Report - r3fy6.shop/

Report Overview

Submitted URL
r3fy6.shop/
IP
188.114.97.1
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-26 04:11:25
Access
public
Website Title
Газпром-Инвест Официальный сайт
Final URL
r3fy6.shop/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
66

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2024-04-25	4.2 kB	260 kB	216.58.207.227
ipinfo.io	8136	2013-04-23	2013-12-16	2024-04-25	407 B	678 B	34.117.186.192
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2024-04-25	509 B	24 kB	142.250.74.106
r3fy6.shop	unknown	unknown	No data	No data	15 kB	3.4 MB	188.114.96.1
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-24	2.2 kB	308 kB	104.17.25.14
code.jquery.com	634	2005-12-10	2012-05-21	2024-04-25	404 B	90 kB	151.101.130.137

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom
2024-04-25	medium	r3fy6.shop/	Gazprom

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (11)

	URL	Size	First Seen	Last Seen
	r3fy6.shop/	539 B	2023-09-16	2024-05-05
Pretty URL r3fy6.shop/ IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-09-16 05:55:04 Last Seen2024-05-05 08:06:52 Times Seen11339 Hash 468a5049db1adf2d5f4f7c420aeec45f 56f1d3150e5a056be36805153c4ca952df1a5069 0b8f88f3590bd4f0ea8ecd461c920a744f12f337a857c497b93f2b306626993e Loading...

	cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js	90 kB	2023-03-07	2024-05-06
Pretty URL cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:01 Last Seen2024-05-06 17:53:47 Times Seen141687 Hash dc5e7f18c8d36ac1d3d4753a87c98d0a c8e1c8b386dc5b7a9184c763c88d19a346eb3342 f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Loading...

	cdnjs.cloudflare.com/ajax/libs/bootstrap/5.0.1/js/bootstrap.min.js	60 kB	2023-03-07	2024-05-05
Pretty URL cdnjs.cloudflare.com/ajax/libs/bootstrap/5.0.1/js/bootstrap.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:10:18 Last Seen2024-05-05 08:06:53 Times Seen23102 Hash b5730588db13e71c65bdb1d234089260 282209ef6065e8451a5623c1b208d256d7b14c27 77e1728245a0c2de7d0859163ee081e1113aa75fd6894602cb5eb0d7e739bca9 Loading...

	r3fy6.shop/l/gaz/js/index.js	992 B	2023-09-16	2024-05-05
Pretty URL r3fy6.shop/l/gaz/js/index.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-16 05:55:04 Last Seen2024-05-05 08:06:52 Times Seen14425 Hash 1adfefb340541281830ef6167ef51db5 6e63bd31cb65aca647043cfd03630fd8f06da6aa 963362ac5b92fb739eff1dce8f8e48238c7b6597d2b8c1b87d18b055277cb05b Loading...

	r3fy6.shop/	298 B	2023-09-16	2024-05-05
Pretty URL r3fy6.shop/ IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-09-16 05:55:04 Last Seen2024-05-05 08:06:52 Times Seen11287 Hash c50bdad10d5fe5ba42c30f80ca8ecbfe 50aedce3f6a2194c7fbe87d2fd538614de8d3e4c 732bf6f9fc306d0e15b283137fb020243e02abe7086aa26ea169ddba6df3f4d0 Loading...

	cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.15/js/utils.js	251 kB	2023-03-07	2024-05-05
Pretty URL cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.15/js/utils.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:24:15 Last Seen2024-05-05 08:06:53 Times Seen24399 Hash badf39299033bb934da6325eea28ce72 bf68e8fd78007eb5539e08f0621a75c76c977f22 2c70f3d32d8ed2924ff688ad77a9b8f65663a433b5b0e5f4ba38879956961652 Loading...

	code.jquery.com/jquery-3.6.0.min.js	90 kB	2023-03-07	2024-05-06
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2024-05-06 17:53:44 Times Seen266489 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	cdnjs.cloudflare.com/ajax/libs/ion-rangeslider/2.3.1/js/ion.rangeSlider.min.js	41 kB	2023-04-05	2024-05-06
Pretty URL cdnjs.cloudflare.com/ajax/libs/ion-rangeslider/2.3.1/js/ion.rangeSlider.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 23:55:04 Last Seen2024-05-06 10:44:43 Times Seen11661 Hash dd2250b414858d83d5bff500e9c418d8 e6efd1a460c2f6c5d94924079e0f2029b46272cb 54a80c57a4102dcfca059ae31110176b10e52706b4dc15bb6a621f38909ea64b Loading...

	r3fy6.shop/l/gaz/js/intlTelInput.min.js	30 kB	2023-04-07	2024-05-05
Pretty URL r3fy6.shop/l/gaz/js/intlTelInput.min.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-07 08:40:51 Last Seen2024-05-05 08:06:52 Times Seen11500 Hash 9c8154f4404aec64d3fccdf1375da301 4bfc43bdaf6c1e8654e13873c5a99f6369677f35 a7fdd130131c8899e7cda1f6afb542aeb729b8dc5423f00353c682b5460c643c Loading...

	r3fy6.shop/l/gaz/js/errors.js?t=2	4.2 kB	2023-09-16	2024-05-05
Pretty URL r3fy6.shop/l/gaz/js/errors.js?t=2 IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-16 05:55:04 Last Seen2024-05-05 08:06:53 Times Seen14487 Hash d8bacacbb94df09ddf8d3609d0d18feb ba0208dfefe91cc867282f5bff6bd01de3275d11 566e2f0b77fd55ac4ac6170043c91efe2df9204882d5e030ac2b1169fd167dc1 Loading...

	r3fy6.shop/l/gaz/js/landing_url2.js	257 B	2023-09-16	2024-05-05
Pretty URL r3fy6.shop/l/gaz/js/landing_url2.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-16 05:55:04 Last Seen2024-05-05 08:06:52 Times Seen14464 Hash 2afba324c360fd0ed40f992335bb8c92 699177e3e1a216e054f249ac2f498e26ada9d9a1 9db54e0a4b17459fb1c5f1991a75f3f57e1204b160b90638409391f6234471cd Loading...

