GET rqu.yjzkqbs.es/12qQGm3183c2oMZcdm3M6720
200 OK 28 kB URL GET rqu.yjzkqbs.es/12qQGm3183c2oMZcdm3M6720
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type ASCII text, with very long lines (28186), with no line terminators
Hash a1606fe4c64f4a7649b295a56b8d4b47
ffea9bddd62c0ddfe5f3c314f885da0bc2cf8a1e
8734d2dcfa9c93df3e755660ba1c6bb54ed5fb2a7bfac1b0410d017f11129746
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /12qQGm3183c2oMZcdm3M6720 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: text/css;charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="12qQGm3183c2oMZcdm3M6720"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6KvhE9vubCtVh%2FgipXdLw8otx5I0oClZJNcsTb298EYc1aFDKWqzG4Nb%2BJP%2F%2Fp8YFQZeLCe%2BdMeTJhAkx1WhCPcZQD7kDwhaFcw%3D"}]}
content-encoding: br
priority: u=2,i=?0
vary: accept-encoding
cf-ray: 95fba47e78f9b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/favicon.ico
404 Not Found 0 B URL GET rqu.yjzkqbs.es/favicon.ico
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /favicon.ico HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IjRvNWE3d2VUVktjb2lXTzJPa1lnZEE9PSIsInZhbHVlIjoiZE5iY2hwVlNlaDhGTlpoRXErVWJDa1h0WGs4TTFJQjVSWmRxQkNFSllCKyt5VUV0RVBFOHpVbnFjaHlWNDUyVFI4Y3JnRTc1VGpoa2dQSVE2MTlVV1doT1Foa1JoVFN0dnNSSzVFa0dvY1RCay9lR1VGdFQ4MFFWalRSRWI0T28iLCJtYWMiOiI5MjAyNzc4OGQzY2Q4YjZmODUyY2YxOWQ4ZTcxMjcxNTExNjE3NzIxNGE2MzliYWM3YTI1MWVjNGUwZGFmNGViIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImNNdURlSkpCbEY5aEdTcVdPS0VNYmc9PSIsInZhbHVlIjoiSnBRZEtMR0JZczlNaURpNXNqalJ4QWNEcVVvZktwS3VZWXVHczhBdElRaVVUMExvdFdlL2FucVFFdjhVY1JJN2J4S1JBWjg3NHZGdXJudjVlQkVFZTdiWVA4N3MxdkZ3Z0puckNrZ1JXODdCL0Z2NEpPVXpxUXE5R3FUMEtxejEiLCJtYWMiOiJlNTZiMWRlMDljOTEwZDE0MzI2MzVjMzQ4YTBlYmI2ZjFlNDg5ODYyOTY3NDY0ZGRmYzY2ZWEwYmY2MTNiNDgwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Tue, 15 Jul 2025 19:24:55 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=n4lT8GBrSLuP2Wx4PujVby1tdbqrjfRMenjLt8Mv5ZyyY2d2EG8FaldyVC9eoYOIqp%2BKk6DrEaE7I1a66DoOKX8DDR2jo7AcizA%3D"}]}
cf-cache-status: HIT
age: 21
vary: accept-encoding
cache-control: max-age=14400
priority: u=6,i=?0
content-encoding: br
cf-ray: 95fba48c8f88b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1197143911:1752604000:Aydb2N42sAZH7t3rNUcK1SoE9_4dee4KOH8KWaey-M8/95fba403ded25697/6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL
200 OK 4.9 kB URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1197143911:1752604000:Aydb2N42sAZH7t3rNUcK1SoE9_4dee4KOH8KWaey-M8/95fba403ded25697/6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type ASCII text, with very long lines (4944), with no line terminators
Hash 2c6b543469dc3db879660d13e3bf2333
6e7e8b65817be0fd690f46ada6fb0ba757e77d97
24e90e1e257d38e724ba0dcb0b7ada491a54a4a8e29ff707b1abb208c7710ff1
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1197143911:1752604000:Aydb2N42sAZH7t3rNUcK1SoE9_4dee4KOH8KWaey-M8/95fba403ded25697/6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
cf-chl: 6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 44524
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:45 GMT
content-type: text/html; charset=UTF-8
cf-chl-out-s: gCrQGzBAD5hd7i6e2GiQ8KF0/FlvcnVhc1ZJ3vBHBHsw/Vhn5Wmw+mcq6XfUrard3OTE5OqPFKWKAZcX+bON0hOl/OGLkT6Ln62xwGmYdOOtsoNaIP7IlPgxhbAOpod7HpvkDQpquC8CYiUV1CvX3rx3Kzk1+PE/Sw4+BF1O8sorDAh3qpO+oQphvCUzOW4UucCQSwRwJ00zN4RpUy1HxaBg03vujj52Bsu5QgJTAtSyOFmwOp22YB1qJxUen8keKIChNUvByjDh57mBlJnzBV4uwxGZN5RB8unlP0QJ2BRXk13oMBQlA8+YrZR202803chJONeJ7SAz/VtgtqVPXmON8eY+qz+QlwSaur1YZzXXLzSJghAME9CFZrPWsfNxkGNXtG2KcnwDbY1d5eJmTIeK2bigcnxG69FT1qq9Bnfce1lXpi9ifKXGa1Qoon/x6M4E5kuXyyHA1ihvE/hcC280upOcaDc9qK9/ajJJn1nBCyuV4I9uvFpOK/cAmMWbpm42JFldV7+04UqEJkDYvvF8rmx0EmCAXAHl6068TZtFHKt9haJonhqh4CS7ont8ximirAC9F49OLgulx6M04FENVx/Wkqot6G3u5WXVJo5XiJz27UmrdPvsLLnjAnw7hjiFfhbJ2mEEMYvzRCm+wh7qBlTFgEc8iisx4ITV2gzA+HNRTEyIc6UinB9Ek9zcqvj8glS1B648VybCjYfd0nzfy0Ic8AjpEOKeLI2ykdF6ziU2deWvOXQZFeAIBmVAwiHghekDhXMmENX04Nd2lyPEe0UseStltGkQy0j80QYHb24HwXkmvUKpIpe39ijPHmJaBA4jDXffI2NLYOS/o0I2aqNOW8hMK9nxKp7uT24HKPPbLVTsZcts6FFjQ6EXd9X9yLytIn8FUtmNJJp2g+jbK7jUwPvxTNOoyBP8DIwp4MMo9ioVXFULo+BjDJ0mytD+zJAY42cCSKeVI0RDjeiVrQ/wAdCIjivq3+EEWQbP4rmlxiC02qKiRDAlQ4Lbxj6rRlBiZWbQr4N5jsodvMKr4MeMHrVKmSv5U8WRMkyijXBhgd/XYiin4SbVBEAMBESHOrJ7h3gsKokXRAHMlf7qGvt0il+bask0o0nJt7CaH9iytrUISoAnFlylKJNsaAjW0FONX8r0JCD+YEzuhZF7Tta143mL1JSsQ+RXPjPZoNEY3HwXz9Jwd8GrEYtIKbqSFyNuYuVVuMhF0y9Ok+x2ERZTN8+YX1VFKDeTiB/aZpjAQ/k0B5n+cMjG3JzwVh3uedYE0Y9ehEyymqZVGGmraRB6xuokawrazVXjQ3Y=$DzDQJLTD6AOhIA1ZwHArmA==
cf-chl-out: IuF6vT0pMNMoa8mj58k8wCCGnLa1HT/Ll6NT7DfkzxiBEQd7khCs/t+JVYJAGZjBGHnoWvbnShgdKgC/a+dCGw==$JGKiLVEMZN1jtT7xAfRq9Q==
priority: u=3,i=?0
server: cloudflare
cf-ray: 95fba452ebfc5697-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/GDSherpa-bold.woff2
200 OK 28 kB URL GET rqu.yjzkqbs.es/GDSherpa-bold.woff2
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Hash a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-bold.woff2 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: font/woff2
content-length: 28000
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-bold.woff2"
cf-cache-status: MISS
age: 2147
last-modified: Tue, 15 Jul 2025 18:49:06 GMT
accept-ranges: bytes
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6SP9oiH5JmuqRditijXYqCqNFpGgIJQcJ7ygQpjWbzuR%2BhsrXn8Mn8h1XA4RwDY65LlspoDVgg%2BDruDX6iUhU6X8PftSkoYcAvA%3D"}]}
cache-control: max-age=14400
priority: u=3,i=?0
cf-ray: 95fba47e890fb4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/wx0Z8CdjCjf952KbopsjrvIOaS2ciNEvY1ntRBgopinui9WAQzpstLPuIdab171
200 OK 2.9 kB URL GET rqu.yjzkqbs.es/wx0Z8CdjCjf952KbopsjrvIOaS2ciNEvY1ntRBgopinui9WAQzpstLPuIdab171
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type SVG Scalable Vector Graphics image
Hash fe87496cc7a44412f7893a72099c120a
a0c1458c08a815df63d3cb0406d60be6607ca699
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /wx0Z8CdjCjf952KbopsjrvIOaS2ciNEvY1ntRBgopinui9WAQzpstLPuIdab171 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/svg+xml
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="wx0Z8CdjCjf952KbopsjrvIOaS2ciNEvY1ntRBgopinui9WAQzpstLPuIdab171"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=7Xpb3dRXT%2BnhfZttQiXrkLWXjQJuiBLkAhqGaiOH9ryBRTMTXb9%2FJRpHlDIymosMQ9abmpvgOorL8Ze75GW%2BNsXRfjiTh8u9"}]}
content-encoding: br
priority: u=4,i=?0
vary: accept-encoding
cf-ray: 95fba47eb9a1b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-sbold-webfont.41acb8650115f83780fc.woff2
200 OK 20 kB URL GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-sbold-webfont.41acb8650115f83780fc.woff2
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 20328, version 2.197
Hash 27429b092c0595aa8803b611bd7508f3
dd4beda27e8057403b27d1276ca9d68902692615
9b5d2290b34cd718e1e97e894d6790f92387ee50de0b3364da291e7112f412be
GET /assets/loginpage/font/assets/proximanova-sbold-webfont.41acb8650115f83780fc.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20328
date: Sun, 06 Jul 2025 07:50:01 GMT
accept-ranges: bytes
server: nginx
last-modified: Tue, 07 Nov 2023 18:54:23 GMT
etag: "27429b092c0595aa8803b611bd7508f3"
x-amz-meta-sha1sum: dd4beda27e8057403b27d1276ca9d68902692615
expires: Mon, 06 Jul 2026 07:50:01 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
x-cache: Hit from cloudfront
via: 1.1 74cb6ad66f88e47ae011abd64e57e7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: AykTNYr1j0yjqf-bOsmfyleEGaq_B2fIaUz2qjqTIzyeFuH0uCJDHQ==
age: 819292
X-Firefox-Spdy: h2
GET rqu.yjzkqbs.es/uvbCXW4J2PCsDpjtW6tvhyUGyKrrop8Zh4NkudSSb7c434121
200 OK 644 B URL GET rqu.yjzkqbs.es/uvbCXW4J2PCsDpjtW6tvhyUGyKrrop8Zh4NkudSSb7c434121
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type RIFF (little-endian) data, Web/P image
Hash 541b83c2195088043337e4353b6fd60d
f09630596b6713217984785a64f6ea83e91b49c5
2658b8874f0d2a12e8726df78ac8954324c3bbe4695e66bdef89195fde64322f
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /uvbCXW4J2PCsDpjtW6tvhyUGyKrrop8Zh4NkudSSb7c434121 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/webp
content-length: 644
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="uvbCXW4J2PCsDpjtW6tvhyUGyKrrop8Zh4NkudSSb7c434121"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=dpI4qWtlr91%2FsbJuhK%2FuxC3HJ53vaElR%2FYK%2FT9G%2FduANYM8bM8Fb4hdiA3k201v%2B3MH8s9sU5X0IO1c27jSn2CB%2FAYhYYzhe3No%3D"}]}
priority: u=4,i=?0
cf-ray: 95fba47ea97db4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/95fba403ded25697/1752607473961/bca81c1ad2f3f566a47e51072b504a642b8467cdfa728160753f56c90a5ac13a/nl6ewZR7-NGb7r7
401 Unauthorized 1 B URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/95fba403ded25697/1752607473961/bca81c1ad2f3f566a47e51072b504a642b8467cdfa728160753f56c90a5ac13a/nl6ewZR7-NGb7r7
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type very short file (no magic)
Hash ff44570aca8241914870afbc310cdb85
58668e7669fd564d99db5d581fcdb6a5618440b5
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
GET /cdn-cgi/challenge-platform/h/g/pat/95fba403ded25697/1752607473961/bca81c1ad2f3f566a47e51072b504a642b8467cdfa728160753f56c90a5ac13a/nl6ewZR7-NGb7r7 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 401 Unauthorized
date: Tue, 15 Jul 2025 19:24:37 GMT
content-type: text/plain; charset=utf-8
content-length: 1
