challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
104.18.95.41302 Found 0 B URL challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
IP 104.18.95.41:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 14 Feb 2025 16:50:10 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/b/324d0dcf743c/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 911e8e408f781c0a-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
104.17.25.14200 OK 14 kB URL GET HTTP/3 cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP 104.17.25.14:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:50:10 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 156281
expires: Wed, 04 Feb 2026 16:50:10 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kyL%2BsArwXghvjjz5uuafZjjkuF8xxnZ%2Fd5vvsQKppx71iTbcSOCXsXiGG2KhW14vgbCy2Zva4zzouOs%2BFGSQGjkPxqp5UXbcHvmFZwWZxhUgog%2FcCzNIduwW8ClKUFyrAcrvE3QF"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911e8e409b78b509-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET code.jquery.com/jquery-3.6.0.min.js
151.101.2.137200 OK 31 kB URL GET HTTP/2 code.jquery.com/jquery-3.6.0.min.js
IP 151.101.2.137:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 14 Feb 2025 16:50:10 GMT
age: 793469
x-served-by: cache-lga21931-LGA, cache-hel1410020-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 29031
x-timer: S1739551811.705228,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
developers.cloudflare.com/favicon.png
104.16.6.189200 OK 937 B URL developers.cloudflare.com/favicon.png
IP 104.16.6.189:0
File type PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Hash fc3b7bbe7970f47579127561139060e2
3f7c5783fe1f4404cb16304a5a274778ea3abd25
85e6223afdbd5badf2c79bcfbaa6fe686acaa781eca52c196647ffabb3be2ffe
GET /favicon.png HTTP/1.1
Host: developers.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:50:10 GMT
content-type: image/png
content-length: 937
cache-control: public, max-age=0, must-revalidate
etag: "6be7ff94b6151f8cfbf08b53a17e2ac1"
set-cookie: __cf_bm=8nJ6bm5WzqR2slBXjzSknIwXWEvHzgAFm0hmnstwqno-1739551810-1.0.1.1-cVU6GdNc.OgvB0.DsQeVw4J173z6EWaBwfQI37ZbYNIz_LySr.4YQW8g19fVsM7EPNcCNgXbduyuYSCnjMkiLg; path=/; expires=Fri, 14-Feb-25 17:20:10 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: cloudflare
cf-ray: 911e8e4259e3569a-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js
104.18.95.41200 OK 23 kB URL challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js
IP 104.18.95.41:0
File type JavaScript source, ASCII text, with very long lines (48138)
Hash 59306e15eb43de76a56231e5e426ec80
7606b8e4aeace12b393ad6dcebdf6d64bc7240e9
69865fe9be4f6cdced3ca8c047a486db063f1179846f5edff395c39a7494fa34
GET /turnstile/v0/b/324d0dcf743c/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:50:10 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 11 Feb 2025 23:52:12 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 911e8e40afa81c0a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
104.17.25.14200 OK 14 kB URL GET HTTP/3 cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP 104.17.25.14:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:24 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 156295
expires: Wed, 04 Feb 2026 16:50:24 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WsfUrmrFgui08BLt30%2BRycLQNuRxI8jmsatYmfEmseMbF%2BsljPAzPcaEJGO1QMaM%2FLpufSi9bWw5z6nyP8aEQ0Q5NQ3kmxBmv2jDI8%2F7FgNLAVqQyUJ71mhI6ksscDS2VVBLoh34"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911e8e96cc5b56a2-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
q2berjupvxdohax90gif.brightnexst.ru/pax6lf1/
104.21.41.104200 OK 39 kB URL q2berjupvxdohax90gif.brightnexst.ru/pax6lf1/
IP 104.21.41.104:0
File type HTML document, ASCII text, with very long lines (10137), with CRLF line terminators
Hash 33d08cb058f2c3ca13b2865b07d947b9
f203fbfb30b81ee83d29f0d4c019cce36c39b2da
dc18113437f465dd2c6d3faadbdd1932bbbb917b700043400604a11f5c21aad2
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Microsoft Outlook
GET /pax6lf1/ HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://link.shoppermeet.net/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkhUMWRNQ3ZLaVZiMUNuT05oNExkR2c9PSIsInZhbHVlIjoiR1QvZzdtS2V4ZVVmdHFLT0ZmMFFXelBNTTJKZzMrbCtEK1VMUURZa0s5ZzIydVRTWFptYTR5MGlzTUdoMnV6MGpIY2c0bmNWY1NVRVN2MTBVSHJsem5rSi9wVE9ycXoydjM5MjROeHZodVF0TlJlQ3hjSkdDQVVnK2hmcHgxbHYiLCJtYWMiOiI5NTllMzg3OWZjMDE5NmZjMmM5MWUyMWQzZTgzOWZkNTg3ZTE1OTBiZmYzYjg1MGVjODY2OWU5ZTYxYWY5Yjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpONDRObmpSRDJqdFJxcEVpWmF3VlE9PSIsInZhbHVlIjoic3dkOXY1N1d3SWQ3clRlcmFhSVBnL29UeDA3TlllR1BSaURBbHNqemdhZ3dzZmF0S0wwS2RZNnl1dnZHMVUvTzBSSWtYckdkd2ZSY1hHZG9YaCtGakdOa1BpRTQzaWR4cUxqVm16dmpybkhnVHlGU1U4OVF6MDY1TTdOZzRoZWUiLCJtYWMiOiJiYTkyNTlkY2JmMjNhZWMyYjZhYTMxNTMzMzI4ZmM4NDlkOTBjYTdhMjhmYmE3NmFhY2FmY2VjMjFlNWEzOWZlIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:24 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GIqAQvYlr6%2B9xxR6VmdDyKAZTsbUqon6uNZo4%2BYvszYvW8t7raPzpyJ9jPbduZlUKbhciO3MigN1k%2BAfPuy%2BFonHi0CKGI3mD%2FXjMXHE2s0vq9p6m9IblCsucBXmyw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IkMvc2J1cklDNkdDYjVUZUoxQXk3a1E9PSIsInZhbHVlIjoiL0g3VTVOakdGSU5lNStQREFVcmkvZmsranZtdHBVOU5iUmUwbTNBV2xPR1dadytFaXkwMGNEb0h4VHd3bDNlZkMxOU9HTXlpVUd0K2E5NHBOVEh1c0JTSzR3dmRxM2U2OXh2cFhpaUdpdXlSMzVsUnplckh6YnlaL1d0MnV4ZEciLCJtYWMiOiI4NGIzNjdiMTE5ZTg0Y2UzNmI3M2VhNmU2YWRhNmRhODEyYzQzMTMxZDBlNWFhYjkxYjg3NmZmZjIzZWNjMmYxIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:50:24 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6Im42KzJudUZiZ29yU2RmdkczTlNiNFE9PSIsInZhbHVlIjoibHpBU3h2L1RhREpBSEtjTThoM3YzUVVyWFVNaDVUY0FyNWprRTFndTVkQ1gyQ2hRVUw3OEw4M2RjaHpvQ0l2QjVXVU5IK3hFVVd3dlpWNEN6UGdJRFJpeDdSS1JjRlJrTUVoUS8wQ1R2Nk10Q2Q2c1A1U3RoNGpIaVF0dkdMelAiLCJtYWMiOiJjYTcwNDVmMGU2MzI2NTM4NTJlNmFmNmIxOWNjM2NlNGRmZmQ1NzAzMTQzZTY5NzNjYjI5NmYzNDE3OWM1MWY0IiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:50:24 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 911e8e959ef0b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1433&min_rtt=1416&rtt_var=422&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2219&delivery_rate=1928095&cwnd=251&unsent_bytes=0&cid=a44ccddc034f2237&ts=106&x=0", cfL4;desc="?proto=QUIC&rtt=4516&min_rtt=1632&rtt_var=2569&sent=16&recv=11&lost=0&retrans=0&sent_bytes=5777&recv_bytes=3930&delivery_rate=118&cwnd=12000&unsent_bytes=0&cid=716754868bd21b02&ts=14020&x=1", cfExtPri, cfHdrFlush;dur=0
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
104.17.25.14200 OK 14 kB URL GET HTTP/3 cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP 104.17.25.14:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 156296
expires: Wed, 04 Feb 2026 16:50:25 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4D1aZ8li7ScDycIDLhVpTTIc4OGlzUg5gH0VzbgNqBGASMVcEQL%2F85pHga2FWG7QPWBNBTdJVwN%2FKaaxU4Ab3t3Rc13GzLqqkyP7669WsAKG0HvgCy7VzP2jSIngLLrU4qx%2Bumxq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911e8e9b1ba456a2-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
q2berjupvxdohax90gif.brightnexst.ru/rqliQJ5d6VrMC9JMHki4A3EwgigWyy38UVbsUfw
104.21.41.104200 OK 97 kB URL q2berjupvxdohax90gif.brightnexst.ru/rqliQJ5d6VrMC9JMHki4A3EwgigWyy38UVbsUfw
IP 104.21.41.104:0
Hash e15a84a440241bff101bd33e05f0aac6
3de7ac0cbb10755574c8373af55cb57cbe4b3507
392943729c7562621858f769faa30a78c8295261a45862a88620705b70a69c0f
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
POST /rqliQJ5d6VrMC9JMHki4A3EwgigWyy38UVbsUfw HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 38
Origin: https://q2berjupvxdohax90gif.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/pax6lf1/
Cookie: XSRF-TOKEN=eyJpdiI6IkMvc2J1cklDNkdDYjVUZUoxQXk3a1E9PSIsInZhbHVlIjoiL0g3VTVOakdGSU5lNStQREFVcmkvZmsranZtdHBVOU5iUmUwbTNBV2xPR1dadytFaXkwMGNEb0h4VHd3bDNlZkMxOU9HTXlpVUd0K2E5NHBOVEh1c0JTSzR3dmRxM2U2OXh2cFhpaUdpdXlSMzVsUnplckh6YnlaL1d0MnV4ZEciLCJtYWMiOiI4NGIzNjdiMTE5ZTg0Y2UzNmI3M2VhNmU2YWRhNmRhODEyYzQzMTMxZDBlNWFhYjkxYjg3NmZmZjIzZWNjMmYxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im42KzJudUZiZ29yU2RmdkczTlNiNFE9PSIsInZhbHVlIjoibHpBU3h2L1RhREpBSEtjTThoM3YzUVVyWFVNaDVUY0FyNWprRTFndTVkQ1gyQ2hRVUw3OEw4M2RjaHpvQ0l2QjVXVU5IK3hFVVd3dlpWNEN6UGdJRFJpeDdSS1JjRlJrTUVoUS8wQ1R2Nk10Q2Q2c1A1U3RoNGpIaVF0dkdMelAiLCJtYWMiOiJjYTcwNDVmMGU2MzI2NTM4NTJlNmFmNmIxOWNjM2NlNGRmZmQ1NzAzMTQzZTY5NzNjYjI5NmYzNDE3OWM1MWY0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:24 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WaWqqBD24VeV%2FTXASxUyBuk1B4sTK8PE1DI3uCefczRHzStJ%2B63RSNBJhR%2F9sfsCsYqfBcNg99Qgi2EsbOzLvybCF%2FJXL7chGNC1HoEjnYY5PrIC%2BxG3GauwfOyZMg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImJ6K3dKS0V0UHJHUFlCbWpLWWJ5bFE9PSIsInZhbHVlIjoiSFNGc1l5aVBHNWx0b2VJZFhJaDlncUFqYy9qcW5la1ZUSUhuV1phYjdoVmluRU5KMW9rcE13ejgvVFo2c0ptZ3lzKzlZYkRVSWdJQlRDdzg1RUozTW1OOFJUMTRVblY3WktBTHU2WmxtcjBxUm15THZBMUdkenVYTXg4Mnpob2giLCJtYWMiOiJjNjEzNjMwM2M1ZDFhNzNlZjRiMDY4NWUxMjYyYzRjYjA4YWYxNDVkYzUwY2NiZDk2MGJlMWE2Yzg4MmFhZDM0IiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:50:24 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImVvWkg1SUdtTmpvNVVqQjFGazJrQUE9PSIsInZhbHVlIjoiaXBFekdBdEJDRGRMaHFvWmR2YXl3QmV1VHhXcG55N1R0cjBnSTlVWUhJVmxmNktBdUtmV3hYOWx6ell3MUh1SzQ2dVZUcG1Zb1pQaHlHMjFoTjl1V1g1TEhOUHh5QytnWXRBSkxYV3owN2pYUEZGU3hBdFo1dHNpclpKbmhxUXQiLCJtYWMiOiIyYzQ4YTI4ZWZiM2IzMWJjYmYyOTQzOTRiNjA2ODBiY2U4ZWEyYmViMDQ5MDc1NWM0OGJjMjc0MmEyYTM3MTU4IiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:50:24 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8e9749b6b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1175&min_rtt=1109&rtt_var=549&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2339&delivery_rate=1764777&cwnd=251&unsent_bytes=0&cid=36604e8081b48ff2&ts=90&x=0", cfL4;desc="?proto=QUIC&rtt=4373&min_rtt=1632&rtt_var=1783&sent=29&recv=15&lost=0&retrans=0&sent_bytes=16944&recv_bytes=5940&delivery_rate=67893&cwnd=12000&unsent_bytes=0&cid=716754868bd21b02&ts=14279&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-bold.woff2
104.21.41.104200 OK 28 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-bold.woff2
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Hash a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-bold.woff2 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: font/woff2
content-length: 28000
content-disposition: inline; filename="GDSherpa-bold.woff2"
cache-control: max-age=14400
cf-cache-status: HIT
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6XNcmjZzp7PhnN31nrujIh3cPLoeZIxRdBDVJn47is3pFK6r37572mS7hpYraDF9TsCVxmNXg1E50q5Slu%2BgcSU8eVJXMFyuMwGgjZ704WWTVR4f6MrroS1nJBaErg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
age: 33
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8e9b292fb517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1447&min_rtt=1436&rtt_var=561&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2241&delivery_rate=1896529&cwnd=244&unsent_bytes=0&cid=77c6ff3b8d9f7e0a&ts=141&x=0", cfL4;desc="?proto=QUIC&rtt=2216&min_rtt=926&rtt_var=1480&sent=101&recv=31&lost=0&retrans=0&sent_bytes=88096&recv_bytes=10306&delivery_rate=5530048&cwnd=33600&unsent_bytes=0&cid=716754868bd21b02&ts=14781&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-regular.woff2
104.21.41.104200 OK 29 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-regular.woff2
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Hash 17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-regular.woff2 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: font/woff2
content-length: 28584
content-disposition: inline; filename="GDSherpa-regular.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FrTKBPehe5WBSeS6d4Mda7hTmJltdKWaqJq3NP2y27PpjjJBzIyj5LU3Uhv61FfGgTvrmDeUGcVdGFBN923bY%2BNOMuMbqBVyqmVRv1nFEogM4Ioddsnvnj3VaK1Jpg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 34
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8e9b5976b517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1143&min_rtt=1134&rtt_var=443&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2242&delivery_rate=2397350&cwnd=251&unsent_bytes=0&cid=f56d7601cfc7e805&ts=176&x=0", cfL4;desc="?proto=QUIC&rtt=2636&min_rtt=926&rtt_var=1950&sent=158&recv=39&lost=0&retrans=0&sent_bytes=151359&recv_bytes=18054&delivery_rate=1060800&cwnd=33600&unsent_bytes=0&cid=716754868bd21b02&ts=14807&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-regular.woff
104.21.41.104200 OK 37 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-regular.woff
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type Web Open Font Format, TrueType, length 36696, version 1.0
Hash a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-regular.woff HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: font/woff
content-length: 36696
content-disposition: inline; filename="GDSherpa-regular.woff"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I9MEvPYej8JU3QtYWdlTCKPLlizO5GGN2ZD%2BV3SrNPs0A6NB1bNc76Lal1MfjH8acwGvoPNZqeKKB2l1Fop8c1a%2FL93TfAabPnpLjh9V46AieaMQH1IkN5OoLMRmcw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 34
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8e9b5979b517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1170&min_rtt=1123&rtt_var=399&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2243&delivery_rate=2169288&cwnd=251&unsent_bytes=0&cid=ea16d831dff64eb4&ts=182&x=0", cfL4;desc="?proto=QUIC&rtt=2644&min_rtt=926&rtt_var=1480&sent=217&recv=42&lost=0&retrans=0&sent_bytes=218585&recv_bytes=20071&delivery_rate=1919550&cwnd=67200&unsent_bytes=0&cid=716754868bd21b02&ts=14811&x=1", cfExtPri, cfHdrFlush;dur=2
GET q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-bold.woff
104.21.41.104200 OK 36 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-bold.woff
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type Web Open Font Format, TrueType, length 35970, version 1.0
Hash 496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-bold.woff HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: font/woff
content-length: 35970
content-disposition: inline; filename="GDSherpa-bold.woff"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NGWJ0tJaotMyBBh530GcwYfe5Zf9b3K3kNJsuIusQaSmq1PwUVPTxNyVS4nW4crKxCfT8ca5tZpTdFehGpFxz1XXipuV0vdSRBMN2jCO8qvmsnyuLYWSX9E5l3U%2BPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 34
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8e9b5972b517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1396&min_rtt=1322&rtt_var=502&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2239&delivery_rate=1751966&cwnd=251&unsent_bytes=0&cid=38e99b92661f8156&ts=178&x=0", cfL4;desc="?proto=QUIC&rtt=2636&min_rtt=926&rtt_var=1950&sent=130&recv=39&lost=0&retrans=0&sent_bytes=117759&recv_bytes=18054&delivery_rate=1060800&cwnd=33600&unsent_bytes=0&cid=716754868bd21b02&ts=14804&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-vf.woff2
104.21.41.104200 OK 44 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-vf.woff2
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Hash 2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-vf.woff2 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: font/woff2
content-length: 43596
content-disposition: inline; filename="GDSherpa-vf.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ycJ9CNVVlOeesfzAGhK%2BT5hGfNHF%2BDw1YEqJPc3sXOw%2BhJGwGSJtRgWaYd1hR66JiF9xJRk7sJTODU%2F27lrC0C6olB0bZSmYJx0%2F3wS18d%2BBlVXWUGKoRvPdGI9eQw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 34
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8e9b597bb517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1023&min_rtt=1014&rtt_var=399&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2239&delivery_rate=2654445&cwnd=247&unsent_bytes=0&cid=c5fe161a2da944bb&ts=212&x=0", cfL4;desc="?proto=QUIC&rtt=2636&min_rtt=926&rtt_var=1950&sent=158&recv=39&lost=0&retrans=0&sent_bytes=151359&recv_bytes=18054&delivery_rate=1060800&cwnd=33600&unsent_bytes=0&cid=716754868bd21b02&ts=14806&x=1", cfExtPri, cfHdrFlush;dur=1
GET q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-vf2.woff2
104.21.41.104200 OK 93 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/GDSherpa-vf2.woff2
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Hash bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /GDSherpa-vf2.woff2 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: font/woff2
content-length: 93276
content-disposition: inline; filename="GDSherpa-vf2.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:51 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sRQs5qVeQeWqh8nSon8fRQD%2BcYCDIVn6ey%2BRQiVGwirh%2BZNGZ9wncJDhq6osmQioAg7YTsK28ZyFaNj7nbOQ3xsS7Nh7gy8s0OPmgRrAwkuhKsqFGb%2Fw71icTtG%2Fjw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 34
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8e9b597fb517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1541&min_rtt=1495&rtt_var=593&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2240&delivery_rate=1937123&cwnd=251&unsent_bytes=0&cid=f897b4f2d6da7b46&ts=227&x=0", cfL4;desc="?proto=QUIC&rtt=2636&min_rtt=926&rtt_var=1950&sent=158&recv=39&lost=0&retrans=0&sent_bytes=151359&recv_bytes=18054&delivery_rate=1060800&cwnd=33600&unsent_bytes=0&cid=716754868bd21b02&ts=14806&x=1", cfExtPri, cfHdrFlush;dur=7
GET ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
143.204.55.3200 OK 11 kB URL GET HTTP/2 ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
IP 143.204.55.3:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
Hash 12bdacc832185d0367ecc23fd24c86ce
4422f316eb4d8c8d160312bb695fd1d944cbff12
877ae491d9aac5c6ef82a8430f9f652ace8a0dbc7294bd112aad49bd593769d0
GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/png
content-length: 10796
server: nginx
last-modified: Tue, 23 Feb 2021 04:20:08 GMT
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
date: Wed, 29 Jan 2025 00:59:17 GMT
expires: Thu, 29 Jan 2026 00:59:17 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: "12bdacc832185d0367ecc23fd24c86ce"
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: Dt51WMaZ9upJG5Yz-gHkVdq96CpAHRT9XClM_vTIPoBX5EFZITfJYA==
age: 1439468
X-Firefox-Spdy: h2
GET github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
140.82.121.3302 Found 0 B URL GET HTTP/2 github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
IP 140.82.121.3:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerSectigo Limited
Subjectgithub.com
FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A
ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: GitHub.com
date: Fri, 14 Feb 2025 16:48:29 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-length: 0
x-github-request-id: 6CD2:1B04E2:29D146D:2AC9EEB:67AF7451
X-Firefox-Spdy: h2
GET q2berjupvxdohax90gif.brightnexst.ru/uvnT4CyXoPC5tNChTVgYt6IsHpestyvqBcs8ldS79tPs12130
104.21.41.104200 OK 644 B URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/uvnT4CyXoPC5tNChTVgYt6IsHpestyvqBcs8ldS79tPs12130
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type RIFF (little-endian) data, Web/P image
Hash 541b83c2195088043337e4353b6fd60d
f09630596b6713217984785a64f6ea83e91b49c5
2658b8874f0d2a12e8726df78ac8954324c3bbe4695e66bdef89195fde64322f
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /uvnT4CyXoPC5tNChTVgYt6IsHpestyvqBcs8ldS79tPs12130 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: image/webp
content-length: 644
content-disposition: inline; filename="uvnT4CyXoPC5tNChTVgYt6IsHpestyvqBcs8ldS79tPs12130"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p1vcCoV1KB5J5uhpQ3bpP1Pw1yFapXCvSF2skL%2FDkMFWj5FXFwcm7uHH%2FGRUcOroeYebFtOXsGwcZBJp7gtURkkIbqJ00I2z2E%2FU6npBg7GGwBC3bCQpNWyvfnvkMg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8e9b5980b517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1101&min_rtt=1088&rtt_var=331&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2231&delivery_rate=2468883&cwnd=251&unsent_bytes=0&cid=dfd564f665e7dd97&ts=77&x=0", cfL4;desc="?proto=QUIC&rtt=2923&min_rtt=926&rtt_var=1639&sent=354&recv=51&lost=0&retrans=0&sent_bytes=373487&recv_bytes=25147&delivery_rate=157541&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15376&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/opjDN1nRRakkEaxahFKIDbmngzxdpXWZgz7hoehx45137
104.21.41.104200 OK 892 B URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/opjDN1nRRakkEaxahFKIDbmngzxdpXWZgz7hoehx45137
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type RIFF (little-endian) data, Web/P image
Hash 41d62ca205d54a78e4298367482b4e2b
839aae21ed8ecfc238fdc68b93ccb27431cd5393
20a4a780db0bcc047015a0d8037eb4eb58b3e5cb338673799c030a3e1b626b40
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /opjDN1nRRakkEaxahFKIDbmngzxdpXWZgz7hoehx45137 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: image/webp
content-length: 892
content-disposition: inline; filename="opjDN1nRRakkEaxahFKIDbmngzxdpXWZgz7hoehx45137"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eZvlOY9j527mguOoXWxaPatUW4Hv%2FeA%2FQK2%2FxUDVP2kcLyj0IHUV3n75USde7HndKE0i4Qs5ff7xvWwCH%2BQdWykT%2B18NKFj9tDRkATG%2BNWO%2Btgx1iG0A2a4Lyv2jBA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8e9b6990b517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1178&min_rtt=1162&rtt_var=468&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2227&delivery_rate=2243222&cwnd=251&unsent_bytes=0&cid=a85c16a2a3d15374&ts=129&x=0", cfL4;desc="?proto=QUIC&rtt=2350&min_rtt=926&rtt_var=1473&sent=364&recv=55&lost=0&retrans=0&sent_bytes=381694&recv_bytes=25329&delivery_rate=2202500&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15441&x=1", cfExtPri, cfHdrFlush;dur=0
GET objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
185.199.108.133200 OK 10 kB URL GET HTTP/2 objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
IP 185.199.108.133:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerDigiCert Inc
Subject*.github.io
Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28
ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (10017)
Hash 6c20a2be8ba900bc0a7118893a2b1072
ff7766fde1f33882c6e1c481ceed6f6588ea764c
b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500
GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Tue, 07 Dec 2021 16:38:45 GMT
etag: "0x8D9B9A009499A1E"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d91f6eaf-e01e-0032-2f18-13e122000000
x-ms-version: 2023-11-03
x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT
x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=randexp.min.js
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
date: Fri, 14 Feb 2025 16:50:25 GMT
age: 4167
x-served-by: cache-iad-kiad7000045-IAD, cache-hel1410031-HEL
x-cache: HIT, HIT
x-cache-hits: 11369, 1
x-timer: S1739551826.520060,VS0,VE1
content-length: 10245
X-Firefox-Spdy: h2
GET q2berjupvxdohax90gif.brightnexst.ru/qrYdpI4cIkWNnQvIA6udfeBZEis0qEYsW2mg9s12uem2wvh1iZ2yOm14jy6ZIqDTndcd240
104.21.41.104200 OK 9.6 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/qrYdpI4cIkWNnQvIA6udfeBZEis0qEYsW2mg9s12uem2wvh1iZ2yOm14jy6ZIqDTndcd240
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type RIFF (little-endian) data, Web/P image
Hash 4946eb373b18d178c93d473489673bb6
16477acb73b63ca251d37401249e7e4515febd24
666bc574c9f3fb28a8ac626fa8105c187c2a313736494a06bd5a937473673c92
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /qrYdpI4cIkWNnQvIA6udfeBZEis0qEYsW2mg9s12uem2wvh1iZ2yOm14jy6ZIqDTndcd240 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: image/webp
content-length: 9648
content-disposition: inline; filename="qrYdpI4cIkWNnQvIA6udfeBZEis0qEYsW2mg9s12uem2wvh1iZ2yOm14jy6ZIqDTndcd240"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F8U5ieDzIVWxF2zcUTt8kwOcle2kVw9bVzwPVyBQmKzWiIjyvQ1f8Y0yEVoLvSkVk4hxK6tY0eaF9HPepMCyQnmH1Ky3yspAcgePbIWaKN4tXNkg098XBE0SOk2l7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8e9baa02b517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1267&min_rtt=1150&rtt_var=392&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2253&delivery_rate=2236293&cwnd=251&unsent_bytes=0&cid=ff7689374bf2e77b&ts=82&x=0", cfL4;desc="?proto=QUIC&rtt=1973&min_rtt=926&rtt_var=961&sent=385&recv=59&lost=0&retrans=0&sent_bytes=404452&recv_bytes=25512&delivery_rate=1221330&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15608&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/uv2SSRvcoZjkeNakre3HqD9dXNhTuLoamYgDrenxJBmnqwbte8zRBQUoBXhvK3DSgh260
104.21.41.104200 OK 18 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/uv2SSRvcoZjkeNakre3HqD9dXNhTuLoamYgDrenxJBmnqwbte8zRBQUoBXhvK3DSgh260
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type RIFF (little-endian) data, Web/P image
Hash 4b52ecdc33382c9dca874f551990e704
8f3bf8e41cd4cdddb17836b261e73f827b84341b
cce050cc3b150c0b370751021bb15018ee2b64ac369e230fe3b571a9b00d4342
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /uv2SSRvcoZjkeNakre3HqD9dXNhTuLoamYgDrenxJBmnqwbte8zRBQUoBXhvK3DSgh260 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: image/webp
content-length: 17842
content-disposition: inline; filename="uv2SSRvcoZjkeNakre3HqD9dXNhTuLoamYgDrenxJBmnqwbte8zRBQUoBXhvK3DSgh260"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dl3m92bgtelRBhbwcvo5jYcoVN0264FaTXzpCRS9IOUdCIr6e1IZkxDp9IRL84EqR1hpc8qq86hd7BGEP0TlcF0TAP%2FZIVUoavcLsW27egyHlL5JgJfDyHsT7UE6qw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8e9baa09b517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1266&min_rtt=1247&rtt_var=505&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2251&delivery_rate=2070050&cwnd=251&unsent_bytes=0&cid=ae6ce8212b33f1c2&ts=96&x=0", cfL4;desc="?proto=QUIC&rtt=1781&min_rtt=926&rtt_var=877&sent=394&recv=61&lost=0&retrans=0&sent_bytes=415197&recv_bytes=25603&delivery_rate=2269804&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15618&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/ghnfkCVKhwufgzAjGpjTzyiV6EJxyKpAITF2wrlTE5kTFEG1uph1LxSInRef210
104.21.41.104200 OK 25 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/ghnfkCVKhwufgzAjGpjTzyiV6EJxyKpAITF2wrlTE5kTFEG1uph1LxSInRef210
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type RIFF (little-endian) data, Web/P image
Hash f9a795e2270664a7a169c73b6d84a575
0fbb60ab27ab88c064eb347d0722c8ed4cf5e8b8
d00203b2eea6e418c31baafa949ada5349a9f9b7e99fa003aec7406822693740
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /ghnfkCVKhwufgzAjGpjTzyiV6EJxyKpAITF2wrlTE5kTFEG1uph1LxSInRef210 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: image/webp
content-length: 25216
content-disposition: inline; filename="ghnfkCVKhwufgzAjGpjTzyiV6EJxyKpAITF2wrlTE5kTFEG1uph1LxSInRef210"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uwsFRxJ4xO0F6VGzuKQ6KfdDDZ1%2Bm5882rWdFJ5vQ03DYFrZIrum6jC5Vr5WMmjQNGP64DmgPQuqC%2BEpv7S4%2BMq7oONgs1vMwlW7VDfiCcZ0ZaAtU%2FxohkWLhfQZkA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8e9ba9ffb517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1155&min_rtt=1139&rtt_var=353&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2245&delivery_rate=2289328&cwnd=251&unsent_bytes=0&cid=f60276e59e9c9774&ts=89&x=0", cfL4;desc="?proto=QUIC&rtt=1973&min_rtt=926&rtt_var=961&sent=373&recv=59&lost=0&retrans=0&sent_bytes=390948&recv_bytes=25512&delivery_rate=1221330&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15607&x=1", cfExtPri, cfHdrFlush;dur=0
GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
143.204.55.3200 OK 20 kB URL GET HTTP/2 ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
IP 143.204.55.3:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 20416, version 2.197
Hash d99a7377dabb55772ca9f986b0a04b57
2b5fcd8431953c44e410d0489899e74f6d2cfecc
affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149
GET /assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://q2berjupvxdohax90gif.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20416
date: Mon, 27 Jan 2025 07:42:18 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:56:28 GMT
etag: "d99a7377dabb55772ca9f986b0a04b57"
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
expires: Tue, 27 Jan 2026 07:42:18 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 46NtAMurT8kSDc7mH9hfl1rH0i_eHjbo6xk_QB_bkucNUvnqYaTdlw==
age: 1588088
X-Firefox-Spdy: h2
GET q2berjupvxdohax90gif.brightnexst.ru/ijDYqFtHTnCJDSbU5ygeqZfJrYmzUkSld3QPcqAqrOOsUDqibFijxUvjBhL5Rcv58XGS2zz4sHikyz230
104.21.41.104200 OK 1.3 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/ijDYqFtHTnCJDSbU5ygeqZfJrYmzUkSld3QPcqAqrOOsUDqibFijxUvjBhL5Rcv58XGS2zz4sHikyz230
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type RIFF (little-endian) data, Web/P image
Hash 32ca2081553e969f9fdd4374134521ad
7b09924c4c3d8b6e41fe38363e342da098be4173
216fc342a469aa6a005b2eacc24622095e5282d3e9f1ae99ce54c27b92ec3587
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /ijDYqFtHTnCJDSbU5ygeqZfJrYmzUkSld3QPcqAqrOOsUDqibFijxUvjBhL5Rcv58XGS2zz4sHikyz230 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:26 GMT
content-type: image/webp
content-length: 1298
content-disposition: inline; filename="ijDYqFtHTnCJDSbU5ygeqZfJrYmzUkSld3QPcqAqrOOsUDqibFijxUvjBhL5Rcv58XGS2zz4sHikyz230"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XPx1Pl8TQz9mavBKjA%2BxFBP0mJtEyrb3wsklhQ2ZJTxMwLKQpipjscfa2ueG2DhBvuxZmy9AYBc0ljbOB6lD%2BcuMkL%2FT0GYTjlZWIQmC0tnz0%2Ba9dofon97AhgSYLA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8ea23d3ab517-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1325&min_rtt=1307&rtt_var=526&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2263&delivery_rate=1993117&cwnd=251&unsent_bytes=0&cid=9fdd3e275c8fdbda&ts=92&x=0", cfL4;desc="?proto=QUIC&rtt=2826&min_rtt=926&rtt_var=1741&sent=849&recv=105&lost=0&retrans=0&sent_bytes=930454&recv_bytes=30546&delivery_rate=18209859&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=16034&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/ijicpSGYddHgEP8WbBh8unjqRrYLcdSVUmwJ6IgvAVSNH0i9Ju78169
104.21.41.104200 OK 7.4 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/ijicpSGYddHgEP8WbBh8unjqRrYLcdSVUmwJ6IgvAVSNH0i9Ju78169
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type SVG Scalable Vector Graphics image
Hash bca9b46fee32162356ba5b4783e614dc
cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5
fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /ijicpSGYddHgEP8WbBh8unjqRrYLcdSVUmwJ6IgvAVSNH0i9Ju78169 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: image/svg+xml
content-disposition: inline; filename="ijicpSGYddHgEP8WbBh8unjqRrYLcdSVUmwJ6IgvAVSNH0i9Ju78169"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wg5GQMWPwceiAq7%2BzK5iQ5itkjjN46sd1MEVjI%2B8HTHchwpxLGe3TvTUE2hg1PROgBn%2BGhsm72dnPFR7GYlQVCaOY376bt%2BBwoQdajdkN4szi8MD%2B9ioonY%2BiKNrKw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8e9b79a0b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1488&min_rtt=1483&rtt_var=428&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2237&delivery_rate=1902759&cwnd=251&unsent_bytes=0&cid=b0535aede4e3d202&ts=87&x=0", cfL4;desc="?proto=QUIC&rtt=2215&min_rtt=926&rtt_var=1375&sent=366&recv=56&lost=0&retrans=0&sent_bytes=383476&recv_bytes=25375&delivery_rate=350377&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15477&x=1", cfExtPri, cfHdrFlush;dur=0
GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
143.204.55.3200 OK 223 kB URL GET HTTP/2 ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
IP 143.204.55.3:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
Size 223 kB (222931 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Tue, 14 May 2024 21:48:24 GMT
x-amz-meta-sha1sum: 7b5499b46660a0348cc2b22cae927dcc3fda8b20
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Wed, 29 Jan 2025 17:13:28 GMT
expires: Thu, 29 Jan 2026 17:13:28 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"0329c939fca7c78756b94fbcd95e322b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: kfLG-NS8N0rvSaSKAZu--NcnY9nEUq56ftcivRHbSrX3Xovr1efs8g==
age: 1381017
X-Firefox-Spdy: h2
GET ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
143.204.55.3200 OK 10 kB URL GET HTTP/2 ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
IP 143.204.55.3:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type ASCII text, with very long lines (10450)
Hash e0d37a504604ef874bad26435d62011f
4301f0d2b729ae22adece657d79eccaa25f429b1
c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179
GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Thu, 14 Mar 2024 00:03:58 GMT
x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Fri, 31 Jan 2025 02:19:39 GMT
expires: Sat, 31 Jan 2026 02:19:39 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 9ede9483eb891e14681c7c693b47c862.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 6de22eZzaZ0b-MNGDBb05d9VSD9CWwkl0a8TMSRTYT4ok0phNl5EoA==
age: 1261846
X-Firefox-Spdy: h2
GET q2berjupvxdohax90gif.brightnexst.ru/34e9TX1q9ozAcOE1VBDzDdijYmaDYL7nS2Ao67108
104.21.41.104200 OK 4.8 MB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/34e9TX1q9ozAcOE1VBDzDdijYmaDYL7nS2Ao67108
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
Size 4.8 MB (4756466 bytes)
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /34e9TX1q9ozAcOE1VBDzDdijYmaDYL7nS2Ao67108 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:26 GMT
content-type: application/javascript
content-disposition: inline; filename="34e9TX1q9ozAcOE1VBDzDdijYmaDYL7nS2Ao67108"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zY9TtJXf9ilL%2BzTct88nkV%2F1oAgfaAwDZeu67lsDyUrXZ3E2GpMVSwzG5pmCscrv41%2B280iZkWK3%2BZmk54Xp7Lztq7RVPS1vSXaGq4KLmMCpxnzkuHU0qtqGfEXosA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8e9bba0bb517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1353&min_rtt=1316&rtt_var=567&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2187&delivery_rate=1795412&cwnd=251&unsent_bytes=0&cid=c73145811c788b0b&ts=91&x=0", cfL4;desc="?proto=QUIC&rtt=1781&min_rtt=926&rtt_var=877&sent=404&recv=61&lost=0&retrans=0&sent_bytes=427197&recv_bytes=25603&delivery_rate=2269804&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15619&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/kli04cYIX6en0r4TIj1rgHCg1ycvZF2845qoklTtSJuUrIYLXAd1jtfmAHnzGmjwx218
104.21.41.104200 OK 1.9 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/kli04cYIX6en0r4TIj1rgHCg1ycvZF2845qoklTtSJuUrIYLXAd1jtfmAHnzGmjwx218
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type SVG Scalable Vector Graphics image
Hash 4b5c228b4faba433d06ec569ed855b2d
a7d3882b93e332460e7c59510a6a811ef011983f
eb19d76cd1fad39abf0f2778991883a5cf9ff560117ce8f7c64124e71471b4ed
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /kli04cYIX6en0r4TIj1rgHCg1ycvZF2845qoklTtSJuUrIYLXAd1jtfmAHnzGmjwx218 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:26 GMT
content-type: image/svg+xml
content-disposition: inline; filename="kli04cYIX6en0r4TIj1rgHCg1ycvZF2845qoklTtSJuUrIYLXAd1jtfmAHnzGmjwx218"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Mm8DOO7kt3TtNauBcVrxIRR2ayQVR6A0qBmVzxxoGnju14x1M4ojqq8mKnzgi16OrdnrSu3UdZ8jx5RwaFyZtlmDcHcARsZfHhdadAA5ZHjP7ARpUA2U5yFFG8fzw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8ea23d35b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1426&min_rtt=1241&rtt_var=598&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2250&delivery_rate=2333601&cwnd=251&unsent_bytes=0&cid=d0a731154bd8124e&ts=91&x=0", cfL4;desc="?proto=QUIC&rtt=2826&min_rtt=926&rtt_var=1741&sent=847&recv=105&lost=0&retrans=0&sent_bytes=928875&recv_bytes=30546&delivery_rate=18209859&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=16032&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/34qUf1RL7j7cxyhAXj6711
104.21.41.104200 OK 27 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/34qUf1RL7j7cxyhAXj6711
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type ASCII text, with very long lines (26765), with no line terminators
Hash 1a862a89d5633fac83d763886726740d
e5ce3aa454c992a13fd406a9647d7afbf831051f
5c22fd904edb792331a7307ddf4a790e0d1318924f6d8e7362fa6b55d5ab6fbb
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /34qUf1RL7j7cxyhAXj6711 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="34qUf1RL7j7cxyhAXj6711"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U3KtVBtaWoHohfssXUNvc1W3S4k9WvruzQm95ZVo5lif%2FmPkLGjHudxr2FhmQbU7QHP1sT54DBZp%2FrHP5A68a%2BvZYK3CPxI6kygqzlHvbl0zv7pdCcDcz%2FqTvvK0ug%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 911e8e9b291fb517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1239&min_rtt=1227&rtt_var=485&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2197&delivery_rate=2184012&cwnd=251&unsent_bytes=0&cid=6ff4f32d7058ec1a&ts=85&x=0", cfL4;desc="?proto=QUIC&rtt=3162&min_rtt=926&rtt_var=1549&sent=348&recv=50&lost=0&retrans=0&sent_bytes=366404&recv_bytes=25102&delivery_rate=608465&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=14888&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/mnnEu6uqtPVPbCHQXEPPn60uv4635EgOGLzSICe5R90150
104.21.41.104200 OK 270 B URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/mnnEu6uqtPVPbCHQXEPPn60uv4635EgOGLzSICe5R90150
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type SVG Scalable Vector Graphics image
Hash 0c09c5ea7c28d6feb4d124957dde0a0d
1b9efde2d8f0e2a3d9d5315117e597c2d622fc5e
b3c39d2c15327b7ae68940502a2d7bf457fe521e075e6e671d0340edc58bcb3a
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /mnnEu6uqtPVPbCHQXEPPn60uv4635EgOGLzSICe5R90150 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: image/svg+xml
content-disposition: inline; filename="mnnEu6uqtPVPbCHQXEPPn60uv4635EgOGLzSICe5R90150"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oEh1RmTpfeCXd20XuKolL8Qm1OR5B%2BgDJjbMlqKNTDMMF6GlEdYVmydZ7bQ3Cb66rhcx5512cKnU8bxbO4%2BTJ1IV%2B5xQCfo4O95qJS9VdJSdaXdQMRGlxUn%2FDn63pw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8e9b6994b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1072&min_rtt=1063&rtt_var=418&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2228&delivery_rate=2535901&cwnd=251&unsent_bytes=0&cid=dd16d63dc3e450da&ts=127&x=0", cfL4;desc="?proto=QUIC&rtt=2116&min_rtt=926&rtt_var=1228&sent=369&recv=57&lost=0&retrans=0&sent_bytes=386782&recv_bytes=25421&delivery_rate=1521946&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15493&x=1", cfExtPri, cfHdrFlush;dur=0
GET get.geojs.io/v1/ip/geo.json
172.67.70.233200 OK 336 B URL GET HTTP/2 get.geojs.io/v1/ip/geo.json
IP 172.67.70.233:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectgeojs.io
Fingerprint55:74:AA:F3:7A:AF:02:8B:48:DB:6E:73:EB:A1:95:20:EC:13:2D:8E
ValidityTue, 31 Dec 2024 05:30:37 GMT - Mon, 31 Mar 2025 06:30:13 GMT
File type troff or preprocessor input, ASCII text, with very long lines (394), with no line terminators
Hash 0c7de1334864e507d633f5bc59a5f8f7
1f60f61cece5da9ce1dbe2ca32b003b7041e1c8d
85e3f08f85f9b332e948d98e7679861e95e26e6564b5a5a4066c37a2c0b679f2
GET /v1/ip/geo.json HTTP/1.1
Host: get.geojs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://q2berjupvxdohax90gif.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:50:28 GMT
content-type: application/json
x-request-id: 44d9eca8b3bf1c9e16bcaff68d486d24-ASH
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
geojs-backend: ash-01
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2QT0isG%2B%2B856NyKXbMRpGXGrtbIUdHY0%2FXlHY2VeSBkSCPISZlFFfk5yhzbMRaENKSDJ8Pm4WtWjcFsgXuN0bPhWbrvBGBoJVL4%2Ba8WVM8UYBeJ1EDz6VjwJkLjodg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server: cloudflare
cf-ray: 911e8eae59a4b4eb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=550&min_rtt=489&rtt_var=130&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3264&recv_bytes=1276&delivery_rate=6939297&cwnd=254&unsent_bytes=0&cid=c541453aba42427e&ts=121&x=0"
X-Firefox-Spdy: h2
GET q2berjupvxdohax90gif.brightnexst.ru/opc3Re8rkV4dKbhGWDYqsfj4qUGnEYOSOLckzRghuT0gE2Zit9RB0EFWeQUyhef200
104.21.41.104200 OK 268 B URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/opc3Re8rkV4dKbhGWDYqsfj4qUGnEYOSOLckzRghuT0gE2Zit9RB0EFWeQUyhef200
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type SVG Scalable Vector Graphics image
Hash 1318aafc1fb9ded0c623e5b9a557e6df
0917cdd7633cd1642b02b2b785416ec7e5106dcc
d86660a84daa211b121ec9fe0df83d6b945f61b888384391eabc7d6b4e941dc4
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /opc3Re8rkV4dKbhGWDYqsfj4qUGnEYOSOLckzRghuT0gE2Zit9RB0EFWeQUyhef200 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: image/svg+xml
content-disposition: inline; filename="opc3Re8rkV4dKbhGWDYqsfj4qUGnEYOSOLckzRghuT0gE2Zit9RB0EFWeQUyhef200"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LF6OsF8gMHwcGiOc95tWbCkPKqmEY84m6sXiwKIsiQESdDiXphK9pS7jXkLUtennaOAvh6b%2Fa9pdsU80nr5%2B4BkI2bqcsCyqE2q2UXwariZiU6IWfbHERMD5JVbgPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8e9b79aab517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1055&min_rtt=1049&rtt_var=406&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2248&delivery_rate=2627949&cwnd=251&unsent_bytes=0&cid=8f9e7304c6630d6b&ts=78&x=0", cfL4;desc="?proto=QUIC&rtt=1973&min_rtt=926&rtt_var=961&sent=372&recv=59&lost=0&retrans=0&sent_bytes=389884&recv_bytes=25512&delivery_rate=1221330&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15597&x=1", cfExtPri, cfHdrFlush;dur=0
POST q2berjupvxdohax90gif.brightnexst.ru/tnLsCWdQ5COGJ8KbPDSsCS2UdZZKC4QstJumIocWqH17yGjdsn2
104.21.41.104200 OK 2.8 kB URL POST HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/tnLsCWdQ5COGJ8KbPDSsCS2UdZZKC4QstJumIocWqH17yGjdsn2
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type troff or preprocessor input, ASCII text, with very long lines (2797), with no line terminators
Hash d1a884bd70c69e29926cc167d69b2c67
9899d8a7c31525625f4c8f330f561cc62e3b68a8
c11dd8995c68e221d12eb08ab5f49f944e659451e9a9f29f35cd00622ce627cb
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
POST /tnLsCWdQ5COGJ8KbPDSsCS2UdZZKC4QstJumIocWqH17yGjdsn2 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 55
Origin: https://q2berjupvxdohax90gif.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:26 GMT
content-type: application/json
cache-control: no-cache, private
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2lNyBEvZ1N7%2BmJd6mJ4NHCF1b7gRxDNUAATepXwh8ZBBZGCv5JAHLRemRsZXSW31UyPlNPc83wOg8%2BDkNlmsx8H%2FoYcncCVUZ5JgmazVzo7TmnHGWFg%2F0dNDfEf3rg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IjVMUDBnblB5WHdHV1U5dDNKWFJoZUE9PSIsInZhbHVlIjoiT285RDhsWWcwTVNPamdzSUE2ckcyZEdBV1FQYW84eTczUEtCNUQ4OGFNbGUySEV5QmpUYkpzRkdzblBwQkVhTDZ3cW1Ybm04dmYzdEFtSmVJOHlHUXgrdHpzMll6MmNtZEMrMDBZZ20xeGxMamx5TENxeFBtT1Qyb0svYWc0dHIiLCJtYWMiOiI5MDQ4ZTM1NjU2MGQ0ZGEyN2I2OGRjYzdiYTJkMjY3YjFkZTM4MzQ5ZDkxMmNhZDY3ZTkyMWFiZmUzNGQ0OWZkIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:50:26 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImNNdkxWUFlkbXpiK2RJRmRaQkR0T1E9PSIsInZhbHVlIjoiS1Fhb0xYa1ozaVBnNFQvMlUvRzlwcnU1VTdTN0U0RzVxajMxZjFlRGQ3clhQM1VNTVdQNW1BTmpOWlFrUGM5ME1VeDU1V1A4SGVrWUxnTEVPaytVN3lqWnBhZjB4Rmw2U1RBdjVYNmNZdHByUXBXbHppWXdUa2ZZSWpIVTI3OTYiLCJtYWMiOiI0NTFhOGEwYmY3OTU4OGJjZWE2YjM1NGVjY2E4Y2I1OGNmNmM0YzllNmJlN2Q3MWI3MDc4ZjkxZmJiNGQyMDVmIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:50:26 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8ea1bc75b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1024&min_rtt=1007&rtt_var=412&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2420&delivery_rate=2524847&cwnd=251&unsent_bytes=0&cid=57bf08d346a7b05d&ts=86&x=0", cfL4;desc="?proto=QUIC&rtt=2185&min_rtt=926&rtt_var=1164&sent=707&recv=96&lost=0&retrans=0&sent_bytes=766726&recv_bytes=30138&delivery_rate=20187467&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15945&x=1", cfExtPri, cfHdrFlush;dur=0
POST y0iiu6q5n2fmiaxg1mj9behw0hkis2kavq5sxvfkwk6dznnhfyefbxne.alphasphexre.ru/tGIdSMveqbKviBhaRevjypnAGMmLSJINGHIMEFOUCTLGQZSMKDINQUSSGTMCODORGKSYrs9XBEtzYiJ0fp9RW12fP45HKjuv35
188.114.96.1200 OK 536 B URL POST HTTP/2 y0iiu6q5n2fmiaxg1mj9behw0hkis2kavq5sxvfkwk6dznnhfyefbxne.alphasphexre.ru/tGIdSMveqbKviBhaRevjypnAGMmLSJINGHIMEFOUCTLGQZSMKDINQUSSGTMCODORGKSYrs9XBEtzYiJ0fp9RW12fP45HKjuv35
IP 188.114.96.1:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectalphasphexre.ru
Fingerprint51:0B:50:F9:26:19:11:28:1B:CE:49:F2:27:82:01:A0:E9:CD:B8:49
ValidityThu, 23 Jan 2025 22:23:35 GMT - Wed, 23 Apr 2025 23:22:15 GMT
File type ASCII text, with very long lines (536), with no line terminators
Hash b700a2408fff4601b18b91dd7b1adf0f
294a42cbff29c06fe6bff0cc3d5d6b93f7fda3dc
23731d6f86bfade6b1fd1acf5985785e9e1cb0f155f662cf89464d7a6f2c04b6
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
POST /tGIdSMveqbKviBhaRevjypnAGMmLSJINGHIMEFOUCTLGQZSMKDINQUSSGTMCODORGKSYrs9XBEtzYiJ0fp9RW12fP45HKjuv35 HTTP/1.1
Host: y0iiu6q5n2fmiaxg1mj9behw0hkis2kavq5sxvfkwk6dznnhfyefbxne.alphasphexre.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 123
Origin: https://q2berjupvxdohax90gif.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:50:29 GMT
content-type: text/plain; charset=utf-8
vary: Origin
access-control-allow-origin: https://q2berjupvxdohax90gif.brightnexst.ru
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r2AZdGLIMTGsepOEHUxJ1Mg%2Fi2CqKTEO2DAoL4T4FEAJrbOAdpEZS2qzGGnbkw0QoeK2BZGB6WRGUw0Uf2hFvrFJhGgWwm%2FPHrW5G5dkJhen29QHZE5xt9schifDImGw2SS4k7zX%2FA1jwngSjIdyDQMw7GLX4pXeDz%2Fw2Q7jJyVswy68zRFgH7WPewrIISTDyfxxdWCpHs7hSg0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 911e8eafccdab512-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=577&min_rtt=479&rtt_var=193&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3209&recv_bytes=1431&delivery_rate=6808777&cwnd=253&unsent_bytes=0&cid=563c2b96ccb18aa4&ts=906&x=0"
X-Firefox-Spdy: h2
GET q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
104.21.41.104200 OK 150 kB URL User Request GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
IP 104.21.41.104:443
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type HTML document, ASCII text, with very long lines (52491), with CRLF line terminators
Size 150 kB (150362 bytes)
Hash 7f8d58c9e7628c23e85124086bc59816
30b9f1f355558112dfd6da19bb4df69ad03de409
c0c2c4fc3e470171fc83f939e207ab519ccc7f9682b39aa190f4d276bcdbbc98
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery suspicious Suspicious - Anti-debugging code
GET /tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/pax6lf1/
Cookie: XSRF-TOKEN=eyJpdiI6ImJ6K3dKS0V0UHJHUFlCbWpLWWJ5bFE9PSIsInZhbHVlIjoiSFNGc1l5aVBHNWx0b2VJZFhJaDlncUFqYy9qcW5la1ZUSUhuV1phYjdoVmluRU5KMW9rcE13ejgvVFo2c0ptZ3lzKzlZYkRVSWdJQlRDdzg1RUozTW1OOFJUMTRVblY3WktBTHU2WmxtcjBxUm15THZBMUdkenVYTXg4Mnpob2giLCJtYWMiOiJjNjEzNjMwM2M1ZDFhNzNlZjRiMDY4NWUxMjYyYzRjYjA4YWYxNDVkYzUwY2NiZDk2MGJlMWE2Yzg4MmFhZDM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImVvWkg1SUdtTmpvNVVqQjFGazJrQUE9PSIsInZhbHVlIjoiaXBFekdBdEJDRGRMaHFvWmR2YXl3QmV1VHhXcG55N1R0cjBnSTlVWUhJVmxmNktBdUtmV3hYOWx6ell3MUh1SzQ2dVZUcG1Zb1pQaHlHMjFoTjl1V1g1TEhOUHh5QytnWXRBSkxYV3owN2pYUEZGU3hBdFo1dHNpclpKbmhxUXQiLCJtYWMiOiIyYzQ4YTI4ZWZiM2IzMWJjYmYyOTQzOTRiNjA2ODBiY2U4ZWEyYmViMDQ5MDc1NWM0OGJjMjc0MmEyYTM3MTU4IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cmz90EjR98Ydrl0Zz8nJm3V00Mm7m0J6omTUpNkqJvqSoLZJYZs9GXy3ZMCaB2f9tD6%2FUxdCwF%2FmYBIsczIe4FRRSIiSc6Wh64nABkDYT0%2FWCt5GaE2cNC44VE7DSA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:50:24 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:50:24 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 911e8e991d47b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1528&min_rtt=1516&rtt_var=438&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2284&delivery_rate=1864777&cwnd=251&unsent_bytes=0&cid=4a74144f3d822df4&ts=147&x=0", cfL4;desc="?proto=QUIC&rtt=4113&min_rtt=1632&rtt_var=1857&sent=34&recv=17&lost=0&retrans=0&sent_bytes=18844&recv_bytes=6971&delivery_rate=19406&cwnd=12000&unsent_bytes=0&cid=716754868bd21b02&ts=14633&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/xyusDh9aBarsYjUyef30
104.21.41.104200 OK 36 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/xyusDh9aBarsYjUyef30
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type ASCII text, with CRLF line terminators
Hash 38501e3fbbbd89b56aa5ba35de1a32fe
d9b31981b6f834e8480ba28fbc1cff1be772f589
a1ca6b381cb01968851c98512c6e7f6c5309a49f7a16b864813135cbff82a85b
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /xyusDh9aBarsYjUyef30 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="xyusDh9aBarsYjUyef30"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AoRA9q0A8mdFWIlxdCfqblLTFNrAec9mKTjE9vpIZ3TlqhFBXo7%2Bx5lzynJ%2BP9Fbijuou03L6iSLAjXkuPQhgPEfQYYj6uqB5NrXXFRVRxkzdJtWe1gWSGAr00GrSw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 911e8e9b2925b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1168&min_rtt=1164&rtt_var=336&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2195&delivery_rate=2421404&cwnd=251&unsent_bytes=0&cid=78f959e4fc13b3dd&ts=87&x=0", cfL4;desc="?proto=QUIC&rtt=2710&min_rtt=926&rtt_var=1656&sent=356&recv=52&lost=0&retrans=0&sent_bytes=375018&recv_bytes=25193&delivery_rate=730356&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15381&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/favicon.ico
104.21.41.104404 Not Found 0 B URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/favicon.ico
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /favicon.ico HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6IjVMUDBnblB5WHdHV1U5dDNKWFJoZUE9PSIsInZhbHVlIjoiT285RDhsWWcwTVNPamdzSUE2ckcyZEdBV1FQYW84eTczUEtCNUQ4OGFNbGUySEV5QmpUYkpzRkdzblBwQkVhTDZ3cW1Ybm04dmYzdEFtSmVJOHlHUXgrdHpzMll6MmNtZEMrMDBZZ20xeGxMamx5TENxeFBtT1Qyb0svYWc0dHIiLCJtYWMiOiI5MDQ4ZTM1NjU2MGQ0ZGEyN2I2OGRjYzdiYTJkMjY3YjFkZTM4MzQ5ZDkxMmNhZDY3ZTkyMWFiZmUzNGQ0OWZkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImNNdkxWUFlkbXpiK2RJRmRaQkR0T1E9PSIsInZhbHVlIjoiS1Fhb0xYa1ozaVBnNFQvMlUvRzlwcnU1VTdTN0U0RzVxajMxZjFlRGQ3clhQM1VNTVdQNW1BTmpOWlFrUGM5ME1VeDU1V1A4SGVrWUxnTEVPaytVN3lqWnBhZjB4Rmw2U1RBdjVYNmNZdHByUXBXbHppWXdUa2ZZSWpIVTI3OTYiLCJtYWMiOiI0NTFhOGEwYmY3OTU4OGJjZWE2YjM1NGVjY2E4Y2I1OGNmNmM0YzllNmJlN2Q3MWI3MDc4ZjkxZmJiNGQyMDVmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 14 Feb 2025 16:50:27 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vGdrtWm%2BqjqMFf8LgoWAA%2BQsNQj5QqOE1Ml5vre5CcloD5Asccu%2F1LdVwqBqtRds5qV9HMqaM43hRCaGPeg6Zz7d5%2BEYrqxhJhyJnTV5jT%2FiRv9OjOmI2GijKj1Jkw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 37
priority: u=6,i=?0
server: cloudflare
cf-ray: 911e8ea6ee29b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1373&min_rtt=1273&rtt_var=678&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2177&delivery_rate=1394990&cwnd=234&unsent_bytes=0&cid=efba9c42d24b6906&ts=144&x=0", cfL4;desc="?proto=QUIC&rtt=2539&min_rtt=926&rtt_var=1509&sent=852&recv=108&lost=0&retrans=0&sent_bytes=932699&recv_bytes=31583&delivery_rate=1405591&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=16655&x=1", cfExtPri, cfHdrFlush;dur=0
GET q2berjupvxdohax90gif.brightnexst.ru/wxos15pghCQ7RVdQ6FkfOalqx0F9preb560TDiOemntVmIht7HTmlm2gbRNbcEAbc790172
104.21.41.104200 OK 2.9 kB URL GET HTTP/3 q2berjupvxdohax90gif.brightnexst.ru/wxos15pghCQ7RVdQ6FkfOalqx0F9preb560TDiOemntVmIht7HTmlm2gbRNbcEAbc790172
IP 104.21.41.104:443
Requested by https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Certificate IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT
File type SVG Scalable Vector Graphics image
Hash e924de0d471df54b6280f3dc8b187cb8
857f03226070b502a9e06b4249710ec10be4c9e9
24ce135a31ce83ac3d62471fcc0e1a82ce6f1533c993ee59ca4e110d5f2fae33
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /wxos15pghCQ7RVdQ6FkfOalqx0F9preb560TDiOemntVmIht7HTmlm2gbRNbcEAbc790172 HTTP/1.1
Host: q2berjupvxdohax90gif.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://q2berjupvxdohax90gif.brightnexst.ru/tuctewavacfmirfyhzykswrxmpsoqvnXACGPKTHHHQVFCRV?SOWRPSMDVEHX
Cookie: XSRF-TOKEN=eyJpdiI6ImIxcTl2UVpINFQ5c2VTTUJ1UHc2ZXc9PSIsInZhbHVlIjoieDhta3ZtR3FtQUNjV29IUEM5UTFwbG1LSjNtekFXdUdOelRtODhQU29Fek53aUJtSFQ1c2NQRVdpOU9hYThzUEFPem9XSVo2eGNjYVd0OXZPZmNEN3ZPUXQzVkdQczQxeEltMjZ1R1FsdlNtdGNORVhraHlHVGJVL1RaSVdXSUwiLCJtYWMiOiIxMWNlZWNkNWE2ODlkMjM2NzlmM2IxOGM2NDM3MzFlMDQyMDZlZGE1ODVlNzRiYTVmOTY0N2Y3N2FmYzU0ZWUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkxpZ2xkR0d3cG9lRjBYMDhabnZDR2c9PSIsInZhbHVlIjoib3NNaWw2RVdLTXk5TThHdmNROUZvTVVNaDZOeVUzejZCVHFwNlY3YWtnT2ZJU3dUREVDVU5vdWNacWxneUFMclJna1l3cmtER0w4WmpPWW5BcUlFeU11OElMSGJnTmwwdTJoSjhic1EyWWlsOFBBOWkvZ0JiOGdpdm5ONWFyblUiLCJtYWMiOiI3Zjg2M2FiYWZmM2QwYTZhNjI0NTllYTQ4MGU4NDBlN2ExMDFmZjNmNTFkODlhZjk4YzM1YWU1NWFkMTM0ZDVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:50:25 GMT
content-type: image/svg+xml
content-disposition: inline; filename="wxos15pghCQ7RVdQ6FkfOalqx0F9preb560TDiOemntVmIht7HTmlm2gbRNbcEAbc790172"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o69GKLsaHwCXc0v4SPhkhf2hQ85IrLIuupndvwY5uuQtn2SLuYziJUnBWk5cfKOj3fwccq0JrhiDbG51Pb7F9RPL82jk%2BgSCEegeHiy2CjXHJD7jDn1tTMQdkU1NnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8e9b79a1b517-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1170&min_rtt=1150&rtt_var=341&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2253&delivery_rate=2405315&cwnd=246&unsent_bytes=0&cid=deccf4e3a05f5f04&ts=81&x=0", cfL4;desc="?proto=QUIC&rtt=2085&min_rtt=926&rtt_var=983&sent=370&recv=58&lost=0&retrans=0&sent_bytes=387824&recv_bytes=25467&delivery_rate=47648&cwnd=268800&unsent_bytes=0&cid=716754868bd21b02&ts=15541&x=1", cfExtPri, cfHdrFlush;dur=0