| challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback | 104.18.95.41 | 302 Found | 0 B |
URL challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback IP 104.18.95.41:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 14 Feb 2025 16:49:40 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/b/324d0dcf743c/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 911e8d845cb5b50b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js | 104.17.25.14 | 200 OK | 14 kB |
URL GET HTTP/3cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js IP 104.17.25.14:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32 ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File typeJavaScript source, ASCII text, with very long lines (48316), with no line terminators Hash2ca03ad87885ab983541092b87adb299 1a17f60bf776a8c468a185c1e8e985c41a50dc27 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:49:40 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 156251
expires: Wed, 04 Feb 2026 16:49:40 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2tbLvMscZbJ2QMz5M%2FstGlbmgewzoU4gbu4W7GZu4tv9n2InY3jxzn6FrG5IxvAaLpkymvy3veyzROD3qeIg8Tc4aY3vlPn%2BrQUJHCfxqvky%2B3PY1gAAz44C0VEkNBlpsI8lynDY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911e8d845e96b527-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| q2berjupvxdohax90gif.brightnexst.ru/pax6lf1/%23%23nregena.umberger@slurpmail.net | 172.67.146.141 | 200 OK | 57 kB |
URL q2berjupvxdohax90gif.brightnexst.ru/pax6lf1/%23%23nregena.umberger@slurpmail.net IP 172.67.146.141:0
File typeHTML document, ASCII text, with very long lines (65295) Hash71e0f5bff3a4beae9009c1131d54e55b 9d72f4aa87b8ad693789c868d4f4a575521fbc06 7f422ddbbc9e8debbca80ffa8bb029775c307114bd7e7d5f2a5f750351d330ce
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft | urlquery | phishing | Phishing - Microsoft Outlook |
GET /pax6lf1/%23%23nregena.umberger@slurpmail.net HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:49:40 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DVcfimlVrHT1d07lRb%2BieCBFtJsTBSfOogeGGfKceL7HpKMHHOYD0vdKRlBr6Jt0dIYhAf7njaC10XRPzZQmYud68DZC2tBUQOw07eUX1l8ogwFMN9iA7LR6CvPhSg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6Ik1IVkprcWF4VTE1amwrYTlpRi93YlE9PSIsInZhbHVlIjoiVk5RZUQxMTVaMy8zZDIxellOLzl2K040eEt5TmltdVFFalMzS1N1UXZzYUZFRUgyTkpRZnFUVS9RTjhwaFdEc1FGM09KL0tNbG5GUjVrNFBKbW5YUTN6dXcwOC84VmZPWko3bENncU1ZM3BlOUdzV0F6b2FXdUNpYW1ONWdYcHMiLCJtYWMiOiIxYjFlOGZmOTU4NTZlYjI2NTgwNDQ3YTY5NzNhZWJmM2Q5ZjU5ZGZlMWI2YjdlMjg1MjQwZjM0M2NkNDkyODZkIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:40 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6Ilg1SS91V1Q4c090NVJYRW0zdmVMMkE9PSIsInZhbHVlIjoiNWdLcVJFWWpZK2NJQ0lSVHh6Q0VqNGx0Z2lkc1JyVG10Nk94b1hHNjNPcU9OUWIvdGdxdnI3UVQwNURWZ2d2Ym4xMWtYWm5UTkNUNDZIZ1pWTTd6M3R2MEM2REM5NEk0ZnZBZGNSc1NzS1krYmI3aEU3S0dtUjFVZFdvelNGdjAiLCJtYWMiOiIwZGE0NzgwOWE3NjMxNWI5NThjNzY0YzdhZjA3MmJlNWM1NmYzZDRjNjc1MTc2NmIxMTA0Nzc3OWQwYzZiMmVjIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:40 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 911e8d807c8e1bfe-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1300&min_rtt=1145&rtt_var=593&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=1456&delivery_rate=1585980&cwnd=247&unsent_bytes=0&cid=38fd96518ac4c168&ts=123&x=0", cfL4;desc="?proto=TCP&rtt=5997&min_rtt=522&rtt_var=10994&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3205&recv_bytes=1172&delivery_rate=7325463&cwnd=254&unsent_bytes=0&cid=a1dc38541abc2eab&ts=230&x=0"
X-Firefox-Spdy: h2
|
|
| developers.cloudflare.com/favicon.png | 104.16.5.189 | 200 OK | 937 B |
URL developers.cloudflare.com/favicon.png IP 104.16.5.189:0
File typePNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced Hashfc3b7bbe7970f47579127561139060e2 3f7c5783fe1f4404cb16304a5a274778ea3abd25 85e6223afdbd5badf2c79bcfbaa6fe686acaa781eca52c196647ffabb3be2ffe
GET /favicon.png HTTP/1.1
Host: developers.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:49:40 GMT
content-type: image/png
content-length: 937
cache-control: public, max-age=0, must-revalidate
etag: "6be7ff94b6151f8cfbf08b53a17e2ac1"
set-cookie: __cf_bm=yDVJe0mUEbTvVgMGk5Ph.NIDNXdA7udxbAmRsNcenYE-1739551780-1.0.1.1-4HJhAWnhVcFckCo5LrgvNATI8CsVdw_kTMNWCjNGHjM9BKH4PwOCnmaQghtum2gvNjAQFmWfmnl8NspX4IjyqQ; path=/; expires=Fri, 14-Feb-25 17:19:40 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: cloudflare
cf-ray: 911e8d85fef00b31-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js | 104.18.95.41 | 200 OK | 24 kB |
URL challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js IP 104.18.95.41:0
File typeJavaScript source, ASCII text, with very long lines (48138) Hash59306e15eb43de76a56231e5e426ec80 7606b8e4aeace12b393ad6dcebdf6d64bc7240e9 69865fe9be4f6cdced3ca8c047a486db063f1179846f5edff395c39a7494fa34
GET /turnstile/v0/b/324d0dcf743c/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:49:40 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 11 Feb 2025 23:52:12 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 911e8d847cf5b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| code.jquery.com/jquery-3.6.0.min.js | 151.101.130.137 | 200 OK | 31 kB |
URL GET HTTP/2code.jquery.com/jquery-3.6.0.min.js IP 151.101.130.137:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5 ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 14 Feb 2025 16:49:50 GMT
age: 793448
x-served-by: cache-lga21931-LGA, cache-hel1410020-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 29024
x-timer: S1739551791.564455,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
|
|
| q2berjupvxdohax90gif.brightnexst.ru/pax6lf1/%23%23nregena.umberger@slurpmail.net | 172.67.146.141 | 200 OK | 22 kB |
URL q2berjupvxdohax90gif.brightnexst.ru/pax6lf1/%23%23nregena.umberger@slurpmail.net IP 172.67.146.141:0
File typeHTML document, ASCII text, with very long lines (9997), with CRLF line terminators Hashc33f2d8d5e3dec35229f6b79461c43bb ca885f14eb59b32c2db3d30b63e72609937bde37 c617c90375657b7580718cbe22549628373a2249926df71479d515827a35e297
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft | urlquery | phishing | Phishing - Microsoft Outlook |
