk-ct,x-kpsdk-r,x-kpsdk-c
x-envoy-upstream-service-time: 5
Server: envoy
Cache-Control: public, max-age=120
Expires: Wed, 08 May 2024 22:54:34 GMT
Date: Wed, 08 May 2024 22:52:34 GMT
Connection: close
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/v1/api/shopper/get_state?domain=tocafootball.com&realm=pass&app=o365&login_hint=ymaruyama%40tocafootball.com&client-request-id=901e4cc2-23d1-6a53-d152-8d8bf4bb8240&username=ymaruyama%40tocafootball.com&wa=wsignin1.0&wtrealm=urn%3Afederation%3AMicrosoftOnline&wctx=estsredirect%3D2%26estsrequest%3DrQQIARAAjVFNaNNgAO3XdHGdf2NHDwrRUyFtvvwsSUGcabuf0NKutRubSPmaJW3aJF-XpEub2YsnQYSiF9Gbx55keJB5EU-yg2xHh4LH4UFERHYSW7x403d4vMN77_BegoBJmL7G_AFLT5hmDAPSmj5Rf8Gdm5l9m788PLpaaR2VHz748frewghcafp-x0unUrjrWxi3k9gwTE1PathO4QClXgFwCMAJAI-il_o2crt9ZKMFH2vIwNivI8uaWEdRcZ6TBEZiBEGAjCBCCMXkFqsJBquJNJIgS_MsZOi6KBs0b8wzAiewLOKF4-jF4s2u32QnhF0z1L9H4wZ27VoHe_5T4jHIar6S9VYauZxSZvJFvqOymwVc7bZyWq8ahEjJbqvBZkvfGWc5DrqtvMVakpBpBU64qLTNQraQUZjVQsB7lU3GVSrVct9pZrWlTt0z1HlF7W9UQhHV6n6l1lqhTZGFNcNFMrchbXOy1Fxb53XbrKvbNrtWxagtr66OiP9afI8gx9vY2DkgSNzRHXPrMAY-x8CXWJSZPo2B51PjS-LKu4-Ju3PKyxvvi3t8L3IwlaqX5aVSqKt6oyQsWo0OXnR2-rdEp9JryD0naITNXHk5rCJ9XboupeGQBEOS3Cfj08RshCIyJXhCgm8kuH8msh__17-HZ8HxOX6G1Cxk2t5cYpcyt2o-busOld6lerZX07SJ2kFWV_eo9G1q3E_dGQwGb85HTi_sf_r14cnPZ1-XX8xGfgM1&iframe=false&page=login&orig_app=sso&orig_path=%2Flogin | 5.230.252.96 | 200 OK | 343 B |
URL GET HTTP/1.1capitalflashes.com/v1/api/shopper/get_state?domain=tocafootball.com&realm=pass&app=o365&login_hint=ymaruyama%40tocafootball.com&client-request-id=901e4cc2-23d1-6a53-d152-8d8bf4bb8240&username=ymaruyama%40tocafootball.com&wa=wsignin1.0&wtrealm=urn%3Afederation%3AMicrosoftOnline&wctx=estsredirect%3D2%26estsrequest%3DrQQIARAAjVFNaNNgAO3XdHGdf2NHDwrRUyFtvvwsSUGcabuf0NKutRubSPmaJW3aJF-XpEub2YsnQYSiF9Gbx55keJB5EU-yg2xHh4LH4UFERHYSW7x403d4vMN77_BegoBJmL7G_AFLT5hmDAPSmj5Rf8Gdm5l9m788PLpaaR2VHz748frewghcafp-x0unUrjrWxi3k9gwTE1PathO4QClXgFwCMAJAI-il_o2crt9ZKMFH2vIwNivI8uaWEdRcZ6TBEZiBEGAjCBCCMXkFqsJBquJNJIgS_MsZOi6KBs0b8wzAiewLOKF4-jF4s2u32QnhF0z1L9H4wZ27VoHe_5T4jHIar6S9VYauZxSZvJFvqOymwVc7bZyWq8ahEjJbqvBZkvfGWc5DrqtvMVakpBpBU64qLTNQraQUZjVQsB7lU3GVSrVct9pZrWlTt0z1HlF7W9UQhHV6n6l1lqhTZGFNcNFMrchbXOy1Fxb53XbrKvbNrtWxagtr66OiP9afI8gx9vY2DkgSNzRHXPrMAY-x8CXWJSZPo2B51PjS-LKu4-Ju3PKyxvvi3t8L3IwlaqX5aVSqKt6oyQsWo0OXnR2-rdEp9JryD0naITNXHk5rCJ9XboupeGQBEOS3Cfj08RshCIyJXhCgm8kuH8msh__17-HZ8HxOX6G1Cxk2t5cYpcyt2o-busOld6lerZX07SJ2kFWV_eo9G1q3E_dGQwGb85HTi_sf_r14cnPZ1-XX8xGfgM1&iframe=false&page=login&orig_app=sso&orig_path=%2Flogin IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (363), with no line terminators Hash92d09d46e3c6543b286460d135a21cd2 97a165dc429d5ef7370af2894753ca22077a9b99 c4d2d91f2f6b95ff97e1cb8ff8615c48e3696360cc450b27bd2eff6c3c3f3957
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /v1/api/shopper/get_state?domain=tocafootball.com&realm=pass&app=o365&login_hint=ymaruyama%40tocafootball.com&client-request-id=901e4cc2-23d1-6a53-d152-8d8bf4bb8240&username=ymaruyama%40tocafootball.com&wa=wsignin1.0&wtrealm=urn%3Afederation%3AMicrosoftOnline&wctx=estsredirect%3D2%26estsrequest%3DrQQIARAAjVFNaNNgAO3XdHGdf2NHDwrRUyFtvvwsSUGcabuf0NKutRubSPmaJW3aJF-XpEub2YsnQYSiF9Gbx55keJB5EU-yg2xHh4LH4UFERHYSW7x403d4vMN77_BegoBJmL7G_AFLT5hmDAPSmj5Rf8Gdm5l9m788PLpaaR2VHz748frewghcafp-x0unUrjrWxi3k9gwTE1PathO4QClXgFwCMAJAI-il_o2crt9ZKMFH2vIwNivI8uaWEdRcZ6TBEZiBEGAjCBCCMXkFqsJBquJNJIgS_MsZOi6KBs0b8wzAiewLOKF4-jF4s2u32QnhF0z1L9H4wZ27VoHe_5T4jHIar6S9VYauZxSZvJFvqOymwVc7bZyWq8ahEjJbqvBZkvfGWc5DrqtvMVakpBpBU64qLTNQraQUZjVQsB7lU3GVSrVct9pZrWlTt0z1HlF7W9UQhHV6n6l1lqhTZGFNcNFMrchbXOy1Fxb53XbrKvbNrtWxagtr66OiP9afI8gx9vY2DkgSNzRHXPrMAY-x8CXWJSZPo2B51PjS-LKu4-Ju3PKyxvvi3t8L3IwlaqX5aVSqKt6oyQsWo0OXnR2-rdEp9JryD0naITNXHk5rCJ9XboupeGQBEOS3Cfj08RshCIyJXhCgm8kuH8msh__17-HZ8HxOX6G1Cxk2t5cYpcyt2o-busOld6lerZX07SJ2kFWV_eo9G1q3E_dGQwGb85HTi_sf_r14cnPZ1-XX8xGfgM1&iframe=false&page=login&orig_app=sso&orig_path=%2Flogin HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
traceparent: 00-72a6ea5bfec72516cdbc9b392531adf7-3be529905e659426-01
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/json
Server: envoy
x-request-id: ac187be6-af97-9ea7-806a-ea202b3e9244
x-amzn-trace-id: Root=1-663c0239-05de7f9e7104d3557eaab5a7
apm-trace-id: 72a6ea5bfec72516cdbc9b392531adf7
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
Content-Language: de_DE
x-envoy-upstream-service-time: 50
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Wed, 08 May 2024 22:52:41 GMT
content-length: 343
Connection: close
|
|
