| progressie.click/control_greenlant/?login=accounting@caballero-brokers.net |  172.67.202.43 | | 167 B |
URL progressie.click/control_greenlant/?login=accounting@caballero-brokers.net IP172.67.202.43:0
File typeHTML document, ASCII text, with CRLF line terminators Hash0104c301c5e02bd6148b8703d19b3a73 7436e0b4b1f8c222c38069890b75fa2baf9ca620 446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
GET /control_greenlant/?login=accounting@caballero-brokers.net HTTP/1.1
Host: progressie.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Date: Tue, 07 May 2024 20:42:41 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Tue, 07 May 2024 21:42:41 GMT
Location: https://progressie.click/control_greenlant/?login=accounting@caballero-brokers.net
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FbxbB638L0A5eyBjxOaQbwuLQmjURWYtdsqWM5xVw2%2FjZJy%2F4SJpDNzmHCUDbRe4aNXrGRlLIRD%2FF1xCYE4O40NhlVQgAcSKEnlA7z5gjtf0spnQmsI9IFLRnSNV482OzOyR"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 880409b88ff95699-OSL
alt-svc: h2=":443"; ma=60
|
|
| challenges.cloudflare.com/turnstile/v0/api.js |  104.17.3.184 | | 0 B |
URL challenges.cloudflare.com/turnstile/v0/api.js IP104.17.3.184:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Tue, 07 May 2024 20:42:42 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/b/ce7818f50e39/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 880409c28b7856b1-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null | 104.21.23.6 | 200 OK | 32 kB |
URL User Request GET HTTP/3jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null IP104.21.23.6:443
CertificateIssuerLet's Encrypt Subjectjupita.top Fingerprint9E:5B:A3:A8:86:17:B2:D3:02:73:C1:56:80:93:96:CC:EA:89:5C:6D ValidityThu, 18 Apr 2024 20:57:05 GMT - Wed, 17 Jul 2024 20:57:04 GMT
File typeHTML document, ASCII text, with very long lines (1847), with no line terminators Hashdeda9352c49a23c86315bb308c0747db 457e12be2233ed4b54f448476e40ac916fd61657 037ed40bd357eaa68ed9a5e62eab9da11768068698fd51986295aed70e0ae950
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft Outlook | | urlquery | suspicious | Suspicious - Anti-debugging code | | Quad9 DNS | malicious | Sinkholed |
GET /_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null HTTP/1.1
Host: jupita.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://progressie.click/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
date: Tue, 07 May 2024 20:42:42 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.30
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hImGBr2s3e89blIQ6g8lHxfsuwDIrk2xXvBJmk4kAKjONXi4zGWmdMrQKtCW2ZTK9J70eCiiYyCKnEm0aUkI2kH1%2FqfuK0Oiek7Rgd1eaY4wG5sO1g8sjTLEpvzi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880409bfbfd01c12-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| jupita.top/cdn-cgi/challenge-platform/scripts/jsd/main.js | 104.21.23.6 | | 0 B |
URL jupita.top/cdn-cgi/challenge-platform/scripts/jsd/main.js IP104.21.23.6:0
CertificateIssuerLet's Encrypt Subjectjupita.top Fingerprint9E:5B:A3:A8:86:17:B2:D3:02:73:C1:56:80:93:96:CC:EA:89:5C:6D ValidityThu, 18 Apr 2024 20:57:05 GMT - Wed, 17 Jul 2024 20:57:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1
Host: jupita.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 302 Found
date: Tue, 07 May 2024 20:42:43 GMT
content-length: 0
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/ce7818f50e39/main.js
cache-control: max-age=300, public
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZxncHW4HWO99TB6Y%2BJunnT4FDezQtdf29sH84UVDwJWR3JMSUWufyo3zDXW6J0MFKJSPoZFKfgaPYe%2F%2B3QnxzM9eWeEYgHB9lyVjSpdl5btP1jFIw5h2sQ8jjEP2"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880409c47d1a569a-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D | 104.17.3.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D IP104.17.3.184:0
File typePNG image data, 2 x 2, 8-bit/color RGB, non-interlaced Hash9246cca8fc3c00f50035f28e9f6b7f7d 3aa538440f70873b574f40cd793060f53ec17a5d c07d7d29e3c20fa6ca4c5d20663688d52bad13e129ad82ce06b80eb187d9dc84
GET /cdn-cgi/challenge-platform/h/b/cmg/1/GLhOioXg0bs57t4qPrORXFsL1%2BWig2mIKbgpVPMu7ZQ%3D HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/qt9kx/0x4AAAAAAAXjXiXiV7KvBpAv/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 20:42:43 GMT
content-type: image/png
content-length: 61
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 880409c549fa56a4-OSL
alt-svc: h3=":443"; ma=86400
|
|
| jupita.top/cdn-cgi/challenge-platform/h/b/jsd/r/880409bfbfd01c12 | 104.21.23.6 | | 0 B |
URL jupita.top/cdn-cgi/challenge-platform/h/b/jsd/r/880409bfbfd01c12 IP104.21.23.6:0
CertificateIssuerLet's Encrypt Subjectjupita.top Fingerprint9E:5B:A3:A8:86:17:B2:D3:02:73:C1:56:80:93:96:CC:EA:89:5C:6D ValidityThu, 18 Apr 2024 20:57:05 GMT - Wed, 17 Jul 2024 20:57:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/jsd/r/880409bfbfd01c12 HTTP/1.1
Host: jupita.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 12313
Origin: https://jupita.top
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 20:42:43 GMT
content-type: text/plain; charset=UTF-8
content-length: 0
set-cookie: cf_clearance=_sGaiqHi2ltLjTZ2Fgn56mPXP3Ol9x4GPkjOWlc.t0I-1715114563-1.0.1.1-quKlf1ZP1asUtC.vPv8EHEUyQF.dw09CdJAfT5kE6HZpUImnj7_02NzVBxNYfL5rvyH09NZMb8PJ9F2w.O5HvA; path=/; expires=Wed, 07-May-25 20:42:43 GMT; domain=.jupita.top; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hKoeaZmRopqJzND5eXHfqhQi0x3GfEOPZNtbIrTfwCmNZ8QhCwTTHIelsst9Wc63vbk8Jib0yPMYMI0VFk3XZFMVFmOvWfsVC%2FE6nMgGApwPCR%2BgZDpjmqIHOh0V"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880409c5deec569a-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/880409c498fd56a4/1715114563772/de26a1a06cd0e1bba1418f7f9f95fd53ef7210d4f096a1afc4a050d17b38f757/0-BXRbCz-pGKy02 | 104.17.3.184 | | 1 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/880409c498fd56a4/1715114563772/de26a1a06cd0e1bba1418f7f9f95fd53ef7210d4f096a1afc4a050d17b38f757/0-BXRbCz-pGKy02 IP104.17.3.184:0
File typevery short file (no magic) Hashff44570aca8241914870afbc310cdb85 58668e7669fd564d99db5d581fcdb6a5618440b5 6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
GET /cdn-cgi/challenge-platform/h/b/pat/880409c498fd56a4/1715114563772/de26a1a06cd0e1bba1418f7f9f95fd53ef7210d4f096a1afc4a050d17b38f757/0-BXRbCz-pGKy02 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/qt9kx/0x4AAAAAAAXjXiXiV7KvBpAv/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 401 Unauthorized
date: Tue, 07 May 2024 20:42:45 GMT
content-type: text/plain; charset=UTF-8
content-length: 1
www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20g3iahoGzQ4buhQY9_n5X9U-9yENTwlqGvxKBQ0Xs491cAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAycESnW8nWijopFBbXs0ShsFXencIiaM4x8DmoYUMDVIj9LKs0W82Vt7SxGoLjV854ZLsONjPcD9gaNsV1U7ial-U1eHrh6bc6pi2_dUVK8NsyLnCLOtvOiP0SY8vabqRR4dPd6S61Y-diDWwToPoCSioJqJhohK4pCLZ5_YF-5VfEFiyMTtIeFQadCwQWCTWWHJgK8wlIzn3e6mBeQZJ1VsOf21BzIlCKUydJy4Pf1ah0N7KjgN2pp4S9j2sSUl0ZbfnPznB7zO130ijqjcDO7wydsvznYw_ApvEdn5mKTlOFBQM1jktH72KBkAGAS-M4Zko5MazCXVbKxK3oLAhkwIDAQAB", max-age=20, PrivateToken challenge="AAIALHBwLWlzc3Vlci1wcm9kdWN0aW9uLnJlc2VhcmNoLmNsb3VkZmxhcmUuY29tIN4moaBs0OG7oUGPf5-V_VPvchDU8Jahr8SgUNF7OPdXABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAi_Bv1vvWWnyuOfVJgRV-AQLxEJECUUmMRrMnYz-gJA-oMd79ajvP3atoTZqB_EsZIq7SMmpbCRFhPolqzIrtXh7AF1Q-ZWY2RoRVRgKr7d6iJMZ49iZUmbz837eqBZJrEMuXftZmY35str5sb0GjzklF8z_hcQJC9vancYXncsYoiMDaROW0tLwSQA9BGfbmA6GlbVj4XH8DH19cKifxmO6RlIPPKlL1KmZbrRakkpuqvJO2-x1Zc2S5GCpponuvQTqJQH8Ud9loZLI75e-Xa9KAUNtBTM0t9WSEsv8cSJLV1BPBVTy1lOnwghofw4fqmlYv6CXClzAUqWouSTJ7uwIDAQAB", max-age=20
server: cloudflare
cf-ray: 880409d23f3a56a4-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880409c498fd56a4/1715114563774/jXemPRBT6f7rPiI | 104.17.3.184 | | 61 B |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/880409c498fd56a4/1715114563774/jXemPRBT6f7rPiI IP104.17.3.184:0
File typePNG image data, 67 x 14, 8-bit/color RGB, non-interlaced Hash7bb2f1461be26c89fb420e1918b62806 2422bc5922ec888342f32d1d451aa583c16be076 098fa6b6518112f84f337e93597f844b7449368ae18910c916a2f4144db45365
GET /cdn-cgi/challenge-platform/h/b/i/880409c498fd56a4/1715114563774/jXemPRBT6f7rPiI HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/qt9kx/0x4AAAAAAAXjXiXiV7KvBpAv/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 20:42:45 GMT
content-type: image/png
content-length: 61
server: cloudflare
cf-ray: 880409d26f7a56a4-OSL
alt-svc: h3=":443"; ma=86400
|
|
| jupita.top/cdn-cgi/challenge-platform/h/b/rc/880409c498fd56a4 | 104.21.23.6 | | 21 B |
URL jupita.top/cdn-cgi/challenge-platform/h/b/rc/880409c498fd56a4 IP104.21.23.6:0
CertificateIssuerLet's Encrypt Subjectjupita.top Fingerprint9E:5B:A3:A8:86:17:B2:D3:02:73:C1:56:80:93:96:CC:EA:89:5C:6D ValidityThu, 18 Apr 2024 20:57:05 GMT - Wed, 17 Jul 2024 20:57:04 GMT
Hash018598ff9794435b440d1bbf293cc10f 9129b0ca1a4febdf97636946a1fe7be8abf11890 898a24300baa285e173627eb7801c18db52748bb2119f56a71dcce0a5f8c8063
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /cdn-cgi/challenge-platform/h/b/rc/880409c498fd56a4 HTTP/1.1
Host: jupita.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null
Content-Type: application/json
Content-Length: 596
Origin: https://jupita.top
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=_sGaiqHi2ltLjTZ2Fgn56mPXP3Ol9x4GPkjOWlc.t0I-1715114563-1.0.1.1-quKlf1ZP1asUtC.vPv8EHEUyQF.dw09CdJAfT5kE6HZpUImnj7_02NzVBxNYfL5rvyH09NZMb8PJ9F2w.O5HvA
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 20:42:45 GMT
content-type: application/json
content-length: 21
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
set-cookie: cf_clearance=.BCTTPobFM6UG1OAnxcr3zMULKhAhM7DYgf_CXuxp28-1715114565-1.0.1.1-oVbqiSCf_KVe_qUAEIb4olpwZM0e6Zv7UCH7jh29FSd9jujGfWd9f_jOwHdkyOGR739mtVPjwodfKQ70Zr.ZhA; path=/; expires=Wed, 07-May-25 20:42:45 GMT; domain=.jupita.top; HttpOnly; Secure; SameSite=None
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1tcPDozglQibkI3dow5UewOtg1yhXV250p8L9juUtkqLfz0v0WpLqWCyRDoV%2FWaal%2BhVs62lm08ipp%2BJC5O1pZ9dXNvmjQZGhpiWOT%2FQkq5Wx1SiWVJ%2FMakf2MW6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880409d41ed5569a-OSL
alt-svc: h3=":443"; ma=86400
|
|
| ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.js | 172.217.21.170 | 200 OK | 85 kB |
URL GET HTTP/3ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.js IP172.217.21.170:443
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null CertificateIssuerGoogle Trust Services LLC Subjectupload.video.google.com Fingerprint36:49:20:36:0C:4D:DA:55:65:64:23:0F:49:3E:FA:78:87:35:A3:79 ValidityTue, 16 Apr 2024 04:17:12 GMT - Tue, 09 Jul 2024 04:17:11 GMT
File typeJavaScript source, ASCII text Hash2849239b95f5a9a2aea3f6ed9420bb88 af32f706407ab08f800c5e697cce92466e735847 1fe2bb5390a75e5d61e72c107cab528fc3c29a837d69aab7d200e1dbb5dcd239
GET /ajax/libs/jquery/3.6.0/jquery.js HTTP/1.1
Host: ajax.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
timing-allow-origin: *
content-length: 85110
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 03 May 2024 05:06:55 GMT
expires: Sat, 03 May 2025 05:06:55 GMT
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 401751
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| www.google.com/s2/favicons?domain=caballero-brokers.net | 142.250.74.100 | 301 Moved Permanently | 341 B |
URL GET HTTP/2www.google.com/s2/favicons?domain=caballero-brokers.net IP142.250.74.100:443
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null CertificateIssuerGoogle Trust Services LLC Subjectwww.google.com FingerprintC6:A2:DC:31:5A:53:FA:DD:55:71:A3:F4:DD:43:3D:16:71:B8:B3:99 ValidityTue, 16 Apr 2024 04:20:32 GMT - Tue, 09 Jul 2024 04:20:31 GMT
File typeHTML document, ASCII text, with CRLF, LF line terminators Hash3c99efe71029923c6952d932f860b41a 4693c600c28f922595cb535ab4d93d99ae319a19 6424b982d62750bd91e8f5b9a2317149ad1dc9a98495f8714c05764fb5b3d8c4
GET /s2/favicons?domain=caballero-brokers.net HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
location: https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 07 May 2024 20:42:46 GMT
expires: Tue, 07 May 2024 21:12:46 GMT
cache-control: public, max-age=1800
server: sffe
content-length: 341
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.google.com/s2/favicons?domain=caballero-brokers.net | 142.250.74.100 | 301 Moved Permanently | 341 B |
URL GET HTTP/2www.google.com/s2/favicons?domain=caballero-brokers.net IP142.250.74.100:443
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null CertificateIssuerGoogle Trust Services LLC Subjectwww.google.com FingerprintC6:A2:DC:31:5A:53:FA:DD:55:71:A3:F4:DD:43:3D:16:71:B8:B3:99 ValidityTue, 16 Apr 2024 04:20:32 GMT - Tue, 09 Jul 2024 04:20:31 GMT
File typeHTML document, ASCII text, with CRLF, LF line terminators Hash3c99efe71029923c6952d932f860b41a 4693c600c28f922595cb535ab4d93d99ae319a19 6424b982d62750bd91e8f5b9a2317149ad1dc9a98495f8714c05764fb5b3d8c4
GET /s2/favicons?domain=caballero-brokers.net HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
location: https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16
x-content-type-options: nosniff
server: sffe
content-length: 341
x-xss-protection: 0
date: Tue, 07 May 2024 20:42:46 GMT
expires: Tue, 07 May 2024 21:12:46 GMT
cache-control: public, max-age=1800
content-type: text/html; charset=UTF-8
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.google.com/s2/favicons?domain=caballero-brokers.net | 142.250.74.100 | 301 Moved Permanently | 341 B |
URL GET HTTP/2www.google.com/s2/favicons?domain=caballero-brokers.net IP142.250.74.100:443
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null CertificateIssuerGoogle Trust Services LLC Subjectwww.google.com FingerprintC6:A2:DC:31:5A:53:FA:DD:55:71:A3:F4:DD:43:3D:16:71:B8:B3:99 ValidityTue, 16 Apr 2024 04:20:32 GMT - Tue, 09 Jul 2024 04:20:31 GMT
File typeHTML document, ASCII text, with CRLF, LF line terminators Hash3c99efe71029923c6952d932f860b41a 4693c600c28f922595cb535ab4d93d99ae319a19 6424b982d62750bd91e8f5b9a2317149ad1dc9a98495f8714c05764fb5b3d8c4
GET /s2/favicons?domain=caballero-brokers.net HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
location: https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16
x-content-type-options: nosniff
server: sffe
content-length: 341
x-xss-protection: 0
date: Tue, 07 May 2024 20:42:46 GMT
expires: Tue, 07 May 2024 21:12:46 GMT
cache-control: public, max-age=1800
content-type: text/html; charset=UTF-8
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 | 216.58.211.4 | | 573 B |
URL t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 IP216.58.211.4:0
File typePNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced Hashdd9502635f6255441f8521a1ea225f18 b168b2c70c44da0dbbab507f9a812d647aaaf53a 172286d6107e3e8e842cc795f8460c1d88f1b8d605a071a51e3363367a1ecd83
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 HTTP/1.1
Host: t1.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://jupita.top/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
content-location: https://cbi-group.net/wp-content/uploads/2018/10/FAV-ICON-16-16-.png
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-length: 573
date: Tue, 07 May 2024 20:42:46 GMT
expires: Tue, 14 May 2024 20:42:46 GMT
cache-control: public, max-age=604800
last-modified: Fri, 26 Oct 2018 23:09:59 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 | 216.58.211.4 | | 573 B |
URL t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 IP216.58.211.4:0
File typePNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced Hashdd9502635f6255441f8521a1ea225f18 b168b2c70c44da0dbbab507f9a812d647aaaf53a 172286d6107e3e8e842cc795f8460c1d88f1b8d605a071a51e3363367a1ecd83
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 HTTP/1.1
Host: t1.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://jupita.top/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-location: https://cbi-group.net/wp-content/uploads/2018/10/FAV-ICON-16-16-.png
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-length: 573
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 07 May 2024 20:42:46 GMT
expires: Tue, 14 May 2024 20:42:46 GMT
cache-control: public, max-age=604800
last-modified: Fri, 26 Oct 2018 23:09:59 GMT
content-type: image/png
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| jupita.top/_phoenix_delta/validate.php | 104.21.23.6 | | 574 B |
URL jupita.top/_phoenix_delta/validate.php IP104.21.23.6:0
CertificateIssuerLet's Encrypt Subjectjupita.top Fingerprint9E:5B:A3:A8:86:17:B2:D3:02:73:C1:56:80:93:96:CC:EA:89:5C:6D ValidityThu, 18 Apr 2024 20:57:05 GMT - Wed, 17 Jul 2024 20:57:04 GMT
Hashef71367706f56064522fc33f9f88e233 6c8bc6e4cf166c7947d3a3e22b64c3afa8be83be 5575c51b840f9dd4c9b348756aeffa71d3f1010f64c8bb47c0730532305b8f71
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
POST /_phoenix_delta/validate.php HTTP/1.1
Host: jupita.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 560
Origin: https://jupita.top
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null
Cookie: cf_clearance=.BCTTPobFM6UG1OAnxcr3zMULKhAhM7DYgf_CXuxp28-1715114565-1.0.1.1-oVbqiSCf_KVe_qUAEIb4olpwZM0e6Zv7UCH7jh29FSd9jujGfWd9f_jOwHdkyOGR739mtVPjwodfKQ70Zr.ZhA
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 20:42:46 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.4.30
access-control-allow-origin: *
set-cookie: captcha=1; expires=Tue, 07-May-2024 21:12:46 GMT; Max-Age=1800; path=/
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FnD23Nj86PNJwcPTz5xint5IbkWt1pD%2BeSSL5l4inasy1tQeSFvuk%2F4FzT9259bp6RK%2B6ZYRqNUc4jIfunwgsTcQYA0ZwJJL%2FtE3%2FZmtQ%2FoAkE0zHhKlkqym0gX%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880409d44f25569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| jupita.top/_phoenix_delta/functions/spinner.gif | 104.21.23.6 | 200 OK | 46 kB |
URL GET HTTP/3jupita.top/_phoenix_delta/functions/spinner.gif IP104.21.23.6:443
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null CertificateIssuerLet's Encrypt Subjectjupita.top Fingerprint9E:5B:A3:A8:86:17:B2:D3:02:73:C1:56:80:93:96:CC:EA:89:5C:6D ValidityThu, 18 Apr 2024 20:57:05 GMT - Wed, 17 Jul 2024 20:57:04 GMT
File typeGIF image data, version 89a, 48 x 48 Hashbab0ad7ce20e911217791c00bcd4e35b 0822ac44951def4349090998b9ecb153128f03d5 bd750f550a5db2901c0bd52ec564da6adfbad55562b862b1f125d96d9d62b026
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /_phoenix_delta/functions/spinner.gif HTTP/1.1
Host: jupita.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null
Cookie: cf_clearance=.BCTTPobFM6UG1OAnxcr3zMULKhAhM7DYgf_CXuxp28-1715114565-1.0.1.1-oVbqiSCf_KVe_qUAEIb4olpwZM0e6Zv7UCH7jh29FSd9jujGfWd9f_jOwHdkyOGR739mtVPjwodfKQ70Zr.ZhA; captcha=1; PHPSESSID=39dfv71t6jmn2vqrp0u323tbq7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 20:42:47 GMT
content-type: image/gif
content-length: 46341
last-modified: Wed, 07 Oct 2020 21:45:56 GMT
etag: "b505-5b11ba3eced00"
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AwdB4DSOv7VMksq2Jz6cYFUWtSR2ZHN93wRHqNjEMkSWZ7njqOt3vemlu%2FneUJpMnpxj%2BLXAT8Vqcls9XtnMntixSDwx3ipWY81JPfh%2B%2BVwaZhxzspmwnUmJU0on"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 880409d8be65569a-OSL
alt-svc: h3=":443"; ma=86400
|
|
| challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/553922989:1715113629:jx4-nFhzqMdohsDeC3NDnoDpflkeGk4zyGMc5ufXGvM/880409c498fd56a4/2a291077203a058 | 104.17.3.184 | | 13 kB |
URL challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/553922989:1715113629:jx4-nFhzqMdohsDeC3NDnoDpflkeGk4zyGMc5ufXGvM/880409c498fd56a4/2a291077203a058 IP104.17.3.184:0
File typeASCII text, with very long lines (4400), with no line terminators Hash88e2d207bf1faed0059e2a1dd6777303 712578bb34af9a2d0cbcd4d91ba72afdc7c5e598 722591793e63fe36858276971f04d9eac5e2e62101b69c596d1cdb515237efda
POST /cdn-cgi/challenge-platform/h/b/flow/ov1/553922989:1715113629:jx4-nFhzqMdohsDeC3NDnoDpflkeGk4zyGMc5ufXGvM/880409c498fd56a4/2a291077203a058 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/qt9kx/0x4AAAAAAAXjXiXiV7KvBpAv/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 2a291077203a058
Content-Length: 27635
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 07 May 2024 20:42:45 GMT
content-type: text/html; charset=UTF-8
cf-chl-out: JUBBxifH6BAsl7+wi3PJ7yxMEzs0bXBtgYYUgcgDiw32CQI9RlhBi2folTXki6BJ2Y1i/H1quPvwMO/4k0KRfFORiqIRP8Q1Y5EWqAujmZ5UXm0QPR6D0Y6ecIo0WGEa$FtshKuXuChCRL3+k5Nwq2A==
cf-chl-out-s: iSM4ktOPEtwKajbFocHZYg==$FFM8MLFX45BtvONT4fHBzw==
vary: accept-encoding
server: cloudflare
cf-ray: 880409d3998756a4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
|
|
| t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 | 216.58.211.4 | 200 OK | 573 B |
URL GET HTTP/2t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 IP216.58.211.4:443
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typePNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced Hashdd9502635f6255441f8521a1ea225f18 b168b2c70c44da0dbbab507f9a812d647aaaf53a 172286d6107e3e8e842cc795f8460c1d88f1b8d605a071a51e3363367a1ecd83
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 HTTP/1.1
Host: t1.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://jupita.top/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-location: https://cbi-group.net/wp-content/uploads/2018/10/FAV-ICON-16-16-.png
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-length: 573
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 07 May 2024 20:42:46 GMT
expires: Tue, 14 May 2024 20:42:46 GMT
cache-control: public, max-age=604800
last-modified: Fri, 26 Oct 2018 23:09:59 GMT
content-type: image/png
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| wakandos.top/usp_Enigma_premium_users/admin/kfud_loader.php?login=accounting@caballero-brokers.net&page=null&hide_email=true | 0.0.0.0 | | 0 B |
URL GET wakandos.top/usp_Enigma_premium_users/admin/kfud_loader.php?login=accounting@caballero-brokers.net&page=null&hide_email=true IP0.0.0.0:0
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /usp_Enigma_premium_users/admin/kfud_loader.php?login=accounting@caballero-brokers.net&page=null&hide_email=true HTTP/1.1
Host: wakandos.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://jupita.top
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| jupita.top/favicon.ico | 0.0.0.0 | | 0 B |
IP0.0.0.0:0
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null CertificateIssuerLet's Encrypt Subjectjupita.top Fingerprint9E:5B:A3:A8:86:17:B2:D3:02:73:C1:56:80:93:96:CC:EA:89:5C:6D ValidityThu, 18 Apr 2024 20:57:05 GMT - Wed, 17 Jul 2024 20:57:04 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /favicon.ico HTTP/1.1
Host: jupita.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null
Cookie: cf_clearance=.BCTTPobFM6UG1OAnxcr3zMULKhAhM7DYgf_CXuxp28-1715114565-1.0.1.1-oVbqiSCf_KVe_qUAEIb4olpwZM0e6Zv7UCH7jh29FSd9jujGfWd9f_jOwHdkyOGR739mtVPjwodfKQ70Zr.ZhA; captcha=1; PHPSESSID=39dfv71t6jmn2vqrp0u323tbq7
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
|
|
| t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 | 216.58.211.4 | 200 OK | 573 B |
URL GET HTTP/2t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 IP216.58.211.4:443
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typePNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced Hashdd9502635f6255441f8521a1ea225f18 b168b2c70c44da0dbbab507f9a812d647aaaf53a 172286d6107e3e8e842cc795f8460c1d88f1b8d605a071a51e3363367a1ecd83
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 HTTP/1.1
Host: t1.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://jupita.top/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-location: https://cbi-group.net/wp-content/uploads/2018/10/FAV-ICON-16-16-.png
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-length: 573
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 07 May 2024 20:42:46 GMT
expires: Tue, 14 May 2024 20:42:46 GMT
cache-control: public, max-age=604800
last-modified: Fri, 26 Oct 2018 23:09:59 GMT
content-type: image/png
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 | 216.58.211.4 | 200 OK | 573 B |
URL GET HTTP/2t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 IP216.58.211.4:443
Requested byhttps://jupita.top/_phoenix_delta/?login=accounting@caballero-brokers.net&page=null&request_type=null&page_bg=null&no_redrct=null&pcnt=null&no_psplash=null&pmax=null&vcnt=null&use_cdtimr=null CertificateIssuerGoogle Trust Services LLC Subject*.gstatic.com Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT
File typePNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced Hashdd9502635f6255441f8521a1ea225f18 b168b2c70c44da0dbbab507f9a812d647aaaf53a 172286d6107e3e8e842cc795f8460c1d88f1b8d605a071a51e3363367a1ecd83
GET /faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://caballero-brokers.net&size=16 HTTP/1.1
Host: t1.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://jupita.top/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
content-type: image/png
content-location: https://cbi-group.net/wp-content/uploads/2018/10/FAV-ICON-16-16-.png
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-length: 573
date: Tue, 07 May 2024 20:42:46 GMT
expires: Tue, 14 May 2024 20:42:46 GMT
cache-control: public, max-age=604800
last-modified: Fri, 26 Oct 2018 23:09:59 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|