HTTP Transactions (50)

URL IP Response Size

r3fy6.shop/l/gaz/img/logo.png

188.114.96.1

200 OK

1.1 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/logo.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
PNG image data, 114 x 56, 4-bit colormap, non-interlaced
Size
1.1 kB (1065 bytes)
Hash
04385fdb7e2e6f1404f87d7c9f10f00a
e1aa2aca309de313e591d4ae0fa2ef66b5fb7a23
fcba35abb4f62bcb7cbba58e9c7c488f5a49b4f3e99cd469dcc3a47f2df44b5c

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/logo.png HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/png
content-length: 1065
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: "64043bab-429"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mZXVsMCiqF19mOdecsVv2XAIi5B8edJycZmSrZug%2Bdv%2BZijJaipSjF5QaxnrFApFae4zv%2FhY1LvmP0gPfYM87Dicb4rtGQDM8tjl9um4TxDMgANzMDZZWV2IysOU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e449e5b4ff-OSL
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/rus.png

188.114.96.1

200 OK

2.3 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/rus.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
PNG image data, 162 x 56, 8-bit colormap, non-interlaced
Size
2.3 kB (2336 bytes)
Hash
3019a0f4b4dce8e60124f6f0a43c18b5
59d55a14fa68c7d11044fb0daa78617629372b8e
071b949e723dee01c3dcec2832dba89ac844b30564249ec3e5d1500d10e3f05a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/rus.png HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/png
content-length: 2336
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: "64043bab-920"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SWZjErNWALNi79yY9cs0%2BXfp7BuwdClaMUPu6Y4iYMy1die6kQbrR%2BNPq%2FcyyCf7AhDQOCaUd%2BsGNALZdSRaiF4mOhGtd4QXpiDN4Sgb5tLKpGgONuQNqC%2FnuAKj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e449e7b4ff-OSL
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/photo.jpg

188.114.96.1

200 OK

32 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/photo.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 738x808, components 3
Size
32 kB (32109 bytes)
Hash
3fdae4cd437f4c40b9c08785782fa5ce
9a0f1b6f6bd9dccc1932ba1dc3ed0983e900efd3
8cf9de22d548227ffb3aebe51d012b0352ceeee02e36d215f7b80d0c9bc50d43

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/photo.jpg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/jpeg
content-length: 32109
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: "64043bab-7d6d"
expires: Fri, 24 May 2024 13:53:13 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 137865
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lQOtj3cwOh2%2FG9OmkJw%2B3pw0i%2FXPzp0XA3hoRNQwwPoAssnax9VYMCjiDS2OPc9qxZWOv8r01m6k%2BfltQX%2Fr00vgaRXMKxSPPQx2mkL0EDht3ewA1o9Dr9PCTSeI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e459f0b4ff-OSL
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/license.jpg

188.114.96.1

200 OK

504 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/license.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1343x1900, components 3
Size
504 kB (503545 bytes)
Hash
23f74188101be1f61d925652a5a4a125
f7fa278087d032a53275eb4d58e770fb16cc77cc
2039b2ae5b6876263012ee356c4a6dd0c70b595109347f9bee8dd55d60d5558b

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/license.jpg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/jpeg
content-length: 503545
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: "64043bab-7aef9"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sYwC9lEQuCXJtto8oZgpQbljUt1Yimo2AhuOaPpCm03Qsqc4b4biVUloDJgwd%2BQeMh7BuX%2BeToU8Ycam30sYhN6MVeJSwtkf93%2Bd%2B1deoh4PUsoBAQaQhOevSmBZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e459f1b4ff-OSL
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/image%2053.jpg

188.114.96.1

200 OK

61 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/image%2053.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 480x564, components 3
Size
61 kB (60749 bytes)
Hash
ff3619179edca92ec7c521620ba4da04
8a361aeca8645a9fe5bab1e1baaf14c79b9beb7f
6b0379257e26ed216b6e14110fe1bef430ef1254d2c8c1668732fbafaec754c6

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/image%2053.jpg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/jpeg
content-length: 60749
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: "64043bab-ed4d"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dcaRGXAUApTF2eCspdJ5KHBEcxPpXKZVRY2PZT9gKc0ol2yuIXQHK%2FTtfdRXWDHQPKaDq4GJzYSf%2BxYzGqjn%2FJYBCdg%2FnHF9k4g97WoS5BpnBa8zG8VnGmn9jsBO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e459f6b4ff-OSL
alt-svc: h3=":443"; ma=86400

r3fy6.shop/

188.114.96.1

200 OK

52 kB

URL User Request GET HTTP/2
r3fy6.shop/
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
HTML document, Unicode text, UTF-8 text
Size
52 kB (52222 bytes)
Hash
20a61b21f6a51240f8ede962dbb5d869
73b7bd7a08257d0b1e3a695187831f7b0aa9b62e
9f93c478c10c3c03c21a0a8136512d437470efd2110267f711e8b96d38e516fb

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET / HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.2.13
cache-control: private, must-revalidate
pragma: no-cache
expires: -1
set-cookie: sid=deleted; expires=Thu, 27 Apr 2023 04:10:57 GMT; Max-Age=0; path=/; httponly; samesite=lax
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CysjECT4gzSc%2BjL6AY7lZVaYd5ebx453eBRM%2F9MzyOkQkXRFBi8kZBFQh2exS20hIMyCJz6m27XTtykkZoX882JXb6QpYfzCQkBSXbmhHGoQFy058SDCJFzAoHUo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a3b9e16f6d56b9-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js

104.17.25.14

200 OK

28 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65451)
Size
28 kB (27958 bytes)
Hash
dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