| capitalflashes.com/auth-assets/f5d911271c28aedd739cf0ed3bac8356e8b12aaf/6072.js | 5.230.252.96 | 200 OK | 95 kB |
URL GET HTTP/1.1capitalflashes.com/auth-assets/f5d911271c28aedd739cf0ed3bac8356e8b12aaf/6072.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Hash37df8b72c17b69a6374a6a7df7ab747f 9aa9f2072f2ebdfe8ca5889888d7f9902885efa8 e391f23e5a9507cfe8baf173bdcf8e5f50abcffb988af7944ca6524a98100232
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /auth-assets/f5d911271c28aedd739cf0ed3bac8356e8b12aaf/6072.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "37df8b72c17b69a6374a6a7df7ab747f"
Last-Modified: Mon, 06 May 2024 23:50:47 GMT
Vary: Accept-Encoding
x-amz-request-id: tx000005e911445935115d5-0066396cd6-324313292-default
x-rgw-object-type: Normal
content-length: 94619
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:41 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208761821_34830099_406891988_13_1058_128_33_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D | 104.17.2.184 | 200 OK | 61 B |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typePNG image data, 2 x 2, 8-bit/color RGB, non-interlaced Hash9246cca8fc3c00f50035f28e9f6b7f7d 3aa538440f70873b574f40cd793060f53ec17a5d c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 08 May 2024 22:52:22 GMT
content-type: image/png
content-length: 61
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 880d05108f785690-OSL
alt-svc: h3=":443"; ma=86400
|
|
| capitalflashes.com/identity-static-assets/_next/static/chunks/pages/_app-716ed9ac98d9996f.js | 5.230.252.96 | 200 OK | 411 kB |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/chunks/pages/_app-716ed9ac98d9996f.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size411 kB (410880 bytes) Hashd45ba6f016c50117df66b7e66eec66c7 5747ebc7a181e1251b1162cb6431029dd74fb483 ca02f2e663cf867319c636d1ae95f9149a3bd98ffec90edceef4ad28c4ab07bd
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/chunks/pages/_app-716ed9ac98d9996f.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "bef54ec3eeec4684f30b1f547329d710:1715065813.685079"
Last-Modified: Tue, 07 May 2024 07:33:21 GMT
Vary: Accept-Encoding
content-length: 410880
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:36 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208756535_34830099_406888815_12_985_37_38_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/identity-static-assets/_next/static/Y7ajyRvRjQClI4_DcMCYp/_ssgManifest.js | 5.230.252.96 | 200 OK | 77 B |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/Y7ajyRvRjQClI4_DcMCYp/_ssgManifest.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeASCII text, with no line terminators Hashb6652df95db52feb4daf4eca35380933 65451d110137761b318c82d9071c042db80c4036 6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/Y7ajyRvRjQClI4_DcMCYp/_ssgManifest.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "b6652df95db52feb4daf4eca35380933:1715076909.759831"
Last-Modified: Tue, 07 May 2024 11:03:05 GMT
Vary: Accept-Encoding
content-length: 77
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:38 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208758197_34830099_406889810_12_1114_37_76_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| events.api.capitalflashes.com/pageEvents.aspx?visitor_guid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&visit_guid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&delegated=false&agent=false&page_count=1&location=https%3A%2F%2Fcapitalflashes.com%2F%3F9kenmj6zh%3DaHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw&sitename=capitalflashes.com&page=%2F&referrer=https%3A%2F%2Ffishincapital.com%2F&marketid=de-DE&privatelabelid=1&has_consent=0&cv=0.8.0&client_name=scc-gd-c1&trace_id=4a33009dc243b0fd63a2aa7b43174cd5&rand=633513502&same_site=None&salessite=true&corrid=863085384&eventdate=2024-05-08T22%3A52%3A43.773Z×tamp=1715208763773&hit_id=9593886d-9459-4632-b223-893c4d981d65&event_type=page.event&eventtype=load&e_id=sso.login_panel.sso_landing.o365.page.load&loadSource=gasket&server=auth-ui-65cbd4457-x82sc&page_level_properties=loadSource%2Cserver | 0.0.0.0 | | 0 B |