www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gvKgcGtLz9WakflEHK1BKZCuEZ836coFgdT9WyQpawToAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAscjm_UO_k901rNdCKgLw5bvI4i6M_jDNCIXpfs2LRbtxwLOrUyplqVvML_hVlB5tIDMuj0ihhaOFHose-Y0_UjQnNUGE_vol46VvGgscTMtTjU4xINriap8AMTIygvljEBt6my-nBwkUGhY3U9v5iKC-eWR5bTfvrqFsuIVxafkSfhHqDXB4KLGNjvOOV71GGJ9x4yxA-C2OcULZ1uDDKuvAaMhuiWdF6OzSTXruP9yPg1vmuteavOW1re0YDbCbtK16PhHdSzWym7v_FrvId-2zf26j50FlTd_vl_DcKNDVCgWDoU0uX3cU6V3rSQoVXREEqPr-2ywSGru8ZuXRoQIDAQAB", max-age=20, PrivateToken challenge="AAIAHXNhdC5wYXQtaXNzdWVyLmNsb3VkZmxhcmUuY29tILyoHBrS8_VmpH5RBytQSmQrhGfN-nKBYHU_VskKWsE6ABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAsLS4HBnLGydwK-bLQGRCaoyMsrXBRrDgQVmxS06j3UF0nYSd6GdTGCKIu1WV60eg-tJtTttfEVq7wHVQf4vzjYBidmCh88ebzxKv2GB6PESSodf5MsEup9xd5dxpkYScgL1CCJq89kRrOQ_CS61bvkL_oGyZf4ffqG5THgaOsopqj8dFLH6_SMy9yf8EgMYqpyjxfKsD-1_qb1m1DRjJEKPWKIGwmHXIKQJUqsxZFm4_Inwkxx7QMpVP4GyqlTxFVz7stWwJRSkMLHjEM_IWLUYfPhuwIUVqmRjGsY1n8flA1bRfxaWHNDxoi25-M2BKTP9NkNNJBbTKErhrZ9LGywIDAQAB", max-age=20, PrivateToken challenge="AAIALHBwLWlzc3Vlci1wcm9kdWN0aW9uLnJlc2VhcmNoLmNsb3VkZmxhcmUuY29tILyoHBrS8_VmpH5RBytQSmQrhGfN-nKBYHU_VskKWsE6ABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEArFBSpY0YPcNslVpklXsEb2gfZsCpmIVdQhoS4K7cHrhquWhyk4MLkyi7_s6aWrx_Xf7HlTYTdYhnNJYeSmBvNR-rT9Jr-vgHew2EKxCRkzFMKPiBFgHMw6CQNwFmH4vtDoB7QjzQGuScPRdzh7kPu8509ew2xkFnr9tjB-6n7HM01yE-AK-YLGAsO2pnr7E7uB1wVPOxxon_JAZ3bYOfTUgjOOdXlFNC8lcuocjbz6S74A95qx_Ud-iEvXXfOoBv5KLuG4xndLeZHQmGd8Zt7VxbSldzBAmsB7NLLExZxPD-x71RLAY9HVS2lcMOPbQ3diWMBwpfS95tytYOn-a5rwIDAQAB", max-age=20
priority: u=4,i=?0
server: cloudflare
cf-ray: 95fba41cf8b35697-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/klncIwTEL0emqSat47WOvPGnqQH89COKale5vLIumRTgHdclBgwpTdY288HLyyz230
200 OK 1.3 kB URL GET rqu.yjzkqbs.es/klncIwTEL0emqSat47WOvPGnqQH89COKale5vLIumRTgHdclBgwpTdY288HLyyz230
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type RIFF (little-endian) data, Web/P image
Hash 32ca2081553e969f9fdd4374134521ad
7b09924c4c3d8b6e41fe38363e342da098be4173
216fc342a469aa6a005b2eacc24622095e5282d3e9f1ae99ce54c27b92ec3587
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /klncIwTEL0emqSat47WOvPGnqQH89COKale5vLIumRTgHdclBgwpTdY288HLyyz230 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/webp
content-length: 1298
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="klncIwTEL0emqSat47WOvPGnqQH89COKale5vLIumRTgHdclBgwpTdY288HLyyz230"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=RZQC070xQl8b1MeYQ2I1y9ONUgE9aCtB2bPaJSAtM%2FQlkbuK3%2FN%2FZcQxX3YRm1fEKyupErJY99bzNQzoT8qnX5a7XXuRc3zJFzg%3D"}]}
priority: u=4,i=?0
cf-ray: 95fba482c86ab4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/mnOY4XrNAbVpWneRiq4U9dOmKh8uvAV16I3VeszKI6FZRp90150
200 OK 270 B URL GET rqu.yjzkqbs.es/mnOY4XrNAbVpWneRiq4U9dOmKh8uvAV16I3VeszKI6FZRp90150
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type SVG Scalable Vector Graphics image
Hash 40eb39126300b56bf66c20ee75b54093
83678d94097257eb474713dec49e8094f49d2e2a
765709425a5b9209e875dccf2217d3161429d2d48159fc1df7b253b77c1574f4
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /mnOY4XrNAbVpWneRiq4U9dOmKh8uvAV16I3VeszKI6FZRp90150 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/svg+xml
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="mnOY4XrNAbVpWneRiq4U9dOmKh8uvAV16I3VeszKI6FZRp90150"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UwiLCIAVp7Ij8JJekQRQ64BWvnkekV1LosNgCOP8DulcXFv7hR%2BGRAaeMIx9cHccvo9isfmZjDp%2F%2BDuaD8U72WbJAE1TjNjirMk%3D"}]}
content-encoding: br
priority: u=4,i=?0
vary: accept-encoding
cf-ray: 95fba47ea983b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/favicon.ico
404 Not Found 0 B URL GET rqu.yjzkqbs.es/favicon.ico
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /favicon.ico HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Cookie: XSRF-TOKEN=eyJpdiI6IkFaUkJ5ZDM3MFMwMUZtV2daTE14bVE9PSIsInZhbHVlIjoiZUFLMkF0Ujd4TGdLbWc4REtvcGpHYVhtMklidmRtSlgyZHYxblZLZ2JVMW9kM1BHK3grRmhMRHR4Wi9rdk1vRC9QUFpIaWpxOWMveTVHZFVyenNQbTJwR3FPR2VHM2JzVUpQaEFSSFBsWWVQS012L1hSWHNERk5FTjJCMkhxVlgiLCJtYWMiOiIzYzgzY2YxNmEzNmQ1ZWYxYmMyN2NjYjlkNWZhYTg1ZDI3NTRiNzNjYzg4YmUyOWI5ZWIxYzVkOWM2OTJlNGJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilg0dWt6MXVxMDV4RmM1QjlTR2lTYlE9PSIsInZhbHVlIjoiUGlMRk1KdjdLRkdtV0U0djRwcWQzVUY5cWUrQitaSldSNDZRSVpmcWk0SzhReHZYZ1I0ODJxamFoaUt6QzNPR1FWbStFYVVvM1lSQXV4VXhzekIrNmZ5YWV1ZG9BU3BMWmFUenlPWXl6cnZnZU9TcWxJdXFKb0NZVm9lejFlVEwiLCJtYWMiOiJiY2M3ZTJkNTc5NzQ0YWZkZWI0NzZlNDg1MDY3MmU0MGZmODY1ZWZkOTAyZDJlMzlmYWY5OTM3ZTAyZjlmNjg4IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Tue, 15 Jul 2025 19:24:33 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=n4lT8GBrSLuP2Wx4PujVby1tdbqrjfRMenjLt8Mv5ZyyY2d2EG8FaldyVC9eoYOIqp%2BKk6DrEaE7I1a66DoOKX8DDR2jo7AcizA%3D"}]}
cf-cache-status: EXPIRED
age: 107
vary: accept-encoding
cache-control: max-age=14400
priority: u=6,i=?0
content-encoding: br
cf-ray: 95fba403a9e3b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1197143911:1752604000:Aydb2N42sAZH7t3rNUcK1SoE9_4dee4KOH8KWaey-M8/95fba403ded25697/6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL
200 OK 30 kB URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1197143911:1752604000:Aydb2N42sAZH7t3rNUcK1SoE9_4dee4KOH8KWaey-M8/95fba403ded25697/6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type ASCII text, with very long lines (29720), with no line terminators
Hash 16edd5b246e24423448ff13166c03810
b186a59a6d68d7e7df7a58d7c8a237096012ce4e
bcca45a3e89d7d0e715d2dc8c4f7891ec4540e1bfdd7a60c3dd4c726a84fe155
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1197143911:1752604000:Aydb2N42sAZH7t3rNUcK1SoE9_4dee4KOH8KWaey-M8/95fba403ded25697/6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
cf-chl: 6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 34914
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:40 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: Tu6IC66qIPYENsdIfd+GpgI/WDc2grAWXNU5xpKslr2Vvnrwa/KRyTU989Z3ZVRo$oB1Wx0I/FGgGSc7KoGEKdw==
priority: u=3,i=?0
server: cloudflare
cf-ray: 95fba430fd0d5697-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/ijDtpvBntAjbhqGBcymfwx3iMRh4n2GthsSql56163
200 OK 7.4 kB URL GET rqu.yjzkqbs.es/ijDtpvBntAjbhqGBcymfwx3iMRh4n2GthsSql56163
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type SVG Scalable Vector Graphics image
Hash b59c16ca9bf156438a8a96d45e33db64
4e51b7d3477414b220f688adabd76d3ae6472ee3
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /ijDtpvBntAjbhqGBcymfwx3iMRh4n2GthsSql56163 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/svg+xml
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="ijDtpvBntAjbhqGBcymfwx3iMRh4n2GthsSql56163"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=MsB7ghh%2BbrVUO8DU4GH6oicbNnvAn3OzLNMYTcqW%2By9P9S5gBUAZlBfgKDsj8G0xsb39zKAj2iumI3sqY4itRFWUU0ueJZbUhXM%3D"}]}
content-encoding: br
priority: u=4,i=?0
vary: accept-encoding
cf-ray: 95fba47eb99eb4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET release-assets.githubusercontent.com/github-production-release-asset/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?sp=r&sv=2018-11-09&sr=b&spr=https&se=2025-07-15T20%3A23%3A55Z&rscd=attachment%3B+filename%3Drandexp.min.js&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2025-07-15T19%3A23%3A34Z&ske=2025-07-15T20%3A23%3A55Z&sks=b&skv=2018-11-09&sig=MY9H%2BkDNp8xqjFY2gXb4IxJhzoxN8y4UA9t92bBxtwo%3D&jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc1MjYwNzc2MCwibmJmIjoxNzUyNjA3NDYwLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.j0rmfgrNYLXAMkDYxchFSiXo0dYOyiXfZjMX9Zm_2cw&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
200 OK 10 kB URL GET release-assets.githubusercontent.com/github-production-release-asset/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?sp=r&sv=2018-11-09&sr=b&spr=https&se=2025-07-15T20%3A23%3A55Z&rscd=attachment%3B+filename%3Drandexp.min.js&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2025-07-15T19%3A23%3A34Z&ske=2025-07-15T20%3A23%3A55Z&sks=b&skv=2018-11-09&sig=MY9H%2BkDNp8xqjFY2gXb4IxJhzoxN8y4UA9t92bBxtwo%3D&jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc1MjYwNzc2MCwibmJmIjoxNzUyNjA3NDYwLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.j0rmfgrNYLXAMkDYxchFSiXo0dYOyiXfZjMX9Zm_2cw&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerSectigo Limited
Subject*.github.io
Fingerprint8C:FF:59:E5:8E:C4:FA:76:FE:AF:2D:C5:C0:D4:13:6A:77:2D:F9:91
ValidityFri, 07 Mar 2025 00:00:00 GMT - Sat, 07 Mar 2026 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (10017)
Hash 6c20a2be8ba900bc0a7118893a2b1072
ff7766fde1f33882c6e1c481ceed6f6588ea764c
b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500
GET /github-production-release-asset/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?sp=r&sv=2018-11-09&sr=b&spr=https&se=2025-07-15T20%3A23%3A55Z&rscd=attachment%3B+filename%3Drandexp.min.js&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2025-07-15T19%3A23%3A34Z&ske=2025-07-15T20%3A23%3A55Z&sks=b&skv=2018-11-09&sig=MY9H%2BkDNp8xqjFY2gXb4IxJhzoxN8y4UA9t92bBxtwo%3D&jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc1MjYwNzc2MCwibmJmIjoxNzUyNjA3NDYwLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.j0rmfgrNYLXAMkDYxchFSiXo0dYOyiXfZjMX9Zm_2cw&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1
Host: release-assets.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Tue, 07 Dec 2021 16:38:45 GMT
etag: "0x8D9B9A009499A1E"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 38bb28af-201e-0012-0ee5-f09a85000000