GET /pax6lf1/%23%23nregena.umberger@slurpmail.net HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjY0UG5IMW41c2U2dmxnUWlyUitnQ0E9PSIsInZhbHVlIjoiUnlzQ2c5dFpXMC9aVy9ZeXN1anJkVlQ0MDh6WU0vRWUrZi8zU2NabkVaNkI3M3ZBSE5YSmJ1Q1Y1eGhzSjg1eStQOG4rWG11aktXcWYyY1FUcWhVSEg4anQ3WjA3NzZITTM5ZWw3a3k4c2R0ZlpTblFEckFPRlhzT2lORlNrbU0iLCJtYWMiOiJmYTE3MzQzYjcyM2E4NzQ2OWUwOWYxZGI0MjI0ZmEwZjI1NzNkNzE1NzNhYTVjNmQyNDhjYzQ0YWFmNmRhNTkxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IitQNWlVNGRHZUxaYWI2UE90STNVN1E9PSIsInZhbHVlIjoiNnoyU3hQSWo1czdnbTZ4VnJwQlQvVHlHMGZlaWRTcmlmOUJyTjB4blB4S09IV2J0bGFaUk1oWCtIcXlhY3c2aUNVWVBnNHVQdlFST05tczJsOXBuaFdIdXAxa05PU2xMSUdZNElQMkluMFUwRm4rYytIcUx4ZzNlbEREajkxVUkiLCJtYWMiOiJmZDI5NGM1Yzg0ZTlhNTVlYjMwMjc1NzcxNTgzNjM5MDc2NjM1NzhjMGZlMzdlZDkzNDcyOTBiNmI1ZTYzZDdjIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:50 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QqjWFVft%2B7T%2Fgvs92APqFAZv4wmBBYhgJhHLge8298EdVKcRFWNO64prUpdSSZFCmAlkfq54qfLjHxjYSLDomWdoKbMy%2FRbMQHCYu8R12Bvf53sqyCzADYdH0rgDGA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IkZBSWZsa2VudzB6T2xFNXRIY3AzaHc9PSIsInZhbHVlIjoiNThnL2xqK0tqMEI4MkhYaHp3Zy9iMFJjSFVlRk1vZzZmOGI5akgxeXdQS1B1eC8vaWFHRlMwUEVhSlJkZXdwdk5JdDZVZnFQalpQYWpFMG5sUk9Ic3AxMmdKb0lvZzZTKzJvSTcza3BnYk04NjVIZlBKa3o3NGkyZFUveHYwcisiLCJtYWMiOiI5NGNjMjY3NDQzMjAzMTg5OGE4OGNlYTQ0MzU0MmVjNjAzNGMzOWIxNjcwNTlhZDY5MmM2ZWY3OWMxODA5ZTdlIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:50 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6Ik1qRkVaZE5uZy8zK011czBXRHo3L0E9PSIsInZhbHVlIjoiekkreDVQWkVpdkpERXVjK2Vqd3BpUHJxdXlTeGpIVVFzTy9lYkxBcWtIVncwcHhJczdJSzZpZE52bVU4ZUJJeWV4Z0pNK3FQV2JEZEx0akgrUDJMUEdGRHBlMi9qSGxSTzF0ajY4TFRRTzNJcisxc1VDL2hWcTBta1lHV0p1ckYiLCJtYWMiOiIwNzBjYTA0ODk4NTlkN2JmYmFjYTBlNDIwOWUyODkxOTJhNzgzOTRmNWM5NWI3NmUzOWY2MGNjYTFiMzI0ODIyIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:50 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 911e8dc1ac0e5687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1852&min_rtt=1760&rtt_var=574&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2208&delivery_rate=1637083&cwnd=251&unsent_bytes=0&cid=f04db65c52a14a19&ts=111&x=0", cfL4;desc="?proto=QUIC&rtt=4747&min_rtt=2312&rtt_var=2663&sent=16&recv=11&lost=0&retrans=0&sent_bytes=5757&recv_bytes=3867&delivery_rate=160&cwnd=12000&unsent_bytes=0&cid=59237dde8255af83&ts=10369&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js | 104.17.25.14 | 200 OK | 14 kB |
URL GET HTTP/3cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js IP 104.17.25.14:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32 ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File typeJavaScript source, ASCII text, with very long lines (48316), with no line terminators Hash2ca03ad87885ab983541092b87adb299 1a17f60bf776a8c468a185c1e8e985c41a50dc27 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 156262
expires: Wed, 04 Feb 2026 16:49:51 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V19c6cUThBlzle9vW0J8PhxYrc3VVXZnAOQvo%2FGJIQ6AR%2BSn9LmyrHgwf9qgUpdc00uxkkm%2B%2F9sIakvwJsn9MwSF9OJ1Mv3Wu3U8OZ1DO7N%2ByxlshL4FD%2BHiBPdXUISUV8ny1e1N"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911e8dc7a8950b4d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| code.jquery.com/jquery-3.6.0.min.js | 151.101.130.137 | 200 OK | 31 kB |
URL GET HTTP/2code.jquery.com/jquery-3.6.0.min.js IP 151.101.130.137:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5 ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 14 Feb 2025 16:49:51 GMT
age: 793449
x-served-by: cache-lga21931-LGA, cache-hel1410020-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 29026
x-timer: S1739551791.316235,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
|
|
| ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 | 143.204.55.87 | 200 OK | 11 kB |
URL GET HTTP/2ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 IP 143.204.55.87:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerDigiCert Inc Subject*.oktacdn.com Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5 ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File typePNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced Hash12bdacc832185d0367ecc23fd24c86ce 4422f316eb4d8c8d160312bb695fd1d944cbff12 877ae491d9aac5c6ef82a8430f9f652ace8a0dbc7294bd112aad49bd593769d0
GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/png
content-length: 10796
server: nginx
last-modified: Tue, 23 Feb 2021 04:20:08 GMT
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
date: Wed, 29 Jan 2025 00:59:17 GMT
expires: Thu, 29 Jan 2026 00:59:17 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: "12bdacc832185d0367ecc23fd24c86ce"
x-cache: Hit from cloudfront
via: 1.1 6480520a5e02f3163410e3134bd77baa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: o_JF4eRczU9B9ovoLJhVU8WU9WlS4RyLuRsrVjQB3iNF_gQD9DMTgA==
age: 1439434
X-Firefox-Spdy: h2
|
|
| q2berjupvxdohax90gif.brightnexst.ru/qrkx8dSV1fawZUXvAfoFoghmEZ4HpblNGKfMpms45139 | 172.67.146.141 | 200 OK | 892 B |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/qrkx8dSV1fawZUXvAfoFoghmEZ4HpblNGKfMpms45139 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeRIFF (little-endian) data, Web/P image Hash41d62ca205d54a78e4298367482b4e2b 839aae21ed8ecfc238fdc68b93ccb27431cd5393 20a4a780db0bcc047015a0d8037eb4eb58b3e5cb338673799c030a3e1b626b40
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /qrkx8dSV1fawZUXvAfoFoghmEZ4HpblNGKfMpms45139 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: image/webp
content-length: 892
content-disposition: inline; filename="qrkx8dSV1fawZUXvAfoFoghmEZ4HpblNGKfMpms45139"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VZjcZGgnRJoKKP8olnkhkiPbIfLsosqn0rNu8IgPA%2B0mF%2FSwS%2Bb%2B9eMzsJE7WopOIVuOboneed%2Bt%2BZRQyOjupuu4uaaPloKEoIz0bDBxfvO2G3mKXlSPWBbEzKy2hQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dc7dfbe5687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1552&min_rtt=1534&rtt_var=467&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2243&delivery_rate=1742478&cwnd=251&unsent_bytes=0&cid=37666d7f8c35917e&ts=84&x=0", cfL4;desc="?proto=QUIC&rtt=2173&min_rtt=970&rtt_var=1359&sent=127&recv=49&lost=0&retrans=0&sent_bytes=98997&recv_bytes=25401&delivery_rate=2652115&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11367&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/wx99Q7hWiVI78zBcB8pimxOnqrXogamr0j1rFRpwsu34123 | 172.67.146.141 | 200 OK | 644 B |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/wx99Q7hWiVI78zBcB8pimxOnqrXogamr0j1rFRpwsu34123 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeRIFF (little-endian) data, Web/P image Hash541b83c2195088043337e4353b6fd60d f09630596b6713217984785a64f6ea83e91b49c5 2658b8874f0d2a12e8726df78ac8954324c3bbe4695e66bdef89195fde64322f
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /wx99Q7hWiVI78zBcB8pimxOnqrXogamr0j1rFRpwsu34123 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: image/webp
content-length: 644
content-disposition: inline; filename="wx99Q7hWiVI78zBcB8pimxOnqrXogamr0j1rFRpwsu34123"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MMshNDCMZSlJEP9bN7trP8z6ItAumgZ9oT4ywMM8qKefI%2FOtwE9Xmr9PbIa2L3K7k%2FjUPfckv0d3ELNX6iKFd01TPBJtuzpyLPBezRlbvmiPZWgnyIZ8LThU4FfGjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dc7dfb75687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1365&min_rtt=1259&rtt_var=415&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2246&delivery_rate=2140428&cwnd=251&unsent_bytes=0&cid=2598a80da25dc908&ts=96&x=0", cfL4;desc="?proto=QUIC&rtt=2107&min_rtt=970&rtt_var=1143&sent=132&recv=51&lost=0&retrans=0&sent_bytes=103882&recv_bytes=25492&delivery_rate=244568&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11378&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-bold.woff2 | 172.67.146.141 | 200 OK | 28 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-bold.woff2 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 28000, version 1.66 Hasha4bca6c95fed0d0c5cc46cf07710dcec 73b56e33b82b42921db8702a33efd0f2b2ec9794 5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-bold.woff2 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: font/woff2
content-length: 28000
content-disposition: inline; filename="GDSherpa-bold.woff2"
cache-control: max-age=14400
cf-cache-status: MISS
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6XNcmjZzp7PhnN31nrujIh3cPLoeZIxRdBDVJn47is3pFK6r37572mS7hpYraDF9TsCVxmNXg1E50q5Slu%2BgcSU8eVJXMFyuMwGgjZ704WWTVR4f6MrroS1nJBaErg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dc7bf625687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1447&min_rtt=1436&rtt_var=561&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2241&delivery_rate=1896529&cwnd=244&unsent_bytes=0&cid=77c6ff3b8d9f7e0a&ts=141&x=0", cfL4;desc="?proto=QUIC&rtt=1949&min_rtt=970&rtt_var=730&sent=150&recv=54&lost=0&retrans=0&sent_bytes=123242&recv_bytes=25628&delivery_rate=6652233&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11407&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js | 140.82.121.3 | 302 Found | 0 B |
URL GET HTTP/2github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js IP 140.82.121.3:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerSectigo Limited Subjectgithub.com FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: GitHub.com
date: Fri, 14 Feb 2025 16:48:29 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-length: 0
x-github-request-id: CE73:38EA8B:28A3E08:299A945:67AF742F
X-Firefox-Spdy: h2
|
|
| q2berjupvxdohax90gif.brightnexst.ru/opjWPBkGJrsuMPK2A2qSyaRhvPynYFBpQiuvebrVOKgC2AThYvQvXku3BKcd240 | 172.67.146.141 | 200 OK | 9.6 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/opjWPBkGJrsuMPK2A2qSyaRhvPynYFBpQiuvebrVOKgC2AThYvQvXku3BKcd240 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeRIFF (little-endian) data, Web/P image Hash4946eb373b18d178c93d473489673bb6 16477acb73b63ca251d37401249e7e4515febd24 666bc574c9f3fb28a8ac626fa8105c187c2a313736494a06bd5a937473673c92
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /opjWPBkGJrsuMPK2A2qSyaRhvPynYFBpQiuvebrVOKgC2AThYvQvXku3BKcd240 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: image/webp
content-length: 9648
content-disposition: inline; filename="opjWPBkGJrsuMPK2A2qSyaRhvPynYFBpQiuvebrVOKgC2AThYvQvXku3BKcd240"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oLA21JTtFl4pTx5%2FFhMxTaKQPj1i2so35Lsodm5USLnUf05HrFhtufffVGZwre9tu096Ze0%2BWdSU0oUmjfYHOWrs4X7yASVFRWfpqSNHLkJ8lz4mPBpuGWhmtSplZA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dc8081f5687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1732&min_rtt=1510&rtt_var=621&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2262&delivery_rate=1907773&cwnd=249&unsent_bytes=0&cid=6a1745a90aab68af&ts=86&x=0", cfL4;desc="?proto=QUIC&rtt=1850&min_rtt=970&rtt_var=588&sent=191&recv=56&lost=0&retrans=0&sent_bytes=170209&recv_bytes=25720&delivery_rate=3565328&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11440&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/uvJ0fW4hhMiAodHB6TTMTovClC1G1cl8tE41zAJh4gMmnF0pejqfKMRbnHlfuRo2bG4u1sTypMOXPiQKC3Vmgh258 | 172.67.146.141 | 200 OK | 18 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/uvJ0fW4hhMiAodHB6TTMTovClC1G1cl8tE41zAJh4gMmnF0pejqfKMRbnHlfuRo2bG4u1sTypMOXPiQKC3Vmgh258 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeRIFF (little-endian) data, Web/P image Hash4b52ecdc33382c9dca874f551990e704 8f3bf8e41cd4cdddb17836b261e73f827b84341b cce050cc3b150c0b370751021bb15018ee2b64ac369e230fe3b571a9b00d4342
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /uvJ0fW4hhMiAodHB6TTMTovClC1G1cl8tE41zAJh4gMmnF0pejqfKMRbnHlfuRo2bG4u1sTypMOXPiQKC3Vmgh258 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: image/webp
content-length: 17842
content-disposition: inline; filename="uvJ0fW4hhMiAodHB6TTMTovClC1G1cl8tE41zAJh4gMmnF0pejqfKMRbnHlfuRo2bG4u1sTypMOXPiQKC3Vmgh258"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sb%2ByQC50qNEYUWqEW1HZZf4Xabw29%2BE9vszNRLlWVQJDqo8XmmvZHugUUiDsRHLScb%2Bb42JGXrGYY0hEpVlDsJha8eZbGZMQDItHNpgYNP24knyr%2BUS%2BeQZd5V6OTw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dc8082c5687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1080&min_rtt=1064&rtt_var=327&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2288&delivery_rate=2549295&cwnd=251&unsent_bytes=0&cid=a06c148c18037305&ts=95&x=0", cfL4;desc="?proto=QUIC&rtt=1989&min_rtt=970&rtt_var=867&sent=138&recv=53&lost=0&retrans=0&sent_bytes=109092&recv_bytes=25583&delivery_rate=1576875&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11401&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-bold.woff | 172.67.146.141 | 200 OK | 36 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-bold.woff IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeWeb Open Font Format, TrueType, length 35970, version 1.0 Hash496b7bbde91c7dc7cf9bbabbb3921da8 2bd3c406a715ab52dad84c803c55bf4a6e66a924 ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-bold.woff HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: font/woff
content-length: 35970
content-disposition: inline; filename="GDSherpa-bold.woff"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NGWJ0tJaotMyBBh530GcwYfe5Zf9b3K3kNJsuIusQaSmq1PwUVPTxNyVS4nW4crKxCfT8ca5tZpTdFehGpFxz1XXipuV0vdSRBMN2jCO8qvmsnyuLYWSX9E5l3U%2BPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dc7cf6a5687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1396&min_rtt=1322&rtt_var=502&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2239&delivery_rate=1751966&cwnd=251&unsent_bytes=0&cid=38e99b92661f8156&ts=178&x=0", cfL4;desc="?proto=QUIC&rtt=1772&min_rtt=970&rtt_var=501&sent=209&recv=60&lost=0&retrans=0&sent_bytes=188568&recv_bytes=25902&delivery_rate=2819091&cwnd=34800&unsent_bytes=0&cid=59237dde8255af83&ts=11478&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-regular.woff2 | 172.67.146.141 | 200 OK | 29 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-regular.woff2 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 28584, version 1.66 Hash17081510f3a6f2f619ec8c6f244523c7 87f34b2a1532c50f2a424c345d03fe028db35635 2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-regular.woff2 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: font/woff2
content-length: 28584
content-disposition: inline; filename="GDSherpa-regular.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FrTKBPehe5WBSeS6d4Mda7hTmJltdKWaqJq3NP2y27PpjjJBzIyj5LU3Uhv61FfGgTvrmDeUGcVdGFBN923bY%2BNOMuMbqBVyqmVRv1nFEogM4Ioddsnvnj3VaK1Jpg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dc7cf7a5687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1143&min_rtt=1134&rtt_var=443&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2242&delivery_rate=2397350&cwnd=251&unsent_bytes=0&cid=f56d7601cfc7e805&ts=176&x=0", cfL4;desc="?proto=QUIC&rtt=1772&min_rtt=970&rtt_var=501&sent=236&recv=60&lost=0&retrans=0&sent_bytes=220825&recv_bytes=25902&delivery_rate=2819091&cwnd=34800&unsent_bytes=0&cid=59237dde8255af83&ts=11478&x=1", cfExtPri, cfHdrFlush;dur=1
|
|
| q2berjupvxdohax90gif.brightnexst.ru/ghznydYXH70BSxiynbJjRDwmnH7NZpZu2vl9MgvsMtfyoOoMBx12204 | 172.67.146.141 | 200 OK | 25 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/ghznydYXH70BSxiynbJjRDwmnH7NZpZu2vl9MgvsMtfyoOoMBx12204 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeRIFF (little-endian) data, Web/P image Hashf9a795e2270664a7a169c73b6d84a575 0fbb60ab27ab88c064eb347d0722c8ed4cf5e8b8 d00203b2eea6e418c31baafa949ada5349a9f9b7e99fa003aec7406822693740
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /ghznydYXH70BSxiynbJjRDwmnH7NZpZu2vl9MgvsMtfyoOoMBx12204 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: image/webp
content-length: 25216
content-disposition: inline; filename="ghznydYXH70BSxiynbJjRDwmnH7NZpZu2vl9MgvsMtfyoOoMBx12204"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wSxom7jfpPMmfL8p7mZr6xLOXxXZx9jIqt9uJE%2BQTFISgEU5LWq4vSo9Fp9Amm5gCsqQKBt14SgelFfDvY1jky7QqX7BMWx7tRh5mu6mnPg8XLIeQ%2BLgAEz%2B21V1wg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dc808175687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1019&min_rtt=1001&rtt_var=316&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2254&delivery_rate=2590339&cwnd=251&unsent_bytes=0&cid=30177fe2b998c98e&ts=133&x=0", cfL4;desc="?proto=QUIC&rtt=1850&min_rtt=970&rtt_var=588&sent=179&recv=56&lost=0&retrans=0&sent_bytes=156130&recv_bytes=25720&delivery_rate=3565328&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11439&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-regular.woff | 172.67.146.141 | 200 OK | 37 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-regular.woff IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeWeb Open Font Format, TrueType, length 36696, version 1.0 Hasha69e9ab8afdd7486ec0749c551051ff2 c34e6aa327b536fb48d1fe03577a47c7ee2231b8 fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-regular.woff HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: font/woff
content-length: 36696
content-disposition: inline; filename="GDSherpa-regular.woff"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I9MEvPYej8JU3QtYWdlTCKPLlizO5GGN2ZD%2BV3SrNPs0A6NB1bNc76Lal1MfjH8acwGvoPNZqeKKB2l1Fop8c1a%2FL93TfAabPnpLjh9V46AieaMQH1IkN5OoLMRmcw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dc7df975687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1170&min_rtt=1123&rtt_var=399&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2243&delivery_rate=2169288&cwnd=251&unsent_bytes=0&cid=ea16d831dff64eb4&ts=182&x=0", cfL4;desc="?proto=QUIC&rtt=1761&min_rtt=970&rtt_var=387&sent=279&recv=63&lost=0&retrans=0&sent_bytes=269139&recv_bytes=26041&delivery_rate=1996230&cwnd=76800&unsent_bytes=0&cid=59237dde8255af83&ts=11490&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-vf.woff2 | 172.67.146.141 | 200 OK | 44 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-vf.woff2 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 43596, version 1.0 Hash2a05e9e5572abc320b2b7ea38a70dcc1 d5fa2a856d5632c2469e42436159375117ef3c35 3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-vf.woff2 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: font/woff2
content-length: 43596
content-disposition: inline; filename="GDSherpa-vf.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ycJ9CNVVlOeesfzAGhK%2BT5hGfNHF%2BDw1YEqJPc3sXOw%2BhJGwGSJtRgWaYd1hR66JiF9xJRk7sJTODU%2F27lrC0C6olB0bZSmYJx0%2F3wS18d%2BBlVXWUGKoRvPdGI9eQw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dc7dfa25687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1023&min_rtt=1014&rtt_var=399&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2239&delivery_rate=2654445&cwnd=247&unsent_bytes=0&cid=c5fe161a2da944bb&ts=212&x=0", cfL4;desc="?proto=QUIC&rtt=2057&min_rtt=970&rtt_var=929&sent=321&recv=67&lost=0&retrans=0&sent_bytes=316460&recv_bytes=26224&delivery_rate=2885827&cwnd=76800&unsent_bytes=0&cid=59237dde8255af83&ts=11565&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-vf2.woff2 | 172.67.146.141 | 200 OK | 93 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-vf2.woff2 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 93276, version 1.0 Hashbcd7983ea5aa57c55f6758b4977983cb ef3a009e205229e07fb0ec8569e669b11c378ef1 6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-vf2.woff2 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: font/woff2
content-length: 93276
content-disposition: inline; filename="GDSherpa-vf2.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sRQs5qVeQeWqh8nSon8fRQD%2BcYCDIVn6ey%2BRQiVGwirh%2BZNGZ9wncJDhq6osmQioAg7YTsK28ZyFaNj7nbOQ3xsS7Nh7gy8s0OPmgRrAwkuhKsqFGb%2Fw71icTtG%2Fjw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dc7dfb35687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1541&min_rtt=1495&rtt_var=593&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2240&delivery_rate=1937123&cwnd=251&unsent_bytes=0&cid=f897b4f2d6da7b46&ts=227&x=0", cfL4;desc="?proto=QUIC&rtt=2010&min_rtt=970&rtt_var=791&sent=359&recv=68&lost=0&retrans=0&sent_bytes=361998&recv_bytes=26270&delivery_rate=12426597&cwnd=76800&unsent_bytes=0&cid=59237dde8255af83&ts=11574&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream | 185.199.108.133 | 200 OK | 10 kB |
URL GET HTTP/2objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream IP 185.199.108.133:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerDigiCert Inc Subject*.github.io Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28 ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (10017) Hash6c20a2be8ba900bc0a7118893a2b1072 ff7766fde1f33882c6e1c481ceed6f6588ea764c b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500
GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Tue, 07 Dec 2021 16:38:45 GMT
etag: "0x8D9B9A009499A1E"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d91f6eaf-e01e-0032-2f18-13e122000000
x-ms-version: 2023-11-03
x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT
x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=randexp.min.js
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
date: Fri, 14 Feb 2025 16:49:52 GMT
age: 4133
x-served-by: cache-iad-kiad7000045-IAD, cache-hel1410034-HEL
x-cache: HIT, HIT
x-cache-hits: 11369, 10
x-timer: S1739551792.696645,VS0,VE0
content-length: 10245
X-Firefox-Spdy: h2
|
|
| ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 | 143.204.55.87 | 200 OK | 20 kB |
URL GET HTTP/2ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 IP 143.204.55.87:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerDigiCert Inc Subject*.oktacdn.com Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5 ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 20416, version 2.197 Hashd99a7377dabb55772ca9f986b0a04b57 2b5fcd8431953c44e410d0489899e74f6d2cfecc affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149
GET /assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://q2berjupvxdohax90gif.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20416
date: Mon, 27 Jan 2025 07:42:18 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:56:28 GMT
etag: "d99a7377dabb55772ca9f986b0a04b57"
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
expires: Tue, 27 Jan 2026 07:42:18 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 6480520a5e02f3163410e3134bd77baa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: aqokprUNXtmwtRznc5VrrnSRz5drnKZB5lvuMy47d_60PhG0x2RltA==
age: 1588054
X-Firefox-Spdy: h2
|
|
| q2berjupvxdohax90gif.brightnexst.ru/klTOVIxBKjplGT1LRRVfJGajV4LT17OBligTAVSAsiItwynops4PzlHmPFQQDR1HbmRVyz230 | 172.67.146.141 | 200 OK | 1.3 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/klTOVIxBKjplGT1LRRVfJGajV4LT17OBligTAVSAsiItwynops4PzlHmPFQQDR1HbmRVyz230 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeRIFF (little-endian) data, Web/P image Hash32ca2081553e969f9fdd4374134521ad 7b09924c4c3d8b6e41fe38363e342da098be4173 216fc342a469aa6a005b2eacc24622095e5282d3e9f1ae99ce54c27b92ec3587
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /klTOVIxBKjplGT1LRRVfJGajV4LT17OBligTAVSAsiItwynops4PzlHmPFQQDR1HbmRVyz230 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/webp
content-length: 1298
content-disposition: inline; filename="klTOVIxBKjplGT1LRRVfJGajV4LT17OBligTAVSAsiItwynops4PzlHmPFQQDR1HbmRVyz230"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O%2Bmod68hmwczlqzl7cE5YnNkxyikT0wP%2F1wfvK7aNMM89G%2FolfteizNm0T5TOuT2zmaBKtuOJB86hJ3Rov1kyYvDpLKy%2F19cP3TRlqN0tbQwiTcv3PSkhgYXGY5ALQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dceabd05687-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1489&min_rtt=1460&rtt_var=469&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2272&delivery_rate=1708554&cwnd=251&unsent_bytes=0&cid=6d0143b63b5797fb&ts=83&x=0", cfL4;desc="?proto=QUIC&rtt=1523&min_rtt=687&rtt_var=994&sent=862&recv=130&lost=0&retrans=0&sent_bytes=929810&recv_bytes=32072&delivery_rate=20427&cwnd=153600&unsent_bytes=0&cid=59237dde8255af83&ts=12417&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css | 143.204.55.87 | 200 OK | 10 kB |
URL GET HTTP/2ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css IP 143.204.55.87:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerDigiCert Inc Subject*.oktacdn.com Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5 ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File typeASCII text, with very long lines (10450) Hashe0d37a504604ef874bad26435d62011f 4301f0d2b729ae22adece657d79eccaa25f429b1 c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179
GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Thu, 14 Mar 2024 00:03:58 GMT
x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Fri, 31 Jan 2025 02:19:39 GMT
expires: Sat, 31 Jan 2026 02:19:39 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6480520a5e02f3163410e3134bd77baa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: mLf6ZN-0W7I0pu7PxJmVpAvlY2x-gj4jm0EcONBN2cf6VzKeJzkgig==
age: 1261812
X-Firefox-Spdy: h2
|
|
| q2berjupvxdohax90gif.brightnexst.ru/56NZanc75H2pQ9jlyqRXgql5wjijZOZyxC2m3iVlvZ67102 | 172.67.146.141 | 200 OK | 4.8 MB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/56NZanc75H2pQ9jlyqRXgql5wjijZOZyxC2m3iVlvZ67102 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
Size4.8 MB (4756466 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /56NZanc75H2pQ9jlyqRXgql5wjijZOZyxC2m3iVlvZ67102 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: application/javascript
content-disposition: inline; filename="56NZanc75H2pQ9jlyqRXgql5wjijZOZyxC2m3iVlvZ67102"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NORFvt55t4P0%2Fsb7XlT2LqfHQAqdKF5jKF0BSNiICbh%2BdAnF%2F4ddu5AOOTdwnH0KCe3oq%2FI4roeL7FU%2Fdj7IObPJfOyTC7hqIBFx9mN1zX%2Ftn9SiOtaJqGmkIe8YGA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dc8083e5687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1165&min_rtt=1144&rtt_var=333&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2210&delivery_rate=2481576&cwnd=251&unsent_bytes=0&cid=dcdb33cfa32a0eff&ts=129&x=0", cfL4;desc="?proto=QUIC&rtt=1772&min_rtt=970&rtt_var=501&sent=206&recv=60&lost=0&retrans=0&sent_bytes=186025&recv_bytes=25902&delivery_rate=2819091&cwnd=34800&unsent_bytes=0&cid=59237dde8255af83&ts=11476&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/rsomgnKhzs4mwPWZ0UjAhjxqcEivhRXl7wghVVLxfMY52rIQg4zcNAVPrcd200 | 172.67.146.141 | 200 OK | 268 B |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/rsomgnKhzs4mwPWZ0UjAhjxqcEivhRXl7wghVVLxfMY52rIQg4zcNAVPrcd200 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeSVG Scalable Vector Graphics image Hash1318aafc1fb9ded0c623e5b9a557e6df 0917cdd7633cd1642b02b2b785416ec7e5106dcc d86660a84daa211b121ec9fe0df83d6b945f61b888384391eabc7d6b4e941dc4
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /rsomgnKhzs4mwPWZ0UjAhjxqcEivhRXl7wghVVLxfMY52rIQg4zcNAVPrcd200 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: image/svg+xml
content-disposition: inline; filename="rsomgnKhzs4mwPWZ0UjAhjxqcEivhRXl7wghVVLxfMY52rIQg4zcNAVPrcd200"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=myq10K0wq9XJ1ACNqZJiMhVB0hwNScjl%2BRFyLm3%2F3%2BiPOB%2BkmRRbF9BVO9cyFNvdwlWkLMOuMs1%2BaNvPXeGO6IgXMq%2BzyXPHItxy5h7qngxfZUxlc3QtFUBdRuIoeQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dc7fff35687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1184&min_rtt=1161&rtt_var=348&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2261&delivery_rate=2358306&cwnd=251&unsent_bytes=0&cid=b2ce88553419646c&ts=103&x=0", cfL4;desc="?proto=QUIC&rtt=2083&min_rtt=970&rtt_var=906&sent=134&recv=52&lost=0&retrans=0&sent_bytes=105410&recv_bytes=25537&delivery_rate=308264&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11394&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/abAjD1gNDraZoLrsRu02gh29 | 172.67.146.141 | 200 OK | 36 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/abAjD1gNDraZoLrsRu02gh29 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeASCII text, with CRLF line terminators Hash38501e3fbbbd89b56aa5ba35de1a32fe d9b31981b6f834e8480ba28fbc1cff1be772f589 a1ca6b381cb01968851c98512c6e7f6c5309a49f7a16b864813135cbff82a85b
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /abAjD1gNDraZoLrsRu02gh29 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="abAjD1gNDraZoLrsRu02gh29"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wIQatPDym06nqNr4y5%2BImhOe878HjkxuD3EucsjIQbRY4AtmCpCceOTL6d4YDY74pYgQideCy8Ust5OTZoe9rG5Xw8IKRqv86eXfcZSHEVYkvXiSZ8qSyZ0EWa%2B%2FHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 911e8dc7bf555687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1477&min_rtt=1462&rtt_var=579&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2216&delivery_rate=1827129&cwnd=251&unsent_bytes=0&cid=58c6a8cd3f95583f&ts=96&x=0", cfL4;desc="?proto=QUIC&rtt=2314&min_rtt=970&rtt_var=1437&sent=123&recv=48&lost=0&retrans=0&sent_bytes=95012&recv_bytes=25356&delivery_rate=1429051&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11358&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/qzpXiGLk9Y0Gw5QZjm05fL2f3CewyzcaA38FIOD1VP7b5Lsxe | 172.67.146.141 | 200 OK | 2.8 kB |
URL POST HTTP/3q2berjupvxdohax90gif.brightnexst.ru/qzpXiGLk9Y0Gw5QZjm05fL2f3CewyzcaA38FIOD1VP7b5Lsxe IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (2849), with no line terminators Hash15de793ee8df02ff2f2e1cc883b8326b 4fa973ad2b9083398df143d1792a348f32cfd828 7033ee1f03a3b1aba7a96be408de95809c4cbe63ba14d2a80e1805c6b5771857
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
POST /qzpXiGLk9Y0Gw5QZjm05fL2f3CewyzcaA38FIOD1VP7b5Lsxe HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 55
Origin: https://q2berjupvxdohax90gif.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: application/json
cache-control: no-cache, private
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HEAsdlW5QdlDKmfZc3Hz%2Fyr1Kk%2FWVN5Y%2F6cVN0ITJiUNswLSpteZHYSbLggbSuXXDOhpHbVXSr9rPG4%2FrEXrRgTG0J28k1CFq9gquTURz7LlF68Vb3JlI2COobBXtA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IklxZWVaNnhaWjdlQ3BMQzJMV1pQSFE9PSIsInZhbHVlIjoiSHc2eVhGejA1RnRqS1Iwd0UwZ1lkMFZDVm01Ynp5Ukh6dDBobjBvVmU0YloxMTlINGJ2NEdXOFpTUVVZZVRyZFhUQm5tQlp6VXVIY1dOdU03anZRbmppV2ppeXBtelZOZWdCcHV3Ny9rd3lsYngxVTFNclN6NS81OTd0QnBsdGkiLCJtYWMiOiIxYmMwZTYxNDBhMzM2NDIxYTYzNmEzNWI3ZDI5NjE3M2U3YmMzODUyYjEzYjMwMzZiMWIwMjlhNmY2NTk2MzU1IiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:52 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IjZzdjQwTXIrMEEzV2o3ZXNNVTUrY1E9PSIsInZhbHVlIjoiS1ZEMi9EQWkwVXBHTXFHTGhOTWppQUFFY0Y3U0xQUGlFdjZ6ZGZFWGlKL3FkVUx2b2dJT3F0aStLVDFJbGovZ3JuRU1mR2pDQ0M3S0JvR0pzMnhVR0JEdWRMNDgvdDBKOElMWUlaT2xKOTV0My9JcGJpQVhJcS9jRWw0aEhkZ2wiLCJtYWMiOiIxZGQ5ZDQyOWE0Mzg3YjRiNWZkZWVhODUwYWYwZDFhM2FkN2E5OTE1YWJhZjVmYTg2Zjk4ZThhZGVlNmIwOTBhIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:52 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dce5b4d5687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1508&min_rtt=1503&rtt_var=575&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2435&delivery_rate=1869593&cwnd=251&unsent_bytes=0&cid=67e70fce44748e49&ts=96&x=0", cfL4;desc="?proto=QUIC&rtt=1622&min_rtt=687&rtt_var=1061&sent=858&recv=129&lost=0&retrans=0&sent_bytes=926892&recv_bytes=32026&delivery_rate=3604994&cwnd=153600&unsent_bytes=0&cid=59237dde8255af83&ts=12380&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/mndtSM0vNa894GDOivuuDIex7qdIwRfggHiPkijHfeMVAZAth27ETDAVsuSkDwWa2TTZbuv220 | 172.67.146.141 | 200 OK | 1.9 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/mndtSM0vNa894GDOivuuDIex7qdIwRfggHiPkijHfeMVAZAth27ETDAVsuSkDwWa2TTZbuv220 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeSVG Scalable Vector Graphics image Hash4b5c228b4faba433d06ec569ed855b2d a7d3882b93e332460e7c59510a6a811ef011983f eb19d76cd1fad39abf0f2778991883a5cf9ff560117ce8f7c64124e71471b4ed
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /mndtSM0vNa894GDOivuuDIex7qdIwRfggHiPkijHfeMVAZAth27ETDAVsuSkDwWa2TTZbuv220 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/svg+xml
content-disposition: inline; filename="mndtSM0vNa894GDOivuuDIex7qdIwRfggHiPkijHfeMVAZAth27ETDAVsuSkDwWa2TTZbuv220"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RlUP%2FAwmyG%2BrZAinNklNL4v3suehq4S%2F14ilvzptzXkinFdDUg0mBDRC29I3NQCrfteM8glMJ%2Bjw6sxuHPhRIYt%2BL%2BxekfE8wQK8BEcm0GrVxth8t6imqMMLRCVJcw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dceabc85687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1283&min_rtt=1240&rtt_var=424&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2273&delivery_rate=2026592&cwnd=251&unsent_bytes=0&cid=ae90a23dd8f655fa&ts=89&x=0", cfL4;desc="?proto=QUIC&rtt=1465&min_rtt=687&rtt_var=860&sent=864&recv=131&lost=0&retrans=0&sent_bytes=932017&recv_bytes=32118&delivery_rate=758182&cwnd=153600&unsent_bytes=0&cid=59237dde8255af83&ts=12424&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/mncCntPFbxJIhNzqMJCzmENJijzmhsCTwbWg1RLsld3xuGXzse90141 | 172.67.146.141 | 200 OK | 270 B |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/mncCntPFbxJIhNzqMJCzmENJijzmhsCTwbWg1RLsld3xuGXzse90141 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeSVG Scalable Vector Graphics image Hash0c09c5ea7c28d6feb4d124957dde0a0d 1b9efde2d8f0e2a3d9d5315117e597c2d622fc5e b3c39d2c15327b7ae68940502a2d7bf457fe521e075e6e671d0340edc58bcb3a
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /mncCntPFbxJIhNzqMJCzmENJijzmhsCTwbWg1RLsld3xuGXzse90141 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: image/svg+xml
content-disposition: inline; filename="mncCntPFbxJIhNzqMJCzmENJijzmhsCTwbWg1RLsld3xuGXzse90141"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X2iS1y336hhoGCfoXuMnG2J68EwvkUJqTvShg2gSccwM%2BX%2FzOcWj6TEQwYHRuLQmoqZLP4J3H7fHq7s1lXDKkbG34wNWBxZxZP7Cn0ACoBfvkgdXivwA3hyK3j5ZaA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dc7efcb5687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1161&min_rtt=1140&rtt_var=471&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2254&delivery_rate=2202281&cwnd=249&unsent_bytes=0&cid=657bbcbd4e283a68&ts=84&x=0", cfL4;desc="?proto=QUIC&rtt=2028&min_rtt=970&rtt_var=1311&sent=131&recv=50&lost=0&retrans=0&sent_bytes=102836&recv_bytes=25446&delivery_rate=1221780&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11375&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css | 143.204.55.87 | 200 OK | 223 kB |
URL GET HTTP/2ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css IP 143.204.55.87:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerDigiCert Inc Subject*.oktacdn.com Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5 ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