HTTP Headers

GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: application/javascript; charset=utf-8
content-length: 27958
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb09ed3-15d84"
last-modified: Mon, 04 May 2020 23:01:39 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 4894
expires: Wed, 16 Apr 2025 04:10:58 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gIHxXNl2Ln2xxp0KALlgW3hnWQVmXxqHKMN72OHYNXy9WbkOXyB5V%2F0%2BbWp24ngiE682rgflSA%2BnL1DzPn4hQLH5Yq6Bu2ctD4cyLDRB0uLhVHiiJmaCmzMgDPlZIy2oeQLyB6W4"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87a3b9e49966b505-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/ion-rangeslider/2.3.1/js/ion.rangeSlider.min.js

104.17.25.14

200 OK

7.7 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/ion-rangeslider/2.3.1/js/ion.rangeSlider.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (41067)
Size
7.7 kB (7685 bytes)
Hash
b5c1f83e8e2c9fad4a9c7a7e8c34b2fa
a1c7a35489061767940a66b546466ff5212a4625
67adfdac93b9ec1899cd00e55ac1b217e109dc5b379c3e2940f91f8a64f2dd2f

HTTP Headers

GET /ajax/libs/ion-rangeslider/2.3.1/js/ion.rangeSlider.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: application/javascript; charset=utf-8
content-length: 7685
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ea7-a0d3"
last-modified: Mon, 04 May 2020 16:11:19 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 111591
expires: Wed, 16 Apr 2025 04:10:58 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GeoGL2907HwUz8Tg%2FLodf8fekuaTqPguoNIqcLqgm0Kg%2Bp8CzTzIdvCmzbBeVeZto6dHCCLgkWrL5AR6vC9WuIBx7YdGi8cV9FnmVwMv6F6ZoICbPG1fJU5IXSR20jOsRSyRNWS8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87a3b9e549a5b505-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.13/css/intlTelInput.css

104.17.25.14

200 OK

2.0 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.13/css/intlTelInput.css
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text
Size
2.0 kB (1970 bytes)
Hash
a69aa970266649e0b08c2cb4bc166568
d9314a52085a2bb6d284421bb18a4c546ecb73d4
ad32b1248207ba91fb945a37d38e7c9deafcba849245872203482db42930d491

HTTP Headers

GET /ajax/libs/intl-tel-input/17.0.13/css/intlTelInput.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: text/css; charset=utf-8
content-length: 1970
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "60c32345-7b2"
last-modified: Fri, 11 Jun 2021 08:48:05 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 1859477
expires: Wed, 16 Apr 2025 04:10:58 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pS%2BF3OreOEkELSU7us%2FeFu9WAd5qa%2BQR5cS9n9joJDsheHVndM1ftQSFDTGuLf4zanyW28BQFAU%2FGWGbo08DAtbW4Pl7OzcMxUaCJJFt%2FsV5pYemFdZmuCjIw9uTzfDOx4Oxee%2Fo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87a3b9e559a6b505-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/bootstrap/5.0.1/js/bootstrap.min.js

104.17.25.14

200 OK

14 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/bootstrap/5.0.1/js/bootstrap.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (59812)
Size
14 kB (14192 bytes)
Hash
b5730588db13e71c65bdb1d234089260
282209ef6065e8451a5623c1b208d256d7b14c27
77e1728245a0c2de7d0859163ee081e1113aa75fd6894602cb5eb0d7e739bca9

HTTP Headers

GET /ajax/libs/bootstrap/5.0.1/js/bootstrap.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: application/javascript; charset=utf-8
content-length: 14192
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "60f76446-3770"
last-modified: Wed, 21 Jul 2021 00:03:18 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 899819
expires: Wed, 16 Apr 2025 04:10:58 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w1mnfKMQQeO2J54BAISOwpAZ1oJZbsuhf0NiR4KxrX0LPVWgS1HsPS%2FjTqlt7DZgtPh7WMrc2%2Beq3kde3Ta5dhX2g1msrEsUHHKhWKp2wzmdf7%2FVTbpMjs9090AYLksZSAvrlS9s"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87a3b9e559a8b505-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.0.min.js

151.101.130.137

200 OK

90 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://r3fy6.shop/
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
90 kB (89501 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: "28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 26 Apr 2024 04:10:58 GMT
age: 151138
x-served-by: cache-lga21931-LGA, cache-hel1410020-HEL
x-cache: HIT, HIT
x-cache-hits: 222, 68580
x-timer: S1714104659.796441,VS0,VE0
vary: Accept-Encoding
content-length: 89501
X-Firefox-Spdy: h2

r3fy6.shop/l/gaz/img/image%2051.jpg

188.114.96.1

200 OK

65 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/image%2051.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 480x564, components 3
Size
65 kB (65334 bytes)
Hash
b9380925144986fcdef1f5cb82a2e1b7
e333dd7a6e3cb5cfa0ae9670ccf5793af8d6777c
99de95d603e85d20ba9d8bc90a314ab139342b0e58ab78b2c6c17cbab56cd2bc

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/image%2051.jpg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/jpeg
content-length: 65334
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: "64043bab-ff36"
expires: Sun, 26 May 2024 04:10:58 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9sibk44h70rlpbLgUKHLWWDZ%2FhKFKNs2VbuC%2F%2FHKxEbLvUP58xmWhLGXVhUlgAp6Yx74OLaHKnnL6OkXPseFbirvShRXfQbzujknroXUB4m5k7nscvRK6G9w3aK8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e459f4b4ff-OSL
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/img3.svg

188.114.96.1

200 OK

8.5 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/img3.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
8.5 kB (8461 bytes)
Hash
0685ab7a7f1613725ac083f51d62dd9e
e9aeb297b2447e9b871fb32dd309434634b705be
693d77da621b2eb643d726ac6cf9bdbd9972311cabbe612700046a5138b32305

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/img3.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-6e39"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IZfKgzoFVap7ID2QgT%2BWUIqn%2F0TXM3qvgVOXDhUMhD%2Bcg0Diq9ISndrXR1sO5aIGpdin9ToRQHbC9UCzmPAmqgav0pvHiecTv01hOkzSZYyB%2FpR8vNW7%2Bcix8ud4"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e449efb4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

fonts.gstatic.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjsGyN.woff2

216.58.207.227

200 OK

30 kB

URL GET HTTP/2
fonts.gstatic.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjsGyN.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 29752, version 1.0
Size
30 kB (29752 bytes)
Hash
ab1fc8621287e4ea9319a3136812cf80
fb4ed2e52e2a8d7ac50a7618a0c2ea5507a24ef3
7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa

HTTP Headers

GET /s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjsGyN.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 29752
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 23 Apr 2024 03:15:27 GMT
expires: Wed, 23 Apr 2025 03:15:27 GMT
cache-control: public, max-age=31536000
age: 262532
last-modified: Wed, 27 Apr 2022 17:05:11 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3fy6.shop/l/gaz/js/errors.js?t=2

188.114.96.1

200 OK

40 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/js/errors.js?t=2
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
Algol 68 source, ASCII text
Size
40 kB (39624 bytes)
Hash
d8bacacbb94df09ddf8d3609d0d18feb
ba0208dfefe91cc867282f5bff6bd01de3275d11
566e2f0b77fd55ac4ac6170043c91efe2df9204882d5e030ac2b1169fd167dc1

HTTP Headers

GET /l/gaz/js/errors.js?t=2 HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: application/javascript; charset=utf8
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-1051"
expires: Fri, 24 May 2024 13:53:11 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 137867
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ha5G5FElmFXXX6c5ezFgk5OIUBOnQewRKYsqaRVuKYtXHEcCgzJqk%2FJCoyHIrsWKpiETJWAx3ea1B1lw66bLBQjnbPy8VKeYDqDSK%2BXaZ75lHeV6i14FeZuf3k8K"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e46a01b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKew72j00.woff2

216.58.207.227

200 OK

21 kB

URL GET HTTP/2
fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKew72j00.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 20860, version 1.0
Size
21 kB (20860 bytes)
Hash
15b0d42b9ec6606a60edbdcced868466
73ca3f9f966f6722e78409b22db328ce4da475a9
f1400c92345dcd9dbf746acab2c60e8580aa959473e9e56c8772cadcf7734b76

HTTP Headers

GET /s/ubuntu/v20/4iCs6KVjbNBYlgoKew72j00.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 20860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 02:49:06 GMT
expires: Fri, 25 Apr 2025 02:49:06 GMT
cache-control: public, max-age=31536000
age: 91313
last-modified: Wed, 27 Apr 2022 16:15:59 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3fy6.shop/l/gaz/img/sprite2.svg

188.114.96.1

200 OK

52 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite2.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
52 kB (51804 bytes)
Hash
b1d484b45a5309d1b3da1b9534d4ac71
2aea50241e0b60221e4ebfe00df237f29daa5951
03be5ce35e1fc893a2d08426a21a9e5dc53983c56fdccd9006da45160ed73d1e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite2.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-26cc"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c4y9lX1Qssi8akww4u8A3cxI4UOD3pEXtOLCdlVTt685uJ0gEcJceHQqj%2FgwLL01%2B205fwNn4Nht4iq3zk%2Fg99YsufjrbQ%2B328R1xnlnwvaekzisnRpLXlaIWdHx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6eb51b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/sprite10.svg

188.114.96.1

200 OK

28 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite10.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
28 kB (28073 bytes)
Hash
fa41411f38996d9a518a8146ab6ae209
d0c1b647b7a29e2002f89b15074c78a5c7bc2506
919543a4ed0fdcfcc462c0dfa7da7471913c25ea63efad12f4f8e1532ec34f1b

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite10.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-c9a"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IjcJXvX0MTrXK8a%2BWeyGnL6gj8sDiNj7jxDGwi55%2FPGuacQ70RQ7dMbP%2BElQ3qcPei%2FfnYTjYB2nfuFoUPbUaOI8AmoRcvnGcV54e2fiBCeRz2Sv9S89jhJ%2Fkm9l"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6eb4cb4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/sprite5.svg

188.114.96.1

200 OK

29 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite5.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
29 kB (28560 bytes)
Hash
daca62ad9bd73b66fdb42a2b108e26df
b537c1c0d24ef26eceea905ca02996a22cfd73a1
3d3ffc8ddc82d1d323fc9e33865ca3f3167cec15c43e891437caef4e9ab36d13

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite5.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-116c"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wBt0YJ1gr4fBxaV3hiP4k0AnSfsU9AXHIOCvuBeOIagZ2FBI%2BsxTDer1OK89b%2BJyUyjah733JQakIExM26aUYAw3RrDpqaNvauykwAFqOu%2BwbeLzH7jBbZ57YECs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6db49b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/sprite6.svg

188.114.96.1

200 OK

53 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite6.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
53 kB (52591 bytes)
Hash
577c76d3485408273e65c1f426004c12
564b0efe86ca0c405e7843e953d2608eb34157be
56e699128aff9d28a360999931de0694df469a397d1d73be4b263a1a3561d36b

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite6.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-2748"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GZEi%2FBTmwpcvwPMlLnXH2rrTyHhdXgGxNxZkfIx9ukDXkeRlPfpBtpoqlCMHsVgib%2FbvMSyjDIstXracCsVekDkNJgKAvXvhD2xsrAuIzXrnY0dlP%2BGw0R0SBFG1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6eb4bb4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/js/intlTelInput.min.js

188.114.96.1

200 OK

36 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/js/intlTelInput.min.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (26995)
Size
36 kB (35611 bytes)
Hash
5c903c8ffd747d2b7db2d362d573bff8
9c0a0caf1658891a03c6030b2a1cbe945719b420
b8f6de98e9dfdcfe1e69e2c779b2f03c2ef56116eedd6341bcee226d87819c6b

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/js/intlTelInput.min.js HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: application/javascript; charset=utf8
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-7351"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zcYnTUjmXRIBAzPRT1OlOvzqXuSy97aoOX86YCO8W9F1biaq22zSbhpBAcuAiFeMqu9%2BHoSv1eiHB5ESxAqsHqDlaGbN8KkF4Mom%2BvtPchsr8uxRg%2FeeOffKOYdg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e469feb4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/flags.png