x-ms-version: 2018-11-09
x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT
x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 15 Jul 2025 19:24:53 GMT
age: 3486
x-served-by: cache-iad-kiad7000080-IAD, cache-hel1410032-HEL
x-cache: HIT, HIT
x-cache-hits: 24, 1
x-timer: S1752607493.146642,VS0,VE99
content-disposition: attachment; filename=randexp.min.js
content-type: application/octet-stream
content-length: 10245
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
302 Found 49 kB URL GET challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Tue, 15 Jul 2025 19:24:33 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/g/01a6b50f61fd/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 95fba402deb6712a-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
POST rqu.yjzkqbs.es/zcQ1VLLxlmCyN0H1bJZA12Sf5aAzBd7njuldYX50devGCU6B7h6fw
200 OK 402 B URL POST rqu.yjzkqbs.es/zcQ1VLLxlmCyN0H1bJZA12Sf5aAzBd7njuldYX50devGCU6B7h6fw
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
Hash 82ba86ac538e11d2d9dbe085e32ff9c5
484093ccb0eedefdbf83ec44249bb664e504dbcb
614b76a7edb4f296bd5fece57a323838c956f575b7257132634b75808fb88042
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
POST /zcQ1VLLxlmCyN0H1bJZA12Sf5aAzBd7njuldYX50devGCU6B7h6fw HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 30
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Cookie: XSRF-TOKEN=eyJpdiI6ImRScS8wZVh2UVR6eTNQdWlsM3plb0E9PSIsInZhbHVlIjoiQTk3Q3lGcVVOOEQvMnBMWjJCQ0x5bm1laHNjQjFzQkZDWWw4cUNycUNZZGkyYXFZeGRvd25VZkc4Y3NLb1NGVGhodExoL21nWjU0RjVWWlBwRVhTdi9pSk1ndWtyWUdPdUljSEViaUtGUUNCYXM5d2t4T2xWY1BJdnliVnM1bEciLCJtYWMiOiI3MjVkNjJjNTJiZDQyMjNhYjQxMDRiMDhhMzZkNWI0YTM2Y2IwYWM2YjQ0NTEwYTg4ZTc3MTZjMmU2ZWUxNGQ4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Img2K3E2NXF6QStmdFc1a1dpbm5Td0E9PSIsInZhbHVlIjoiUTI0TlQxQjU2SWNUTTJRcGo2UjdxTjhRdTBsL3VkUExTNjAveG80MllWSUY1TkIrQmVFcndwaE9XbGhWNGFicW1VSXZEZ0ZnUmlaeDJmN0wzVjQwRWtpLzl1NG1iSTQvZzE3OGdUVldkZHpTUkl6MEF4bEJpQkNobTRIMjV2a0wiLCJtYWMiOiI5ZDE2NThkN2FkMGZmNWUxODViOTUyMDVkYTliYjg1YjAxZTQxMjdiZGQ0NmY2MDkxM2ZlOGIyMWFmZGNlMTc3IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:50 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6%2FrHEZGgKtjnQAKVgu23zSmGthFcF44cM%2BT1NsEajOERuaR0J9bTIW4yT1aOxC0rr9J2F4pgvBJMOZwhYP46udkUXwGkx5calto%3D"}]}
cf-cache-status: DYNAMIC
priority: u=3,i=?0
content-encoding: br
set-cookie: XSRF-TOKEN=eyJpdiI6InFOOWthR05NT3ltQmF4VDBUbWxzV1E9PSIsInZhbHVlIjoieFZsN0ZkbllnczkwYkxzV0hOWmRWQlF0TmtXeSs2dXJyU0RFM0l6R1ZSWlY1eXM2Y2J5Z2lRNk5PWXg5ZUxJSm03bG9ZWmlodFNGcHZWbm9hUkJKRzZkUE1KQ0d4L1Q0WlFSN1hYaHJSRzJDK1RreHdBcjRwRFpYaVRpUkc1TGoiLCJtYWMiOiJiNWEwMTIwMjcwNzM2ZmIwMjAzZjc2MDM5Y2EyN2Y0ZWYyN2NkZTQxMjI0ZTQxNDJmZTRmZWQ1OWI5MDdmMWZjIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:50 GMT
laravel_session=eyJpdiI6InQ0QnI2Z0Z4VHNsRFpyMEI5ZlVOdFE9PSIsInZhbHVlIjoidWxvUnloVE9xKzN1ZkZ4WDk1UmR4N2Z5MS9adXYyTlRlTzNiMUpYY2w1VllFWlJDK0IwcmxNRGxybWZwTnMvU0ZCOWtESjJYaGRKbjV2eGpMREY0ZzAyWGtKSm1CWXZVYUFCMTg0Qk1oUEQrVXJHT3pmOW9qUHlOTjR0dE1jWTIiLCJtYWMiOiI5NWEwNTE0NmE5YmNlOGMyMmQyNzJhYzc4OTVhMzkzODZjNDQwMWFjY2IyODE5ZTg5M2EwOWYxMTA3MzNmZTY1IiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:50 GMT
cf-ray: 95fba46f9b24b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/GDSherpa-vf.woff2
200 OK 44 kB URL GET rqu.yjzkqbs.es/GDSherpa-vf.woff2
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Hash 2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-vf.woff2 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: font/woff2
content-length: 43596
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-vf.woff2"
age: 2146
cf-cache-status: MISS
last-modified: Tue, 15 Jul 2025 18:49:06 GMT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JC4cfceMdho0WLxoy2naSW1LwHMRyk47Yl5GQbOa%2BmiqnlmTkGnR8eknS4eDL5gtHgPbFNYlhQ6oV1vaQUDwM7iS5vZT07geid8%3D"}]}
cache-control: max-age=14400
priority: u=3,i=?0
cf-ray: 95fba47ea969b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST lv0xcbylaahdg4xsvs5uttowzavjjqoooheb3tdzeoioexedcu7nesdxsu.jcfjtltxrz.es/KNZiOQYtgNvcFWTegAlGrzQdutSRMGHYFOXCDQDLKGZDDUWWJPNYXSBUWRIVNRFAPHVYAZXOKLMCrs57VKHUVCm9I4I012yJOwx34
200 OK 536 B URL POST lv0xcbylaahdg4xsvs5uttowzavjjqoooheb3tdzeoioexedcu7nesdxsu.jcfjtltxrz.es/KNZiOQYtgNvcFWTegAlGrzQdutSRMGHYFOXCDQDLKGZDDUWWJPNYXSBUWRIVNRFAPHVYAZXOKLMCrs57VKHUVCm9I4I012yJOwx34
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectjcfjtltxrz.es
FingerprintCB:F9:D5:B4:6A:4A:9C:10:4A:9B:9D:9A:2D:25:A2:B5:43:F0:C1:FB
ValidityThu, 12 Jun 2025 23:15:55 GMT - Thu, 11 Sep 2025 00:13:34 GMT
File type ASCII text, with very long lines (536), with no line terminators
Hash b700a2408fff4601b18b91dd7b1adf0f
294a42cbff29c06fe6bff0cc3d5d6b93f7fda3dc
23731d6f86bfade6b1fd1acf5985785e9e1cb0f155f662cf89464d7a6f2c04b6
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
Quad9 DNS malicious Sinkholed
POST /KNZiOQYtgNvcFWTegAlGrzQdutSRMGHYFOXCDQDLKGZDDUWWJPNYXSBUWRIVNRFAPHVYAZXOKLMCrs57VKHUVCm9I4I012yJOwx34 HTTP/1.1
Host: lv0xcbylaahdg4xsvs5uttowzavjjqoooheb3tdzeoioexedcu7nesdxsu.jcfjtltxrz.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 99
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 15 Jul 2025 19:24:56 GMT
content-type: text/plain; charset=utf-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: Origin
access-control-allow-origin: https://rqu.yjzkqbs.es
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=x%2FGMs6y77iQ2lvL4X0rmxgNKF2g3krVZtLlF7LerdKk7xuIz1ihHolUYfUowEbus%2BJrjGbFWuUjsJ7SLsbr80ukPiAarITKWpTr9wZJhTNubOqAU2oMcicS8ruvTiNuE2uwUFDXzPVrxbNJrVRuFBJp3mALn6689aRoR8nrFn15YX4XBYkE%3D"}]}
content-encoding: br
cf-ray: 95fba4905ac8b4ff-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
200 OK 86 B URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced
Hash 70c202196187ab3c11b4e094c20c6de1
9c52b959e74aee9d79cbc9f35d1f9f65a3b8c863
6255b9231d09ebe6aa1ac19ba46bdd81f3df58989c9ef2e11d6cd6e2e7b21643
GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:33 GMT
content-type: image/png
content-length: 86
priority: u=4,i=?0
server: cloudflare
cf-ray: 95fba4048fb75697-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1197143911:1752604000:Aydb2N42sAZH7t3rNUcK1SoE9_4dee4KOH8KWaey-M8/95fba403ded25697/6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL
200 OK 283 kB URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1197143911:1752604000:Aydb2N42sAZH7t3rNUcK1SoE9_4dee4KOH8KWaey-M8/95fba403ded25697/6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 283 kB (282784 bytes)
Hash 9b63c1b0744fa10343b70cb132bddecb
cd58fc0f1293401afa2564390c408ebf5a57de6a
37ed772e73db0e89877e34c5aa072a3426af599d744635470110852a2ec3b446
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1197143911:1752604000:Aydb2N42sAZH7t3rNUcK1SoE9_4dee4KOH8KWaey-M8/95fba403ded25697/6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
cf-chl: 6.xUYq9Jp0xim8tB5tf6likgsgh3JOTLrfi1.kpLxps-1752607473-1.2.1.1-aiAphzKmqgbeDnsTO3tbrdUM9orhKlPzwJljTIt.dn1VPPM8NSJjytGWdA4vjNaL
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 3436
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:34 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: DghBKwSZiofUMYYn2VJcwiuVQALnabJ+pRaCUTnjAaJtvZETbkwbB/wYH9nAyd6lnEP9oQNkAWS4zF+2d2UaP0eVUQNDGS6QGKGHRO3AqyvOd1xv2Wkz10VRUHtJ/EAeRpxd2YP+ql4Qa+S8kF/FVOOv4HaPwTGk7rNMPbVLTl12VlgPTOjsyg3cdiiDnb7CT7eOBV7bxG5cpD8WZvz5WW1Kf5DE5IeGjJCo6g0ggNVKEaZeIAGkHKUuxgTmjRRqlJvJnwQG8NVbhSienXy7CW2p68F8pGMOg1nh/xgchKL5UFxje5f/Zp4FtswBjCJVGQqRSLh01PvkiIMFPg7AjSkleWnWuYNasKmAYYbBbhAwycFBaW6x98igDL7o8fkFkajp43tdpvI0glvv9P7wYybAJlRFzAvcPeJoDSsDPd4wB236gwjAVsXuu/UQm+aBmuwTWhGFQbeDuT/mUR4YoV1ri/8I2BGKWj9DdpSECoe8LCkr3KEPqFuUuASpB0yd9ScUrnJnmF26ZmKJmLmKMjcyS21NnGiKbBPLcP4gngtgKdtfOBPvNmx16OolBmvdjPzKFnvvRaC4hYBhyGGKYFLc0chPx8/xEGUk2YrbT/If66ysPADMhHnWNZS0hMI+fTiUGGMhuZHYe5XLFicV/t6JjfcbyEnkP0+alckB+0uincFGHhHAxLZF5P1SOr9KazA2i0JpEEHXX7fUK5xaWvCQoD9fZvuhZzdM29T/KGdESJuDoePW5W8x01K9foPrwnycCWjwtE1o6JCkmQxZBw==$SvC+DmykrYKjrOxvKs6k/Q==
priority: u=3,i=?0
server: cloudflare
cf-ray: 95fba4082c745697-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET cdn.jsdelivr.net/npm/lz-string@1.4.4/libs/lz-string.min.js
200 OK 4.7 kB URL GET cdn.jsdelivr.net/npm/lz-string@1.4.4/libs/lz-string.min.js
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGlobalSign nv-sa
Subjectjsdelivr.net
Fingerprint21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4
ValidityMon, 02 Jun 2025 15:43:52 GMT - Sat, 04 Jul 2026 15:43:51 GMT
File type JavaScript source, ASCII text, with very long lines (4718)
Hash 109c13d75d0b6fc6440d3e98f803d396
b69e7073bc2c1bc9a57aada4c73799d182ef8368
9d1a0ef07a2ea5faa8cd4afb60a0518075e6771e341e5ff4e0e481cefedeecbf
GET /npm/lz-string@1.4.4/libs/lz-string.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 1.4.4
x-jsd-version-type: version
etag: W/"126f-tp5wc7wsG8mleq2kxzeZ0YLvg2g"
content-encoding: br
accept-ranges: bytes
date: Tue, 15 Jul 2025 19:24:50 GMT
age: 3015776
x-served-by: cache-fra-etou8220041-FRA, cache-hel1410022-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1425
X-Firefox-Spdy: h2
GET github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
302 Found 10 kB URL GET github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerSectigo Limited
Subjectgithub.com
FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A
ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Tue, 15 Jul 2025 19:24:20 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With,Accept-Encoding, Accept, X-Requested-With
location: https://release-assets.githubusercontent.com/github-production-release-asset/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?sp=r&sv=2018-11-09&sr=b&spr=https&se=2025-07-15T20%3A23%3A55Z&rscd=attachment%3B+filename%3Drandexp.min.js&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2025-07-15T19%3A23%3A34Z&ske=2025-07-15T20%3A23%3A55Z&sks=b&skv=2018-11-09&sig=MY9H%2BkDNp8xqjFY2gXb4IxJhzoxN8y4UA9t92bBxtwo%3D&jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc1MjYwNzc2MCwibmJmIjoxNzUyNjA3NDYwLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.j0rmfgrNYLXAMkDYxchFSiXo0dYOyiXfZjMX9Zm_2cw&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
x-github-request-id: E8C3:20DCB7:704E4C:7376E7:6876AB04
X-Firefox-Spdy: h2
GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/img/ui/forms/checkbox-sign-in-widget.png
200 OK 3.1 kB URL GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/img/ui/forms/checkbox-sign-in-widget.png
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type PNG image data, 50 x 1155, 8-bit/color RGBA, non-interlaced
Hash 7846b2f8c6d0a7ca69fdd3d3c294e92d
e0bb021ffdf93c68fef44de2a3b08f378b6fb50a
40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665
GET /assets/js/sdk/okta-signin-widget/7.18.0/img/ui/forms/checkbox-sign-in-widget.png HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/png
content-length: 3141
date: Sat, 28 Jun 2025 08:49:51 GMT
accept-ranges: bytes
server: nginx
last-modified: Tue, 14 May 2024 21:49:26 GMT
etag: "7846b2f8c6d0a7ca69fdd3d3c294e92d"
x-amz-meta-sha1sum: e0bb021ffdf93c68fef44de2a3b08f378b6fb50a
expires: Sun, 28 Jun 2026 08:49:51 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
x-cache: Hit from cloudfront
via: 1.1 74cb6ad66f88e47ae011abd64e57e7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: yq5riS7Y0pSnykDpm1IWnwBJt-8t_s9sFViYm4LbWqh6FfSWggesaQ==
age: 1506902
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/95fba403ded25697/1752607473963/xYuimPO89YLAPVR
200 OK 300 B URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/95fba403ded25697/1752607473963/xYuimPO89YLAPVR
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type PNG image data, 67 x 42, 8-bit/color RGBA, non-interlaced
Hash 89e63714e7bb66a5c009e3be9e2bc0d3
2930dd9be54cc799eb891af72aff12766424b5b1
b6de9fd4e37292c01d62d4ec55d566c5e43ec189911f7f30c3123d6174b10f8b
GET /cdn-cgi/challenge-platform/h/g/d/95fba403ded25697/1752607473963/xYuimPO89YLAPVR HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:39 GMT
content-type: image/png
content-length: 300
priority: u=4,i=?0
server: cloudflare
cf-ray: 95fba429cb3b5697-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/GDSherpa-regular.woff
200 OK 37 kB URL GET rqu.yjzkqbs.es/GDSherpa-regular.woff
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type Web Open Font Format, TrueType, length 36696, version 1.0
Hash a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-regular.woff HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: font/woff
content-length: 36696
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-regular.woff"
age: 2146
cf-cache-status: MISS
last-modified: Tue, 15 Jul 2025 18:49:06 GMT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=YTbQ%2B6JQp1bGuIVjqEgi%2F3p04XVW6PkOgTzvGyqdYjvWb4VcyafyA0Sd3lNlvyrNC4Cvqp%2FezxXs8ABrmq6lF8CWoVSA76MTVn0%3D"}]}
cache-control: max-age=14400
priority: u=3,i=?0
cf-ray: 95fba47e9944b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET get.geojs.io/v1/ip/geo.json
200 OK 335 B URL GET get.geojs.io/v1/ip/geo.json
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectgeojs.io
FingerprintA3:C6:58:F9:E8:49:67:61:59:AC:B4:7D:C8:2F:CB:C3:EC:B2:82:9B
ValidityThu, 26 Jun 2025 06:15:54 GMT - Wed, 24 Sep 2025 07:15:44 GMT
Hash 499a23c1491cb10c3a6bfccab779911c
bf28afd4bdb44e26347af9816a07b0c79dcf8602
87a6393a961536e63e7d093a365eae9b13208ff5bd1c3cbe2f0f02bc329df30b
GET /v1/ip/geo.json HTTP/1.1
Host: get.geojs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: application/json
server: cloudflare
x-request-id: 75d924033706a9e7d64b8c6d15b6ece2-ASH
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
geojs-backend: ash-01
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
x-content-type-options: nosniff
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Xv0mJtiGgSeLxYBoN7ZmzlcrsvbxMe0NDolUrZdUOLT2lG6z1G8RDbKabA8zTxe98zLyRHtNY0qbnq4M8gqvl1D%2Bbs0guok%3D"}]}
content-encoding: br
cf-ray: 95fba482f94db4eb-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET rqu.yjzkqbs.es/GDSherpa-vf2.woff2
200 OK 93 kB URL GET rqu.yjzkqbs.es/GDSherpa-vf2.woff2
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Hash bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-vf2.woff2 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: font/woff2
content-length: 93276
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-vf2.woff2"
age: 2146
cf-cache-status: MISS
last-modified: Tue, 15 Jul 2025 18:49:06 GMT
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hFCnod5yKoh1sLH7kQPOHnVYpuWeeuZmlNRvGGWEXMIP3%2BEt2A0ZQuXkT2PzHyVV5YI73Ht0VNfM46qpedyrcZ4v3oJuwW4Oo1A%3D"}]}
cache-control: max-age=14400
priority: u=3,i=?0
cf-ray: 95fba47ea978b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
200 OK 223 kB URL GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type ASCII text, with very long lines (51734)
Size 223 kB (222931 bytes)
Hash 0329c939fca7c78756b94fbcd95e322b
7b5499b46660a0348cc2b22cae927dcc3fda8b20
0e47f4d2af98bfe77921113c8aaf0c53614f88ff14ff819be6612538611ed3d1
GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Tue, 14 May 2024 21:48:24 GMT
x-amz-meta-sha1sum: 7b5499b46660a0348cc2b22cae927dcc3fda8b20
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Tue, 08 Jul 2025 22:58:17 GMT
expires: Wed, 08 Jul 2026 22:58:17 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"0329c939fca7c78756b94fbcd95e322b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 74cb6ad66f88e47ae011abd64e57e7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: qfTYDXPSo5PZVq90ZHgtJsTLwmdNuoc5bSwWzQ8AKmgkqr4cDZK7LQ==
age: 591996
X-Firefox-Spdy: h2
GET ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
200 OK 10 kB URL GET ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type ASCII text, with very long lines (10450)
Hash e0d37a504604ef874bad26435d62011f
4301f0d2b729ae22adece657d79eccaa25f429b1
c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179
GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Thu, 14 Mar 2024 00:03:58 GMT
x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Tue, 08 Jul 2025 01:41:49 GMT
expires: Wed, 08 Jul 2026 01:41:49 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 74cb6ad66f88e47ae011abd64e57e7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: BRArE_ifwHF_FV_Ia0w_AxhczugMAeggX7V2OMcUJHmOaqCCy3VuVw==
age: 668583
X-Firefox-Spdy: h2
GET rqu.yjzkqbs.es/qraAFhdXthI1l6mBiXSWrjPM7rgFv1aXpn0hUpw7Ak62SeWuvzLym8JHfKY7zKrCH9jAwTPkef240
200 OK 9.6 kB URL GET rqu.yjzkqbs.es/qraAFhdXthI1l6mBiXSWrjPM7rgFv1aXpn0hUpw7Ak62SeWuvzLym8JHfKY7zKrCH9jAwTPkef240
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type RIFF (little-endian) data, Web/P image
Hash 4946eb373b18d178c93d473489673bb6
16477acb73b63ca251d37401249e7e4515febd24
666bc574c9f3fb28a8ac626fa8105c187c2a313736494a06bd5a937473673c92
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /qraAFhdXthI1l6mBiXSWrjPM7rgFv1aXpn0hUpw7Ak62SeWuvzLym8JHfKY7zKrCH9jAwTPkef240 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/webp
content-length: 9648
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="qraAFhdXthI1l6mBiXSWrjPM7rgFv1aXpn0hUpw7Ak62SeWuvzLym8JHfKY7zKrCH9jAwTPkef240"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=FCew40Ua8GvAYgoSUT3oQMWK4Fgdxzl%2BvhhRNtqYHnhQxP2DbSqMEcwry32sq0heosz6qhPy%2BSh1uCDjbfeL5osviWstaGAqW%2BM%3D"}]}
priority: u=4,i=?0
cf-ray: 95fba47ec9b4b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/img/security/default.png
200 OK 1.8 kB URL GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/img/security/default.png
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
Hash 04eeeba5b3538c4524d8e6828ba2c405
8db73b75bc7547a90aebd1377852ea3bf7cbc5ea
da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434
GET /assets/js/sdk/okta-signin-widget/7.18.0/img/security/default.png HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/png
content-length: 1800
server: nginx
last-modified: Tue, 14 May 2024 21:49:26 GMT
x-amz-meta-sha1sum: 8db73b75bc7547a90aebd1377852ea3bf7cbc5ea
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
date: Tue, 08 Jul 2025 10:22:59 GMT
expires: Wed, 08 Jul 2026 10:22:59 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: "04eeeba5b3538c4524d8e6828ba2c405"
x-cache: Hit from cloudfront
via: 1.1 74cb6ad66f88e47ae011abd64e57e7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: tZHARwahBka7fT9zgJREqmWv5nwmceFjybkfFIKXsYEj9Aseg5TCbg==
age: 637314
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 15 Jul 2025 19:24:47 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 95fba45c3be85689-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 410896
expires: Sun, 05 Jul 2026 19:24:47 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5a5X2DGc2fqqM4aVMD7vTz3gjma5uT1L8K7%2Fh0ITY6%2FnQVG%2BqvWVEyy9FL4FQCCTGjVn5edlSr%2BkGPpNaaxflHoNbyruDIzjuHnOH6sIIY9kRKul4XIDxYo1awki2x9Jd35vK0zO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
200 OK 20 kB URL GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 20416, version 2.197
Hash d99a7377dabb55772ca9f986b0a04b57
2b5fcd8431953c44e410d0489899e74f6d2cfecc
affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149
GET /assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20416
date: Sun, 13 Jul 2025 15:12:14 GMT
accept-ranges: bytes
server: nginx
last-modified: Tue, 07 Nov 2023 18:56:28 GMT
etag: "d99a7377dabb55772ca9f986b0a04b57"
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
expires: Mon, 13 Jul 2026 15:12:14 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
x-cache: Hit from cloudfront
via: 1.1 74cb6ad66f88e47ae011abd64e57e7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: LWelAkccV1CnkiHiStqZ-RB7-guFz7kDo65Ckt7FRPyFP5Pxmcy0_w==
age: 187959
X-Firefox-Spdy: h2
GET rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
200 OK 7.2 kB URL User Request GET rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
IP
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type HTML document, ASCII text, with very long lines (2237), with CRLF line terminators
Hash 9766dfbe1bb61032daa19d0d6ac939c9
1a5dc1150ce382f76202baa852784f94afed309d
814da3be83eb672e96454632df38292c1ced4427d205804ed7a6b4ec4c8d3c6b
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
GET /XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Cookie: XSRF-TOKEN=eyJpdiI6IkQ4aEU2RGJWZGlGZmgvSXFoTzE4dnc9PSIsInZhbHVlIjoiQjNMNVNBSEJ2SGdxelB6MWpId0hVN04rZ2FkMzRmcWZseVEwekt5MEROaGZsY01DVGorc015cTV3YjZQa2NEeUx5Z05xMlZFWTFvTThHVVlhMjJDcm91alBVVy9heU82eklLcHNzMEVHaVpPRGxUU1gvelJiMEE0anlsWVlEUy8iLCJtYWMiOiIwYzA2NmIwMTJmOWEzZmYzZGQxOWM0MmEwZjI3OWQ0YzJkNDRmNzNjZGRiOWNlZjMxNzgyZmI5YjI2YzQwMmI5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlpjRUtuc3lyby9DdFpsVWptSDlsZmc9PSIsInZhbHVlIjoiTnMydmdmK2Q0bnczdHRuMHBQM1RQd1dIRHcybDVZS1JJSXNVVEpsTjlRMG5TUEZ6TUw1blk0amdmZ05oOHJjdmVweTVSdTlXS3ptYzduMUZWNG5HdkVxV25zRHFuaU5yUDE1aTBMOW9uREdFelo5R24za0pCMVZYdXhmbkFOaSsiLCJtYWMiOiI4Y2MzYzUxMTQ5MTg2NmFmYWJiY2NmYTdjNTBhNTJiMDI0NTVkZGQ4NzEyZTdlMGJhY2QyOWRlNjhlMmNkODA5IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:47 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Kte72BBpgfameK1PR9mmJBbfcj%2Bk0DmNwKnV5UP2aidjFM5KDC%2FdWGI5%2BQajsSKSYH0OV%2FWkxgX7dS1htMZGwZqA6OpOWUb9u9s%3D"}]}
cf-cache-status: DYNAMIC
priority: u=1,i=?0
content-encoding: br
set-cookie: XSRF-TOKEN=eyJpdiI6ImFmS0hOTW03TzFtdzROYjRwNXhVQWc9PSIsInZhbHVlIjoiTjk1UEJmQklhT1RSS3JrTWhNeVNiY2lSVzQ2WWpFNlRzMkF5bHlHWWRpRXc4Qld6bVJIdjFVaW9HRS9lOTJ0dVZVMEhIU0o2ODZFSkNlc0daSEorZjlobjRRWHF6R21wZjlnK0dKU09wL1U4R1JMYVk4eUs4NWdraWUxOHU0WEwiLCJtYWMiOiI0NjMyM2M3Yjc0NWI3ZWQ4YzFhNDhhNWUwMzZhMDcxMWVkZjM1NGRlOGYyNGY1OTEyNzg2ZjRjNGNjOWIzYjBlIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:47 GMT
laravel_session=eyJpdiI6IkFReEV4WXRLY05uMUJUbnZsYjdqQWc9PSIsInZhbHVlIjoiTlJTS1owSHJVb0h1VFMxcnVNQkR5TlZtSzVPVFRKcjJHVWIzWTFSVUJQOHcrWk1ubHdzYXh2QkN0Y2w5bmh2VHpPUjYzenBJNU5QekFpNUJLcW9VL2JPV2ZxR09mUXFONlAwZ0VJZ2huS0twUEtjU1BKODN3OGZpRE1TZ0VyQWQiLCJtYWMiOiI4YjJlOWM4ZWY2MzQxNzlkYWJiNGNlMzljMjU5NTE4NjczODlhZTAzNDZmMjY5NzJlODBlYTE5MWY4NjczZTBkIiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:47 GMT
cf-ray: 95fba458ea14b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET code.jquery.com/jquery-3.6.0.min.js
200 OK 90 kB URL GET code.jquery.com/jquery-3.6.0.min.js
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerSectigo Limited
Subject*.jquery.com
Fingerprint56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE
ValidityThu, 12 Jun 2025 00:00:00 GMT - Fri, 26 Jun 2026 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 15 Jul 2025 19:24:47 GMT
age: 366417
x-served-by: cache-lga21931-LGA, cache-hel1410022-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 44940
x-timer: S1752607487.456321,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
GET rqu.yjzkqbs.es/rse7quVzmhql4Gi1YCclwV0StpOuvxTbu3rHQWmLYd9mFwFFGjKW5yI2Fef200
200 OK 268 B URL GET rqu.yjzkqbs.es/rse7quVzmhql4Gi1YCclwV0StpOuvxTbu3rHQWmLYd9mFwFFGjKW5yI2Fef200
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type SVG Scalable Vector Graphics image
Hash 59759b80e24a89c8cd029b14700e646d
651b1921c99e143d3c242de3faacfb9ad51dbb53
b02b5df3ecd59d6cd90c60878683477532cbfc24660028657f290bdc7bc774b5
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /rse7quVzmhql4Gi1YCclwV0StpOuvxTbu3rHQWmLYd9mFwFFGjKW5yI2Fef200 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/svg+xml
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="rse7quVzmhql4Gi1YCclwV0StpOuvxTbu3rHQWmLYd9mFwFFGjKW5yI2Fef200"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Ke%2FOvfsaIajFUPvS%2FcVntYRWJdHDxnceVyW9ZAwFLW7WKeeJWVmRXP8EPrNoVukq5CituvZFuEg0PUaZCuHZU3QEWaBj1LQkRrc%3D"}]}
content-encoding: br
priority: u=4,i=?0
vary: accept-encoding
cf-ray: 95fba47eb9a2b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/op2WlUrjha3qzhp8Lz7efX77FcYxjWPxN45140
200 OK 892 B URL GET rqu.yjzkqbs.es/op2WlUrjha3qzhp8Lz7efX77FcYxjWPxN45140
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type RIFF (little-endian) data, Web/P image
Hash 41d62ca205d54a78e4298367482b4e2b
839aae21ed8ecfc238fdc68b93ccb27431cd5393
20a4a780db0bcc047015a0d8037eb4eb58b3e5cb338673799c030a3e1b626b40
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /op2WlUrjha3qzhp8Lz7efX77FcYxjWPxN45140 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/webp
content-length: 892
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="op2WlUrjha3qzhp8Lz7efX77FcYxjWPxN45140"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=PKW9EXo%2Ft3Z4W06Tf4io830RICRrOForPd%2F7%2BXJ1lt7I7b4TBV2sBdztUV7ZC%2BFCFQpf9F1%2BAnkZby71IbtY%2F47xVWZNoX1VlkY%3D"}]}
priority: u=4,i=?0
cf-ray: 95fba47ea980b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/uvP8Lat2BNY25MRWzmIlpcS8JWbE9455gsns8rxsbqjodwCIJ8faBZpnkRpi8ief255
200 OK 18 kB URL GET rqu.yjzkqbs.es/uvP8Lat2BNY25MRWzmIlpcS8JWbE9455gsns8rxsbqjodwCIJ8faBZpnkRpi8ief255
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type RIFF (little-endian) data, Web/P image
Hash 4b52ecdc33382c9dca874f551990e704
8f3bf8e41cd4cdddb17836b261e73f827b84341b
cce050cc3b150c0b370751021bb15018ee2b64ac369e230fe3b571a9b00d4342
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /uvP8Lat2BNY25MRWzmIlpcS8JWbE9455gsns8rxsbqjodwCIJ8faBZpnkRpi8ief255 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/webp
content-length: 17842
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="uvP8Lat2BNY25MRWzmIlpcS8JWbE9455gsns8rxsbqjodwCIJ8faBZpnkRpi8ief255"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=smBr30NfGolFpHHc0aOIrN8ZJaqYGBcYYXZWVA55GLntRBe1lKFIRl%2FMSd14UAjRxN7Cv3w5v5rZtGloUbn%2BiNJdDyT4tuWCXSs%3D"}]}
priority: u=4,i=?0
cf-ray: 95fba47ec9bbb4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
200 OK 27 kB URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type HTML document, ASCII text, with very long lines (27006), with no line terminators
Hash 8a066f723d242dc6bf585a2a89a7b50a
2ee58b80a779bc16d1b41e0848949efefd4dc24f
a80432e0214c5b7a6431ddcf9c538ee6a26405f8ff2b20de3f98db8233d3e0f1
GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/ HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:33 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
content-security-policy: default-src 'none'; script-src 'nonce-ydESpDkUQaoLQu6D' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
origin-agent-cluster: ?1
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
referrer-policy: same-origin
document-policy: js-profiling
priority: u=4,i=?0
server: cloudflare
cf-ray: 95fba403ded25697-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
200 OK 217 kB URL User Request GET rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
IP
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type HTML document, ASCII text, with very long lines (11203), with CRLF line terminators
Size 217 kB (216983 bytes)
Hash ff81ce8045c633d683e8a646d3c25b66
72526db816ba7fd42bc054b51fac8a1635bb7a41
27aaab591c55d98f13a6202573a02003df16f6775b92df8cf46f2843bfb14259
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
GET /yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Cookie: XSRF-TOKEN=eyJpdiI6InFOOWthR05NT3ltQmF4VDBUbWxzV1E9PSIsInZhbHVlIjoieFZsN0ZkbllnczkwYkxzV0hOWmRWQlF0TmtXeSs2dXJyU0RFM0l6R1ZSWlY1eXM2Y2J5Z2lRNk5PWXg5ZUxJSm03bG9ZWmlodFNGcHZWbm9hUkJKRzZkUE1KQ0d4L1Q0WlFSN1hYaHJSRzJDK1RreHdBcjRwRFpYaVRpUkc1TGoiLCJtYWMiOiJiNWEwMTIwMjcwNzM2ZmIwMjAzZjc2MDM5Y2EyN2Y0ZWYyN2NkZTQxMjI0ZTQxNDJmZTRmZWQ1OWI5MDdmMWZjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQ0QnI2Z0Z4VHNsRFpyMEI5ZlVOdFE9PSIsInZhbHVlIjoidWxvUnloVE9xKzN1ZkZ4WDk1UmR4N2Z5MS9adXYyTlRlTzNiMUpYY2w1VllFWlJDK0IwcmxNRGxybWZwTnMvU0ZCOWtESjJYaGRKbjV2eGpMREY0ZzAyWGtKSm1CWXZVYUFCMTg0Qk1oUEQrVXJHT3pmOW9qUHlOTjR0dE1jWTIiLCJtYWMiOiI5NWEwNTE0NmE5YmNlOGMyMmQyNzJhYzc4OTVhMzkzODZjNDQwMWFjY2IyODE5ZTg5M2EwOWYxMTA3MzNmZTY1IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:52 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JXrLGFGRs50yYw0e%2B3GKapsBQLz2JxjMon%2FtI%2FoOOsHQCF%2FkZj5soYycrIZcsvzMnBOe9sCllE%2BgzBWJSaysd9b46Lye8QW8aag%3D"}]}
cf-cache-status: DYNAMIC
priority: u=1,i=?0
content-encoding: br
set-cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:51 GMT
laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:51 GMT
cf-ray: 95fba4733856b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:52 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 95fba47ceb6c5699-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 410901
expires: Sun, 05 Jul 2026 19:24:52 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jBlbS3ue2H80zPBe6t3J1E%2F%2B%2By7xupczh7DpoHVhBrd3u%2FyD%2FMHjhYcZOduLI9uAxChTm%2B%2BWj%2BVHpvy47AIIX8XahGOMwOE1CD4t6xL%2BZhpo7f9u3xHVPdkxakCQAt9Zl1amAjMI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/GDSherpa-bold.woff
200 OK 36 kB URL GET rqu.yjzkqbs.es/GDSherpa-bold.woff
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type Web Open Font Format, TrueType, length 35970, version 1.0
Hash 496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-bold.woff HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: font/woff
content-length: 35970
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-bold.woff"
cf-cache-status: MISS
age: 2147
last-modified: Tue, 15 Jul 2025 18:49:06 GMT
accept-ranges: bytes
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2TKDkeOAhfAOf5lxbEuDMnmQheH28NDXLtxy2ILNheCCCO4e%2FT1ZQkbE4eipch9dCV52W%2FVHoA8f6V7KNwpYrJziYSDaqdh0"}]}
cache-control: max-age=14400
priority: u=3,i=?0
cf-ray: 95fba47e8912b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/GDSherpa-regular.woff2
200 OK 29 kB URL GET rqu.yjzkqbs.es/GDSherpa-regular.woff2
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Hash 17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-regular.woff2 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: font/woff2
content-length: 28584
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-regular.woff2"
cf-cache-status: MISS
age: 2147
last-modified: Tue, 15 Jul 2025 18:49:06 GMT
accept-ranges: bytes
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NWRDGpJ%2B8p5hBdbLBFg2mrOMmQvNiE6wwAFJ8jLTB0fUbDFVHuZZHak%2Fx%2FIdlYne%2Fpzhy9ebffHg69Oa457zdR8RPUQqTqvM1xE%3D"}]}
cache-control: max-age=14400
priority: u=3,i=?0
cf-ray: 95fba47e9925b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET code.jquery.com/jquery-3.6.0.min.js
200 OK 90 kB URL GET code.jquery.com/jquery-3.6.0.min.js
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerSectigo Limited
Subject*.jquery.com
Fingerprint56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE
ValidityThu, 12 Jun 2025 00:00:00 GMT - Fri, 26 Jun 2026 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 15 Jul 2025 19:24:52 GMT
age: 366422
x-served-by: cache-lga21931-LGA, cache-hel1410022-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 44943
x-timer: S1752607493.870703,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
GET rqu.yjzkqbs.es/abLzEv86HrsOuTef22
200 OK 36 kB URL GET rqu.yjzkqbs.es/abLzEv86HrsOuTef22
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type ASCII text, with CRLF line terminators
Hash 38501e3fbbbd89b56aa5ba35de1a32fe
d9b31981b6f834e8480ba28fbc1cff1be772f589
a1ca6b381cb01968851c98512c6e7f6c5309a49f7a16b864813135cbff82a85b
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /abLzEv86HrsOuTef22 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: text/css;charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="abLzEv86HrsOuTef22"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=FEzVEJ0aggmRhW604GeLT1vF%2BA0M%2FB4ifI%2Bp5E6UcysJ9nEa%2FyEY5IlpPxyXrbrRAxZOKoBIaXBjQPiap%2FyUkTbGLg4UVwan2T8%3D"}]}
content-encoding: br
priority: u=2,i=?0
vary: accept-encoding
cf-ray: 95fba47e78feb4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/56bJg9bpiEyyPwuhhghsJ595VL2uLMJ67108
200 OK 294 kB URL GET rqu.yjzkqbs.es/56bJg9bpiEyyPwuhhghsJ595VL2uLMJ67108
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size 294 kB (293461 bytes)
Hash 9517afbe907f00c154c9f8823d82750c
2d0c7bac8055c5e6fc95ca7b4f1e9883fc353076
b1e2c075c27642b16aa07a432b373272ae70d32c6b102e841b16c97994882890
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /56bJg9bpiEyyPwuhhghsJ595VL2uLMJ67108 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: application/javascript
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="56bJg9bpiEyyPwuhhghsJ595VL2uLMJ67108"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cQGXlOfXCV%2F8qkzaxpKsz2ZY3pHR2pnZ9YY1P6%2BNzZQPQTB8EAv5ZrfLwZqKsBzcVtCu5pHxi6oToWjiyNDOyY7atrbTQuck"}]}
content-encoding: br
priority: u=3,i=?0
vary: accept-encoding
cf-ray: 95fba47ec9bfb4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 95fba481fc225699-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 410902
expires: Sun, 05 Jul 2026 19:24:53 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G14ycODUds%2FKIOI5L9y4DPqZAK3jW104AEeX1ltjjXiFS0I0AS3SdB%2BaJnhHcyrZt8OGdw3XYqRdniSL8KuMsSHvv2kzfKqb7ye4KRNhEHlhZhRcJS9cNw8xKkVSfT5nnRN%2BGsFs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-light-webfont.aba797dabec6686294a9.woff2
200 OK 20 kB URL GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-light-webfont.aba797dabec6686294a9.woff2
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 20052, version 2.197
Hash 3bf194f33d52c87ea38f13e04fd41950
28b8b4bd234dde07b7ee63a6d32c6f275f03eca1
018930498a4b01e598099a6e45d7316d54c7b1411ce2b741a3b1f1b0ed4e578b
GET /assets/loginpage/font/assets/proximanova-light-webfont.aba797dabec6686294a9.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20052
date: Fri, 11 Jul 2025 09:03:51 GMT
accept-ranges: bytes
server: nginx
last-modified: Tue, 07 Nov 2023 18:58:19 GMT
etag: "3bf194f33d52c87ea38f13e04fd41950"
x-amz-meta-sha1sum: 28b8b4bd234dde07b7ee63a6d32c6f275f03eca1
expires: Sat, 11 Jul 2026 09:03:51 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
x-cache: Hit from cloudfront
via: 1.1 74cb6ad66f88e47ae011abd64e57e7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: G8AWhXF83QIppKEWW8mu_LeDCeIsnvP4RQe1yoYxbIl9MnisdNl1Pw==
age: 382862
X-Firefox-Spdy: h2
GET get.geojs.io/v1/ip/geo.json
200 OK 335 B URL GET get.geojs.io/v1/ip/geo.json
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectgeojs.io
FingerprintA3:C6:58:F9:E8:49:67:61:59:AC:B4:7D:C8:2F:CB:C3:EC:B2:82:9B
ValidityThu, 26 Jun 2025 06:15:54 GMT - Wed, 24 Sep 2025 07:15:44 GMT
Hash 499a23c1491cb10c3a6bfccab779911c
bf28afd4bdb44e26347af9816a07b0c79dcf8602
87a6393a961536e63e7d093a365eae9b13208ff5bd1c3cbe2f0f02bc329df30b
GET /v1/ip/geo.json HTTP/1.1
Host: get.geojs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 15 Jul 2025 19:24:55 GMT
content-type: application/json
server: cloudflare
x-request-id: b10ded8bf92b84b48d4bed52f0c4aff4-ASH
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
geojs-backend: ash-01
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
x-content-type-options: nosniff
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=q46wNZES%2BqEdWp0oPNYfTKLKjVKq3NCE5FTm6wCaniGaUqWb7q8bpRU%2BLtLBuZluMYyTW87afB8npneMTgViYIFjMO3Nk9s%3D"}]}
content-encoding: br
cf-ray: 95fba48f3961b4eb-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
200 OK 1.9 kB URL User Request GET rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
IP
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type HTML document, ASCII text
Hash 745ae8e1ec39cc9259aa510adb12287f
6740d623186d79532c3fdcfe8f64925a7b5ae7d4
e1f49c66896940a0f4063dd2276ad921fb9628cab6cdb64ae3ef1eddbbbcebc4
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
GET /XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 15 Jul 2025 19:24:32 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=DEY%2Biou%2BiTEkD2IfMS6xv1Hu3R2GziaBVx620c%2B0j7LCo%2FqeUPxidAA18mC6HA3ICnGLIAYmY12zPq3tynrejs2igcogcK12hDk%3D"}]}
cf-cache-status: DYNAMIC
content-encoding: br
set-cookie: XSRF-TOKEN=eyJpdiI6IkFaUkJ5ZDM3MFMwMUZtV2daTE14bVE9PSIsInZhbHVlIjoiZUFLMkF0Ujd4TGdLbWc4REtvcGpHYVhtMklidmRtSlgyZHYxblZLZ2JVMW9kM1BHK3grRmhMRHR4Wi9rdk1vRC9QUFpIaWpxOWMveTVHZFVyenNQbTJwR3FPR2VHM2JzVUpQaEFSSFBsWWVQS012L1hSWHNERk5FTjJCMkhxVlgiLCJtYWMiOiIzYzgzY2YxNmEzNmQ1ZWYxYmMyN2NjYjlkNWZhYTg1ZDI3NTRiNzNjYzg4YmUyOWI5ZWIxYzVkOWM2OTJlNGJjIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:32 GMT
laravel_session=eyJpdiI6Ilg0dWt6MXVxMDV4RmM1QjlTR2lTYlE9PSIsInZhbHVlIjoiUGlMRk1KdjdLRkdtV0U0djRwcWQzVUY5cWUrQitaSldSNDZRSVpmcWk0SzhReHZYZ1I0ODJxamFoaUt6QzNPR1FWbStFYVVvM1lSQXV4VXhzekIrNmZ5YWV1ZG9BU3BMWmFUenlPWXl6cnZnZU9TcWxJdXFKb0NZVm9lejFlVEwiLCJtYWMiOiJiY2M3ZTJkNTc5NzQ0YWZkZWI0NzZlNDg1MDY3MmU0MGZmODY1ZWZkOTAyZDJlMzlmYWY5OTM3ZTAyZjlmNjg4IiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:32 GMT
cf-ray: 95fba3fc487f7127-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
POST rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
200 OK 90 B URL User Request POST rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
IP
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type HTML document, ASCII text, with no line terminators
Hash 7828f7ae07241c0978ce44e5cc4a0a83
a9c93817a15b03507c3c21021fba863d3ac62b7f
a65713ab569fbcda76f7d8cd7827b5cc51b58eb5d1b03b50c91924ba9c785fd9
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
POST /XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 1008