Size223 kB (222931 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Tue, 14 May 2024 21:48:24 GMT
x-amz-meta-sha1sum: 7b5499b46660a0348cc2b22cae927dcc3fda8b20
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Wed, 29 Jan 2025 17:13:28 GMT
expires: Thu, 29 Jan 2026 17:13:28 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"0329c939fca7c78756b94fbcd95e322b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 6480520a5e02f3163410e3134bd77baa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: wtLXZuG2InWeYyDNvzYfqjs4eK84Wg4fy58KzvhDS8GvDTCevDyjRA==
age: 1380983
X-Firefox-Spdy: h2
|
|
| q2berjupvxdohax90gif.brightnexst.ru/favicon.ico | 172.67.146.141 | 404 Not Found | 0 B |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/favicon.ico IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /favicon.ico HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6IklxZWVaNnhaWjdlQ3BMQzJMV1pQSFE9PSIsInZhbHVlIjoiSHc2eVhGejA1RnRqS1Iwd0UwZ1lkMFZDVm01Ynp5Ukh6dDBobjBvVmU0YloxMTlINGJ2NEdXOFpTUVVZZVRyZFhUQm5tQlp6VXVIY1dOdU03anZRbmppV2ppeXBtelZOZWdCcHV3Ny9rd3lsYngxVTFNclN6NS81OTd0QnBsdGkiLCJtYWMiOiIxYmMwZTYxNDBhMzM2NDIxYTYzNmEzNWI3ZDI5NjE3M2U3YmMzODUyYjEzYjMwMzZiMWIwMjlhNmY2NTk2MzU1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjZzdjQwTXIrMEEzV2o3ZXNNVTUrY1E9PSIsInZhbHVlIjoiS1ZEMi9EQWkwVXBHTXFHTGhOTWppQUFFY0Y3U0xQUGlFdjZ6ZGZFWGlKL3FkVUx2b2dJT3F0aStLVDFJbGovZ3JuRU1mR2pDQ0M3S0JvR0pzMnhVR0JEdWRMNDgvdDBKOElMWUlaT2xKOTV0My9JcGJpQVhJcS9jRWw0aEhkZ2wiLCJtYWMiOiIxZGQ5ZDQyOWE0Mzg3YjRiNWZkZWVhODUwYWYwZDFhM2FkN2E5OTE1YWJhZjVmYTg2Zjk4ZThhZGVlNmIwOTBhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 14 Feb 2025 16:49:53 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vGdrtWm%2BqjqMFf8LgoWAA%2BQsNQj5QqOE1Ml5vre5CcloD5Asccu%2F1LdVwqBqtRds5qV9HMqaM43hRCaGPeg6Zz7d5%2BEYrqxhJhyJnTV5jT%2FiRv9OjOmI2GijKj1Jkw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 3
priority: u=6,i=?0
server: cloudflare
cf-ray: 911e8dd34bcb5687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1373&min_rtt=1273&rtt_var=678&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2177&delivery_rate=1394990&cwnd=234&unsent_bytes=0&cid=efba9c42d24b6906&ts=144&x=0", cfL4;desc="?proto=QUIC&rtt=1411&min_rtt=687&rtt_var=755&sent=867&recv=133&lost=0&retrans=0&sent_bytes=933637&recv_bytes=33125&delivery_rate=1167068&cwnd=153600&unsent_bytes=0&cid=59237dde8255af83&ts=13044&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| get.geojs.io/v1/ip/geo.json | 104.26.0.100 | 200 OK | 336 B |
URL GET HTTP/2get.geojs.io/v1/ip/geo.json IP 104.26.0.100:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectgeojs.io Fingerprint55:74:AA:F3:7A:AF:02:8B:48:DB:6E:73:EB:A1:95:20:EC:13:2D:8E ValidityTue, 31 Dec 2024 05:30:37 GMT - Mon, 31 Mar 2025 06:30:13 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (394), with no line terminators Hash0c7de1334864e507d633f5bc59a5f8f7 1f60f61cece5da9ce1dbe2ca32b003b7041e1c8d 85e3f08f85f9b332e948d98e7679861e95e26e6564b5a5a4066c37a2c0b679f2
GET /v1/ip/geo.json HTTP/1.1
Host: get.geojs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://q2berjupvxdohax90gif.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:49:54 GMT
content-type: application/json
x-request-id: 7b864c38bba630e4190018bc05fec9fd-ASH
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
geojs-backend: ash-01
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xxdvRHIrvWeJ4xHu6sims%2F%2FgJHVyZcYwJSzEug%2FQYNXLRh%2F96%2FmWHMcKpi7WACqhvm%2FY8LlV5q5gh21teiQptTi8uHSPe8XLsGMEHsk31SgyOF2snMjTB1VvsCOCeg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server: cloudflare
cf-ray: 911e8ddb0de67129-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1041&min_rtt=505&rtt_var=1056&sent=8&recv=10&lost=0&retrans=0&sent_bytes=3190&recv_bytes=1151&delivery_rate=6601823&cwnd=254&unsent_bytes=0&cid=4f4cb62cc3e3e585&ts=134&x=0"
X-Firefox-Spdy: h2
|
|
| q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD | 172.67.146.141 | 200 OK | 150 kB |
URL User Request GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD IP 172.67.146.141:443
CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeHTML document, ASCII text, with very long lines (52495), with CRLF line terminators Size150 kB (150054 bytes) Hashf74a36ee9ad613a011c6c9060c97990a dbc9cd8ee13b142be028ef119b23b1946197b0ab 809d0eb06685aa5c2eb42dbb3c74cc53c53518af2a38f97cb013e387d5c88aa1
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft | urlquery | suspicious | Suspicious - Anti-debugging code |
GET /OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/pax6lf1/%23%23nregena.umberger@slurpmail.net
Cookie: XSRF-TOKEN=eyJpdiI6Im1MYXd1cHdmT0tzOHZxR01aQm5Zemc9PSIsInZhbHVlIjoid0N6RU96TlU0L1kwclNCWnpOdk5Rb2drcy9hY3ZjRmxDZmtaWm15dmFpak9EVVNLTTYydk1LYjZidSttS1Z4d0Z2M3IwS2RjSlhQOFlCNnBuK01hUUpiejZqcTFHd3ZjSS9HV1R4dVp1K21CeGl2L0pMejZGNXN5SEhabkIzT1giLCJtYWMiOiI2NGFlOTk1MWVjYjc1NzM5ZmYxMzYwNGE1OTAwMmM3ZmU0YjY0N2ExNDhhMTUzZDJkNmMyZjA1MzYyMzVhYTY0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlVMVm81YVhWbE81YTR0M3pUdnI4L3c9PSIsInZhbHVlIjoiT2phVkxUUW5JVEpkaDk3V2x3THFEanhsU1F4QlJJeGkyN1Fqa0tRbDJya1ZZY3VDdTlLZ0oyVGZTQVBDT1JQeXV1UDcza0JKT1pKc0VTdlBvZ1praWY1MUk5bGN6OHQ0MlhmYSs5a2NrNWV4Rk55WTR1eTJwSDN5TGUxNHVCVXMiLCJtYWMiOiJhNjc3OTg1NjFhMzhiOTliZjQwN2U0YmNhZmViNWQyMGM2OWRjNjkwYjI3ZDRmODQ4NmJlOTAzZDFiY2QwNDE5IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=atNtQprcaSFrQ8s8iERYRBfOle4WA5r%2BaPcpn7MY6uQmKk1U%2FMR6NxON1YA3UH9B1dKjijAoAU6nnVukUtzE9p0685dPISkpyfLP6MnNkHHsNruyCmKfdkQPTOKzwA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:51 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:51 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 911e8dc57add5687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1052&min_rtt=1047&rtt_var=305&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2337&delivery_rate=2676524&cwnd=251&unsent_bytes=0&cid=07f074d35a887d75&ts=179&x=0", cfL4;desc="?proto=QUIC&rtt=5077&min_rtt=1835&rtt_var=3729&sent=33&recv=18&lost=0&retrans=0&sent_bytes=18014&recv_bytes=7064&delivery_rate=1426&cwnd=12000&unsent_bytes=0&cid=59237dde8255af83&ts=11046&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/yzMIIbRSvfBfvrYItDKpBnYYcjxPUopiuh6vJle6d68iwvGZoQu90180 | 172.67.146.141 | 200 OK | 2.9 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/yzMIIbRSvfBfvrYItDKpBnYYcjxPUopiuh6vJle6d68iwvGZoQu90180 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeSVG Scalable Vector Graphics image Hashe924de0d471df54b6280f3dc8b187cb8 857f03226070b502a9e06b4249710ec10be4c9e9 24ce135a31ce83ac3d62471fcc0e1a82ce6f1533c993ee59ca4e110d5f2fae33