188.114.96.1

200 OK

71 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/flags.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
PNG image data, 5652 x 15, 8-bit/color RGBA, non-interlaced
Size
71 kB (70857 bytes)
Hash
416250f60d785a2e02f17e054d2e4e44
21572c9751e5a3dc20395befa0fcb349c32c4811
0a012cf808a24573168308916092d2d4bd3f2b4af8e16b59167013cc77acee55

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/flags.png HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/l/gaz/css/bundle.e15e13582eb553ce5360.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/png
content-length: 70857
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: "64043bab-114c9"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4mRD68qmymSavxye4cANvYooRHAva3qRFrgEmR5KlZWwjRYR8SHEg02kpCxI3U6cOI0vMSbnmDsLNF8kbStZfCiUWGyDsn65DEPiK%2BLPNAjBnZyszt2owv2k3DMp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e94cb6b4ff-OSL
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/gaz-platform-preview_Moment.jpg

188.114.96.1

206 Partial Content

269 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/gaz-platform-preview_Moment.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, Exif Standard: [ - TIFF image data, big-endian, direntries=2], baseline, precision 8, 1280x720, components 3
Size
269 kB (269400 bytes)
Hash
014f995f08707c11acee3e1320ec13d7
8b6817cbcc45e6b1972ef221090de41e5c2bb634
166e7ea503e963f66d438d8a229949afd272cb3a1fd32c880edcc8fe577bc06d

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/gaz-platform-preview_Moment.jpg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 206 Partial Content
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/jpeg
content-length: 1564162
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: "64043bab-17de02"
expires: Sat, 25 May 2024 22:11:57 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21542
content-range: bytes 0-1564161/1564162
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KCcmEot2lXqa%2BTd2%2B9xPgXXkb%2B30OxZmrLSzWZxGTsiIga1MI%2BF9mlS8tdbfXrgDhRuAY3hK5aWuSLu2CH3n2fVHUn2drCsVvPY25wLrmHDrXMVaYr8aTTo3d2Xr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e99cd8b4ff-OSL
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/img2.svg

188.114.96.1

200 OK

5.3 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/img2.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
5.3 kB (5305 bytes)
Hash
53a632a7497ecd4803fb4208c9f6843a
c19a1766603c6a401b4352852fbdf6fda05f14a3
5c9c89052bff64e0821767b5219b15f86122901a8de1aec3d9a439cfe8c07ca7

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/img2.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-4c63"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Eux%2BAXiWrRUw1Km6yjFFNGvJAw3whMJVA2ixbUzIm%2FRSzel88yEb%2FYEsdBP0qtv4FBv2%2FJoZ3Jbq0D1kIEacyza79xhqRctzmqlxpCFazno2iAs%2BkZpIMM6E3f6M"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e449edb4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/css/errors.css

188.114.96.1

200 OK

13 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/css/errors.css
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
ASCII text
Size
13 kB (12896 bytes)
Hash
22a7d010505b33d89e8fe16bb6e7b99e
1d9dbe2cdcdac913fd51cfafa7b9d5d8fa51b5be
3aef2497637b734e03ad0aaff15ffcabf914ccaf430361324de236e53ca69f3d

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/css/errors.css HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: text/css
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-93c"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6n1LRbPRbMOSrfiM08ICWR5NuCKrA54Dxg1juPcQ1WEnc15wprt2SBkncj2FjV610zZh6fHfHnEUjggElOp2Cb8LbCJ4bnQNRpfzUm1M86p0zHjYs6oBA%2BbeYUcK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e449e3b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/sprite12.svg

188.114.96.1

200 OK

12 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite12.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
12 kB (11581 bytes)
Hash
1485211ad1d53b026e468cbf96d186b1
f3704e1e63a905b87060eb6a3b05a4a0d1f4b0ce
42d12b02a2081435a2156ddcc6f9f932e23b9e1c8f0ba7041558fc139c0f69fa

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite12.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-20cb"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qcGaaE0qeqKPisa7%2Fc30OacQqw7ZMZ7teQn2E4a8bYBx%2B%2BMyoaFo4y5FHqI0zs2rwc2g%2Bz7ajPhzLa2an1tWEIKQFxcVTf7aNHZ8O8rSKcy5xWgps8oO3AQYrOMq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6fb5cb4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/uniq

188.114.96.1

200 OK

4.9 kB

URL GET HTTP/3
r3fy6.shop/uniq
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
ASCII text, with no line terminators
Size
4.9 kB (4949 bytes)
Hash
444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /uniq HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.2.13
cache-control: private, must-revalidate
pragma: no-cache
expires: -1
set-cookie: sid=deleted; expires=Thu, 27 Apr 2023 04:10:58 GMT; Max-Age=0; path=/; httponly; samesite=lax
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZnPD4yQ3CqnKVIzyCD5sRFXsKUh%2F6%2FNu%2BMRkPNrtkTlR6LzFf9%2BdaOufTZQOw%2BQLijiBeFoZTmC56RvFCjLAhdNHl%2BbZU117i6leDJwUaxQw33jIqNfg6SSzPN4F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a3b9e6ab23b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

ipinfo.io/json

34.117.186.192

200 OK

280 B

URL GET HTTP/2
ipinfo.io/json
IP
34.117.186.192:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Requested by
https://r3fy6.shop/
Certificate
IssuerLet's Encrypt
Subjectipinfo.io
FingerprintC3:D1:C0:FE:0C:C8:E1:18:4F:C8:22:D0:9C:FF:D9:F4:EF:72:CD:6B
ValidityFri, 19 Apr 2024 20:17:23 GMT - Thu, 18 Jul 2024 20:17:22 GMT

File type
JSON text data
Size
280 B (280 bytes)
Hash
adf22d9a8ca3a97a9ff78909b8702358
f5046826566a7e98d6b5e5c7b0a65677c3bde708
756edd1454b049c1370e83c864bc93dfdd82f44d8f9752b3068e5a11867a5de3

