a.rfihub.com/acs/b/c3Q9aHRtbCZhYT01ODEwNzM5LDEyNDUwNjY1NywyNzMwNTE5LDUxODAyMjAzNSwxOTU4NDMsMTcxODg1MSw0M2RiZTYxM2MzYWE4M2NkOGFiY2U5YjI3ZWQxMTI0MyxwLDM5OTYxLDU5NTU3MywxMzc3ODMyOTEsNTgxNzAxLDE0NzM4MDcmbXQ9MSZyYj0yNSZyZT0zMzY2NSZoY2k9JnV1aWQ9MTk5MTc4NzMzMTgwNTY5NzEyOSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMDQuMjM0LjIyNy4xMDEmZGlkPXRpZF8xNzE4ODUxfG1lZF9yZWd1bGFyJmJjbWk9NTg5ODg./n/https:/www.fp-rd.com/clks/bhvh9wkm1MeF5qN47CC2I2lTFU5HsV0k8rBn9oqGdJfSl44kwwj0p4bTraMoCBsQ8-Ix09IVjoLpxUlLHxSbbJloPLoFwsKXs3XuGo1llvZ70fZi0s0Ji74ShSrqliDuz7hejzTif2UPMSDMfKyOR9mg7q62R2gy-kftQtE/ZXJpYy5yZWVkQHNsdXJwbWFpbC5uZXQ=
193.0.160.131302 Found 0 B URL a.rfihub.com/acs/b/c3Q9aHRtbCZhYT01ODEwNzM5LDEyNDUwNjY1NywyNzMwNTE5LDUxODAyMjAzNSwxOTU4NDMsMTcxODg1MSw0M2RiZTYxM2MzYWE4M2NkOGFiY2U5YjI3ZWQxMTI0MyxwLDM5OTYxLDU5NTU3MywxMzc3ODMyOTEsNTgxNzAxLDE0NzM4MDcmbXQ9MSZyYj0yNSZyZT0zMzY2NSZoY2k9JnV1aWQ9MTk5MTc4NzMzMTgwNTY5NzEyOSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMDQuMjM0LjIyNy4xMDEmZGlkPXRpZF8xNzE4ODUxfG1lZF9yZWd1bGFyJmJjbWk9NTg5ODg./n/https:/www.fp-rd.com/clks/bhvh9wkm1MeF5qN47CC2I2lTFU5HsV0k8rBn9oqGdJfSl44kwwj0p4bTraMoCBsQ8-Ix09IVjoLpxUlLHxSbbJloPLoFwsKXs3XuGo1llvZ70fZi0s0Ji74ShSrqliDuz7hejzTif2UPMSDMfKyOR9mg7q62R2gy-kftQtE/ZXJpYy5yZWVkQHNsdXJwbWFpbC5uZXQ=
IP 193.0.160.131:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /acs/b/c3Q9aHRtbCZhYT01ODEwNzM5LDEyNDUwNjY1NywyNzMwNTE5LDUxODAyMjAzNSwxOTU4NDMsMTcxODg1MSw0M2RiZTYxM2MzYWE4M2NkOGFiY2U5YjI3ZWQxMTI0MyxwLDM5OTYxLDU5NTU3MywxMzc3ODMyOTEsNTgxNzAxLDE0NzM4MDcmbXQ9MSZyYj0yNSZyZT0zMzY2NSZoY2k9JnV1aWQ9MTk5MTc4NzMzMTgwNTY5NzEyOSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMDQuMjM0LjIyNy4xMDEmZGlkPXRpZF8xNzE4ODUxfG1lZF9yZWd1bGFyJmJjbWk9NTg5ODg./n/https:/www.fp-rd.com/clks/bhvh9wkm1MeF5qN47CC2I2lTFU5HsV0k8rBn9oqGdJfSl44kwwj0p4bTraMoCBsQ8-Ix09IVjoLpxUlLHxSbbJloPLoFwsKXs3XuGo1llvZ70fZi0s0Ji74ShSrqliDuz7hejzTif2UPMSDMfKyOR9mg7q62R2gy-kftQtE/ZXJpYy5yZWVkQHNsdXJwbWFpbC5uZXQ= HTTP/1.1
Host: a.rfihub.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Date: Thu, 20 Feb 2025 18:29:54 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rud=H4sIAAAAAAAA_-MSNrS0NDS3MDc2NrQwMDWzNDc0shTiM9R1MTAo9M7xN0gyCDADAGIIVwQlAAAA; Path=/; Domain=.rfihub.com; Expires=Tue, 17 Mar 2026 18:29:54 GMT; Secure; SameSite=None
ruds=H4sIAAAAAAAA_-MSNrS0NDS3MDc2NrQwMDWzNDc0shTiM9R1MTAo9M7xN0gyCDADAGIIVwQlAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Cache-Control: no-cache
Location: https://www.fp-rd.com/clks/bhvh9wkm1MeF5qN47CC2I2lTFU5HsV0k8rBn9oqGdJfSl44kwwj0p4bTraMoCBsQ8-Ix09IVjoLpxUlLHxSbbJloPLoFwsKXs3XuGo1llvZ70fZi0s0Ji74ShSrqliDuz7hejzTif2UPMSDMfKyOR9mg7q62R2gy-kftQtE/ZXJpYy5yZWVkQHNsdXJwbWFpbC5uZXQ=
Content-Length: 0
Server: Jetty(9.4.51.v20230217)
www.fp-rd.com/clks/bhvh9wkm1MeF5qN47CC2I2lTFU5HsV0k8rBn9oqGdJfSl44kwwj0p4bTraMoCBsQ8-Ix09IVjoLpxUlLHxSbbJloPLoFwsKXs3XuGo1llvZ70fZi0s0Ji74ShSrqliDuz7hejzTif2UPMSDMfKyOR9mg7q62R2gy-kftQtE/ZXJpYy5yZWVkQHNsdXJwbWFpbC5uZXQ=
195.177.95.207200 OK 0 B URL www.fp-rd.com/clks/bhvh9wkm1MeF5qN47CC2I2lTFU5HsV0k8rBn9oqGdJfSl44kwwj0p4bTraMoCBsQ8-Ix09IVjoLpxUlLHxSbbJloPLoFwsKXs3XuGo1llvZ70fZi0s0Ji74ShSrqliDuz7hejzTif2UPMSDMfKyOR9mg7q62R2gy-kftQtE/ZXJpYy5yZWVkQHNsdXJwbWFpbC5uZXQ=
IP 195.177.95.207:0
ASN #25198 Interkvm Host Srl
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /clks/bhvh9wkm1MeF5qN47CC2I2lTFU5HsV0k8rBn9oqGdJfSl44kwwj0p4bTraMoCBsQ8-Ix09IVjoLpxUlLHxSbbJloPLoFwsKXs3XuGo1llvZ70fZi0s0Ji74ShSrqliDuz7hejzTif2UPMSDMfKyOR9mg7q62R2gy-kftQtE/ZXJpYy5yZWVkQHNsdXJwbWFpbC5uZXQ= HTTP/1.1
Host: www.fp-rd.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Thu, 20 Feb 2025 18:29:54 GMT
Server: Apache
refresh: 0;url=https://dg.norixen.com/JFWaj/#Meric.reed@slurpmail.net
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
104.18.94.41302 Found 0 B URL challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
IP 104.18.94.41:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Thu, 20 Feb 2025 18:29:55 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/b/b0e4a89976ce/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 915090a0cc3fb50f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
104.17.25.14200 OK 14 kB URL GET HTTP/3 cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP 104.17.25.14:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 20 Feb 2025 18:29:55 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 481153
expires: Tue, 10 Feb 2026 18:29:55 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y2r6PUgwBhsO%2FZhbCJ4sqHTMftzjLt5StQ3HH3emOHh5qFbvKHCqpVL5gpDdHVuETeKC4n3A87N%2B4AyHHOOAGiTM9OrFl%2FMgBOMbK2WCWq1QLeZeX7x4NpCyNctMoBn6CwzKRbBT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 915090a0ca0f56ca-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET code.jquery.com/jquery-3.6.0.min.js
151.101.194.137200 OK 31 kB URL GET HTTP/2 code.jquery.com/jquery-3.6.0.min.js
IP 151.101.194.137:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 20 Feb 2025 18:29:56 GMT
age: 3829730
x-served-by: cache-lga21931-LGA, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 780786
x-timer: S1740076196.124925,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
developers.cloudflare.com/favicon.png
104.16.2.189200 OK 937 B URL developers.cloudflare.com/favicon.png
IP 104.16.2.189:0
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Hash fc3b7bbe7970f47579127561139060e2
3f7c5783fe1f4404cb16304a5a274778ea3abd25
85e6223afdbd5badf2c79bcfbaa6fe686acaa781eca52c196647ffabb3be2ffe
GET /favicon.png HTTP/1.1
Host: developers.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 20 Feb 2025 18:29:56 GMT
content-type: image/png
content-length: 937
cache-control: public, max-age=0, must-revalidate
etag: "6be7ff94b6151f8cfbf08b53a17e2ac1"
set-cookie: __cf_bm=abC6vUVWxu3Wcycjp.UrvNnEOqyatBHeIfZOhPhfWYQ-1740076196-1.0.1.1-7aBq9bBA48tkYlk.OfJhGXRwfQwYCfljZNLkf9xibgUjWQ6plLjuaZjdQ5QTj09.ac.7Tf3ZD7fg5H7lSO0BXw; path=/; expires=Thu, 20-Feb-25 18:59:56 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: cloudflare
cf-ray: 915090a2eabf5694-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
104.17.25.14200 OK 14 kB URL GET HTTP/3 cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP 104.17.25.14:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:06 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 481164
expires: Tue, 10 Feb 2026 18:30:06 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O2SlR63NcFLON8D2cooGxARRPtVrqyoD8NLf%2BACpJhG5zuqHqbjPoKEkKdlWdchHTwwwH6SgJxMIyFCQfDBJM%2Bw5KSBzT7c1PNHBBwGv6ZjA%2B%2F0JmA9KA%2BLQ6ojb7Nc84hcoDvK9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 915090df9a955694-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET code.jquery.com/jquery-3.6.0.min.js