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Cookie: XSRF-TOKEN=eyJpdiI6IkFaUkJ5ZDM3MFMwMUZtV2daTE14bVE9PSIsInZhbHVlIjoiZUFLMkF0Ujd4TGdLbWc4REtvcGpHYVhtMklidmRtSlgyZHYxblZLZ2JVMW9kM1BHK3grRmhMRHR4Wi9rdk1vRC9QUFpIaWpxOWMveTVHZFVyenNQbTJwR3FPR2VHM2JzVUpQaEFSSFBsWWVQS012L1hSWHNERk5FTjJCMkhxVlgiLCJtYWMiOiIzYzgzY2YxNmEzNmQ1ZWYxYmMyN2NjYjlkNWZhYTg1ZDI3NTRiNzNjYzg4YmUyOWI5ZWIxYzVkOWM2OTJlNGJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilg0dWt6MXVxMDV4RmM1QjlTR2lTYlE9PSIsInZhbHVlIjoiUGlMRk1KdjdLRkdtV0U0djRwcWQzVUY5cWUrQitaSldSNDZRSVpmcWk0SzhReHZYZ1I0ODJxamFoaUt6QzNPR1FWbStFYVVvM1lSQXV4VXhzekIrNmZ5YWV1ZG9BU3BMWmFUenlPWXl6cnZnZU9TcWxJdXFKb0NZVm9lejFlVEwiLCJtYWMiOiJiY2M3ZTJkNTc5NzQ0YWZkZWI0NzZlNDg1MDY3MmU0MGZmODY1ZWZkOTAyZDJlMzlmYWY5OTM3ZTAyZjlmNjg4IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:46 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Fkdfx82tS9YF8JfJMOCizDcvkwkvtgJfl7gQVsGRxs9FNk6o2SRbC1HWH2biyv8YFVPq0LxSByZ2QyCRVL%2BCR2Un0LxzanEYhYY%3D"}]}
cf-cache-status: DYNAMIC
priority: u=1,i=?0
content-encoding: br
set-cookie: XSRF-TOKEN=eyJpdiI6IkQ4aEU2RGJWZGlGZmgvSXFoTzE4dnc9PSIsInZhbHVlIjoiQjNMNVNBSEJ2SGdxelB6MWpId0hVN04rZ2FkMzRmcWZseVEwekt5MEROaGZsY01DVGorc015cTV3YjZQa2NEeUx5Z05xMlZFWTFvTThHVVlhMjJDcm91alBVVy9heU82eklLcHNzMEVHaVpPRGxUU1gvelJiMEE0anlsWVlEUy8iLCJtYWMiOiIwYzA2NmIwMTJmOWEzZmYzZGQxOWM0MmEwZjI3OWQ0YzJkNDRmNzNjZGRiOWNlZjMxNzgyZmI5YjI2YzQwMmI5IiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:46 GMT
laravel_session=eyJpdiI6IlpjRUtuc3lyby9DdFpsVWptSDlsZmc9PSIsInZhbHVlIjoiTnMydmdmK2Q0bnczdHRuMHBQM1RQd1dIRHcybDVZS1JJSXNVVEpsTjlRMG5TUEZ6TUw1blk0amdmZ05oOHJjdmVweTVSdTlXS3ptYzduMUZWNG5HdkVxV25zRHFuaU5yUDE1aTBMOW9uREdFelo5R24za0pCMVZYdXhmbkFOaSsiLCJtYWMiOiI4Y2MzYzUxMTQ5MTg2NmFmYWJiY2NmYTdjNTBhNTJiMDI0NTVkZGQ4NzEyZTdlMGJhY2QyOWRlNjhlMmNkODA5IiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:46 GMT
cf-ray: 95fba453ba91b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET y8qg.kvcirm.es/kanjari!jd4zd
200 OK 1 B URL GET y8qg.kvcirm.es/kanjari!jd4zd
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectkvcirm.es
FingerprintAA:42:7A:7F:E2:86:D5:89:2D:1D:4A:F6:B4:C5:87:AC:E2:AF:55:50
ValidityTue, 24 Jun 2025 23:18:42 GMT - Tue, 23 Sep 2025 00:17:09 GMT
File type very short file (no magic)
Hash cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /kanjari!jd4zd HTTP/1.1
Host: y8qg.kvcirm.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 15 Jul 2025 19:24:48 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
access-control-allow-origin: *
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=M58dYb2m5%2Bvm3f3V6wrQBEZxDrBHswXpYhqQrCKFAqP%2F%2FsbmhWhfWhz29UgFfhgnJxjNccpYc9ereHgO0z25ob9PHlXM%2Ffh3TFj78w%3D%3D"}]}
content-encoding: br
cf-ray: 95fba45f0a250b51-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:52 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 95fba47d5ca45699-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 410901
expires: Sun, 05 Jul 2026 19:24:52 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F3aJVaxo12tzxeBTMzQGxThJ1QPceO38WXgR3RJBIa12A3HNwiUXM6BOxUSSkVhpbCcdTMtw85vZjosb5doPHCMEuyIWZGnLzJkH0g7Y6vkojZFjY6ml02AHUa9JTYG6n9nYNHZc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/ijZYLZBaoDlZgOQdr53b8QsfDJ0rhrsq72zPVU60JP3mnGYw48EiUCqiPhfysXpP7uWc3kUM12202
200 OK 25 kB URL GET rqu.yjzkqbs.es/ijZYLZBaoDlZgOQdr53b8QsfDJ0rhrsq72zPVU60JP3mnGYw48EiUCqiPhfysXpP7uWc3kUM12202
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type RIFF (little-endian) data, Web/P image
Hash f9a795e2270664a7a169c73b6d84a575
0fbb60ab27ab88c064eb347d0722c8ed4cf5e8b8
d00203b2eea6e418c31baafa949ada5349a9f9b7e99fa003aec7406822693740
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /ijZYLZBaoDlZgOQdr53b8QsfDJ0rhrsq72zPVU60JP3mnGYw48EiUCqiPhfysXpP7uWc3kUM12202 HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/webp
content-length: 25216
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="ijZYLZBaoDlZgOQdr53b8QsfDJ0rhrsq72zPVU60JP3mnGYw48EiUCqiPhfysXpP7uWc3kUM12202"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=0g6il3tqB4rKTaBMZtysn0Id7ZvxynHpL9jjW7oMGjfdn642HGAJm0ACXBbWFH6zusAHz%2F2hTlFKS9fMQp4HJVdZBDMRmn7a8Xk%3D"}]}
priority: u=4,i=?0
cf-ray: 95fba47ec9b1b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET challenges.cloudflare.com/turnstile/v0/g/01a6b50f61fd/api.js
200 OK 49 kB URL GET challenges.cloudflare.com/turnstile/v0/g/01a6b50f61fd/api.js
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type JavaScript source, ASCII text, with very long lines (48827)
Hash 707a05535c9f035d06963e6bd60b1bad
3dd101c54d1bd9ce2a3ee2d03284f95acde594da
ac0d4e7a101b3dca7dabdbb9c04424dd776496494730d046391ee590f3502713
GET /turnstile/v0/g/01a6b50f61fd/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 15 Jul 2025 19:24:33 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Thu, 10 Jul 2025 13:50:19 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 95fba4030eec712a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
POST rqu.yjzkqbs.es/yrP8hhTkYf7i1Y7Cu28psTsquUI9t5CEqhmq9kgQvywjKPBVD4af5bh5dz
200 OK 1 B URL POST rqu.yjzkqbs.es/yrP8hhTkYf7i1Y7Cu28psTsquUI9t5CEqhmq9kgQvywjKPBVD4af5bh5dz
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type very short file (no magic)
Hash c4ca4238a0b923820dcc509a6f75849b
356a192b7913b04c54574d18c28d46e6395428ab
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
POST /yrP8hhTkYf7i1Y7Cu28psTsquUI9t5CEqhmq9kgQvywjKPBVD4af5bh5dz HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 3072
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6Ikw2dlN4L2RtQjR6WHNnOTJJZGpsTlE9PSIsInZhbHVlIjoiVFpVQU5iTWlzVEUyWXZRYWpzYmlWM2dxMGN3NVpJQ2JyeU5ObW1jSUF5cFdVUVM2cklYMUo1SDFLZmZBNGZTZW0wMGRvT2lxcVhrWmFyc0g4UUk0clFMcHBrN2k5TzV0dHZsY2VZMk9FQ1Y5b2RMZjkwT29RRjZoOHh0Q2tmY2giLCJtYWMiOiJkZjhhNzY0NTMxYjI4MmY2YmI4OGJhMDdjMDBjYmU5ZTE5ZTY2NTBhYmFlMTk0NzY4MmRlYjYyMmNjZTRhMTE2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlZ6V0tTNlhsM3ZuWjVFUk9xWTZhMXc9PSIsInZhbHVlIjoidng0R2EyRWM5cFIzYWdIRkVCRCtMaC8waHhMM0x6dVYyUzgwaUE0bEFXZjJvdHhrWXIrbnVDSS9XQk1HVm12anhYSWhyZytLQ1JMU1lLNnk3dm4vOFpmcUR6NUpVQ0ptMmFMOFFqLzFCMDJYQTkrVElsRlNxN0pRQmJJMUx4d3UiLCJtYWMiOiI3YjYzYTljYzlkOWM5ZThhMWVjMjkxZWJiZDU2NjUzZTZhNGI0MWZkNjFhZDUwYTQ1M2RjM2M4NGU5YjNmZmE2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:54 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Pxa%2BAEg2bokXiCSaxwUHIXBBmLOYI%2F4M%2Fb2QkJoJlUTQYCzq7HKuMZ3wUNoLzT9GMxVlqHPEY58wwpSFZO6V9LhKR%2FeDCRhm3yc%3D"}]}
cf-cache-status: DYNAMIC
priority: u=3,i=?0
content-encoding: br
set-cookie: XSRF-TOKEN=eyJpdiI6IjRvNWE3d2VUVktjb2lXTzJPa1lnZEE9PSIsInZhbHVlIjoiZE5iY2hwVlNlaDhGTlpoRXErVWJDa1h0WGs4TTFJQjVSWmRxQkNFSllCKyt5VUV0RVBFOHpVbnFjaHlWNDUyVFI4Y3JnRTc1VGpoa2dQSVE2MTlVV1doT1Foa1JoVFN0dnNSSzVFa0dvY1RCay9lR1VGdFQ4MFFWalRSRWI0T28iLCJtYWMiOiI5MjAyNzc4OGQzY2Q4YjZmODUyY2YxOWQ4ZTcxMjcxNTExNjE3NzIxNGE2MzliYWM3YTI1MWVjNGUwZGFmNGViIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:54 GMT
laravel_session=eyJpdiI6ImNNdURlSkpCbEY5aEdTcVdPS0VNYmc9PSIsInZhbHVlIjoiSnBRZEtMR0JZczlNaURpNXNqalJ4QWNEcVVvZktwS3VZWXVHczhBdElRaVVUMExvdFdlL2FucVFFdjhVY1JJN2J4S1JBWjg3NHZGdXJudjVlQkVFZTdiWVA4N3MxdkZ3Z0puckNrZ1JXODdCL0Z2NEpPVXpxUXE5R3FUMEtxejEiLCJtYWMiOiJlNTZiMWRlMDljOTEwZDE0MzI2MzVjMzQ4YTBlYmI2ZjFlNDg5ODYyOTY3NDY0ZGRmYzY2ZWEwYmY2MTNiNDgwIiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:54 GMT
cf-ray: 95fba4841a55b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
200 OK 1.9 kB URL GET aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint38:05:DB:30:B5:83:1A:A0:A9:AD:24:B2:62:0F:E7:F6:60:9B:7C:00
ValidityTue, 29 Oct 2024 00:00:00 GMT - Wed, 29 Oct 2025 23:59:59 GMT
File type SVG Scalable Vector Graphics image
Hash bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 15 Jul 2025 19:24:53 GMT
content-type: image/svg+xml
content-length: 673
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Wed, 24 May 2023 10:11:46 GMT
etag: 0x8DB5C3F47E260FD
x-ms-request-id: 099c66cc-e01e-005c-2714-f1960e000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20250715T192453Z-156d7cb4cf8q5jpnhC1SVG2rpc0000000be0000000005tfs
x-fd-int-roxy-purgeid: 4554691
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=95fba403ded25697&lang=auto
200 OK 142 kB URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=95fba403ded25697&lang=auto
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size 142 kB (142016 bytes)
Hash ef35f44e6c0fbf65e1a05dcdfbc5a8db
e6d90a7543d12203354c8fe470191316ed6c92b0
695e799277b6cc5c515f714ff0b9736debc4bb98bc39e44ee2d5c9d95b274099
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=95fba403ded25697&lang=auto HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/a07hf/0x4AAAAAABgwsYRSaGvLZvP-/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:33 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
priority: u=3,i=?0
server: cloudflare
cf-ray: 95fba404afe75697-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST rqu.yjzkqbs.es/bg0FcdExZ39pfSHvHN2DYBhjd
200 OK 20 B URL POST rqu.yjzkqbs.es/bg0FcdExZ39pfSHvHN2DYBhjd
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
Hash 5820854f62a6eb3d38ba7ba0d1b3ea75
639df0b84fe699b4a290a713fd6b9a94bd4deb95
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
POST /bg0FcdExZ39pfSHvHN2DYBhjd HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Content-Type: multipart/form-data; boundary=---------------------------211238976128447790593614201098
Content-Length: 328
Origin: https://rqu.yjzkqbs.es
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImFmS0hOTW03TzFtdzROYjRwNXhVQWc9PSIsInZhbHVlIjoiTjk1UEJmQklhT1RSS3JrTWhNeVNiY2lSVzQ2WWpFNlRzMkF5bHlHWWRpRXc4Qld6bVJIdjFVaW9HRS9lOTJ0dVZVMEhIU0o2ODZFSkNlc0daSEorZjlobjRRWHF6R21wZjlnK0dKU09wL1U4R1JMYVk4eUs4NWdraWUxOHU0WEwiLCJtYWMiOiI0NjMyM2M3Yjc0NWI3ZWQ4YzFhNDhhNWUwMzZhMDcxMWVkZjM1NGRlOGYyNGY1OTEyNzg2ZjRjNGNjOWIzYjBlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkFReEV4WXRLY05uMUJUbnZsYjdqQWc9PSIsInZhbHVlIjoiTlJTS1owSHJVb0h1VFMxcnVNQkR5TlZtSzVPVFRKcjJHVWIzWTFSVUJQOHcrWk1ubHdzYXh2QkN0Y2w5bmh2VHpPUjYzenBJNU5QekFpNUJLcW9VL2JPV2ZxR09mUXFONlAwZ0VJZ2huS0twUEtjU1BKODN3OGZpRE1TZ0VyQWQiLCJtYWMiOiI4YjJlOWM4ZWY2MzQxNzlkYWJiNGNlMzljMjU5NTE4NjczODlhZTAzNDZmMjY5NzJlODBlYTE5MWY4NjczZTBkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:49 GMT
content-type: application/json
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UaWiqdStrrccwwcplp2yX%2FshzIeL09O7FvTfugsex4oKbeBYIrjeKlf1cAG0k50HL2d5N5c7iArsCpUeKAGT9EkyPY8becDttZ8%3D"}]}
content-encoding: br
priority: u=4,i=?0
vary: accept-encoding
set-cookie: XSRF-TOKEN=eyJpdiI6IkYvNHdSTCs2MXZQQ0diNmFZelNPZ3c9PSIsInZhbHVlIjoiRXlNK01XcG9ENkZpRXlsenFheWIvS1BkeENTVGhMNUxiczhNcWRsUktQdW85NzR3K0hFeEpWQU5ZVTVhY29HakxWNThjVkNmdkhieDBSSnhxd0RiOUordUN2Vmc2K1c4cG5RVWVBZ1RMNWNJWjdMME9qODZaRTlMOVlKVTZ4UVgiLCJtYWMiOiI4Y2JmYWNlM2IyMWY0OTY5ZjdmZjYyM2YyMTZmOThiMWJmN2MzMWYwMTVlZDg4ZDQyOWQ5Mzk0OWU5YjI4NjgyIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:49 GMT
laravel_session=eyJpdiI6IjdRUS93OEFhRkxSZlpQMXFNVm0xT1E9PSIsInZhbHVlIjoiZk9SSXJ6RkJOY2lhRlk2RG9SY09tYW53K3AzaE9LUDQ0R0pvaENVZENiRTh2QUhuZEhmbmpqNHQ1S1pqRURrWE5KUk1wMXJ2dTQvcy9aR1Vqc2xYT1Rqb2hza1JuMVNUMDNYbHdPdFRRNGIzZVBIRitjOVpjT2JFTHNTd0pqLy8iLCJtYWMiOiI0YzU3ZmRiZmYxOTM4YzU1MjE1OWIxNTYxNjU0YTg2MjkwYTZkMTM0MDkyYzljNjUzMGMxZGE4YTUzYTYwZDY1IiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:49 GMT
cf-ray: 95fba4665e5fb4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
200 OK 26 kB URL User Request GET rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
IP
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
File type JavaScript source, ASCII text, with very long lines (24817), with CRLF line terminators
Hash 68203924d098b45f25578b66c75ca080
028cd916c1e62d1796754bdbc6a6797d4484d769
564630a3cbeab9f5e780b77b3a1c021e87279fa465ce6d5753c0cf2c2f7605b7
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
GET /XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkYvNHdSTCs2MXZQQ0diNmFZelNPZ3c9PSIsInZhbHVlIjoiRXlNK01XcG9ENkZpRXlsenFheWIvS1BkeENTVGhMNUxiczhNcWRsUktQdW85NzR3K0hFeEpWQU5ZVTVhY29HakxWNThjVkNmdkhieDBSSnhxd0RiOUordUN2Vmc2K1c4cG5RVWVBZ1RMNWNJWjdMME9qODZaRTlMOVlKVTZ4UVgiLCJtYWMiOiI4Y2JmYWNlM2IyMWY0OTY5ZjdmZjYyM2YyMTZmOThiMWJmN2MzMWYwMTVlZDg4ZDQyOWQ5Mzk0OWU5YjI4NjgyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdRUS93OEFhRkxSZlpQMXFNVm0xT1E9PSIsInZhbHVlIjoiZk9SSXJ6RkJOY2lhRlk2RG9SY09tYW53K3AzaE9LUDQ0R0pvaENVZENiRTh2QUhuZEhmbmpqNHQ1S1pqRURrWE5KUk1wMXJ2dTQvcy9aR1Vqc2xYT1Rqb2hza1JuMVNUMDNYbHdPdFRRNGIzZVBIRitjOVpjT2JFTHNTd0pqLy8iLCJtYWMiOiI0YzU3ZmRiZmYxOTM4YzU1MjE1OWIxNTYxNjU0YTg2MjkwYTZkMTM0MDkyYzljNjUzMGMxZGE4YTUzYTYwZDY1IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:50 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Qd0dopIsY8yh6LT4gDgR%2BDSNSs6xXoG%2FU7aYEKGeGt4bSz7ccp3jrV0%2FpvtB1xCGfChJdP7pW26xu42qALleXE4OZjjPUJUXFTU%3D"}]}
cf-cache-status: DYNAMIC
priority: u=1,i=?0
content-encoding: br
set-cookie: XSRF-TOKEN=eyJpdiI6ImRScS8wZVh2UVR6eTNQdWlsM3plb0E9PSIsInZhbHVlIjoiQTk3Q3lGcVVOOEQvMnBMWjJCQ0x5bm1laHNjQjFzQkZDWWw4cUNycUNZZGkyYXFZeGRvd25VZkc4Y3NLb1NGVGhodExoL21nWjU0RjVWWlBwRVhTdi9pSk1ndWtyWUdPdUljSEViaUtGUUNCYXM5d2t4T2xWY1BJdnliVnM1bEciLCJtYWMiOiI3MjVkNjJjNTJiZDQyMjNhYjQxMDRiMDhhMzZkNWI0YTM2Y2IwYWM2YjQ0NTEwYTg4ZTc3MTZjMmU2ZWUxNGQ4IiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:49 GMT
laravel_session=eyJpdiI6Img2K3E2NXF6QStmdFc1a1dpbm5Td0E9PSIsInZhbHVlIjoiUTI0TlQxQjU2SWNUTTJRcGo2UjdxTjhRdTBsL3VkUExTNjAveG80MllWSUY1TkIrQmVFcndwaE9XbGhWNGFicW1VSXZEZ0ZnUmlaeDJmN0wzVjQwRWtpLzl1NG1iSTQvZzE3OGdUVldkZHpTUkl6MEF4bEJpQkNobTRIMjV2a0wiLCJtYWMiOiI5ZDE2NThkN2FkMGZmNWUxODViOTUyMDVkYTliYjg1YjAxZTQxMjdiZGQ0NmY2MDkxM2ZlOGIyMWFmZGNlMTc3IiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Tue, 15 Jul 2025 21:24:49 GMT
cf-ray: 95fba4691a2bb4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET code.jquery.com/jquery-3.6.0.min.js
200 OK 90 kB URL GET code.jquery.com/jquery-3.6.0.min.js
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerSectigo Limited
Subject*.jquery.com
Fingerprint56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE
ValidityThu, 12 Jun 2025 00:00:00 GMT - Fri, 26 Jun 2026 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 15 Jul 2025 19:24:50 GMT
age: 366420
x-served-by: cache-lga21931-LGA, cache-hel1410022-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 44942
x-timer: S1752607490.422992,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 15 Jul 2025 19:24:50 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 95fba46f1cb25699-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 410899
expires: Sun, 05 Jul 2026 19:24:50 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9V7y8y1GWS9Sm1KoKd%2BBTWTW%2FFt8O6m2zybNDXUbVt8lrAjnP0Bz3mRidYe7p70fNOSUAr0iDW1A3vmYcZSSfF6przqJzJW9CO70H10l1xvYd7dQ5dPhienrUTe%2F2rFvzcv9x%2Fvy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/favicon.ico
404 Not Found 0 B URL GET rqu.yjzkqbs.es/favicon.ico
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /favicon.ico HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Cookie: XSRF-TOKEN=eyJpdiI6ImFmS0hOTW03TzFtdzROYjRwNXhVQWc9PSIsInZhbHVlIjoiTjk1UEJmQklhT1RSS3JrTWhNeVNiY2lSVzQ2WWpFNlRzMkF5bHlHWWRpRXc4Qld6bVJIdjFVaW9HRS9lOTJ0dVZVMEhIU0o2ODZFSkNlc0daSEorZjlobjRRWHF6R21wZjlnK0dKU09wL1U4R1JMYVk4eUs4NWdraWUxOHU0WEwiLCJtYWMiOiI0NjMyM2M3Yjc0NWI3ZWQ4YzFhNDhhNWUwMzZhMDcxMWVkZjM1NGRlOGYyNGY1OTEyNzg2ZjRjNGNjOWIzYjBlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkFReEV4WXRLY05uMUJUbnZsYjdqQWc9PSIsInZhbHVlIjoiTlJTS1owSHJVb0h1VFMxcnVNQkR5TlZtSzVPVFRKcjJHVWIzWTFSVUJQOHcrWk1ubHdzYXh2QkN0Y2w5bmh2VHpPUjYzenBJNU5QekFpNUJLcW9VL2JPV2ZxR09mUXFONlAwZ0VJZ2huS0twUEtjU1BKODN3OGZpRE1TZ0VyQWQiLCJtYWMiOiI4YjJlOWM4ZWY2MzQxNzlkYWJiNGNlMzljMjU5NTE4NjczODlhZTAzNDZmMjY5NzJlODBlYTE5MWY4NjczZTBkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Tue, 15 Jul 2025 19:24:47 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=n4lT8GBrSLuP2Wx4PujVby1tdbqrjfRMenjLt8Mv5ZyyY2d2EG8FaldyVC9eoYOIqp%2BKk6DrEaE7I1a66DoOKX8DDR2jo7AcizA%3D"}]}
cf-cache-status: HIT
age: 13
vary: accept-encoding
cache-control: max-age=14400
priority: u=6,i=?0
content-encoding: br
cf-ray: 95fba45df9f1b4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET rqu.yjzkqbs.es/favicon.ico
404 Not Found 0 B URL GET rqu.yjzkqbs.es/favicon.ico
IP
Requested by https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectyjzkqbs.es
Fingerprint76:25:FD:BB:40:6B:0D:23:24:3D:16:55:7C:B1:5F:9C:C7:97:C3:20
ValidityTue, 10 Jun 2025 23:17:36 GMT - Tue, 09 Sep 2025 00:15:47 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /favicon.ico HTTP/1.1
Host: rqu.yjzkqbs.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/XBY!ATUdZs7SfMU1c/$wbarmen@slurpmail.net
Cookie: XSRF-TOKEN=eyJpdiI6ImRScS8wZVh2UVR6eTNQdWlsM3plb0E9PSIsInZhbHVlIjoiQTk3Q3lGcVVOOEQvMnBMWjJCQ0x5bm1laHNjQjFzQkZDWWw4cUNycUNZZGkyYXFZeGRvd25VZkc4Y3NLb1NGVGhodExoL21nWjU0RjVWWlBwRVhTdi9pSk1ndWtyWUdPdUljSEViaUtGUUNCYXM5d2t4T2xWY1BJdnliVnM1bEciLCJtYWMiOiI3MjVkNjJjNTJiZDQyMjNhYjQxMDRiMDhhMzZkNWI0YTM2Y2IwYWM2YjQ0NTEwYTg4ZTc3MTZjMmU2ZWUxNGQ4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Img2K3E2NXF6QStmdFc1a1dpbm5Td0E9PSIsInZhbHVlIjoiUTI0TlQxQjU2SWNUTTJRcGo2UjdxTjhRdTBsL3VkUExTNjAveG80MllWSUY1TkIrQmVFcndwaE9XbGhWNGFicW1VSXZEZ0ZnUmlaeDJmN0wzVjQwRWtpLzl1NG1iSTQvZzE3OGdUVldkZHpTUkl6MEF4bEJpQkNobTRIMjV2a0wiLCJtYWMiOiI5ZDE2NThkN2FkMGZmNWUxODViOTUyMDVkYTliYjg1YjAxZTQxMjdiZGQ0NmY2MDkxM2ZlOGIyMWFmZGNlMTc3IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Tue, 15 Jul 2025 19:24:50 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=n4lT8GBrSLuP2Wx4PujVby1tdbqrjfRMenjLt8Mv5ZyyY2d2EG8FaldyVC9eoYOIqp%2BKk6DrEaE7I1a66DoOKX8DDR2jo7AcizA%3D"}]}
cf-cache-status: HIT
age: 16
vary: accept-encoding
cache-control: max-age=14400
priority: u=6,i=?0
content-encoding: br
cf-ray: 95fba4704bfeb4f4-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
200 OK 11 kB URL GET ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
IP
Requested by https://rqu.yjzkqbs.es/yapz7rcnhien?common/oauth2/v2.0/authorize?client_id=23d48c944e73305-72ad6a44c72f7a-fec87935ac3bf-40bcc90c38-4b9ab700043ae-56732e49f99213&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
Hash 12bdacc832185d0367ecc23fd24c86ce
4422f316eb4d8c8d160312bb695fd1d944cbff12
877ae491d9aac5c6ef82a8430f9f652ace8a0dbc7294bd112aad49bd593769d0
GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rqu.yjzkqbs.es/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/png
content-length: 10796
date: Sun, 29 Jun 2025 16:32:58 GMT
accept-ranges: bytes
server: nginx
last-modified: Tue, 23 Feb 2021 04:20:08 GMT
etag: "12bdacc832185d0367ecc23fd24c86ce"
expires: Mon, 29 Jun 2026 16:32:58 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-security-policy: default-src 'none'; img-src 'self'; require-trusted-types-for 'script'; report-uri https://oktacsp.report-uri.com/r/t/csp/enforce
x-content-type-options: nosniff
x-cache: Hit from cloudfront
via: 1.1 74cb6ad66f88e47ae011abd64e57e7cc.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: QI84Lu09EL-QI4Hg76d2zZktfg1Xe166itTXIRh17FMWzU6jNQC65Q==
age: 1392714
X-Firefox-Spdy: h2
172.67.191.101
13.107.246.67
140.82.121.3