HTTP Headers

GET /json HTTP/1.1
Host: ipinfo.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://r3fy6.shop/
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.24.0
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: application/json; charset=utf-8
content-length: 280
access-control-allow-origin: *
x-content-type-options: nosniff
x-envoy-upstream-service-time: 3
via: 1.1 google
strict-transport-security: max-age=2592000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3fy6.shop/l/gaz/img/favicon.ico

188.114.96.1

200 OK

887 B

URL GET HTTP/3
r3fy6.shop/l/gaz/img/favicon.ico
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
887 B (887 bytes)
Hash
213beed7102b1e9a334ca0e45a90870d
b92df83ff543e68aad4f796826ea93fbd45e7855
8d753707c334888732d902d8680d85a6cf1e458fcced2494875e9812eae03490

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/favicon.ico HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/x-icon
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-47e"
expires: Sat, 25 May 2024 22:11:57 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21542
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cZ2DHPuKy4BvmMy7Fq0rvNULQnZW77ttdY%2B5SrcQ6Zn7My%2FXwkp9AB8Zh4tUbfcQIXP9FYw8e0bisp4FS1K4iGysfePbLVw6qZ7UiRkWRiftrwHywZ4gBDO%2BWZdh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9ea9d50b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/sprite3.svg

188.114.96.1

200 OK

7.6 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite3.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
7.6 kB (7636 bytes)
Hash
f772a2c3f7fd89a8cdf974fd2ca17f33
5fe1a611a98559d40a179dfdd52798b70f6f9ddb
e1f2ece7be9caba38e3a609cd685202a69ca9ec1d402589a46be8fdbd31be35d

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite3.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-1dd4"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VAddBSWWYdET%2F2w948aVr8nmbhk4XBuDD5o3L%2FYZpFrDbb0HOEHehxlJ2BQzwjI%2B%2Fy4tmu9gZpwSiS6T2ZE9gzXVEbegrxapg3i6BBsgLbGAr1Iuenko0A0xz8ip"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6fb53b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

fonts.gstatic.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjtGyNL4U.woff2

216.58.207.227

200 OK

18 kB

URL GET HTTP/2
fonts.gstatic.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjtGyNL4U.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 18200, version 1.0
Size
18 kB (18200 bytes)
Hash
8c7519686a5ddf20a3981e660a5f2610
3e0d73d14e4892b36fb5c6a9854c7d2e6bec005a
caeaf02fa4a8a45438c270767c4e50fc7f3ed5f94a4c90984eaacb87c2e8a693

HTTP Headers

GET /s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjtGyNL4U.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 18200
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 02:56:03 GMT
expires: Fri, 25 Apr 2025 02:56:03 GMT
cache-control: public, max-age=31536000
age: 90896
last-modified: Wed, 27 Apr 2022 17:10:53 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 02:35:00 GMT
expires: Fri, 25 Apr 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 92159
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3fy6.shop/l/gaz/js/index.js

188.114.96.1

200 OK

992 B

URL GET HTTP/3
r3fy6.shop/l/gaz/js/index.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
JavaScript source, Unicode text, UTF-8 text, with very long lines (1017), with no line terminators
Size
992 B (992 bytes)
Hash
594f69439ec054e6ff377fc1e804e29f
445eec27acea68eff2e90e801f0572d1a39b82e7
eae8b4577a65b270ee87aec23788fb25d766055de730f75af9f139a90b03f43a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/js/index.js HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: application/javascript; charset=utf8
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-3e0"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sb8WI8MQxJsxCrZO2VcUZaX13OPSD46nMVrkM6IB4n5WMXzn1nz%2BmgJOuohom1K0mj280PdHanftRM0vfIXVzqZMzPQhDZXq5KiZxJwz1qgjeIF4LTvgI0NNfILs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e459fab4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.15/js/utils.js

104.17.25.14

200 OK

251 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/intl-tel-input/17.0.15/js/utils.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (1435)
Size
251 kB (251088 bytes)
Hash
badf39299033bb934da6325eea28ce72
bf68e8fd78007eb5539e08f0621a75c76c977f22
2c70f3d32d8ed2924ff688ad77a9b8f65663a433b5b0e5f4ba38879956961652

HTTP Headers

GET /ajax/libs/intl-tel-input/17.0.15/js/utils.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: application/javascript; charset=utf-8
content-length: 46616
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61a59596-b618"
last-modified: Tue, 30 Nov 2021 03:08:06 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 813964
expires: Wed, 16 Apr 2025 04:10:59 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ofq5hiJGGMTKCs9vPeND8aS9C%2Fd8Exarg%2FTPJUljzcfCTcRLVeF3ZVu4CnjY9nnixIrE93VxSgMoLOiopkBlNNifse%2FUnmjBSE9x%2FbYXB1lthM0dPL%2Bt45B%2BH0aYAx2N5uFqXCT%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 87a3b9e9d87856c5-OSL
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/image%2052.jpg

188.114.96.1

200 OK

42 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/image%2052.jpg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 480x564, components 3
Size
42 kB (41866 bytes)
Hash
f0c662297936ce98871f3893f31a8453
fb2739f2545cae2ca591259677416a9d5a91274d
f122b6d4e754445720d6231bee649a99cd53adeb131fabccb058cd9d5d21a68e

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/image%2052.jpg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/jpeg
content-length: 41866
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: "64043bab-a38a"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mkj2deQ43qmE2DhdrskHj8timJeBcHc54MTcqpZZqY%2Fausv1EVEldRKvoqHMc9wJhL2RtDvee8G3NAA8fdbJWS4EobZNcL6JxiEiWYyf7LAG3Vc99X9OrkQcxyXo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e459f7b4ff-OSL
alt-svc: h3=":443"; ma=86400

fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2

216.58.207.227

200 OK

27 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 26736, version 1.0
Size
27 kB (26736 bytes)
Hash
8404cfed82d322c1be8e149fd9f40eb8
3e3657246db3b889e68d520904ac294a230db56d
8f76526e440538ec1300aa89f671acd1b746925833f7160f6c0e29443008f97f