151.101.194.137200 OK 31 kB URL GET HTTP/2 code.jquery.com/jquery-3.6.0.min.js
IP 151.101.194.137:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 20 Feb 2025 18:30:06 GMT
age: 3829740
x-served-by: cache-lga21931-LGA, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 780796
x-timer: S1740076206.030955,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
104.17.25.14200 OK 14 kB URL GET HTTP/3 cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP 104.17.25.14:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:07 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 481165
expires: Tue, 10 Feb 2026 18:30:07 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l7lif5UGdvT2xn6SbBl0NEu8pr%2FTpeLZGAgrTiYVEHuvXP2tOqWf28c5gqg59qC%2F0oLQC%2B3rkuhqesCgzYzETvgrdUKOmdIa4Elji9XFGT09%2B6Fpe1H%2Bd3AHtsoJ2JlhI%2BJ4lf%2B9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 915090eb2dbe5694-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET code.jquery.com/jquery-3.6.0.min.js
151.101.194.137200 OK 31 kB URL GET HTTP/2 code.jquery.com/jquery-3.6.0.min.js
IP 151.101.194.137:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 20 Feb 2025 18:30:07 GMT
age: 3829742
x-served-by: cache-lga21931-LGA, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 780799
x-timer: S1740076208.868995,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
GET dg.norixen.com/GDSherpa-bold.woff2
104.21.73.195200 OK 28 kB URL GET HTTP/3 dg.norixen.com/GDSherpa-bold.woff2
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Hash a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-bold.woff2 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:07 GMT
content-type: font/woff2
content-length: 28000
server: cloudflare
content-disposition: inline; filename="GDSherpa-bold.woff2"
cache-control: max-age=14400
last-modified: Thu, 20 Feb 2025 16:54:25 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pxKWUZlAhjvYq1QmV%2BYjHfTx0qCP%2FgrCkveowcYG1zKdCqbyk0aMBUf2dxhxxvLJnoM7fDx%2FM%2B%2BQgPK3dyNuGxCiH1v4i5E3OrIg9RwRbCSVg3zFgZX37gWgZlEMPN5jCRAjQg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 5742
priority: u=3,i=?0
accept-ranges: bytes
cf-ray: 915090eb38e8b521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=16326&min_rtt=16290&rtt_var=4647&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2219&delivery_rate=245433&cwnd=251&unsent_bytes=0&cid=6d244860311dd674&ts=306&x=0", cfExtPri
GET dg.norixen.com/GDSherpa-regular.woff2
104.21.73.195200 OK 29 kB URL GET HTTP/3 dg.norixen.com/GDSherpa-regular.woff2
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Hash 17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-regular.woff2 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:07 GMT
content-type: font/woff2
content-length: 28584
content-disposition: inline; filename="GDSherpa-regular.woff2"
cache-control: max-age=14400
last-modified: Thu, 20 Feb 2025 16:54:25 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8XHVjDW%2F%2BDNUiY5YEhkh6sksoSi7Iy4hmTYBkByGOOiwBwiIpuYuaZl7avS9nWDJ%2BTUFTFpwBUbLx0kopUMPShcEEwXdr%2FgX7eZpEtM2qtI%2FXBxaBh7L32TfXy9Xm0YYZn6CGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 5742
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915090eb38fbb521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=431&min_rtt=338&rtt_var=168&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2222&delivery_rate=10989130&cwnd=252&unsent_bytes=0&cid=b50423ed2ec6653d&ts=279&x=0", cfL4;desc="?proto=QUIC&rtt=2503&min_rtt=1165&rtt_var=1232&sent=135&recv=39&lost=0&retrans=0&sent_bytes=122151&recv_bytes=15768&delivery_rate=3430105&cwnd=24000&unsent_bytes=0&cid=18de337dc1777d20&ts=12202&x=1", cfExtPri, cfHdrFlush;dur=13
GET dg.norixen.com/GDSherpa-vf.woff2
104.21.73.195200 OK 44 kB URL GET HTTP/3 dg.norixen.com/GDSherpa-vf.woff2
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Hash 2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-vf.woff2 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:07 GMT
content-type: font/woff2
content-length: 43596
content-disposition: inline; filename="GDSherpa-vf.woff2"
cache-control: max-age=14400
last-modified: Thu, 20 Feb 2025 16:54:27 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WvquBxJbnZnCaUwASxRAUrwhIxw1BCp03ry9no1ZiOz4Ms3mk8dspS4ErgFff5iYeUJlOx6m8sXGcrCQS1OKLYTDIR7qEcvFBujusM%2BBnDGP7SZGoMmwO814%2BTt5bQOiIwNyCg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 5739
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915090eb3906b521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=337&min_rtt=324&rtt_var=115&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2217&delivery_rate=10110000&cwnd=252&unsent_bytes=0&cid=ce73993acf81b0b4&ts=401&x=0", cfL4;desc="?proto=QUIC&rtt=2832&min_rtt=1165&rtt_var=1583&sent=178&recv=42&lost=0&retrans=0&sent_bytes=170205&recv_bytes=17728&delivery_rate=1070802&cwnd=48000&unsent_bytes=0&cid=18de337dc1777d20&ts=12211&x=1", cfExtPri, cfHdrFlush;dur=4
GET dg.norixen.com/GDSherpa-bold.woff
104.21.73.195200 OK 36 kB URL GET HTTP/3 dg.norixen.com/GDSherpa-bold.woff
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type Web Open Font Format, TrueType, length 35970, version 1.0
Hash 496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-bold.woff HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:07 GMT
content-type: font/woff
content-length: 35970
content-disposition: inline; filename="GDSherpa-bold.woff"
cache-control: max-age=14400
cf-cache-status: HIT
last-modified: Thu, 20 Feb 2025 16:54:25 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yvchx89soqzUKjKBV0p%2Fyxq9jvywlfw1IPanyqUI5GFebA126OSzZX1DPS6M2fJxcZR1ldy25cdNv%2FXYnsvjjLmqXrg2d2BHHLTJsZgP9Cxn9a%2BLvodophVHkOYvAmcPuJrNHA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
age: 5742
priority: u=3,i=?0
server: cloudflare
cf-ray: 915090eb38f5b521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=376&min_rtt=353&rtt_var=142&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2217&delivery_rate=8442588&cwnd=252&unsent_bytes=0&cid=fb2cc185994cbe63&ts=318&x=0", cfL4;desc="?proto=QUIC&rtt=2503&min_rtt=1165&rtt_var=1232&sent=135&recv=39&lost=0&retrans=0&sent_bytes=122151&recv_bytes=15768&delivery_rate=3430105&cwnd=24000&unsent_bytes=0&cid=18de337dc1777d20&ts=12202&x=1", cfExtPri, cfHdrFlush;dur=3
GET dg.norixen.com/GDSherpa-regular.woff
104.21.73.195200 OK 37 kB URL GET HTTP/3 dg.norixen.com/GDSherpa-regular.woff