URL GET events.api.capitalflashes.com/pageEvents.aspx?visitor_guid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&visit_guid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&delegated=false&agent=false&page_count=1&location=https%3A%2F%2Fcapitalflashes.com%2F%3F9kenmj6zh%3DaHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw&sitename=capitalflashes.com&page=%2F&referrer=https%3A%2F%2Ffishincapital.com%2F&marketid=de-DE&privatelabelid=1&has_consent=0&cv=0.8.0&client_name=scc-gd-c1&trace_id=4a33009dc243b0fd63a2aa7b43174cd5&rand=633513502&same_site=None&salessite=true&corrid=863085384&eventdate=2024-05-08T22%3A52%3A43.773Z×tamp=1715208763773&hit_id=9593886d-9459-4632-b223-893c4d981d65&event_type=page.event&eventtype=load&e_id=sso.login_panel.sso_landing.o365.page.load&loadSource=gasket&server=auth-ui-65cbd4457-x82sc&page_level_properties=loadSource%2Cserver IP0.0.0.0:0
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw==
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /pageEvents.aspx?visitor_guid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&visit_guid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&delegated=false&agent=false&page_count=1&location=https%3A%2F%2Fcapitalflashes.com%2F%3F9kenmj6zh%3DaHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw&sitename=capitalflashes.com&page=%2F&referrer=https%3A%2F%2Ffishincapital.com%2F&marketid=de-DE&privatelabelid=1&has_consent=0&cv=0.8.0&client_name=scc-gd-c1&trace_id=4a33009dc243b0fd63a2aa7b43174cd5&rand=633513502&same_site=None&salessite=true&corrid=863085384&eventdate=2024-05-08T22%3A52%3A43.773Z×tamp=1715208763773&hit_id=9593886d-9459-4632-b223-893c4d981d65&event_type=page.event&eventtype=load&e_id=sso.login_panel.sso_landing.o365.page.load&loadSource=gasket&server=auth-ui-65cbd4457-x82sc&page_level_properties=loadSource%2Cserver HTTP/1.1
Host: events.api.capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://capitalflashes.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| capitalflashes.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/fp?x-kpsdk-v=j-0.0.0 | 5.230.252.96 | 429 Too Many Requests | 370 kB |
URL GET HTTP/1.1capitalflashes.com/149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/fp?x-kpsdk-v=j-0.0.0 IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeHTML document, ASCII text, with very long lines (64999) Size370 kB (370507 bytes) Hash53699b742840eab81a5e7d343ed535ed 466ead861d67fa681d9d8310b6afb89b4f04bcdb 7978c4e509c0bd0adfb5588801137cb99f8dca797b646bf6138b390e0adad375
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/fp?x-kpsdk-v=j-0.0.0 HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 429 Too Many Requests
Content-Type: text/html; charset=utf-8
content-length: 370507
Content-Encoding: br
Access-Control-Allow-Origin:
Access-Control-Allow-Credentials: true
x-kpsdk-r: 1-AA
Access-Control-Expose-Headers: x-kpsdk-ct,x-kpsdk-r,x-kpsdk-c
x-kpsdk-ct: 02gj80m4D9QJcB0hhjuXh64wbSd4VOFy1Ven00SIqvJJB8YYTsyW6i2o9lqL5t2X1acfnxDV04JncOhgmg5aeNkSdXjZa9HTq3jnhkzmBY3Dgu7tS6urPlmam0dqVidJyyZqR8Wgvm3Vixc22Z35H0pUJrIAnkVrT2qsCw
p3p: CP="This site does not specify a policy in the P3P header"
x-envoy-upstream-service-time: 116
Server: envoy
Expires: Wed, 08 May 2024 22:52:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Wed, 08 May 2024 22:52:41 GMT
Connection: close
Set-Cookie: akm_lmprb-ssn=02gj80m4D9QJcB0hhjuXh64wbSd4VOFy1Ven00SIqvJJB8YYTsyW6i2o9lqL5t2X1acfnxDV04JncOhgmg5aeNkSdXjZa9HTq3jnhkzmBY3Dgu7tS6urPlmam0dqVidJyyZqR8Wgvm3Vixc22Z35H0pUJrIAnkVrT2qsCw; Max-Age=86400; Path=/; Expires=Thu, 09 May 2024 22:52:41 GMT; HttpOnly; Secure; SameSite=None
akm_lmprb=02gj80m4D9QJcB0hhjuXh64wbSd4VOFy1Ven00SIqvJJB8YYTsyW6i2o9lqL5t2X1acfnxDV04JncOhgmg5aeNkSdXjZa9HTq3jnhkzmBY3Dgu7tS6urPlmam0dqVidJyyZqR8Wgvm3Vixc22Z35H0pUJrIAnkVrT2qsCw; Max-Age=86400; Path=/; Expires=Thu, 09 May 2024 22:52:41 GMT; HttpOnly
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDgwNTU1MTA1NzExMTcuZDJjNWYyYzctYTgxMi00MjEwLWI3OWYtNGY2MDUzNTIyYTQ1JnN0YXRlPURjdEJEc0lnRUVCUjBMTzRwSjJaTW9VdWpFY3hVd3phQkRxSndaamV2aXplMzMxcmpMbDJsODVDanduekZCa2lNRE1DQjBRTXc0c1NaMHJCU1VSeW5oRGNHcGJzZko2Qkp5WVN6N2FfYnRTX2pJLWk3MjFfZnJhOTNZOHEzOThoVlc0ZW1pYkpxbTJWVW9hazlRUQ== | 5.230.252.96 | 302 Found | 217 kB |
URL User Request GET HTTP/1.1capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDgwNTU1MTA1NzExMTcuZDJjNWYyYzctYTgxMi00MjEwLWI3OWYtNGY2MDUzNTIyYTQ1JnN0YXRlPURjdEJEc0lnRUVCUjBMTzRwSjJaTW9VdWpFY3hVd3phQkRxSndaamV2aXplMzMxcmpMbDJsODVDanduekZCa2lNRE1DQjBRTXc0c1NaMHJCU1VSeW5oRGNHcGJzZko2Qkp5WVN6N2FfYnRTX2pJLWk3MjFfZnJhOTNZOHEzOThoVlc0ZW1pYkpxbTJWVW9hazlRUQ== IP5.230.252.96:443
CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