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /yzMIIbRSvfBfvrYItDKpBnYYcjxPUopiuh6vJle6d68iwvGZoQu90180 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: image/svg+xml
content-disposition: inline; filename="yzMIIbRSvfBfvrYItDKpBnYYcjxPUopiuh6vJle6d68iwvGZoQu90180"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LBG%2BdlP%2Bab%2BimHFXDuXelxNWmXMxUfQ7IkTuW3Bzwx2KduNYib8ME22bltMbquyxF7T%2BUVXx%2BJN7HsqrC1cw7i9WKfkCwh3VfB9wiuAWPrZ%2BDCw592oDEziTEFHTYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dc7efdd5687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1124&min_rtt=1068&rtt_var=342&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2255&delivery_rate=2654445&cwnd=251&unsent_bytes=0&cid=5318f3e216a42b7d&ts=79&x=0", cfL4;desc="?proto=QUIC&rtt=2028&min_rtt=970&rtt_var=1311&sent=129&recv=50&lost=0&retrans=0&sent_bytes=100775&recv_bytes=25446&delivery_rate=1221780&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11369&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| 3zjhubjxdx0admpx1jkzklfwiji22nfaceq4hknxoszjqyxovqjn5ke3w.vividtrackz.ru/ccimjechkguujopcxdavMkOEPOGXTLBDOLVSSGUMQFSTGPXFZLUDNOWJQVYRNAPLNFFXFRKKXJGNKrstKqe9JIXH6NuyHe34Dx3wx32 | 104.21.48.1 | 200 OK | 536 B |
URL POST HTTP/23zjhubjxdx0admpx1jkzklfwiji22nfaceq4hknxoszjqyxovqjn5ke3w.vividtrackz.ru/ccimjechkguujopcxdavMkOEPOGXTLBDOLVSSGUMQFSTGPXFZLUDNOWJQVYRNAPLNFFXFRKKXJGNKrstKqe9JIXH6NuyHe34Dx3wx32 IP 104.21.48.1:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectvividtrackz.ru Fingerprint66:7D:C2:15:FF:5A:64:58:96:43:59:46:73:0C:E7:3C:96:C1:75:27 ValidityThu, 23 Jan 2025 22:25:39 GMT - Wed, 23 Apr 2025 23:23:13 GMT
File typeASCII text, with very long lines (536), with no line terminators Hashb700a2408fff4601b18b91dd7b1adf0f 294a42cbff29c06fe6bff0cc3d5d6b93f7fda3dc 23731d6f86bfade6b1fd1acf5985785e9e1cb0f155f662cf89464d7a6f2c04b6
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
POST /ccimjechkguujopcxdavMkOEPOGXTLBDOLVSSGUMQFSTGPXFZLUDNOWJQVYRNAPLNFFXFRKKXJGNKrstKqe9JIXH6NuyHe34Dx3wx32 HTTP/1.1
Host: 3zjhubjxdx0admpx1jkzklfwiji22nfaceq4hknxoszjqyxovqjn5ke3w.vividtrackz.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 123
Origin: https://q2berjupvxdohax90gif.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:49:55 GMT
content-type: text/plain; charset=utf-8
vary: Origin
access-control-allow-origin: https://q2berjupvxdohax90gif.brightnexst.ru
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mGkbHIQiH4n1ZoOC%2B%2BpreUmi3QWjidiL%2BG0tvnnxZ0KN2Zm3W7tlpmnBGsKxvkhdd%2Bq8oj2CwGm4bs5p6kCeatmc5yRl1QeJySpq7Hm5R%2B9Hz%2B0FZzJjcOX%2Fw7Q9%2B8rTnKieJ7dU3huYcj6WRBDkhoQtaHq9MwKFfaaWen3yJHWfIEFfZrSFEp4kN9YXAElYFmFU0VTlPW7KwSA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 911e8ddcbf7a1c0a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=592&min_rtt=522&rtt_var=167&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3283&recv_bytes=1623&delivery_rate=6745341&cwnd=254&unsent_bytes=0&cid=8c627534a2c70a44&ts=559&x=0"
X-Firefox-Spdy: h2
|
|
| q2berjupvxdohax90gif.brightnexst.ru/56ssdcYp9eBOcdo1x5yL8920 | 172.67.146.141 | 200 OK | 27 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/56ssdcYp9eBOcdo1x5yL8920 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeASCII text, with very long lines (26765), with no line terminators Hash1a862a89d5633fac83d763886726740d e5ce3aa454c992a13fd406a9647d7afbf831051f 5c22fd904edb792331a7307ddf4a790e0d1318924f6d8e7362fa6b55d5ab6fbb
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /56ssdcYp9eBOcdo1x5yL8920 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="56ssdcYp9eBOcdo1x5yL8920"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nYPxxR7fPUV%2FSO4iXZdBBKgjiokWiai8ZAcvgV9DUi5FybBG2tK8Xj%2FQldcXUG%2F4TgkvAeTtnyOraZbpBZjT73gpD1QUqKaD8ZVKgQc7GCqwU54WvXy45DkieMPsLA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 911e8dc7bf455687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1481&min_rtt=1466&rtt_var=423&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2216&delivery_rate=1938420&cwnd=251&unsent_bytes=0&cid=1a4c214e053a07a9&ts=85&x=0", cfL4;desc="?proto=QUIC&rtt=2564&min_rtt=970&rtt_var=1784&sent=115&recv=46&lost=0&retrans=0&sent_bytes=87804&recv_bytes=25265&delivery_rate=5354046&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11305&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| q2berjupvxdohax90gif.brightnexst.ru/ijOPd3LSgKTxce7hclOEKFhYmvyzczLD1JyzsCPfJchcV2wVIRxFunNSb56170 | 172.67.146.141 | 200 OK | 7.4 kB |
URL GET HTTP/3q2berjupvxdohax90gif.brightnexst.ru/ijOPd3LSgKTxce7hclOEKFhYmvyzczLD1JyzsCPfJchcV2wVIRxFunNSb56170 IP 172.67.146.141:443
Requested byhttps://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD CertificateIssuerGoogle Trust Services Subjectbrightnexst.ru Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89 ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File typeSVG Scalable Vector Graphics image Hashbca9b46fee32162356ba5b4783e614dc cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5 fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /ijOPd3LSgKTxce7hclOEKFhYmvyzczLD1JyzsCPfJchcV2wVIRxFunNSb56170 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/OFORLLEEWNQAMZYOpsizzhvbvhfadnslioinpflH346O9HZCTR3B5XIVVXTU0AS?UDPBMIXTBBYCUD
Cookie: XSRF-TOKEN=eyJpdiI6ImViWDh5cUdsYjdPZUxZUXlCTmlKMmc9PSIsInZhbHVlIjoiejl6L3lKTHFMemFvMndPTFJoWjZtMjJvWnBqWmdpalg3a0l0bjZKY0Q2aCt2VlhWU3dRaGZwdmZlTzBnOXh4eVdkM3p6TXJDdEUrTm1tSVV2R0c3YU1HRGxLdktWbFRHUDlBVVk3V05mMTF3bXN5WE11WXpwekZJL0taTzBtREgiLCJtYWMiOiI2ZWQxZjgwMTVjYTY5Mzg0ZTg3YWYzMzA0Mzc1ODNkZGU4MzkzNzJhNjQ0NDZjZmNmNWQ2YjkyNjEzYTM5YWQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IllwUzlQYTUzTGI4QkNnRzM3U2phTmc9PSIsInZhbHVlIjoiVkpJa0pGNGVSS2pTSGRSQXZZb1FCaXdEUlFyN3dMUnlaRHZDRFA4OTN6aDlEVXN1MHI1WXBUZFp6L3FjNSttc0RHZUFReWgrdHRuTXhvVHRoUjJ3VWJvZkhzTktzRnVtSGpPbGd3OVJMeG0yUVJjQWFtN1dBL2k2SEhMN0dmb2IiLCJtYWMiOiI4ZTZiMmFhNzNiNTliMzc0ZWMzZWIyMDA0ZTYzMTAxZjIyNzg3OWYwNGEwMGRiM2QwYTYzODFmZDQwYWI2NmJjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: image/svg+xml
content-disposition: inline; filename="ijOPd3LSgKTxce7hclOEKFhYmvyzczLD1JyzsCPfJchcV2wVIRxFunNSb56170"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XrJ%2FA0mdD4aqhQQ7N1RrG79LO1wqNfbasP2ianujIyUgiStC9Q5ItLJVoaAynTTJZsApqtmVqNTQPpaQUoAUT8LK5CHXD%2BQmECCIuQ6lMbejhLt6oiPObU7w4NxwrQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dc7efcd5687-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1065&min_rtt=1025&rtt_var=323&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2261&delivery_rate=2562831&cwnd=251&unsent_bytes=0&cid=a38962420e3321c9&ts=118&x=0", cfL4;desc="?proto=QUIC&rtt=1949&min_rtt=970&rtt_var=730&sent=160&recv=54&lost=0&retrans=0&sent_bytes=135242&recv_bytes=25628&delivery_rate=6652233&cwnd=21600&unsent_bytes=0&cid=59237dde8255af83&ts=11408&x=1", cfExtPri, cfHdrFlush;dur=0
|
|