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type Web Open Font Format, TrueType, length 36696, version 1.0
Hash a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-regular.woff HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:07 GMT
content-type: font/woff
content-length: 36696
content-disposition: inline; filename="GDSherpa-regular.woff"
cache-control: max-age=14400
last-modified: Thu, 20 Feb 2025 16:54:25 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0QPeodyGyU8OticvLPMcw9aIMgiwT1yRTI5HH5xdYeLZYM8Oyqa4r3lXU%2BsP4ZL1i4y8qbFPIKR3BDchiU%2Fm%2FasKC1tuVt5so1QUUmMA%2F9s98tTip1AyJF8YYQX5uWOzumfK0A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 5742
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915090eb3900b521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=379&min_rtt=358&rtt_var=115&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2220&delivery_rate=10290076&cwnd=252&unsent_bytes=0&cid=06afff7405c77861&ts=496&x=0", cfL4;desc="?proto=QUIC&rtt=2503&min_rtt=1165&rtt_var=1232&sent=115&recv=39&lost=0&retrans=0&sent_bytes=98151&recv_bytes=15768&delivery_rate=3430105&cwnd=24000&unsent_bytes=0&cid=18de337dc1777d20&ts=12199&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/GDSherpa-vf2.woff2
104.21.73.195200 OK 93 kB URL GET HTTP/3 dg.norixen.com/GDSherpa-vf2.woff2
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Hash bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-vf2.woff2 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:07 GMT
content-type: font/woff2
content-length: 93276
content-disposition: inline; filename="GDSherpa-vf2.woff2"
cache-control: max-age=14400
last-modified: Thu, 20 Feb 2025 16:54:27 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9HXcljVzcUENY2zTBe%2BBOLsWPFmlnVYpbPrFb3pdaaGJ5fjxSkZeXYg5cGH%2BYX73V0JxwrcQOkERGVG4VF5NWmRLcO9VIkQuNYdySpcs0XS4tYLJ8l6rHOcYessgC4NdcZcRgA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 5740
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915090eb3908b521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=364&min_rtt=326&rtt_var=114&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2218&delivery_rate=11264623&cwnd=252&unsent_bytes=0&cid=33df15e897f9a308&ts=806&x=0", cfL4;desc="?proto=QUIC&rtt=2503&min_rtt=1165&rtt_var=1232&sent=135&recv=39&lost=0&retrans=0&sent_bytes=122151&recv_bytes=15768&delivery_rate=3430105&cwnd=24000&unsent_bytes=0&cid=18de337dc1777d20&ts=12203&x=1", cfExtPri, cfHdrFlush;dur=12
GET ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
143.204.55.47200 OK 11 kB URL GET HTTP/2 ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
IP 143.204.55.47:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
Hash 12bdacc832185d0367ecc23fd24c86ce
4422f316eb4d8c8d160312bb695fd1d944cbff12
877ae491d9aac5c6ef82a8430f9f652ace8a0dbc7294bd112aad49bd593769d0
GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/png
content-length: 10796
date: Thu, 30 Jan 2025 19:53:14 GMT
server: nginx
last-modified: Tue, 23 Feb 2021 04:20:08 GMT
etag: "12bdacc832185d0367ecc23fd24c86ce"
expires: Fri, 30 Jan 2026 19:53:14 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 50584ad285d5f627ddebae74efdd0770.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: vMbHLOkSFDrUO6ILsbaNAK4gjIxAE04bVX0i1xO7FKLZzOHXRnwC5w==
age: 1809414
X-Firefox-Spdy: h2
GET github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
140.82.121.4302 Found 0 B URL GET HTTP/2 github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
IP 140.82.121.4:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerSectigo Limited
Subjectgithub.com
FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A
ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: GitHub.com
date: Thu, 20 Feb 2025 18:30:07 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250220%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250220T183007Z&X-Amz-Expires=300&X-Amz-Signature=18b2d044772b7e19b3e4a066e47c8694847ab5579fa89e7270a7ae1d5bfd689b&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-length: 0
x-github-request-id: 6B5C:169051:27A2A94:2887F92:67B774AF
X-Firefox-Spdy: h2
GET objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250220%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250220T183007Z&X-Amz-Expires=300&X-Amz-Signature=18b2d044772b7e19b3e4a066e47c8694847ab5579fa89e7270a7ae1d5bfd689b&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
185.199.108.133200 OK 10 kB URL GET HTTP/2 objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250220%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250220T183007Z&X-Amz-Expires=300&X-Amz-Signature=18b2d044772b7e19b3e4a066e47c8694847ab5579fa89e7270a7ae1d5bfd689b&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
IP 185.199.108.133:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerDigiCert Inc
Subject*.github.io
Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28
ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (10017)
Hash 6c20a2be8ba900bc0a7118893a2b1072
ff7766fde1f33882c6e1c481ceed6f6588ea764c
b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500
GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250220%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250220T183007Z&X-Amz-Expires=300&X-Amz-Signature=18b2d044772b7e19b3e4a066e47c8694847ab5579fa89e7270a7ae1d5bfd689b&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Tue, 07 Dec 2021 16:38:45 GMT
etag: "0x8D9B9A009499A1E"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d91f6eaf-e01e-0032-2f18-13e122000000
x-ms-version: 2023-11-03
x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT
x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=randexp.min.js
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
date: Thu, 20 Feb 2025 18:30:08 GMT
age: 3527
x-served-by: cache-iad-kiad7000045-IAD, cache-hel1410022-HEL
x-cache: HIT, HIT
x-cache-hits: 11369, 510
x-timer: S1740076208.321853,VS0,VE0
content-length: 10245
X-Firefox-Spdy: h2
GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
143.204.55.47200 OK 20 kB URL GET HTTP/2 ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
IP 143.204.55.47:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 20416, version 2.197
Hash d99a7377dabb55772ca9f986b0a04b57
2b5fcd8431953c44e410d0489899e74f6d2cfecc
affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149
GET /assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://dg.norixen.com
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20416
date: Mon, 10 Feb 2025 01:49:35 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:56:28 GMT
etag: "d99a7377dabb55772ca9f986b0a04b57"
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
expires: Tue, 10 Feb 2026 01:49:35 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 50584ad285d5f627ddebae74efdd0770.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 5YXJJblQlKQceFZRRAtWzg7OuVm--8KumlO-ch0Z1YJMi3A3cmx9Gw==
age: 924034
X-Firefox-Spdy: h2
GET dg.norixen.com/uvxExAGLfxHDfLwmDue7C5P4MopPAylIjUMWuSUeJEZkGqh34130
104.21.73.195200 OK 644 B URL GET HTTP/3 dg.norixen.com/uvxExAGLfxHDfLwmDue7C5P4MopPAylIjUMWuSUeJEZkGqh34130
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type RIFF (little-endian) data, Web/P image
Hash 541b83c2195088043337e4353b6fd60d
f09630596b6713217984785a64f6ea83e91b49c5
2658b8874f0d2a12e8726df78ac8954324c3bbe4695e66bdef89195fde64322f
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /uvxExAGLfxHDfLwmDue7C5P4MopPAylIjUMWuSUeJEZkGqh34130 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:10 GMT
content-type: image/webp
content-length: 644
content-disposition: inline; filename="uvxExAGLfxHDfLwmDue7C5P4MopPAylIjUMWuSUeJEZkGqh34130"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KWX2gIsdezjSn9oD55ufBvSU5XZ1E8c2hvwbDIlSSYc6czLclLxJuPjUFGo9YRh9YmSVUFe2dLanNFtT%2FjsYqn7XGCf7e3Qlk9oPocKJhhdMSsDfhiQxbaO%2F%2B4PC17c6nUxZ1w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090eb490eb521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=16321&min_rtt=16316&rtt_var=4596&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2199&delivery_rate=247490&cwnd=252&unsent_bytes=0&cid=c483f3ff5a8e060d&ts=202&x=0", cfL4;desc="?proto=QUIC&rtt=4985&min_rtt=1165&rtt_var=4296&sent=369&recv=59&lost=0&retrans=1&sent_bytes=388553&recv_bytes=27780&delivery_rate=2640&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=14941&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/qrCso439O0A9yOP92IqUFH9ii4YfWhZnmmnxkdZzCWzw6CNY8xM67140
104.21.73.195200 OK 892 B URL GET HTTP/3 dg.norixen.com/qrCso439O0A9yOP92IqUFH9ii4YfWhZnmmnxkdZzCWzw6CNY8xM67140
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type RIFF (little-endian) data, Web/P image
Hash 41d62ca205d54a78e4298367482b4e2b
839aae21ed8ecfc238fdc68b93ccb27431cd5393
20a4a780db0bcc047015a0d8037eb4eb58b3e5cb338673799c030a3e1b626b40
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /qrCso439O0A9yOP92IqUFH9ii4YfWhZnmmnxkdZzCWzw6CNY8xM67140 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:11 GMT
content-type: image/webp
content-length: 892
content-disposition: inline; filename="qrCso439O0A9yOP92IqUFH9ii4YfWhZnmmnxkdZzCWzw6CNY8xM67140"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6XNjhgJ5Q5%2F9WMIRMHangdOpB5frLpnWisxUXH6q03dTQRWTrwfUhGrOpSyTec8xhpCeeds9OhrGn1bVoM0t9FxvadokwrZaWOTJFp9V8ZSQAUIrEok%2BOA%2BJBHNpSX197AIfHg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090eb5929b521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=16327&min_rtt=16310&rtt_var=4620&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2203&delivery_rate=245985&cwnd=228&unsent_bytes=0&cid=834772dcbd599c92&ts=186&x=0", cfL4;desc="?proto=QUIC&rtt=4113&min_rtt=1165&rtt_var=3929&sent=375&recv=61&lost=0&retrans=1&sent_bytes=393771&recv_bytes=27871&delivery_rate=2087710&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=15908&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/qrR3o9Isj2OkcgFbv3gVkyNAJ96l3c7WroCSzsB1rTgk3stF7RXKamC3OWWo1OOWUc5yWVM1AIccd231
104.21.73.195200 OK 9.6 kB URL GET HTTP/3 dg.norixen.com/qrR3o9Isj2OkcgFbv3gVkyNAJ96l3c7WroCSzsB1rTgk3stF7RXKamC3OWWo1OOWUc5yWVM1AIccd231
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type RIFF (little-endian) data, Web/P image
Hash 4946eb373b18d178c93d473489673bb6
16477acb73b63ca251d37401249e7e4515febd24
666bc574c9f3fb28a8ac626fa8105c187c2a313736494a06bd5a937473673c92
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /qrR3o9Isj2OkcgFbv3gVkyNAJ96l3c7WroCSzsB1rTgk3stF7RXKamC3OWWo1OOWUc5yWVM1AIccd231 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:11 GMT
content-type: image/webp
content-length: 9648
content-disposition: inline; filename="qrR3o9Isj2OkcgFbv3gVkyNAJ96l3c7WroCSzsB1rTgk3stF7RXKamC3OWWo1OOWUc5yWVM1AIccd231"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BusrcNlJTE2Brf62VcQGMXk86mjvIP4EaS1VV%2FX2dlhSE%2BEA9iklk6YjhuFpVpyQYkzQcPoqM5LnT93C%2FihIyGwRTHGr3jU1rN9%2BqYdLon7Bl47Qm%2BmGcZFY8DXzuQnvroTcEg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090ebb9cab521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=280&min_rtt=272&rtt_var=91&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2227&delivery_rate=12598130&cwnd=252&unsent_bytes=0&cid=a3836305c18ab694&ts=188&x=0", cfL4;desc="?proto=QUIC&rtt=2789&min_rtt=1165&rtt_var=2470&sent=395&recv=66&lost=0&retrans=1&sent_bytes=415343&recv_bytes=28101&delivery_rate=6009914&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=15937&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/uverI0JMgXGH1sN6rmAix4XpcfJrMPIhJFkDc0uMM3QV5OORj670oGgtV5Jgyunawh6HdGfCAKSIaCef260
104.21.73.195200 OK 18 kB URL GET HTTP/3 dg.norixen.com/uverI0JMgXGH1sN6rmAix4XpcfJrMPIhJFkDc0uMM3QV5OORj670oGgtV5Jgyunawh6HdGfCAKSIaCef260
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type RIFF (little-endian) data, Web/P image
Hash 4b52ecdc33382c9dca874f551990e704
8f3bf8e41cd4cdddb17836b261e73f827b84341b
cce050cc3b150c0b370751021bb15018ee2b64ac369e230fe3b571a9b00d4342
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /uverI0JMgXGH1sN6rmAix4XpcfJrMPIhJFkDc0uMM3QV5OORj670oGgtV5Jgyunawh6HdGfCAKSIaCef260 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:11 GMT
content-type: image/webp
content-length: 17842
content-disposition: inline; filename="uverI0JMgXGH1sN6rmAix4XpcfJrMPIhJFkDc0uMM3QV5OORj670oGgtV5Jgyunawh6HdGfCAKSIaCef260"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L9G22qfwinWocuVtiBR0bbG%2B2rH4u7XoUDd2mWwcLJwAn2fJAtAKubFjEuhz0hg0mN8C%2BI7bqlzWp2M5wTcmr4gUzeqRE4900L0innGjtETasycCSb3Txcl0KhL0ny2PLz%2FGFA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090ebb9ccb521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=266&min_rtt=251&rtt_var=99&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2230&delivery_rate=11620689&cwnd=252&unsent_bytes=0&cid=076386178e2865ee&ts=179&x=0", cfL4;desc="?proto=QUIC&rtt=2994&min_rtt=1165&rtt_var=2746&sent=384&recv=65&lost=0&retrans=1&sent_bytes=403263&recv_bytes=28055&delivery_rate=934889&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=15933&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/ijVHzihdK6Chgt0zf1RIiwj6D8JEDofitNBVUA6Th7mn5CCNXVFQzExSjLVob5SbBOrvef210
104.21.73.195200 OK 25 kB URL GET HTTP/3 dg.norixen.com/ijVHzihdK6Chgt0zf1RIiwj6D8JEDofitNBVUA6Th7mn5CCNXVFQzExSjLVob5SbBOrvef210
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type RIFF (little-endian) data, Web/P image
Hash f9a795e2270664a7a169c73b6d84a575
0fbb60ab27ab88c064eb347d0722c8ed4cf5e8b8
d00203b2eea6e418c31baafa949ada5349a9f9b7e99fa003aec7406822693740
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /ijVHzihdK6Chgt0zf1RIiwj6D8JEDofitNBVUA6Th7mn5CCNXVFQzExSjLVob5SbBOrvef210 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:12 GMT
content-type: image/webp
content-length: 25216
content-disposition: inline; filename="ijVHzihdK6Chgt0zf1RIiwj6D8JEDofitNBVUA6Th7mn5CCNXVFQzExSjLVob5SbBOrvef210"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GhI%2BXHQULYQAJu5Ed%2BLjYK9mlP5Lvufkowsk4TcPChLG2kgmtVjfdjXI42btYpV4hKK3R3BMheS%2BKWHZpzEhAOzUDFc9dzKuS57z1GzvJ1UJIU%2F1ND8%2BijLozGn2CNHv87cqUw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090ebb9c8b521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=18636&min_rtt=18618&rtt_var=5268&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2220&delivery_rate=216245&cwnd=252&unsent_bytes=0&cid=618fca8476b09ff2&ts=190&x=0", cfL4;desc="?proto=QUIC&rtt=1358&min_rtt=844&rtt_var=539&sent=688&recv=98&lost=0&retrans=1&sent_bytes=725381&recv_bytes=29551&delivery_rate=11193470&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=16928&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/kl8nyLGk5R3wDc0ruOw6Ndysv1opOqBlHOK3UMNT0TRUDL2PRQcw7ziQxab230
104.21.73.195200 OK 1.3 kB URL GET HTTP/3 dg.norixen.com/kl8nyLGk5R3wDc0ruOw6Ndysv1opOqBlHOK3UMNT0TRUDL2PRQcw7ziQxab230
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type RIFF (little-endian) data, Web/P image
Hash 32ca2081553e969f9fdd4374134521ad
7b09924c4c3d8b6e41fe38363e342da098be4173
216fc342a469aa6a005b2eacc24622095e5282d3e9f1ae99ce54c27b92ec3587
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /kl8nyLGk5R3wDc0ruOw6Ndysv1opOqBlHOK3UMNT0TRUDL2PRQcw7ziQxab230 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:12 GMT
content-type: image/webp
content-length: 1298
content-disposition: inline; filename="kl8nyLGk5R3wDc0ruOw6Ndysv1opOqBlHOK3UMNT0TRUDL2PRQcw7ziQxab230"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fd4Heb2NSqKUTdogXLjWCA1ZQKjjGL9fsMpsVdqXY1RBtfL88in78qQv0Vws6yAkf1XTkP6ReSySknxJSolklMNn2xWbeQ%2Fit7RMRGEzw6Bw4KdPtYOWY5mNFLSXp9jFSSEQVg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090f2ed58b521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=380&min_rtt=319&rtt_var=139&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2209&delivery_rate=12071641&cwnd=252&unsent_bytes=0&cid=0231a9018d15c76a&ts=329&x=0", cfL4;desc="?proto=QUIC&rtt=1072&min_rtt=757&rtt_var=209&sent=896&recv=117&lost=0&retrans=1&sent_bytes=947487&recv_bytes=30413&delivery_rate=562929&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=17165&x=1", cfExtPri, cfHdrFlush;dur=0
GET get.geojs.io/v1/ip/geo.json
172.67.70.233200 OK 662 B URL GET HTTP/2 get.geojs.io/v1/ip/geo.json
IP 172.67.70.233:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectgeojs.io
Fingerprint55:74:AA:F3:7A:AF:02:8B:48:DB:6E:73:EB:A1:95:20:EC:13:2D:8E
ValidityTue, 31 Dec 2024 05:30:37 GMT - Mon, 31 Mar 2025 06:30:13 GMT
Hash 4bddcd49e2aa87668fc1deb9ab28707a
a0ddcb092a3a86dc4fcb6576db7b193773b9c380
a7d6f0a1333e117da7f42a875c5d05178da4329b745ce0a08126bdfefb2903c0
GET /v1/ip/geo.json HTTP/1.1
Host: get.geojs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dg.norixen.com
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 20 Feb 2025 18:30:13 GMT
content-type: application/json
x-request-id: f6562289eabd5df5264f8c0c7b02ba43-ASH
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
geojs-backend: ash-01
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zZnGpToNla5JaR%2FsbTW%2FlM2TWO26BruuLvTx2tNTaN2zQhyOYPM4%2FnArjnvpAWHpZdzSaXqMyH51hCVDpT6YcV4UyIojLVkAgRIoaWeDuRuiG9SAtjRIAHAaTt0hVQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server: cloudflare
cf-ray: 9150910f5c23568f-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=539&min_rtt=476&rtt_var=185&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3169&recv_bytes=1119&delivery_rate=7743315&cwnd=253&unsent_bytes=0&cid=ebe3c69c7d578bb3&ts=149&x=0"
X-Firefox-Spdy: h2
GET dg.norixen.com/xyKDjc2Onvo9rsoef21
104.21.73.195200 OK 36 kB URL GET HTTP/3 dg.norixen.com/xyKDjc2Onvo9rsoef21
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type ASCII text, with CRLF line terminators
Hash 38501e3fbbbd89b56aa5ba35de1a32fe
d9b31981b6f834e8480ba28fbc1cff1be772f589
a1ca6b381cb01968851c98512c6e7f6c5309a49f7a16b864813135cbff82a85b
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /xyKDjc2Onvo9rsoef21 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:10 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="xyKDjc2Onvo9rsoef21"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e4wwd0IebCKHfZiD8icq0BzQaV7%2B5ITtkJpXd8cOuPAhxMHITxeJkGMmmMHyQAxgebLVV1%2BsvO%2B%2Fxyp%2FMNLuuqdxoKYK1ImgakY9e6l5k5J%2Bh0TCGFSMPPoORx%2B6pTDqZg6NmA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 915090eb28e5b521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=342&min_rtt=335&rtt_var=109&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2159&delivery_rate=10449612&cwnd=252&unsent_bytes=0&cid=86933239bc094381&ts=176&x=0", cfL4;desc="?proto=QUIC&rtt=5492&min_rtt=1165&rtt_var=4378&sent=365&recv=58&lost=0&retrans=1&sent_bytes=384558&recv_bytes=27734&delivery_rate=504308&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=14883&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/favicon.ico
104.21.73.195404 Not Found 0 B URL GET HTTP/3 dg.norixen.com/favicon.ico
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6ImxFRWRHb0F5VXVpa3hxZ2lOOWRvOFE9PSIsInZhbHVlIjoiSkJDQUxUVm95U2lPRUg0aVQxMmplM2ZWb3JtLzdhdHN1cTdSQ1M5clBYRUZFdU1yREFmQ01PcWRCY1FqajRLUlZENzRlNVZtaGdNMTVFOFpQN3JnK2lzd3NNM2M1Mk1aT3R5UFBabnRxTHJRbkxyMzQ2RjBzbjdmTzFFWTFpSWkiLCJtYWMiOiJmOTNmNjdmZWRjNWZiMjgwNjczMDdjYzkxNGNiNzczOTZhN2I3Y2YzN2I0NDAzNTI5NDFiMjBmOTJlZGFlNWQxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImRSZDVURWtJaXZmc09LVEplVVJ4enc9PSIsInZhbHVlIjoiN0FBWkpiaWR4MU9mdjdCUHovNzVBRzZzOEpwNWpUWWZPb09UdVNMZWg2U1U4d2hPc1hWbjNvNlg5ZGdGL2RxeWpvWXI0YmRyVDl1dHN6MnhZTlltRFRBSko1N3ZacTZlZjJWdytDSW1UWHJoc1FveEdQdkt2MlovMWxYd0VnNCsiLCJtYWMiOiIwODk5OGExMmVmNzQ2YjhkMDA1OGU0NGY0NjY3NWQ3ZTJmNmUxNTQ5M2U2NjI0NDQ0NTc5MzVkNDFhNDc3MTkwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Thu, 20 Feb 2025 18:30:13 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D0y62uGddqhPMngoXMb2RNFdlEbJEkmXlXI%2FfWI7Rtm0y7D1WxVHcEaeMSL8hnrLdeWZOi3stHicFsA8rBmlwArNLHbJHjWkqYwGVZR8FBqNz3UCK6gY8e1HG0%2BWBBVpUPpB8w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 5749
priority: u=6,i=?0
server: cloudflare
cf-ray: 9150910e2c12b521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=347&min_rtt=344&rtt_var=102&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2096&delivery_rate=11109890&cwnd=252&unsent_bytes=0&cid=e0d9c8e2e2be66b5&ts=308&x=0", cfL4;desc="?proto=QUIC&rtt=1478&min_rtt=757&rtt_var=969&sent=899&recv=119&lost=0&retrans=1&sent_bytes=949716&recv_bytes=31376&delivery_rate=445869&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=17806&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/560VCfN4QTvR54Mcdr0TD8918
104.21.73.195200 OK 27 kB URL GET HTTP/3 dg.norixen.com/560VCfN4QTvR54Mcdr0TD8918
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type ASCII text, with very long lines (26765), with no line terminators
Hash 1a862a89d5633fac83d763886726740d
e5ce3aa454c992a13fd406a9647d7afbf831051f
5c22fd904edb792331a7307ddf4a790e0d1318924f6d8e7362fa6b55d5ab6fbb
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /560VCfN4QTvR54Mcdr0TD8918 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:08 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="560VCfN4QTvR54Mcdr0TD8918"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PK0sIiiIxq68jSHv7txql1RqAm4GyWZPOtb3KQChSBJLqnKHph1zyfbreiSwG5GW8Hpx5piCbmp2d%2FXQmk8cfVuYHNWez24f9ZBtI8kXm7Eo9UQkXDTRxhacxNlEJGldXIfm2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 915090eb28e2b521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=313&min_rtt=277&rtt_var=101&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2165&delivery_rate=13435215&cwnd=252&unsent_bytes=0&cid=190c5897da08c3b3&ts=159&x=0", cfL4;desc="?proto=QUIC&rtt=6056&min_rtt=1165&rtt_var=6223&sent=355&recv=53&lost=0&retrans=1&sent_bytes=377318&recv_bytes=24657&delivery_rate=2618272&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=12455&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/opwqubUp3wnitaM6bnm2FXOKwmyziKI0ECpXijmO5m982SFVn7Qdjr88YtsyWcd196
104.21.73.195200 OK 268 B URL GET HTTP/3 dg.norixen.com/opwqubUp3wnitaM6bnm2FXOKwmyziKI0ECpXijmO5m982SFVn7Qdjr88YtsyWcd196
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type SVG Scalable Vector Graphics image
Hash 1318aafc1fb9ded0c623e5b9a557e6df
0917cdd7633cd1642b02b2b785416ec7e5106dcc
d86660a84daa211b121ec9fe0df83d6b945f61b888384391eabc7d6b4e941dc4
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /opwqubUp3wnitaM6bnm2FXOKwmyziKI0ECpXijmO5m982SFVn7Qdjr88YtsyWcd196 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:11 GMT
content-type: image/svg+xml
content-disposition: inline; filename="opwqubUp3wnitaM6bnm2FXOKwmyziKI0ECpXijmO5m982SFVn7Qdjr88YtsyWcd196"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GD6WCb4SPWZPmyPwbb3DazKbmmDkweeKPKrhHKzQRJQR02%2ByC8BE3nBqdhRSEjhg6VV%2BAfsscWtFG4lQyQPa4Jfv4V6inCjMaGJtUHyaEvfOcfGB5a%2BB4zWfjOJSSTR8moDNzg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090eb694bb521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=16286&min_rtt=16278&rtt_var=4594&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2213&delivery_rate=247581&cwnd=252&unsent_bytes=0&cid=0dd0f3cc9a2d450a&ts=189&x=0", cfL4;desc="?proto=QUIC&rtt=2763&min_rtt=1165&rtt_var=1904&sent=405&recv=67&lost=0&retrans=1&sent_bytes=426138&recv_bytes=28147&delivery_rate=3737241&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=15969&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/560PhMi0xc5mHrqivsFoQIrueBAghYfMZDLUEJx2cNZ89108
104.21.73.195200 OK 4.8 MB URL GET HTTP/3 dg.norixen.com/560PhMi0xc5mHrqivsFoQIrueBAghYfMZDLUEJx2cNZ89108
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
Size 4.8 MB (4756466 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /560PhMi0xc5mHrqivsFoQIrueBAghYfMZDLUEJx2cNZ89108 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:11 GMT
content-type: application/javascript
server: cloudflare
content-disposition: inline; filename="560PhMi0xc5mHrqivsFoQIrueBAghYfMZDLUEJx2cNZ89108"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cVKEur8HIkD3Y5SsaHrLxAR9go%2F4Z04cyRu8IMY0PsB8Kkrw4PHvt1DbPM%2FfDUuWn1VbHDK6LF%2F2BbKZySfCFNvpLBXZyj7msIeA%2BkX%2BTEiyMOFtHTJfdC7FV7HtQKhTo55iCA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
priority: u=3,i=?0
vary: accept-encoding
cf-ray: 915090ebb9ceb521-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=265&min_rtt=254&rtt_var=92&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2159&delivery_rate=12757097&cwnd=252&unsent_bytes=0&cid=6769eeb5fc1564b9&ts=175&x=0", cfExtPri
POST dg.norixen.com/gkkj40FGpA8B3tBhNP6oYpcpl5Eft3nVB4EhgjWGFjVJ0eKN6svEoja
104.21.73.195200 OK 2.8 kB URL POST HTTP/3 dg.norixen.com/gkkj40FGpA8B3tBhNP6oYpcpl5Eft3nVB4EhgjWGFjVJ0eKN6svEoja
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type troff or preprocessor input, ASCII text, with very long lines (2855), with no line terminators
Hash 2bc5d16b28b8ed3ac050bb0c056359db
fdcf1070960908b4e9f5d9d6746de413a8d1d30a
4d59da017774c1da6a31ed6d17be3c59209e4873549755aef0999e26be25dac2
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
POST /gkkj40FGpA8B3tBhNP6oYpcpl5Eft3nVB4EhgjWGFjVJ0eKN6svEoja HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 55
Origin: https://dg.norixen.com
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:12 GMT
content-type: application/json
cache-control: no-cache, private
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GL%2B2HFvqLYq8L7I2%2BfeX2WUHyL8UfjjWSr3CpAZeZyRwGEn%2FH08whPVmvrHAtJsyIM6pCkIgFM%2B%2F4wFnOpn%2BKvSmbTI8NzRaj0fOMK28q2fIEiHJI7ei%2B6WKk%2FiBYzuTOQo5nQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImxFRWRHb0F5VXVpa3hxZ2lOOWRvOFE9PSIsInZhbHVlIjoiSkJDQUxUVm95U2lPRUg0aVQxMmplM2ZWb3JtLzdhdHN1cTdSQ1M5clBYRUZFdU1yREFmQ01PcWRCY1FqajRLUlZENzRlNVZtaGdNMTVFOFpQN3JnK2lzd3NNM2M1Mk1aT3R5UFBabnRxTHJRbkxyMzQ2RjBzbjdmTzFFWTFpSWkiLCJtYWMiOiJmOTNmNjdmZWRjNWZiMjgwNjczMDdjYzkxNGNiNzczOTZhN2I3Y2YzN2I0NDAzNTI5NDFiMjBmOTJlZGFlNWQxIiwidGFnIjoiIn0%3D; expires=Thu, 20-Feb-2025 20:30:12 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImRSZDVURWtJaXZmc09LVEplVVJ4enc9PSIsInZhbHVlIjoiN0FBWkpiaWR4MU9mdjdCUHovNzVBRzZzOEpwNWpUWWZPb09UdVNMZWg2U1U4d2hPc1hWbjNvNlg5ZGdGL2RxeWpvWXI0YmRyVDl1dHN6MnhZTlltRFRBSko1N3ZacTZlZjJWdytDSW1UWHJoc1FveEdQdkt2MlovMWxYd0VnNCsiLCJtYWMiOiIwODk5OGExMmVmNzQ2YjhkMDA1OGU0NGY0NjY3NWQ3ZTJmNmUxNTQ5M2U2NjI0NDQ0NTc5MzVkNDFhNDc3MTkwIiwidGFnIjoiIn0%3D; expires=Thu, 20-Feb-2025 20:30:12 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 915090f29cf2b521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=279&min_rtt=269&rtt_var=85&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2368&delivery_rate=13616161&cwnd=252&unsent_bytes=0&cid=15d9f1eaa7bdf3e4&ts=162&x=0", cfL4;desc="?proto=QUIC&rtt=1252&min_rtt=844&rtt_var=342&sent=758&recv=102&lost=0&retrans=1&sent_bytes=806269&recv_bytes=29732&delivery_rate=27977355&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=16996&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/efcA78EBpv6ygFvujaLrwCIt8tHklOg49WhorNWORA7SCbliNqgD78150
104.21.73.195200 OK 270 B URL GET HTTP/3 dg.norixen.com/efcA78EBpv6ygFvujaLrwCIt8tHklOg49WhorNWORA7SCbliNqgD78150
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type SVG Scalable Vector Graphics image
Hash 0c09c5ea7c28d6feb4d124957dde0a0d
1b9efde2d8f0e2a3d9d5315117e597c2d622fc5e
b3c39d2c15327b7ae68940502a2d7bf457fe521e075e6e671d0340edc58bcb3a
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /efcA78EBpv6ygFvujaLrwCIt8tHklOg49WhorNWORA7SCbliNqgD78150 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:11 GMT
content-type: image/svg+xml
content-disposition: inline; filename="efcA78EBpv6ygFvujaLrwCIt8tHklOg49WhorNWORA7SCbliNqgD78150"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8zEcNc6IE5B8%2FCtyyRNpJmBCEyP5M6VQ%2BhsPU71NywZ4pG3iZXsCNU1hZ0zfgtzf9phGyj%2FVHYNzxmtDX3AO7Zfm1JXmYA3pDjxjg4XdmkVaU8jymn06jIS9hvm1PDGIotvpaA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090eb592fb521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=307&min_rtt=294&rtt_var=109&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2204&delivery_rate=10342710&cwnd=252&unsent_bytes=0&cid=dfb2d4c9cb47d3a4&ts=152&x=0", cfL4;desc="?proto=QUIC&rtt=4113&min_rtt=1165&rtt_var=3929&sent=374&recv=61&lost=0&retrans=1&sent_bytes=392715&recv_bytes=27871&delivery_rate=2087710&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=15897&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/ijY17IBeVjfleV174jOUotizcdQpFqeNph7QBdw1t56170
104.21.73.195200 OK 7.4 kB URL GET HTTP/3 dg.norixen.com/ijY17IBeVjfleV174jOUotizcdQpFqeNph7QBdw1t56170
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type SVG Scalable Vector Graphics image
Hash bca9b46fee32162356ba5b4783e614dc
cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5
fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /ijY17IBeVjfleV174jOUotizcdQpFqeNph7QBdw1t56170 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:11 GMT
content-type: image/svg+xml
content-disposition: inline; filename="ijY17IBeVjfleV174jOUotizcdQpFqeNph7QBdw1t56170"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dh2vfw0i05hwCVq7VX1nG7T%2F2XvfpKdh4kEbeyqFTL2V43TCo%2FHqeHxc1z3%2FXZy1rxwmNsKfBQ8LaMXWXTvhOcTzW4tKWn%2FoncgwBIlJ4AiGrct7IHrHc%2FR9iTg13t%2FS9nDQSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090eb6944b521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=278&min_rtt=268&rtt_var=86&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2193&delivery_rate=13215686&cwnd=252&unsent_bytes=0&cid=95b1ecf167920776&ts=176&x=0", cfL4;desc="?proto=QUIC&rtt=3542&min_rtt=1165&rtt_var=3194&sent=379&recv=63&lost=0&retrans=1&sent_bytes=397632&recv_bytes=27963&delivery_rate=1173279&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=15922&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/mn8DfvblC0NS1QX0JSCDuF6Ty45mlrA56Fe7Btp2SXVOeoFDriwx214
104.21.73.195200 OK 1.9 kB URL GET HTTP/3 dg.norixen.com/mn8DfvblC0NS1QX0JSCDuF6Ty45mlrA56Fe7Btp2SXVOeoFDriwx214
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type SVG Scalable Vector Graphics image
Hash 4b5c228b4faba433d06ec569ed855b2d
a7d3882b93e332460e7c59510a6a811ef011983f
eb19d76cd1fad39abf0f2778991883a5cf9ff560117ce8f7c64124e71471b4ed
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /mn8DfvblC0NS1QX0JSCDuF6Ty45mlrA56Fe7Btp2SXVOeoFDriwx214 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:12 GMT
content-type: image/svg+xml
content-disposition: inline; filename="mn8DfvblC0NS1QX0JSCDuF6Ty45mlrA56Fe7Btp2SXVOeoFDriwx214"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YYV6VodTdjNcjUdbDNDL9OgIKSWNFIVv9fiU0LvZqwJ1Pq%2F5wHOr37GUlnAXMMmxQrobjIFzYJ4NQsNblM1s1mRxqfhcOHEcNgNBVf6NhS3y0h8tmws9ggldf1jPTkE6JqEN2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090f2dd4db521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=256&min_rtt=248&rtt_var=86&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2202&delivery_rate=12920127&cwnd=252&unsent_bytes=0&cid=3c7412cba7dd3af2&ts=311&x=0", cfL4;desc="?proto=QUIC&rtt=1099&min_rtt=757&rtt_var=207&sent=893&recv=116&lost=0&retrans=1&sent_bytes=945884&recv_bytes=30367&delivery_rate=7355822&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=17157&x=1", cfExtPri, cfHdrFlush;dur=0
GET dg.norixen.com/yz5hllBTdpsOCfYc6vbsO5tFAqWopf3XU7kur27Zs00tgCFU9bvByvDf9ab171
104.21.73.195200 OK 2.9 kB URL GET HTTP/3 dg.norixen.com/yz5hllBTdpsOCfYc6vbsO5tFAqWopf3XU7kur27Zs00tgCFU9bvByvDf9ab171
IP 104.21.73.195:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
File type SVG Scalable Vector Graphics image
Hash e924de0d471df54b6280f3dc8b187cb8
857f03226070b502a9e06b4249710ec10be4c9e9
24ce135a31ce83ac3d62471fcc0e1a82ce6f1533c993ee59ca4e110d5f2fae33
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /yz5hllBTdpsOCfYc6vbsO5tFAqWopf3XU7kur27Zs00tgCFU9bvByvDf9ab171 HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:11 GMT
content-type: image/svg+xml
content-disposition: inline; filename="yz5hllBTdpsOCfYc6vbsO5tFAqWopf3XU7kur27Zs00tgCFU9bvByvDf9ab171"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yK%2By5YuYp3oesROn92KM6FwvThGY6uooOcHAlE0HQ9AW5KzsvjXBuaPjIgUzvLvy8rf5Edc8oNC3xeHgQG5TeYpv4WvTzA%2BdD0CPbPTJRoWxkMcnJi7oOt%2BsGPhUl0w2wV1dug%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 915090eb6947b521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=319&min_rtt=309&rtt_var=105&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2209&delivery_rate=11327731&cwnd=252&unsent_bytes=0&cid=61a78337e5d756a2&ts=166&x=0", cfL4;desc="?proto=QUIC&rtt=3796&min_rtt=1165&rtt_var=3580&sent=377&recv=62&lost=0&retrans=1&sent_bytes=395566&recv_bytes=27917&delivery_rate=199347&cwnd=127200&unsent_bytes=0&cid=18de337dc1777d20&ts=15913&x=1", cfExtPri, cfHdrFlush;dur=0
GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
143.204.55.47200 OK 223 kB URL GET HTTP/2 ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
IP 143.204.55.47:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
Size 223 kB (222931 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
date: Fri, 31 Jan 2025 21:15:21 GMT
server: nginx
last-modified: Tue, 14 May 2024 21:48:24 GMT
etag: W/"0329c939fca7c78756b94fbcd95e322b"
x-amz-meta-sha1sum: 7b5499b46660a0348cc2b22cae927dcc3fda8b20
expires: Sat, 31 Jan 2026 21:15:21 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 50584ad285d5f627ddebae74efdd0770.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: LG3Nal3AXCqsCuWDtBzae8IWJUu8wmKM6MmbP5OoUiRxuIS3OoRiJA==
age: 1718087
X-Firefox-Spdy: h2
POST pjadpm4veajvl9lnjtbpywsly0of0nbpmp73qsyimlnhc2v0sh8.umanpx.ru/947702007119309345982QztGIlTqgqEALTMSDBNJLWTOBGGDSBLEQLBLWLMYIRBMBXKXYrs0fbKVZ4M98Z9s534bqbVkoxwx40
172.67.142.143200 OK 536 B URL POST HTTP/2 pjadpm4veajvl9lnjtbpywsly0of0nbpmp73qsyimlnhc2v0sh8.umanpx.ru/947702007119309345982QztGIlTqgqEALTMSDBNJLWTOBGGDSBLEQLBLWLMYIRBMBXKXYrs0fbKVZ4M98Z9s534bqbVkoxwx40
IP 172.67.142.143:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerGoogle Trust Services
Subjectumanpx.ru
FingerprintF2:62:E1:EC:94:45:55:60:7C:B7:6A:BB:98:83:4A:92:9E:41:AB:1A
ValidityTue, 11 Feb 2025 18:24:40 GMT - Mon, 12 May 2025 19:22:19 GMT
File type ASCII text, with very long lines (536), with no line terminators
Hash b700a2408fff4601b18b91dd7b1adf0f
294a42cbff29c06fe6bff0cc3d5d6b93f7fda3dc
23731d6f86bfade6b1fd1acf5985785e9e1cb0f155f662cf89464d7a6f2c04b6
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
Quad9 DNS malicious Sinkholed
POST /947702007119309345982QztGIlTqgqEALTMSDBNJLWTOBGGDSBLEQLBLWLMYIRBMBXKXYrs0fbKVZ4M98Z9s534bqbVkoxwx40 HTTP/1.1
Host: pjadpm4veajvl9lnjtbpywsly0of0nbpmp73qsyimlnhc2v0sh8.umanpx.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 103
Origin: https://dg.norixen.com
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 20 Feb 2025 18:30:14 GMT
content-type: text/plain; charset=utf-8
vary: Origin
access-control-allow-origin: https://dg.norixen.com
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bt1k%2FMmaj%2FCXpu9fq66B5AaBAgOn23OtgNEw0d0yQiju0bDLE48YFIv%2FkJLNs8iyTo4k2hCfPsciNAore57cIYOUUmOHnaz%2FqNDTtrmyWsFYxHnwK3FusPBz6xfW3OxdTNneiLJBqRxEEVdm11BXKtSzWaI%2BXLKJDw2h7Ox1KI7bmtFdObPvTY%2BiSlEGk2N1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 91509110ec1bb4ed-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=689&min_rtt=555&rtt_var=305&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3271&recv_bytes=1544&delivery_rate=6961538&cwnd=254&unsent_bytes=0&cid=bf367756bf717082&ts=802&x=0"
X-Firefox-Spdy: h2
GET dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
104.21.73.195200 OK 289 kB URL User Request GET HTTP/3 dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
IP 104.21.73.195:443
Certificate IssuerGoogle Trust Services
Subjectnorixen.com
Fingerprint79:74:B8:4D:1E:EC:69:BE:0B:E7:D7:4F:FE:5A:15:9E:34:89:B8:E7
ValiditySun, 02 Feb 2025 19:47:47 GMT - Sat, 03 May 2025 19:08:08 GMT
Size 289 kB (289278 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU HTTP/1.1
Host: dg.norixen.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/JFWaj/
Cookie: XSRF-TOKEN=eyJpdiI6IlNsa2FqVDF3dHBHWHlxT1pVL25sd1E9PSIsInZhbHVlIjoiOFFFaHZJdk55dU9MSTVLVHZCOU1IWFVORS93V0NpSGZZS2JhVlhrT1g3Nzgzc05HNE9pb25qZGR6eEMwRzJwSXdGalNoYy9Bb0FjZ0hrVnIreWZ0c095a0JHUzZIS3ArL01ZbWFNR0dsVlVQeDc4cjdkSU1ZbTlvd2s3RzBvS04iLCJtYWMiOiIxYjQ4MTYyMDMzZGMzYjFiZDc1MmZkZThiMDE1ZGU3NjE5MGQyMjI2ZWVkN2Q4ZjZlN2JkZDMzZjQxY2FjZDAwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im9wVXRKdktMTGJWQ3gwMU5LSm4wd2c9PSIsInZhbHVlIjoicDJwS3BXZFpMS3I0TC9nNThoNDJTTGlpelBnZUF2NjRWMnlXekNnY3VPazlUY3J0MlFuUnoxd01XdUNkanJ6enFHanZVQ1hUNlRVL0EzaEVwVGI3TGVyeEI4VHdDcWxoWUJDNjRhU1MyTnF1d3JJYXl4RFd4cXdWRnVYeE8yR1YiLCJtYWMiOiIxYWI1NGYzMjY0MWE4YTI5MDc4MmJmYjllNTY3NGU5NmI5MjI4MWE3MmQ4NjVjZTk4YjNjYTc3NmE2YmQ0MTdlIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 20 Feb 2025 18:30:07 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0C52bSHnOgCb5lRZufxTUwSbNNDsUlQY04HGtzqPxnN7wpBhs1C7mrJxaxzoOanyASLoeKwugWr9E8BylZz1y09qLwbEfkhiJjyiHEvrK9kspAhBmwLzBlyPdF7473A7PF%2BsHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IkF6UzNNZHhXSHAxTU5oam1kbFRERGc9PSIsInZhbHVlIjoic0xYQWhOOHRCSE15anpCbnc5L25kNGVMTUl6aGY0UkF0aG5DMlM3Z1pkb1l6YXBEZVl4dlhBSjRmVW5ueXRRSU1ncTg5OEFSQ0RLRitpQjZxY254YXBiM0VQM1VNNmJXT3BSb1hheFRKSDRIZHI4dWUyY1NqaXhhTEQwVTk3MFEiLCJtYWMiOiJlNGI2MzFkOTNlZjRkNGE2ZTQzMDVkYjZiZDI1NDA2Yjg0MTBlMGQyNjliZmNlOTIwMDhjNGRhMGQxOWMxM2Q2IiwidGFnIjoiIn0%3D; expires=Thu, 20-Feb-2025 20:30:07 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IjRvc0N1dXpvamt1bHdCOE9MNmFDR0E9PSIsInZhbHVlIjoiNHVIMnp1Q2JCV0dRL2VTRElZVkJGMjVPUEVoL3oyL1dyWUV4QmJJaE01UlRLV2RpRGhtTlR4VDVuOTlhbTg3eElqcHBBZUxqLzRDNlUzbDFMMzB6dXpONUxrZUxGc1RGSUxTbGdrUlQ3YVFjOUpVUUJFT04ydXB1SkkrY1lrNWYiLCJtYWMiOiI3MjJiOTUxZmM5OTMyNzAzMjljN2IyNDNiZjk3ZWJmMDUxNGJkZjlhMzI4YzNkNzAxZmM2ZWY1ZjU2OTY2ZDgyIiwidGFnIjoiIn0%3D; expires=Thu, 20-Feb-2025 20:30:07 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 915090e54f23b521-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=18354&min_rtt=18343&rtt_var=5168&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2247&delivery_rate=220129&cwnd=228&unsent_bytes=0&cid=d245a7298c78179d&ts=389&x=0", cfL4;desc="?proto=QUIC&rtt=4900&min_rtt=1612&rtt_var=4868&sent=34&recv=17&lost=0&retrans=0&sent_bytes=19490&recv_bytes=6736&delivery_rate=896783&cwnd=12000&unsent_bytes=0&cid=18de337dc1777d20&ts=11775&x=1", cfExtPri, cfHdrFlush;dur=0
GET ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
143.204.55.47200 OK 10 kB URL GET HTTP/2 ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
IP 143.204.55.47:443
Requested by https://dg.norixen.com/zcithnnwdfikdgyceX50C30SWYC6PGV0MRTCA4PXC2?YUKXHKMDTUSPSJQGMGLRXYYU
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type ASCII text, with very long lines (10450)
Hash e0d37a504604ef874bad26435d62011f
4301f0d2b729ae22adece657d79eccaa25f429b1
c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179
GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dg.norixen.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Thu, 14 Mar 2024 00:03:58 GMT
x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Fri, 31 Jan 2025 02:19:39 GMT
expires: Sat, 31 Jan 2026 02:19:39 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 50584ad285d5f627ddebae74efdd0770.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: Xh_V9bewxWJQVYT-s_XLcdavVEJ8_Gqlk8lmfFtzCdpsMyGS3Qps9A==
age: 1786229
X-Firefox-Spdy: h2