Size217 kB (216798 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /?9kenmj6zh=aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvYXV0aG9yaXplP2NsaWVudF9pZD0wMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAmcmVkaXJlY3RfdXJpPWh0dHBzJTNhJTJmJTJmb3V0bG9vay5vZmZpY2UuY29tJTJmb3dhJTJmJnJlc291cmNlPTAwMDAwMDAyLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMCZyZXNwb25zZV9tb2RlPWZvcm1fcG9zdCZyZXNwb25zZV90eXBlPWNvZGUraWRfdG9rZW4mc2NvcGU9b3BlbmlkJm1zYWZlZD0xJm1zYXJlZGlyPTEmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZwcm90ZWN0ZWR0b2tlbj10cnVlJmNsYWltcz0lN2IlMjJpZF90b2tlbiUyMiUzYSU3YiUyMnhtc19jYyUyMiUzYSU3YiUyMnZhbHVlcyUyMiUzYSU1YiUyMkNQMSUyMiU1ZCU3ZCU3ZCU3ZCZub25jZT02Mzg1MDgwNTU1MTA1NzExMTcuZDJjNWYyYzctYTgxMi00MjEwLWI3OWYtNGY2MDUzNTIyYTQ1JnN0YXRlPURjdEJEc0lnRUVCUjBMTzRwSjJaTW9VdWpFY3hVd3phQkRxSndaamV2aXplMzMxcmpMbDJsODVDanduekZCa2lNRE1DQjBRTXc0c1NaMHJCU1VSeW5oRGNHcGJzZko2Qkp5WVN6N2FfYnRTX2pJLWk3MjFfZnJhOTNZOHEzOThoVlc0ZW1pYkpxbTJWVW9hazlRUQ== HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://fishincapital.com/
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: -1
Location: https://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw==
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: dcc84209-7c2a-4212-b43f-ce4fb2347800
x-ms-ests-server: 2.1.18037.7 - WUS3 ProdSlices
x-ms-srs: 1.P
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; expires=Fri, 07-Jun-2024 22:52:31 GMT; path=/; secure; HttpOnly; SameSite=None
fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; expires=Fri, 07-Jun-2024 22:52:31 GMT; path=/; secure; HttpOnly; SameSite=None
esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; domain=capitalflashes.com; path=/; secure; HttpOnly; SameSite=None
cltm=CgAQABoAIgQIDBAF; domain=capitalflashes.com; path=/; secure; HttpOnly; SameSite=None
x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Date: Wed, 08 May 2024 22:52:30 GMT
Connection: close
content-length: 1718
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/identity-static-assets/_next/static/chunks/pass-background.ef0f2d9164ab36e3.js | 5.230.252.96 | 200 OK | 11 kB |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/chunks/pass-background.ef0f2d9164ab36e3.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (11306), with no line terminators Hash690076bdf450f1c29f918d0be439e000 b190384250e2c8d58329af919a6165d1bce31594 e44e5e251eb3bd46b94e42180f75345d362208c760d8feafb9317bf583a48014
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/chunks/pass-background.ef0f2d9164ab36e3.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "690076bdf450f1c29f918d0be439e000:1706027365.66649"
Last-Modified: Tue, 23 Jan 2024 17:33:52 GMT
Vary: Accept-Encoding
content-length: 11306
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:41 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208761207_34830099_406891756_13_990_27_28_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/identity-static-assets/_next/static/chunks/main-be9a3ce76a67f23c.js | 5.230.252.96 | 200 OK | 114 kB |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/chunks/main-be9a3ce76a67f23c.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size114 kB (114084 bytes) Hashf927e3a3a83b5849dd56e70a2c06782b a5a7d488cd3c52484d326cea53c3be68317c9ad6 3b21335bca9115a077c241188ea40815b264c1c690f707560135899657555b06
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/chunks/main-be9a3ce76a67f23c.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "f3270ea43497a5ad9c38a69e71a3bc26:1709148060.173888"
Last-Modified: Wed, 28 Feb 2024 19:49:47 GMT
Vary: Accept-Encoding
content-length: 114084
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:34 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208754561_34830099_406887405_15_1012_39_54_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/identity-static-assets/_next/static/chunks/pages/index-b34c7e403ec569d8.js | 5.230.252.96 | 200 OK | 3.5 kB |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/chunks/pages/index-b34c7e403ec569d8.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (3542), with no line terminators Hash0daa06f99c5ffc2b86f440cdea27d4b4 ff8b6bf28dd50d94bbc52c5e54462a87ebd16bc7 36bb5c0524fb878ac501a2ae159f28f9424cc8599160c7a355338b6df1bb0b0e
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/chunks/pages/index-b34c7e403ec569d8.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "b1ee05b21d2f5180c5152e1dc02711ee:1714422336.215129"
Last-Modified: Mon, 29 Apr 2024 20:48:53 GMT
Vary: Accept-Encoding
content-length: 3472
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:37 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208757255_34830099_406889185_13_1174_62_54_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/identity-static-assets/_next/static/chunks/6502-81c206b4a5c37e1d.js | 5.230.252.96 | 200 OK | 13 kB |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/chunks/6502-81c206b4a5c37e1d.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (12934), with no line terminators Hash8521f543fbdee72c05a949760a5938aa d31a2e34cfc1403e41ea81f0435cc3a11839c7fc 6ad2db84902ec97c463dae3c52a636341a83484b79c2531800af88d15baec0f6
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/chunks/6502-81c206b4a5c37e1d.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "8521f543fbdee72c05a949760a5938aa:1714497412.281574"
Last-Modified: Tue, 30 Apr 2024 17:45:30 GMT
Vary: Accept-Encoding
content-length: 12934
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:36 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208756803_34830099_406888890_14_1153_39_32_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/wrhs-next/5a3c09ada3e8754d1f83b97656867399/heartbeat.js | 5.230.252.96 | 200 OK | 2.6 kB |
URL GET HTTP/1.1capitalflashes.com/wrhs-next/5a3c09ada3e8754d1f83b97656867399/heartbeat.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (2663), with no line terminators Hashfc8ccd62997ba0778fa00cd8ccb7a54e 6f836004f2ca643f4bdfbf163d7af9da44623341 25c3e4eb630ebb95e597d2bbdeaec195244c709b1c4f775e999c7e0f2117c366
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /wrhs-next/5a3c09ada3e8754d1f83b97656867399/heartbeat.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "5a3c09ada3e8754d1f83b97656867399"
Last-Modified: Wed, 17 Jan 2024 19:40:32 GMT
Vary: Accept-Encoding
x-amz-id-2: USwwrm2tJaP5k8Xnx+9Sl4doePB/4EcU1eTfvbEqKRqmsopYmpVmTFARKXw5eBcWIqcaT6NfpUyPuCCWgtXnEg==
x-amz-request-id: B7M1K3RC238RNET8
x-amz-server-side-encryption: AES256
x-amz-version-id: F5k6D.7X4MlgV1Dlb8zET7a5uAkFUkMO
content-length: 2566
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:32 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208752885_34830099_406885613_15_1054_27_40_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/auth-assets/f5d911271c28aedd739cf0ed3bac8356e8b12aaf/pass-header-template.js | 5.230.252.96 | 200 OK | 898 B |
URL GET HTTP/1.1capitalflashes.com/auth-assets/f5d911271c28aedd739cf0ed3bac8356e8b12aaf/pass-header-template.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (944), with no line terminators Hashac71add6689a861781e4c47326760600 afde51eb4694d86af4ab094fc1d007ccc963e8bd 2fdf0a9b9a5da541266a218e29f6059ca3e4351f567f0368698ec41766e734d6
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /auth-assets/f5d911271c28aedd739cf0ed3bac8356e8b12aaf/pass-header-template.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=1&C_TOUCH=2024-05-08T22:52:39.172Z; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; market=de-DE; _policy=%7B%22restricted_market%22:true,%22tracking_market%22:%22explicit%22%7D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "43a708968d42c3c6e342af9897bfaa5f"
Last-Modified: Mon, 06 May 2024 23:47:37 GMT
Vary: Accept-Encoding
x-amz-request-id: tx00000d39248ba8383deea-0066396c18-3242ea3d9-default
x-rgw-object-type: Normal
content-length: 898
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:41 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208761409_34830099_406891840_13_914_27_28_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=880d05100f3a5690 | 104.17.2.184 | 200 OK | 424 kB |
URL GET HTTP/3challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=880d05100f3a5690 IP104.17.2.184:443
Requested byhttps://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal CertificateIssuerCloudflare, Inc. Subjectchallenges.cloudflare.com Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size424 kB (424424 bytes) Hashe807d72438ecb3ab93ff7807206acaa4 f9f33f10de21710294afaea6740a0fa253610d87 e2fd4f3a0fcd5a36a045b3d08537b0ceaa3db08381518ad6227219816e0cfd6b
GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=880d05100f3a5690 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/u08ua/0x4AAAAAAAZsePEII6Zx_leq/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 08 May 2024 22:52:22 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
vary: accept-encoding
server: cloudflare
cf-ray: 880d05108f7d5690-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| capitalflashes.com/identity-static-assets/_next/static/chunks/12-cf29d8fb90cc6d47.js | 5.230.252.96 | 200 OK | 13 kB |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/chunks/12-cf29d8fb90cc6d47.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (13442), with no line terminators Hash731dbbc38ef302ba76fa4b9d1a2ea72a 93adca6cc74a40aa31a8c1d44a97296b1e4d519c c4d7ee5ae540e7ef8b4a6adafc94f07d20077737e788eebba5cb006465bd8d1b
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/chunks/12-cf29d8fb90cc6d47.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "731dbbc38ef302ba76fa4b9d1a2ea72a:1706027343.398988"
Last-Modified: Tue, 23 Jan 2024 16:54:53 GMT
Vary: Accept-Encoding
content-length: 13442
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:36 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208756777_34830099_406888883_13_1068_74_43_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/wrhs/5dca119939463a11b5bba26a8dc03d3c/vendor.min.js | 5.230.252.96 | 200 OK | 294 kB |
URL GET HTTP/1.1capitalflashes.com/wrhs/5dca119939463a11b5bba26a8dc03d3c/vendor.min.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (65472) Size294 kB (293903 bytes) Hash2e76d689b56dbd80d563222d5fb199d6 2f6aebcf9889212351da3681ea6e07a31d566dd3 94106ad83b5dee79f64d3849ac8dd6c5294c95a13c225b4719b1f776c5ee0824
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /wrhs/5dca119939463a11b5bba26a8dc03d3c/vendor.min.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "5dca119939463a11b5bba26a8dc03d3c"
Last-Modified: Mon, 26 Feb 2024 22:03:05 GMT
Vary: Accept-Encoding
x-amz-id-2: WY4tHLcwhxkfLAUgwjhzlV8pm9wKNZWJ3ktB71qkSf6T9BhLPtVHZT5VpZexDPz08SAPndhW2zMi7SIoMFkong==
x-amz-request-id: ZVC1TB3RK5FB9AG9
x-amz-server-side-encryption: AES256
x-amz-version-id: iptehPMO.thZpKYfokWiFrkiZjx7cKe7
content-length: 293903
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:32 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208752893_34830099_406885619_10_639_37_42_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/wrhs-next/5cb2b92a0487b6d43802b82c60508446/scc-gd-c1.min.js | 5.230.252.96 | 200 OK | 182 kB |
URL GET HTTP/1.1capitalflashes.com/wrhs-next/5cb2b92a0487b6d43802b82c60508446/scc-gd-c1.min.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (65536), with no line terminators Size182 kB (182132 bytes) Hashe9208bedd59a3e23602295816e617aca 7cb6c1f723f3741026ee9031442105d9c1666044 2a510fe1ab9d59c3b53ddbb595e4b2775b13ec3c7545582647c2683fd68b62ea
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /wrhs-next/5cb2b92a0487b6d43802b82c60508446/scc-gd-c1.min.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "5cb2b92a0487b6d43802b82c60508446"
Last-Modified: Mon, 06 May 2024 15:16:03 GMT
Vary: Accept-Encoding
x-amz-id-2: cpB2ERd5JGpNxEOnWLUlDiiDssHbHcshV6qsXFrCz/F+stNnzwoZYwLoaNcdElKH+NGW0Lx4A9s=
x-amz-request-id: MXZ4RVTDFCWMECGH
x-amz-server-side-encryption: AES256
x-amz-version-id: XGA71QhHrfefV5luLGC0bZ41ErUsxdlg
content-length: 182132
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:33 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208753179_34830099_406886081_12_1052_57_104_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/auth-assets/f5d911271c28aedd739cf0ed3bac8356e8b12aaf/login-panel.js | 5.230.252.96 | 200 OK | 556 kB |
URL GET HTTP/1.1capitalflashes.com/auth-assets/f5d911271c28aedd739cf0ed3bac8356e8b12aaf/login-panel.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
Size556 kB (555625 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /auth-assets/f5d911271c28aedd739cf0ed3bac8356e8b12aaf/login-panel.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "9737de133bce91d37b5a18634ecac344"
Last-Modified: Mon, 06 May 2024 23:47:21 GMT
Vary: Accept-Encoding
x-amz-request-id: tx00000cab5c7a89dba509f-0066396c06-3242e1f5b-default
x-rgw-object-type: Normal
content-length: 555625
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:32 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208752856_34830099_406885594_12_869_27_29_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/identity-static-assets/_next/static/chunks/webpack-c705de50c5d23757.js | 5.230.252.96 | 200 OK | 12 kB |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/chunks/webpack-c705de50c5d23757.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (11633), with no line terminators Hash53c7e15ed83325a3bf5b8cda34194730 007b3a6f7a1ae94d1d5c05a94d82e05d037d1c43 140f8ee53f4baf4ee75034b9c1b5f5e1c4645e504d6adeeeccdeb526e38640d0
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/chunks/webpack-c705de50c5d23757.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "ab371110b0a2b3ae7821d2d494b3a94e:1715076931.04654"
Last-Modified: Tue, 07 May 2024 11:00:53 GMT
Vary: Accept-Encoding
content-length: 11633
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:34 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208754518_34830099_406887319_11_952_101_37_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| fishincapital.com/favicon.ico | 5.230.252.96 | 500 Internal Server Error | 22 B |
URL GET HTTP/1.1fishincapital.com/favicon.ico IP5.230.252.96:443
Requested byhttps://fishincapital.com/?pawcnsgb=ae4924a4179dded34526b3e657f990da253e252512a7b84e7c21f72377ab5330be376df4f0f4513e3c2d6decb747a342fb150126671fc8930cbfc76a91bd2373&qrc=ymaruyama%40tocafootball.com CertificateIssuerLet's Encrypt Subjectfishincapital.com Fingerprint4F:C7:78:2F:92:93:75:6D:6C:BB:92:AE:63:D8:DA:75:DE:E0:5B:58 ValidityWed, 08 May 2024 17:18:02 GMT - Tue, 06 Aug 2024 17:18:01 GMT
File typeASCII text, with no line terminators Hash6aab5444a217195068e4b25509bc0c50 7b22eaf7eaa9b7e1f664a0632d3894d406fe7933 fc5525d427bfa27792d3a87411be241c047d07f07c18e2fc36bf00b1c2e33d07
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /favicon.ico HTTP/1.1
Host: fishincapital.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://fishincapital.com/?pawcnsgb=ae4924a4179dded34526b3e657f990da253e252512a7b84e7c21f72377ab5330be376df4f0f4513e3c2d6decb747a342fb150126671fc8930cbfc76a91bd2373&qrc=ymaruyama%40tocafootball.com
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 500 Internal Server Error
Date: Wed, 08 May 2024 22:52:22 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked
|
|
| csp.capitalflashes.com/eventbus | 0.0.0.0 | | 0 B |
URL OPTIONS csp.capitalflashes.com/eventbus IP0.0.0.0:0
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw==
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /eventbus HTTP/1.1
Host: csp.capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://capitalflashes.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| capitalflashes.com/wrhs/31aa663a306bb8fc0cb65e5d696fb1bf/uxcore2.min.js | 5.230.252.96 | 200 OK | 63 kB |
URL GET HTTP/1.1capitalflashes.com/wrhs/31aa663a306bb8fc0cb65e5d696fb1bf/uxcore2.min.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typeJavaScript source, ASCII text, with very long lines (62956) Hash31aa663a306bb8fc0cb65e5d696fb1bf d73430da2440e60097306f2137524428397520b3 1acbb8e280ff3f9f8c53d6427886d08f4d700ec24ac1c73e6a538d1c2eeeb08a
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /wrhs/31aa663a306bb8fc0cb65e5d696fb1bf/uxcore2.min.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "31aa663a306bb8fc0cb65e5d696fb1bf"
Last-Modified: Mon, 26 Feb 2024 22:03:00 GMT
Vary: Accept-Encoding
x-amz-id-2: CGPkgkCnLG2EfZQRwLzMfBiu4rSJ2R7TOdfufStVCkAyFsTaypGzMKcnjGAar3c3PNSUbxGv0ovDQIgybKRfOw==
x-amz-request-id: 2FH81BTAJJBZGN9G
x-amz-server-side-encryption: AES256
x-amz-version-id: Zn1IeOyklMiHukT2gXdv04Wbqqsp3k13
content-length: 62996
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:32 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208752883_34830099_406885606_13_1108_27_28_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/wrhs-next/90885773439e942d65550923fefe99fc/utility-header.js | 5.230.252.96 | 200 OK | 447 kB |
URL GET HTTP/1.1capitalflashes.com/wrhs-next/90885773439e942d65550923fefe99fc/utility-header.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
Size447 kB (447145 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /wrhs-next/90885773439e942d65550923fefe99fc/utility-header.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "90885773439e942d65550923fefe99fc"
Last-Modified: Tue, 23 Apr 2024 20:03:52 GMT
Vary: Accept-Encoding
x-amz-id-2: j06dSef/7pBK2acimSuEoC6/4RQXsLKbspqtVeXvKo3WYner9gOrNjgiDnASqVHR5hH7nERbvV4=
x-amz-request-id: VGEMT7WMM6QV0GWT
x-amz-server-side-encryption: AES256
x-amz-version-id: KNXJhRiuj9yl3peRBQ_C4V7RDpDbb5iB
content-length: 447145
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:38 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208758329_34830099_406889908_14_1147_58_79_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| capitalflashes.com/identity-static-assets/_next/static/chunks/framework-a0c46ad6a3b8da13.js | 5.230.252.96 | 200 OK | 712 B |
URL GET HTTP/1.1capitalflashes.com/identity-static-assets/_next/static/chunks/framework-a0c46ad6a3b8da13.js IP5.230.252.96:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerLet's Encrypt Subjectcapitalflashes.com FingerprintF7:C7:16:01:72:6A:4A:6F:DF:DF:E5:F7:33:08:61:F0:B8:BD:02:F1 ValidityWed, 08 May 2024 17:18:59 GMT - Tue, 06 Aug 2024 17:18:58 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (722), with no line terminators Hash4c775bc33c5befdffd710a64992441da 3b13b446429d2230130e7911706de55585a6bb45 7335f824141903cc7d67a38b55fc145270e802d88b40959007d4e649fa6fc55c