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 26736
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 17:30:29 GMT
expires: Fri, 25 Apr 2025 17:30:29 GMT
cache-control: public, max-age=31536000
age: 38430
last-modified: Thu, 14 Dec 2023 02:00:28 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3fy6.shop/l/gaz/img/sprite1.svg

188.114.96.1

200 OK

1.9 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite1.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
1.9 kB (1900 bytes)
Hash
faf11e7e9b672843ec985034750011da
b6a19a665f2909fdb7ed320e15ee9a3b5030b82c
16701c77b1ecd98f81456241913ba0e2efc81f96eccb2ab7f13dbde6215804be

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite1.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-76c"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d8uSCK6%2BA8dZS8cHwjHuR5guIfmHZIFuqit1ais7D1jeeCaiiNjmztLU7dBBmvxy8RgKwYfhtHDB81rI5cNN9o9b0L%2BjyvKqFyYyNnmhwVcvK%2BCQRu%2B2x%2B95Ah7L"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6fb59b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/sprite4.svg

188.114.96.1

200 OK

11 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite4.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
11 kB (10883 bytes)
Hash
eef5d4eb7bfe0b509764cce858ec1d2f
872c396247d1db1a2c915484095771640cd47244
e57a4152ea0e055f1bdd8f0336a7cd6c0df80dfc06a660f54bc64c19482ee643

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite4.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-2a83"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SeDX6h2RTZZUFIyKM%2BNneiPpKvOU0qyP8QjVvXatTLwmQaLIMP3MnaEC42jwMsdkgBKMTcKBkgh61j6MGsiMPQtmJWJEk1VNN99fDapi9R%2FRhRFsU4r8Uwjt0phx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6fb5ab4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/css/bundle.e15e13582eb553ce5360.css

188.114.96.1

200 OK

889 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/css/bundle.e15e13582eb553ce5360.css
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type

Size
889 kB (889339 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/css/bundle.e15e13582eb553ce5360.css HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: text/css
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-d91fb"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LXSIpaAPM%2FvGoFKTuG8EpveqQGDF0L2A%2FlEW%2BUBN2W%2BIsMqC0ZDNRsprt88aK9022g0ZQOwKG5n7TYEXDDYAk35ZIWj%2BRK%2FEAWt8QnUmFPeUtVRH9NyuF4xa8rMz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e449e4b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/img.svg

188.114.96.1

200 OK

60 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/img.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
60 kB (60346 bytes)
Hash
51120bbddd53794d1dd188eeacd1259c
ec43bc418d3644250cafeeada7d5d1133f60c4bb
4bd591ba5310c896b04e725fb1621dc2e66c3e57e97a160efb90848cb6146e70

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/img.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-ebba"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AEmyFSgR495pMA0DFrnwwM2gr%2B8Ayll2j61SXlt%2FFxgCWsCCrROIARAIsIL%2ByBLB%2Bx0Xg2k0gcPec%2FzPHvQgj9Bg1T2Uyb2nj5MVB63XHwBPwUixHNsa4aH1BAn3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e449e9b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/sprite11.svg

188.114.96.1

200 OK

17 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite11.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
17 kB (16735 bytes)
Hash
0d31c1df315404c74ab459b7dcdf0445
93182488675530bb2df97dd74acd47fd5f537ebd
ed1b1f5e3a2769494eec30f7c4d37a434861f8eef21280f23e4a1df95a35e654

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite11.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-415f"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J%2BiMwVbthtYJJCMYJ9mXC8GwKAf%2F4fSNqKw1LqWvQRINuLMkYxUEyytIhxtr2mwO4yHkwMbyRL1g6s3EZn5dvLQmNhdXn8Sy2sywNH6REJhvh%2FHBk6QWESDjp96A"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6eb4ab4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2

216.58.207.227

200 OK

27 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 26736, version 1.0
Size
27 kB (26736 bytes)
Hash
8404cfed82d322c1be8e149fd9f40eb8
3e3657246db3b889e68d520904ac294a230db56d
8f76526e440538ec1300aa89f671acd1b746925833f7160f6c0e29443008f97f

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 26736
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 17:30:29 GMT
expires: Fri, 25 Apr 2025 17:30:29 GMT
cache-control: public, max-age=31536000
age: 38430
last-modified: Thu, 14 Dec 2023 02:00:28 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3fy6.shop/l/gaz/js/landing_url2.js

188.114.96.1

200 OK

257 B

URL GET HTTP/3
r3fy6.shop/l/gaz/js/landing_url2.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
ASCII text, with no line terminators
Size
257 B (257 bytes)
Hash
f776ce66f65c39ec530a3bd2d09c9933
ebe59a2d5aaa6b873174e30e6e7f2cdfe7bcb2e4
4a2953bfe6a4596f47493279dd3f86935bf92e02cd00f6782245badb1c9991b2

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/js/landing_url2.js HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:58 GMT
content-type: application/javascript; charset=utf8
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-101"
expires: Sat, 25 May 2024 22:11:53 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21545
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gPX5Mefrc62g%2F4AbhoSdbezYqTRVunjr2MA4SwTjpa3Jxld4cNW88gomxIKTnZuDviTn3wywlvPnTyvuzeeUXvyUVc8sqwNNMBTZsG0EfAdLE8WDC9LJl9krTIBA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e46a02b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/sprite8.svg

188.114.96.1

200 OK

46 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite8.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
46 kB (45668 bytes)
Hash
df93c5e07081b864c87d0946fe166bd4
06376f1fadeacbf1d4425dbe6647d3c07eb654f4
9dd34c6d50df718d2bd6c5cc7d89733c3bed24cc3badb3ffef0f91cef47f4c5a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite8.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-b264"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hDSx7S6OvolX9dre%2FVyQexOC%2BOdArlHqktmdVhaujyWmybJeZ0GfrJ8RWMwps7SDZvHEUntYzkoVP7imV28rFXrxh3dELC8A%2FJMhXajWJekU8OR2vZHhvvcYFWxv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6fb52b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/videos/gaz-platform-preview.mp4