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook |
GET /identity-static-assets/_next/static/chunks/framework-a0c46ad6a3b8da13.js HTTP/1.1
Host: capitalflashes.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: qPdM=l70aGY6tpnE0; qPdM.sig=3KsSt6QICC-DmoOJ16PuLjcfwKA; ClientId=693537322D39450A833B491DF3AA7B0C; OIDC=1; OpenIdConnect.nonce.v3.tBg7Ux64QLnpTPTOtiKardf46tMTn7XeRNsywotmp5I=638508055510571117.d2c5f2c7-a812-4210-b79f-4f6053522a45; X-OWA-RedirectHistory=ArLym14BbdjuirFv3Ag; buid=0.AbcAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd80qqZ6VinYOHxg0a0tFE-Dq7LAnH2eW2OfpVIV3CTt3HqPqtkBYfT6PHKqe_yNAWfD2gRD6W1hoLp8Zl90MWz-2F2bSP_0r2uY0bpjOHObUYgAA; fpc=AkswqI7IacBJtXwGjeU4yomerOTJAQAAAC75zd0OAAAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8B1Pgsh3LZusahyLs0ekXwuYycKrX7ZjWIRzaHX-bvZthqyJMZ00_aR_Y6cDGKKJVgujnQf7bsQmyeSl_97iRZLd9OZjjZxCfdfeQ0HvIyFckqm_1jIDpcf_6DlC19MlLsibK2OBNjH8v6yyZT27v34f4C78SnckT3p0mkPpnzyAgAA; cltm=CgAQABoAIgQIDBAF; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4; fb_sessiontraffic=S_TOUCH=&pathway=f62eec47-c24d-4e5c-b4ae-bd271e4466c4&V_DATE=&pc=0; visitor=vid=f62eec47-c24d-4e5c-b4ae-bd271e4466c4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Accept-Ranges: bytes
Content-Encoding: br
ETag: "dbb892502bcee0c165c037c8810ff22d:1706027356.69603"
Last-Modified: Tue, 23 Jan 2024 16:54:26 GMT
Vary: Accept-Encoding
content-length: 712
Cache-Control: max-age=31536000
Date: Wed, 08 May 2024 22:52:36 GMT
Connection: close
Server-Timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715208756062_34830099_406888555_12_991_56_69_-";dur=1
Timing-Allow-Origin: *
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; form-action * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: filesystem: ; frame-ancestors 'self' * http://* https://* file://* about: javascript: data: blob: filesystem: ; object-src * data: blob: filesystem: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';
|
|
| unpkg.com/@elastic/apm-rum@5.9.1/dist/bundles/elastic-apm-rum.umd.min.js | 104.17.245.203 | 200 OK | 58 kB |
URL GET HTTP/2unpkg.com/@elastic/apm-rum@5.9.1/dist/bundles/elastic-apm-rum.umd.min.js IP104.17.245.203:443
Requested byhttps://capitalflashes.com/?9kenmj6zh=aHR0cHM6Ly9zc28uZ29kYWRkeS5jb20vP2RvbWFpbj10b2NhZm9vdGJhbGwuY29tJnJlYWxtPXBhc3MmYXBwPW8zNjUmbG9naW5faGludD15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJmNsaWVudC1yZXF1ZXN0LWlkPTkwMWU0Y2MyLTIzZDEtNmE1My1kMTUyLThkOGJmNGJiODI0MCZ1c2VybmFtZT15bWFydXlhbWElNDB0b2NhZm9vdGJhbGwuY29tJndhPXdzaWduaW4xLjAmd3RyZWFsbT11cm4lM2FmZWRlcmF0aW9uJTNhTWljcm9zb2Z0T25saW5lJndjdHg9ZXN0c3JlZGlyZWN0JTNkMiUyNmVzdHNyZXF1ZXN0JTNkclFRSUFSQUFqVkZOYU5OZ0FPM1hkSEdkZjJOSER3clJVeUZ0dnZ3c1NVR2NhYnVmME5LdXRSdWJTUG1hSlczYUpGLVhwRXViMllzblFZU2lGOUdieDU1a2VKQjVFVS15ZzJ4SGg0TEg0VUZFUkhZU1c3eDQwM2Q0dk1ONzdfQmVnb0JKbUw3R19BRkxUNWhtREFQU21qNVJmOEdkbTVsOW03ODhQTHBhYVIyVkh6NzQ4ZnJld2doY2FmcC14MHVuVXJqcld4aTNrOWd3VEUxUGF0aE80UUNsWGdGd0NNQUpBSS1pbF9vMmNydDlaS01GSDJ2SXdOaXZJOHVhV0VkUmNaNlRCRVppQkVHQWpDQkNDTVhrRnFzSkJxdUpOSklnU19Nc1pPaTZLQnMwYjh3ekFpZXdMT0tGNC1qRjRzMnUzMlFuaEYwejFMOUg0d1oyN1ZvSGVfNVQ0akhJYXI2UzlWWWF1WnhTWnZKRnZxT3ltd1ZjN2JaeVdxOGFoRWpKYnF2QlprdmZHV2M1RHJxdHZNVmFrcEJwQlU2NHFMVE5RcmFRVVpqVlFzQjdsVTNHVlNyVmN0OXBacldsVHQwejFIbEY3VzlVUWhIVjZuNmwxbHFoVFpHRk5jTkZNcmNoYlhPeTFGeGI1M1hickt2Yk5ydFd4YWd0cjY2T2lQOWFmSThneDl2WTJEa2dTTnpSSFhQck1BWS14OENYV0pTWlBvMkI1MVBqUy1MS3U0LUp1M1BLeXh2dmkzdDhMM0l3bGFxWDVhVlNxS3Q2b3lRc1dvME9YblIyLXJkRXA5SnJ5RDBuYUlUTlhIazVyQ0o5WGJvdXBlR1FCRU9TM0NmajA4UnNoQ0l5SlhoQ2dtOGt1SDhtc2hfXzE3LUhaOEh4T1g2RzFDeGsydDVjWXBjeXQyby1idXNPbGQ2bGVyWlgwN1NKMmtGV1ZfZW85RzFxM0VfZEdRd0diODVIVGlfc2ZfcjE0Y25QWjEtWFg4eEdmZ00xIw== CertificateIssuerGoogle Trust Services LLC Subjectunpkg.com Fingerprint2E:F1:F6:31:28:EC:29:20:41:F4:58:4B:B1:CF:51:16:77:7E:BF:E3 ValidityMon, 01 Apr 2024 02:40:24 GMT - Sun, 30 Jun 2024 02:40:23 GMT
File typeJavaScript source, ASCII text, with very long lines (58454) Hash0be4c885d07e54abb224234982b34fd7 82ba6a8b59f75a865bcc0ce7e242491156ead595 8d79c92638e9125038fb1faad3896558febee2ed0c34f87e9d01c6f161999342
GET /@elastic/apm-rum@5.9.1/dist/bundles/elastic-apm-rum.umd.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 08 May 2024 22:52:32 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
content-encoding: br
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: "e48a-grpqi1n3WoZbzAzn4kJJEVbq1ZU"
via: 1.1 fly.io
fly-request-id: 01HWQWTNGM8A5AA324SR93BA6S-arn
cf-cache-status: HIT
age: 714815
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 880d0550f82e1bfe-OSL
X-Firefox-Spdy: h2
|
|
0.0.0.0