188.114.96.1

206 Partial Content

902 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/videos/gaz-platform-preview.mp4
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
ISO Media, MP4 v2 [ISO 14496-14]
Size
902 kB (901507 bytes)
Hash
c4e9bba645d2992aee1380a18bb2dc12
4fa6eed225164ffbd60eaa02c54a1816356e8de5
e78492d7f42d167b7c91d5167c549117f78e868965a7cd4266cdf42dd43a22e6

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/videos/gaz-platform-preview.mp4 HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Range: bytes=0-
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: video
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Accept-Encoding: identity
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 206 Partial Content
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: video/mp4
content-length: 33432152
last-modified: Sun, 05 Mar 2023 06:50:20 GMT
etag: "64043bac-1fe2258"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
content-range: bytes 0-33432151/33432152
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y8ymZf9C9%2BNYjZewEc5hvwrqsbsoIt67ouWB229gtiLfWX8OTGnK3h0L3qhbWWYaq6FViIsYzSP4zSEnOojlJIbn7Ps2d8e7uWWX3JDWcCHpJH20bwhKnaYDkyq9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e7dbacb4ff-OSL
alt-svc: h3=":443"; ma=86400

fonts.googleapis.com/css?family=Open+Sans:400,700,800|Ubuntu:400,500,700&display=swap&subset=cyrillic,cyrillic-ext,latin-ext

142.250.74.106

200 OK

23 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Open+Sans:400,700,800|Ubuntu:400,500,700&display=swap&subset=cyrillic,cyrillic-ext,latin-ext
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint15:CB:F7:AC:18:3F:DC:1E:F9:4E:94:D1:98:40:40:61:53:17:28:F2
ValidityMon, 18 Mar 2024 20:35:28 GMT - Mon, 10 Jun 2024 20:35:27 GMT

File type
ASCII text, with very long lines (1572)
Size
23 kB (23277 bytes)
Hash
bde226289812362a62c84ef7429458b6
2be4372515908a31cc206a73532e7a33a9457a83
39f1a91928f8e02d7e73a50cf4b418145902978de383df1f8119b93769170db9

HTTP Headers

GET /css?family=Open+Sans:400,700,800|Ubuntu:400,500,700&display=swap&subset=cyrillic,cyrillic-ext,latin-ext HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Fri, 26 Apr 2024 04:10:58 GMT
date: Fri, 26 Apr 2024 04:10:58 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

r3fy6.shop/l/gaz/img/sprite7.svg

188.114.96.1

200 OK

7.7 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite7.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
7.7 kB (7709 bytes)
Hash
9cd03b34315fb1d8b2e5ea5d645eb561
145842ca640d6b8b05396c0adb0b720e8dd0c97d
0c6a7f69a2b4cd2ee3d7536f54706d729b2da67633315499ee892d920b441d73

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite7.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-1e1d"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jo1P35g4h%2BodjhGFcYVZ5G%2Fr1aZGACTdsgSw%2B5RmppwMOO5dTVrvvmrEVOHX19%2BKYL%2F%2F03lU%2FyUomXEfDMw7t%2BrNIQuM31KfTBJ0XzhTDaew9p3Gw%2Bzxfe4XacSj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6eb4eb4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

r3fy6.shop/l/gaz/img/sprite9.svg

188.114.96.1

200 OK

3.1 kB

URL GET HTTP/3
r3fy6.shop/l/gaz/img/sprite9.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subjectr3fy6.shop
FingerprintF2:D0:3A:42:0D:AF:A6:95:72:3F:F0:5A:20:67:70:34:5E:38:F4:C2
ValidityMon, 01 Apr 2024 11:21:55 GMT - Sun, 30 Jun 2024 11:21:54 GMT

File type
SVG Scalable Vector Graphics image
Size
3.1 kB (3147 bytes)
Hash
a94d5ef8ada6b57084e1367ed8c26c63
2f7a0bf12410dabfee8c9213691a0a294aeaef24
b278a847c81a737362db49bcd557a8fc987f84d9cad706e2d6e33ba163891dc3

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Gazprom

HTTP Headers

GET /l/gaz/img/sprite9.svg HTTP/1.1
Host: r3fy6.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://r3fy6.shop/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 04:10:59 GMT
content-type: image/svg+xml
last-modified: Sun, 05 Mar 2023 06:50:19 GMT
etag: W/"64043bab-c4b"
expires: Sat, 25 May 2024 22:11:56 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 21543
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tKZXdJTBHANfSyOsTlZ7fPsyTA0Oy2gLkAXWQ0I5cEEN5wnIbrOheu0yzqnDWxsu4sJR%2BfLGSRa5FhLdsGQP0YGFs9vi6jKqRD44YkLX%2B0w26n3ssRRPz3oRgwVN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a3b9e6fb5bb4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 02:35:00 GMT
expires: Fri, 25 Apr 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 92159
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2

216.58.207.227

200 OK

35 kB

URL GET HTTP/2
fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://r3fy6.shop/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF5:5C:D9:68:C6:5F:A3:33:5A:73:C3:79:B6:83:FE:44:2E:A4:83:74
ValidityMon, 18 Mar 2024 20:34:25 GMT - Mon, 10 Jun 2024 20:34:24 GMT

File type
Web Open Font Format (Version 2), TrueType, length 34852, version 1.0
Size
35 kB (34852 bytes)
Hash
0e8eefb4549a2edf26c560cb9845952e
8d0b1718aacad934fd0043c87cbc54aa091396bf
7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a

HTTP Headers

GET /s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://r3fy6.shop
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 34852
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 25 Apr 2024 02:38:14 GMT
expires: Fri, 25 Apr 2025 02:38:14 GMT
cache-control: public, max-age=31536000
age: 91965
last-modified: Wed, 27 Apr 2022 16:31:23 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (11)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML