Report - eiku5vqro5.brightnexst.ru/pax6lf1/

Report Overview

Visited public
2025-02-14 16:50:19
Tags
microsoft phishing outlook suspicious
URL
eiku5vqro5.brightnexst.ru/pax6lf1/
Finishing URL
eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
IP / ASN
104.21.41.104
#13335 CLOUDFLARENET
Title
Auth Login
Phishing - Microsoft
Phishing - Generic phishing
Phishing - Microsoft Outlook
Suspicious - Anti-debugging code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
github.com	1423	2007-10-09	2016-07-13	2025-02-12	462 B	4.3 kB	140.82.121.3
objects.githubusercontent.com	134060	2014-02-06	2021-11-01	2025-02-12	897 B	11 kB	185.199.109.133
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20	2025-02-12	472 B	406 B	104.18.95.41
cdnjs.cloudflare.com	235	2009-02-17	2012-05-23	2025-02-12	1.4 kB	45 kB	104.17.25.14
code.jquery.com	634	2005-12-10	2012-05-21	2025-02-12	431 B	32 kB	151.101.2.137
developers.cloudflare.com	592034	2009-02-17	2012-09-07	2025-02-11	454 B	1.7 kB	104.16.3.189
eiku5vqro5.brightnexst.ru	unknown	2025-01-09	2025-02-13	2025-02-13	32 kB	1.1 MB	172.67.146.141
ok4static.oktacdn.com	16592	2014-11-11	2018-06-15	2025-02-11	2.1 kB	268 kB	143.204.55.47

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2025-02-13	medium	eiku5vqro5.brightnexst.ru/pax6lf1/	Generic/Spear Phishing

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (16)

	URL	From	Size	First Seen	Last Seen
	eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY	ScriptElement	1.9 kB	2025-02-14	2025-02-14
Pretty URL eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY IP 172.67.146.141 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash 9073a9116a34938197daa9f7764f60f8 30696b2e9787217d6190bb2066b5fab0304a2935 cc37e6fcbb1a8c812bb5e12d17a2dafceab4f0d3200a52e16c546c3b28a8d525 Loading...

	code.jquery.com/jquery-3.6.0.min.js	ScriptElement	90 kB	2023-03-07	2025-03-13
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.2.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-03-13 17:40 Times Seen186639 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY	ScriptElement	140 kB	2025-02-14	2025-02-14
Pretty URL eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY IP 172.67.146.141 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash 6eccafe9c4070dcad971d195c4509712 1128d09a69b9be5093a17369ce4741e3593f27bd c5bc2d5a615fd94c40a86ba0a324f08875e9a481eef937739bd39dd22aeb1dff Loading...

	cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	ScriptElement	48 kB	2023-03-07	2025-03-13
Pretty URL cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:31 Last Seen2025-03-13 17:39 Times Seen83773 Hash 2ca03ad87885ab983541092b87adb299 1a17f60bf776a8c468a185c1e8e985c41a50dc27 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762 Loading...

	unknown	ScriptElement	746 B	2025-02-14	2025-02-14
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash 0677008f81d2481b1d00a758cb6e9b48 16cb9fc0216211acc1f238294c54715b5892858b 932cd45154e1e27fa6412cdf27677183d30381dcc4216253d6cba3a9ba1428e0 Loading...

	github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js	ScriptElement	10 kB	2024-05-30	2025-03-13
Pretty URL github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js IP 140.82.121.3 ASN #36459 GITHUB Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-30 22:56 Last Seen2025-03-13 17:39 Times Seen11713 Hash 6c20a2be8ba900bc0a7118893a2b1072 ff7766fde1f33882c6e1c481ceed6f6588ea764c b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500 Loading...

	unknown	ScriptElement	2.2 kB	2025-02-14	2025-02-14
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash dfc9f6e1b7bb15f1f471f7d8178aa51c 99ec14e9a159d6acb96a32d74a26e8cfa5a4f789 38d6d37e829a8a2e614fb7ebcf5c9e9fc74291980fcd7fb1230079f6cbed6c24 Loading...

	unknown	ScriptElement	20 kB	2025-02-14	2025-02-14
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash 32a797495d6f9e298fdca1024e96389e 66b2ea3a01242a39ca098f8f83fd7f287a9d22ca 5a65ba012b62ea9d0ef64683fd2b7976b955982e075c3daec1b3adc815ae99bf Loading...

	eiku5vqro5.brightnexst.ru/34OYl47Jrh4EI1rIlTatklWou7ZJkCGHAj89101	ScriptElement	4.8 MB	2025-02-12	2025-02-28
Pretty URL eiku5vqro5.brightnexst.ru/34OYl47Jrh4EI1rIlTatklWou7ZJkCGHAj89101 IP 172.67.146.141 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-12 21:51 Last Seen2025-02-28 23:51 Times Seen4941 Hash 1fcbe4aacbe30b67606277e365405928 68443d074aeff59a5940e48a91c82268b2c3e30f 89feb7dcb6afb24066a555b39d94bbc817a16a597db8a0ca3bbba9eb3ced1f5b Loading...

		Size	First Seen	Last Seen
	#1 Eval - e9ce3aa8ed1847c1d2e608dcd8445713	149 kB	2025-02-12 21:51	2025-03-02 04:44
Pretty Observations First Seen2025-02-12 21:51 Last Seen2025-03-02 04:44 Times Seen4685 Hash e9ce3aa8ed1847c1d2e608dcd8445713 c9cfe3514bad81fa8149990266572b73e14e2cd1 b51043dd7aaa1bc4205fc0f00653c26b8d92f836198668cc92b7902493ba2bf5 Loading...

	#2 Eval - 86f9b1217302624bf96d64d3b120ef83	13 kB	2025-02-14 16:50	2025-02-14 16:50
Pretty Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash 86f9b1217302624bf96d64d3b120ef83 5cc5d4fbd4e91a9e1e151ac8c24d50be8ff79056 0f6660f53759bc36c40846519eb27e5b0791050e4acaca1d2b4efb90dc3fd844 Loading...

	#3 Eval - e02c5cea485ebc4c57548fb383b0fe08	198 kB	2025-02-12 21:51	2025-03-05 21:26
Pretty Observations First Seen2025-02-12 21:51 Last Seen2025-03-05 21:26 Times Seen5350 Hash e02c5cea485ebc4c57548fb383b0fe08 46ca89bcbd64f2c27cb2147b23ff976c7d93ebeb 944a843f8023cf4d833b53d7714e30bdb2aa2625248becc7c38e4de9ebf47071 Loading...

	#4 Eval - 65b32e09cdcbf16f6ec016d77fa31da2	5.1 kB	2025-02-14 16:50	2025-02-14 16:50
Pretty Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash 65b32e09cdcbf16f6ec016d77fa31da2 be168254709178614efd76765d59b36ca12eb66a 7e41cbe9f592af18a4dd2c7c044821b6968bdf0c46b9899904a67c308cc3d2c7 Loading...

		Size	First Seen	Last Seen
	#1 Write - 9a4c80f7d41229e74ae1f6fd49fdedf4	107 kB	2025-02-14 16:50	2025-02-14 16:50
Pretty Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash 9a4c80f7d41229e74ae1f6fd49fdedf4 b0c2eb7e2dafe795141599fca6eb6bd91b9f4ad8 5459b427ec08b019d2f1f2c3d69a73fa93aece43c2a5f594510bd478f079d2e5 Loading...

	#2 Write - 21c08132c004d020418a0d5a544dce10	7.4 kB	2025-02-14 16:50	2025-02-14 16:50
Pretty Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash 21c08132c004d020418a0d5a544dce10 e1f01f50975b4fb203eb2968fa90dde8a5593acd a41ebd4a3e0a62b15456dce8253e94064f187d006025f18ef68c487a75b9d0b0 Loading...

	#3 Write - d207abfd56fab18204d45ee53331b48a	104 kB	2025-02-14 16:50	2025-02-14 16:50
Pretty Observations First Seen2025-02-14 16:50 Last Seen2025-02-14 16:50 Times Seen1 Hash d207abfd56fab18204d45ee53331b48a 0531ad6f4f54c1bbffe4acf5257d10cb1a7d5523 88a3829a99cce33f0a9ebb15301467f53e1da1d02f0ac5740ff58e5bdaad7775 Loading...

HTTP Transactions (37)

URL IP Response Size

challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

104.18.95.41

302 Found

0 B

URL
challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
IP
104.18.95.41:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Fri, 14 Feb 2025 16:49:46 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/b/324d0dcf743c/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 911e8da8b8355699-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.25.14

200 OK

14 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT

File type
JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Size
14 kB (13972 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:49:46 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 156257
expires: Wed, 04 Feb 2026 16:49:46 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k3%2FZe4phx2ldmIkDQoX%2Fvmk2hkGB%2B%2FOKaXGGlyxBihCgbnuTKJ1QxdCODyzMzFKwz2LOm4vNfRFfZLlGhLIxb3Ar1WK4OkTznLPgLER6rq53%2FBBV5EKk3z0sDp0yghVJK2EH1a%2FV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911e8da8ca01b50b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.0.min.js

151.101.2.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.2.137:443
ASN
#54113 FASTLY

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 14 Feb 2025 16:49:46 GMT
age: 3305321
x-served-by: cache-lga21931-LGA, cache-hel1410032-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 181500
x-timer: S1739551786.409464,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

developers.cloudflare.com/favicon.png

104.16.3.189

200 OK

937 B

URL
developers.cloudflare.com/favicon.png
IP
104.16.3.189:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
937 B (937 bytes)
Hash
fc3b7bbe7970f47579127561139060e2
3f7c5783fe1f4404cb16304a5a274778ea3abd25
85e6223afdbd5badf2c79bcfbaa6fe686acaa781eca52c196647ffabb3be2ffe

HTTP Headers

GET /favicon.png HTTP/1.1
Host: developers.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 14 Feb 2025 16:49:46 GMT
content-type: image/png
content-length: 937
cache-control: public, max-age=0, must-revalidate
etag: "6be7ff94b6151f8cfbf08b53a17e2ac1"
set-cookie: __cf_bm=X2aI_KA_PSE0dqL0rFYBtqc9dhekVDb8HRrvPqwnzyk-1739551786-1.0.1.1-uu8GhH7bSH0M_063aCXLO0e3SL4HBAiKzmurw6uJv6lYLkPc_Aj.s5cG92yOmcHimO4v5t_jyBECFMtJ0qnlZA; path=/; expires=Fri, 14-Feb-25 17:19:46 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: cloudflare
cf-ray: 911e8daa7da9b50b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.25.14

200 OK

14 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT

File type
JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Size
14 kB (13972 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 156262
expires: Wed, 04 Feb 2026 16:49:51 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2F12kWDgOzworBTyyDc8fCnlt42BTCz7jl9YIeT%2FPfZ4VOP3wdPsJimX1MUuS%2Bgv%2FOp7n7tHn7ZUW09O82p%2FELokgQTlhffFcjdNg9Nz2QAKonJQPRAVgVlkPvqBztbNQSNqDpTh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911e8dcb4c307129-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

eiku5vqro5.brightnexst.ru/pax6lf1/

172.67.146.141

200 OK

39 kB

URL
eiku5vqro5.brightnexst.ru/pax6lf1/
IP
172.67.146.141:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with very long lines (9977), with CRLF line terminators
Size
39 kB (39133 bytes)
Hash
c4379053202576ca4d2080cb9decc731
c2e1072c9035e20779803c1313677c72464d02c4
2f9837d4c216d2d901b984f26fca389a9cd9f1835e93af3dc60487599b03a244

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook
OpenPhish	phishing	Generic/Spear Phishing

HTTP Headers

GET /pax6lf1/ HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkRsbzVFQVNvR2IxWHh4NWduWXNtTGc9PSIsInZhbHVlIjoiOEM5RWlWaXh2R1hkNHpScWUyWndYVjF6QTFkdVJwNTROZ0pYbUZvWHB0bERnYmxZYUFNcHFDOUFoSGEwU3ZmQlpVQ0VuQkdsY1h4VVdWVzVqSnN1N2E1K3FKMTBoMUxHR21HcUpvaUVUWi9zSUdEWTVmUCtaTXlCajBXQ3g3dmQiLCJtYWMiOiJlYTM3NzEwMjAwY2Q4ZjI1Njg0M2MxYjQ3YzUxMzNmMjE3NzFjNzY4ZTEzNWQwZDFjMTYyMDljYzJkODZmYWNmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlE3dUhSaXJkUmtvekZZMFFQQk5vRVE9PSIsInZhbHVlIjoiejRyNHp1dk1KNWl6Z1dXdFZEWWtCWWJRbnNLUlJJMC9ETHFMZnhpOGtuUm5DSTg1YVpzNmtaZTNYUUVNZy83aEEzYTcrZTVCeVpaT3JobHF4TVBuem95RE5PaE5SMzBDaWFtOU12Q1Q2WkhYeUtWRDUwdlJkZXdOdGt1Z2xKeW0iLCJtYWMiOiI4MzBlOGYxMTY5ZDEwNmFiZjZlNjEyNWYyNzM2NGJjMGI4MzMyZjZhOGMyNTJkZTE3Y2VjYjZmMGExNzFjMTY2IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:51 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aFjZOE5Nx07qRtkd2pFfPtxTq8EnSm7wuajEwNfvalQOmg8SacgmDH0cJC3Ri%2BLtvZwGE%2B5WCpqJ8cuxNnrWCtodbK%2BE1GCyHtH6wiTfpGJfJHjFVTaSMw5K8WqLoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImVkSSs4d3NXWlBoeE1adkNSbWVEYVE9PSIsInZhbHVlIjoiMjl1cnZ5aUV5dWx6TzFQOXVoNHhvcnpPeHNvcnRJY0VOTUxRbzhYdkV1d09jTHpWenQrQXErdWlLVlRmTmcvTFlNOHlQaFNHQ2t2cnpKcERVWmVDZ0xYdXU1c1lHUGZRZWFKZXZSZ25iTnMwOTk2SzVIcWJqb1ZsL00vQ0RYdFUiLCJtYWMiOiIyZDEwOWU0ZjgzOWQ3ZGMxOTQ1YTIyMjA0YzViMjQ5NjgxZWIyOTA3ZTY2NWQ4ZGU2MGI1ZWRiMTM5YmM0Y2FkIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:51 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImFSZk9ndFBvWkRDNHdWZWN1b09LZWc9PSIsInZhbHVlIjoiREN5Uy9zQS9JSTUxa3FEaG5OUVNMaVAzRlFucDloN1I3bWFaL0JYd0FTY2RBeTJSMld6K2JxZnJ0YUVnVkd6bGhJWHJJWisrcW1uSVExWEhKMlN1ZXhwYWduYzZwbWgxTTMxRXEyOFRZV28yWS9YelJST1d4Wm9hL1FDN1pvVW8iLCJtYWMiOiI5NmU0OTI2ZDkyZjZiMTZjZDllY2UxZmE1Y2M2NzQ5NDlkYWJjZTNjNWNlYmE3ZDkzMzZiNWY0MmM4MzJkODFjIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:51 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 911e8dca19cdb50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1159&min_rtt=1087&rtt_var=459&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2162&delivery_rate=2664213&cwnd=251&unsent_bytes=0&cid=c1a601359579f9ac&ts=105&x=0", cfL4;desc="?proto=QUIC&rtt=4460&min_rtt=2773&rtt_var=1746&sent=17&recv=11&lost=0&retrans=0&sent_bytes=5830&recv_bytes=3833&delivery_rate=293&cwnd=12000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=5792&x=1", cfExtPri, cfHdrFlush;dur=0

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.25.14

200 OK

14 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT

File type
JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Size
14 kB (13972 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 156263
expires: Wed, 04 Feb 2026 16:49:52 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aS3mEbFiAVLHb5zllnhjKycfj6ob7PQfeQdvvKAGpxZcVk4RGht8%2BLvDdrhjbVaKn7HHXV7tdv2lrtRSEOc6OK5ScFTbPNXV48k41SY78oSfe7XjcI7a4bRTLYJLs3mE9JEFTh5O"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911e8dcffc8a7129-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

eiku5vqro5.brightnexst.ru/favicon.ico

172.67.146.141

404 Not Found

31 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/favicon.ico
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
data
Size
31 kB (30878 bytes)
Hash
6e91fb3b5fb1269e98a4a1f1c597eaf6
81fbd8f550ca53b28c2a4241e2968b0ed7579068
482456e7ae1776a9eef640c0e5a46f874c1c5d05fdcf94660c6776897e5d24e4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/pax6lf1/
Cookie: XSRF-TOKEN=eyJpdiI6ImVkSSs4d3NXWlBoeE1adkNSbWVEYVE9PSIsInZhbHVlIjoiMjl1cnZ5aUV5dWx6TzFQOXVoNHhvcnpPeHNvcnRJY0VOTUxRbzhYdkV1d09jTHpWenQrQXErdWlLVlRmTmcvTFlNOHlQaFNHQ2t2cnpKcERVWmVDZ0xYdXU1c1lHUGZRZWFKZXZSZ25iTnMwOTk2SzVIcWJqb1ZsL00vQ0RYdFUiLCJtYWMiOiIyZDEwOWU0ZjgzOWQ3ZGMxOTQ1YTIyMjA0YzViMjQ5NjgxZWIyOTA3ZTY2NWQ4ZGU2MGI1ZWRiMTM5YmM0Y2FkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImFSZk9ndFBvWkRDNHdWZWN1b09LZWc9PSIsInZhbHVlIjoiREN5Uy9zQS9JSTUxa3FEaG5OUVNMaVAzRlFucDloN1I3bWFaL0JYd0FTY2RBeTJSMld6K2JxZnJ0YUVnVkd6bGhJWHJJWisrcW1uSVExWEhKMlN1ZXhwYWduYzZwbWgxTTMxRXEyOFRZV28yWS9YelJST1d4Wm9hL1FDN1pvVW8iLCJtYWMiOiI5NmU0OTI2ZDkyZjZiMTZjZDllY2UxZmE1Y2M2NzQ5NDlkYWJjZTNjNWNlYmE3ZDkzMzZiNWY0MmM4MzJkODFjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LHjObq0TNmpt7i8M1aWGrDoJoH%2FhnlvE6AclU645BX1cPw5TNKNW8LAvfo26flE8ZgDQryvjiEOnGTrixKmUDyvALh3EYABMuc96ahyANHJfxBOaOYSBdK7lw%2F%2BUow%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
priority: u=6,i=?0
server: cloudflare
cf-ray: 911e8dcc8e64b50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1177&min_rtt=1163&rtt_var=353&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2120&delivery_rate=2356387&cwnd=251&unsent_bytes=0&cid=8484fafdf551c458&ts=98&x=0", cfL4;desc="?proto=QUIC&rtt=3928&min_rtt=2135&rtt_var=1909&sent=33&recv=15&lost=0&retrans=0&sent_bytes=17766&recv_bytes=5784&delivery_rate=14216&cwnd=12000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6228&x=1", cfExtPri, cfHdrFlush;dur=0

ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7

143.204.55.47

200 OK

11 kB

URL GET HTTP/2
ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
Size
11 kB (10796 bytes)
Hash
12bdacc832185d0367ecc23fd24c86ce
4422f316eb4d8c8d160312bb695fd1d944cbff12
877ae491d9aac5c6ef82a8430f9f652ace8a0dbc7294bd112aad49bd593769d0

HTTP Headers

GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: image/png
content-length: 10796
server: nginx
last-modified: Tue, 23 Feb 2021 04:20:08 GMT
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
date: Wed, 29 Jan 2025 00:59:17 GMT
expires: Thu, 29 Jan 2026 00:59:17 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: "12bdacc832185d0367ecc23fd24c86ce"
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: s_HjN7_VhpaBAi8VQzXvoVlBeVUyT4TFhaWeo8Sq9Khoi4MjL24HAw==
age: 1439435
X-Firefox-Spdy: h2

eiku5vqro5.brightnexst.ru/uvAqsZ1NVZ1omysM7uQAw6Ayx2stslAxQc1nTLTojF34130

172.67.146.141

200 OK

644 B

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/uvAqsZ1NVZ1omysM7uQAw6Ayx2stslAxQc1nTLTojF34130
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
RIFF (little-endian) data, Web/P image
Size
644 B (644 bytes)
Hash
541b83c2195088043337e4353b6fd60d
f09630596b6713217984785a64f6ea83e91b49c5
2658b8874f0d2a12e8726df78ac8954324c3bbe4695e66bdef89195fde64322f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /uvAqsZ1NVZ1omysM7uQAw6Ayx2stslAxQc1nTLTojF34130 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/webp
content-length: 644
content-disposition: inline; filename="uvAqsZ1NVZ1omysM7uQAw6Ayx2stslAxQc1nTLTojF34130"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XVVK9%2FRsirDh%2BePQOk6EVhmUZebvL0%2Bk%2FsB61SEp%2BNsWN%2ByAoPestZ%2FMlCdi%2FAIoZhTeFQduI0iHWQGjgtOBm8fr2vxoULZa27CvVobCuC%2F%2BJQlSwyYRJitYu0Z%2BDA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd02ce0b50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1353&min_rtt=1336&rtt_var=387&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2190&delivery_rate=2123167&cwnd=251&unsent_bytes=0&cid=4df6d71a538cd8b5&ts=107&x=0", cfL4;desc="?proto=QUIC&rtt=1601&min_rtt=906&rtt_var=827&sent=122&recv=50&lost=0&retrans=0&sent_bytes=99219&recv_bytes=24313&delivery_rate=2380283&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6796&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/qr2tGdzF1gN6s80v0ePTKO1lysmnvI1Dj7zglCQBUTrfgPN45137

172.67.146.141

200 OK

892 B

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/qr2tGdzF1gN6s80v0ePTKO1lysmnvI1Dj7zglCQBUTrfgPN45137
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
RIFF (little-endian) data, Web/P image
Size
892 B (892 bytes)
Hash
41d62ca205d54a78e4298367482b4e2b
839aae21ed8ecfc238fdc68b93ccb27431cd5393
20a4a780db0bcc047015a0d8037eb4eb58b3e5cb338673799c030a3e1b626b40

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /qr2tGdzF1gN6s80v0ePTKO1lysmnvI1Dj7zglCQBUTrfgPN45137 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/webp
content-length: 892
content-disposition: inline; filename="qr2tGdzF1gN6s80v0ePTKO1lysmnvI1Dj7zglCQBUTrfgPN45137"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6TTcXFAh%2FtEp6VF%2BE6tnUh1nhnKoXtRfnAQGJhPaJAL8yg0%2FxqJqnP17X%2BRJeaF6yBGKwMvPq1B%2BY8A25wCPYBfcbnFQTZ9StOXgS76jzV%2F3VmXFuXjImIkHsHebnw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd02ce1b50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1102&min_rtt=1088&rtt_var=315&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2195&delivery_rate=2611361&cwnd=251&unsent_bytes=0&cid=49b13c36f4210108&ts=110&x=0", cfL4;desc="?proto=QUIC&rtt=1601&min_rtt=906&rtt_var=827&sent=124&recv=50&lost=0&retrans=0&sent_bytes=100758&recv_bytes=24313&delivery_rate=2380283&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6798&x=1", cfExtPri, cfHdrFlush;dur=0

github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js

140.82.121.3

302 Found

0 B

URL GET HTTP/2
github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
IP
140.82.121.3:443
ASN
#36459 GITHUB

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerSectigo Limited
Subjectgithub.com
FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A
ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: GitHub.com
date: Fri, 14 Feb 2025 16:48:29 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-length: 0
x-github-request-id: EA4F:196D25:29B2E51:2AAAE2B:67AF7430
X-Firefox-Spdy: h2

eiku5vqro5.brightnexst.ru/GDSherpa-regular.woff

172.67.146.141

200 OK

37 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/GDSherpa-regular.woff
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
Web Open Font Format, TrueType, length 36696, version 1.0
Size
37 kB (36696 bytes)
Hash
a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-regular.woff HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: font/woff
content-length: 36696
content-disposition: inline; filename="GDSherpa-regular.woff"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V3q1iW9YZCfGWEdKv1cHb8Pkt9XE%2F47wxP27YUTuEerHYKguGclMZu%2Fvpw2XI%2FRcpLKb%2Fa74z%2FPV72Z9fukV3yuE63ybQKjSv%2BX%2BveO8aQ0ZnH%2F87ppKQV1zfnH%2Blw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dd01ccbb50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1395&min_rtt=1372&rtt_var=561&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2236&delivery_rate=1855221&cwnd=251&unsent_bytes=0&cid=0b8d23bf7c114e04&ts=139&x=0", cfL4;desc="?proto=QUIC&rtt=1527&min_rtt=906&rtt_var=386&sent=147&recv=56&lost=0&retrans=0&sent_bytes=124855&recv_bytes=24585&delivery_rate=316523&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6820&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/qrxhEBv59hrvWqFujrF9SLxSbePPkyKOu6YXK5A1m6GIpY1uviDKf5nNJ7OyhprZKSw9rcd240

172.67.146.141

200 OK

9.6 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/qrxhEBv59hrvWqFujrF9SLxSbePPkyKOu6YXK5A1m6GIpY1uviDKf5nNJ7OyhprZKSw9rcd240
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
RIFF (little-endian) data, Web/P image
Size
9.6 kB (9648 bytes)
Hash
4946eb373b18d178c93d473489673bb6
16477acb73b63ca251d37401249e7e4515febd24
666bc574c9f3fb28a8ac626fa8105c187c2a313736494a06bd5a937473673c92

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /qrxhEBv59hrvWqFujrF9SLxSbePPkyKOu6YXK5A1m6GIpY1uviDKf5nNJ7OyhprZKSw9rcd240 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/webp
content-length: 9648
content-disposition: inline; filename="qrxhEBv59hrvWqFujrF9SLxSbePPkyKOu6YXK5A1m6GIpY1uviDKf5nNJ7OyhprZKSw9rcd240"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Njl4TgbuTjGuWJvLOIXmnXD%2Fb12uesQ1FL9EjOyXEvCo8FVTBaOvA7zA1m51jNAZvx4PiTDZrKrxSqPYpZDFpwVb45SxOgn1hExrOTQYMaWCEyXYJjEUtGfcTiYq6g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd05d47b50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1289&min_rtt=1280&rtt_var=499&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2217&delivery_rate=2132547&cwnd=251&unsent_bytes=0&cid=47f8a9f6497b822c&ts=98&x=0", cfL4;desc="?proto=QUIC&rtt=1527&min_rtt=906&rtt_var=386&sent=157&recv=56&lost=0&retrans=0&sent_bytes=136855&recv_bytes=24585&delivery_rate=316523&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6821&x=1", cfExtPri, cfHdrFlush;dur=4

eiku5vqro5.brightnexst.ru/GDSherpa-bold.woff

172.67.146.141

200 OK

36 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/GDSherpa-bold.woff
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
Web Open Font Format, TrueType, length 35970, version 1.0
Size
36 kB (35970 bytes)
Hash
496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-bold.woff HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: font/woff
content-length: 35970
content-disposition: inline; filename="GDSherpa-bold.woff"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QF%2BEiDzIVSxvFMz6h4mbApZl8LJ1VPp%2BAa5ISpU0AAbqk23SHTxME%2FhGjlg4cYquE7r3gfmtvuZ6ZvTo9ocDXpiI6bY%2B2%2Fxquh92Kx%2BAhGHvgcCqx0pI6Rz%2B7swrGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dd00cb8b50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1048&min_rtt=1039&rtt_var=309&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2233&delivery_rate=2669124&cwnd=251&unsent_bytes=0&cid=fd94d10ca70db7a7&ts=132&x=0", cfL4;desc="?proto=QUIC&rtt=1557&min_rtt=906&rtt_var=340&sent=201&recv=58&lost=0&retrans=0&sent_bytes=187767&recv_bytes=24677&delivery_rate=7197880&cwnd=96000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6835&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY

172.67.146.141

200 OK

94 kB

URL User Request GET HTTP/3
eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
HTML document, ASCII text, with very long lines (52495), with CRLF line terminators
Size
94 kB (93899 bytes)
Hash
cd21361c1a11a587272b8fd561dc6b3f
71e9f7cba57b270e668e5615706cf9760614a435
f13b73b87029b299d2c166142e03e4453df92c24d9940347700b1d2025128c50

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Anti-debugging code

HTTP Headers

GET /zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/pax6lf1/
Cookie: XSRF-TOKEN=eyJpdiI6ImxqVlVuTkp4aWFzaWwzaXBFZ3pjelE9PSIsInZhbHVlIjoidndGV1VrSkRsQzRHdDFDZVZHM1NZc25RVldPdzVORjViUnRyTXJsZ1JHbUdXbjdUcExHUy9XRUNUL24zSENXSnhicTZydkVDenhUQ3N5RmRUam4ydUI0R2k2RlVvZ2hVS3hpdUZPUlQ1TGhMNjI2Qm9hNE5tcDVDbCtkMThaWWEiLCJtYWMiOiJmYzY1NmRkYjI5YWUyZGQxYzE5NzEwZmJkZWNmZjMyZTNmM2NlYWY2MmJkM2RlNjZmNDFjYTQ2YmVmOWY0OTE3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjFLdGdmMzFleHVKdCt2ZFJlYjFkUnc9PSIsInZhbHVlIjoieXNJdnY3S210cHBTT1Nua2FjOUhIdGl1ZzlmanhWTDg5cHQ5bW8vWEpHM0VvbzhxMm1EQXpuK2kzdGIvTVpLSXBXU0JGUnJaelJPbVp5SlNqV3hzeXd2cU1NWGNRd05CSHdjSGMxRHFSb0k1ZWI1TGpmOGZBNzl4ZE9PWTlHSjEiLCJtYWMiOiI4ZGFhMjcxMTUwZmE0YjI0YmE2MTk4YmQyYTBlMGU3ODc1YjIzYTY4MmNiYzczM2ZlOTg5NmVlOTc3YjJhNzcwIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pPsgI1uaC5%2FwIx2uxSVAYmcc3yNrKdLsuoPi2b7OXoAUOizEHmO4M1mRhOn%2B1nODJL%2FOED6miKw4qN32LdVQ0DlXcKk5z5sCWFT0PDdMXx0Mr%2Fk7zHiikxJ%2BoW3TJA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:52 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:52 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 911e8dcdf8f6b50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1282&min_rtt=1218&rtt_var=503&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2245&delivery_rate=2377668&cwnd=251&unsent_bytes=0&cid=106e3f829284287e&ts=144&x=0", cfL4;desc="?proto=QUIC&rtt=4189&min_rtt=2135&rtt_var=1953&sent=35&recv=17&lost=0&retrans=0&sent_bytes=18632&recv_bytes=6788&delivery_rate=32250&cwnd=12000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6452&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/ghjIB03zkv9xWoYBf07hIbOU4tVMxyCfUmEMsnAkVSlcVhLdkkC00JlJef210

172.67.146.141

200 OK

25 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/ghjIB03zkv9xWoYBf07hIbOU4tVMxyCfUmEMsnAkVSlcVhLdkkC00JlJef210
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
RIFF (little-endian) data, Web/P image
Size
25 kB (25216 bytes)
Hash
f9a795e2270664a7a169c73b6d84a575
0fbb60ab27ab88c064eb347d0722c8ed4cf5e8b8
d00203b2eea6e418c31baafa949ada5349a9f9b7e99fa003aec7406822693740

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ghjIB03zkv9xWoYBf07hIbOU4tVMxyCfUmEMsnAkVSlcVhLdkkC00JlJef210 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/webp
content-length: 25216
content-disposition: inline; filename="ghjIB03zkv9xWoYBf07hIbOU4tVMxyCfUmEMsnAkVSlcVhLdkkC00JlJef210"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Z86wn9kOxg5UE%2FZiheBRjV4zdVwYd55RMqKdmaKW7R5M%2FneQBbT2rt5V29%2FBqvhV6eZLxFoURKR2lNh%2BjF9MZhsm9faXB7hhRMmQ46%2BQqEQDVh3f7xXmuqg2eayZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd05d45b50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1541&min_rtt=1418&rtt_var=498&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2204&delivery_rate=2000000&cwnd=251&unsent_bytes=0&cid=d5f382a36c712590&ts=89&x=0", cfL4;desc="?proto=QUIC&rtt=1449&min_rtt=906&rtt_var=450&sent=132&recv=54&lost=0&retrans=0&sent_bytes=108641&recv_bytes=24494&delivery_rate=1669122&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6810&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/uvqrswgO3d3cvoz1KlQfNR6ujixK67DwGWAmre0kvtpmm3jaS8FbSTT46PPIUtgh260

172.67.146.141

200 OK

18 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/uvqrswgO3d3cvoz1KlQfNR6ujixK67DwGWAmre0kvtpmm3jaS8FbSTT46PPIUtgh260
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
RIFF (little-endian) data, Web/P image
Size
18 kB (17842 bytes)
Hash
4b52ecdc33382c9dca874f551990e704
8f3bf8e41cd4cdddb17836b261e73f827b84341b
cce050cc3b150c0b370751021bb15018ee2b64ac369e230fe3b571a9b00d4342

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /uvqrswgO3d3cvoz1KlQfNR6ujixK67DwGWAmre0kvtpmm3jaS8FbSTT46PPIUtgh260 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/webp
content-length: 17842
content-disposition: inline; filename="uvqrswgO3d3cvoz1KlQfNR6ujixK67DwGWAmre0kvtpmm3jaS8FbSTT46PPIUtgh260"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wIQyYQHhguxQa5ea7GEI34LuAMZ%2FsfBdQQILCGdfeJqCTogff8ho3I40QvsVS%2F5Ubmo81TyUqS27WLq81xRkKn4OWST3VzR2rCcrwWOKwqc45LSGeJZl0WCj5rhbpg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd05d4ab50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1133&min_rtt=1116&rtt_var=431&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2210&delivery_rate=2594982&cwnd=251&unsent_bytes=0&cid=91b6ce04e5dbb01c&ts=95&x=0", cfL4;desc="?proto=QUIC&rtt=1527&min_rtt=906&rtt_var=386&sent=157&recv=56&lost=0&retrans=0&sent_bytes=136855&recv_bytes=24585&delivery_rate=316523&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6821&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/GDSherpa-regular.woff2

172.67.146.141

200 OK

29 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/GDSherpa-regular.woff2
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Size
29 kB (28584 bytes)
Hash
17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-regular.woff2 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: font/woff2
content-length: 28584
content-disposition: inline; filename="GDSherpa-regular.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4icinvFPn1aw%2Fglrwzmqf0mlvXzmesJxdozttemb4AqoKEPnu40fM6IOE4D9pw%2B4pnj%2F%2BX3akIyBtOK%2FNHGU%2Fp4WfXTFaENaNqNKKF5oI9ZwCbwi%2B6LpZHCFfJ8DnA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dd01cc7b50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1251&min_rtt=1251&rtt_var=470&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2238&delivery_rate=2303898&cwnd=251&unsent_bytes=0&cid=1064ba32e3b91238&ts=156&x=0", cfL4;desc="?proto=QUIC&rtt=2829&min_rtt=906&rtt_var=2606&sent=280&recv=62&lost=0&retrans=0&sent_bytes=277855&recv_bytes=24860&delivery_rate=251938&cwnd=96000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6872&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/GDSherpa-vf.woff2

172.67.146.141

200 OK

44 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/GDSherpa-vf.woff2
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Size
44 kB (43596 bytes)
Hash
2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-vf.woff2 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: font/woff2
content-length: 43596
content-disposition: inline; filename="GDSherpa-vf.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xLc257vki9uvY3oGheYEd79L5Ho5DQAe0OsP9Jn4ffn3X7nOh0NF4xrBMH7pvS%2B%2FYaXQ37ssdlEjbiJyiKAT0kmFXbIvk%2FadgvwqpTemdxZL3SMx0jbrAx40RAW3vg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dd01cd7b50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1047&min_rtt=1014&rtt_var=346&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2232&delivery_rate=2419381&cwnd=251&unsent_bytes=0&cid=5a4739ae521b9cfe&ts=192&x=0", cfL4;desc="?proto=QUIC&rtt=4394&min_rtt=906&rtt_var=5056&sent=310&recv=64&lost=0&retrans=0&sent_bytes=310968&recv_bytes=24952&delivery_rate=75930&cwnd=96000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6944&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/GDSherpa-vf2.woff2

172.67.146.141

200 OK

93 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/GDSherpa-vf2.woff2
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Size
93 kB (93276 bytes)
Hash
bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-vf2.woff2 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:53 GMT
content-type: font/woff2
content-length: 93276
content-disposition: inline; filename="GDSherpa-vf2.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=poRu7JpgwirjbulbSfEj%2F5vvmHefyoddUP7Jgyb2cV4zgdhLvbP4Ihe9ZTjjVYNi5KgIPv9AFQfsexKtTDEqORg6FE%2FQif8WO3%2FBa%2BF6GIQnvIrRl6TDHIUoEnKd4w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dd01cdcb50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1157&min_rtt=1154&rtt_var=440&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2234&delivery_rate=2443881&cwnd=251&unsent_bytes=0&cid=69140e285e3678c9&ts=208&x=0", cfL4;desc="?proto=QUIC&rtt=4167&min_rtt=906&rtt_var=4247&sent=354&recv=65&lost=0&retrans=0&sent_bytes=362422&recv_bytes=24998&delivery_rate=7293741&cwnd=96000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6959&x=1", cfExtPri, cfHdrFlush;dur=0

objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream

185.199.109.133

200 OK

10 kB

URL GET HTTP/2
objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
IP
185.199.109.133:443
ASN
#54113 FASTLY

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerDigiCert Inc
Subject*.github.io
Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28
ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (10017)
Size
10 kB (10245 bytes)
Hash
6c20a2be8ba900bc0a7118893a2b1072
ff7766fde1f33882c6e1c481ceed6f6588ea764c
b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500

HTTP Headers

GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T164829Z&X-Amz-Expires=300&X-Amz-Signature=cc8c0f248f554872ad6570c0cbc70f592b7aea666d1966b7f5c26ca52b3ca744&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Tue, 07 Dec 2021 16:38:45 GMT
etag: "0x8D9B9A009499A1E"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d91f6eaf-e01e-0032-2f18-13e122000000
x-ms-version: 2023-11-03
x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT
x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=randexp.min.js
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
age: 4134
date: Fri, 14 Feb 2025 16:49:53 GMT
x-served-by: cache-iad-kiad7000045-IAD, cache-hel1410031-HEL
x-cache: HIT, HIT
x-cache-hits: 11369, 0
x-timer: S1739551793.027455,VS0,VE1
content-length: 10245
X-Firefox-Spdy: h2

ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2

143.204.55.47

200 OK

20 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 20416, version 2.197
Size
20 kB (20416 bytes)
Hash
d99a7377dabb55772ca9f986b0a04b57
2b5fcd8431953c44e410d0489899e74f6d2cfecc
affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149

HTTP Headers

GET /assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://eiku5vqro5.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20416
date: Mon, 27 Jan 2025 07:42:18 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:56:28 GMT
etag: "d99a7377dabb55772ca9f986b0a04b57"
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
expires: Tue, 27 Jan 2026 07:42:18 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: wOVo4HMUFK30oGMcXFF-QolS9JjqdZU1SjCZo_BeZiUt9xnrzymIDw==
age: 1588055
X-Firefox-Spdy: h2

eiku5vqro5.brightnexst.ru/ij45mX0k0SWmxAZBPgWVA7PMqrQcRbUfgtmHH62ZiLcvgKFJuBNJPab230

172.67.146.141

200 OK

1.3 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/ij45mX0k0SWmxAZBPgWVA7PMqrQcRbUfgtmHH62ZiLcvgKFJuBNJPab230
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
RIFF (little-endian) data, Web/P image
Size
1.3 kB (1298 bytes)
Hash
32ca2081553e969f9fdd4374134521ad
7b09924c4c3d8b6e41fe38363e342da098be4173
216fc342a469aa6a005b2eacc24622095e5282d3e9f1ae99ce54c27b92ec3587

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ij45mX0k0SWmxAZBPgWVA7PMqrQcRbUfgtmHH62ZiLcvgKFJuBNJPab230 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:53 GMT
content-type: image/webp
content-length: 1298
content-disposition: inline; filename="ij45mX0k0SWmxAZBPgWVA7PMqrQcRbUfgtmHH62ZiLcvgKFJuBNJPab230"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f%2FOxd44a%2BzXVVQNuIzcT0ZMc8%2Bhul5OZthj8n4IGAaVn%2BVzGUF4kB7bTeiJy%2Bp43zNyWn8vrXPxsfON8O0FVoRySxlTOfWKMUjAwTYpOP2Rv9pZUD4URUMJkXgW%2Bhw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd6b8e1b50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1180&min_rtt=1171&rtt_var=346&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2201&delivery_rate=2373770&cwnd=251&unsent_bytes=0&cid=a3a13b5183475598&ts=97&x=0", cfL4;desc="?proto=QUIC&rtt=1522&min_rtt=757&rtt_var=709&sent=849&recv=101&lost=0&retrans=0&sent_bytes=930377&recv_bytes=29447&delivery_rate=1826680&cwnd=192000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=7816&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/kl8VdVJAWt9cQdyYoiqx5kJMJQiI9ijnxbXHUQORdmFcE6o8wFpzuRfr4uv220

172.67.146.141

200 OK

11 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/kl8VdVJAWt9cQdyYoiqx5kJMJQiI9ijnxbXHUQORdmFcE6o8wFpzuRfr4uv220
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
SVG Scalable Vector Graphics image
Size
11 kB (10899 bytes)
Hash
bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /kl8VdVJAWt9cQdyYoiqx5kJMJQiI9ijnxbXHUQORdmFcE6o8wFpzuRfr4uv220 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:53 GMT
content-type: image/svg+xml
content-disposition: inline; filename="kl8VdVJAWt9cQdyYoiqx5kJMJQiI9ijnxbXHUQORdmFcE6o8wFpzuRfr4uv220"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cWqUcytF397AkAhWdQzILhfvnPXPlDTlt92WvjPYfQIREGitGuD0MNPQAIUUf3BIN5aJcRGxCzHodisxUHx2%2BH63bi%2Fdde5FWZGYwHynGi7AjmOpRsgZeAatdl1ZlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd6b8d6b50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1214&min_rtt=1184&rtt_var=505&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2205&delivery_rate=2025174&cwnd=251&unsent_bytes=0&cid=5b1ba20a9ad40bf0&ts=98&x=0", cfL4;desc="?proto=QUIC&rtt=1678&min_rtt=757&rtt_var=764&sent=843&recv=99&lost=0&retrans=0&sent_bytes=925884&recv_bytes=29356&delivery_rate=13582247&cwnd=192000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=7805&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/34OYl47Jrh4EI1rIlTatklWou7ZJkCGHAj89101

172.67.146.141

200 OK

471 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/34OYl47Jrh4EI1rIlTatklWou7ZJkCGHAj89101
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
Unicode text, UTF-8 text, with very long lines (21756), with CRLF line terminators
Size
471 kB (471119 bytes)
Hash
e0b5e689ac9d07752e1f4a5ea58e08a7
60435dbd95ba89d1079ddc9dbea80c9ca45762e5
70cb6b8c9ce50c3edc5e6439a370aab6d3382c92a7719700059b454a9e5e0939

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /34OYl47Jrh4EI1rIlTatklWou7ZJkCGHAj89101 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: application/javascript
content-disposition: inline; filename="34OYl47Jrh4EI1rIlTatklWou7ZJkCGHAj89101"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zDtTULauisZHo5uj0r8zaRcCPlFDbUzjgOii2CU7KxPgCBWQ25u1GpFuKH3GJWgyctjUwVQ2zO5lV6rTWIu33PLilh8a6FmwfR6zvcauwaoi3yFjH6zQpVvc6mLAVg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dd05d4db50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1182&min_rtt=1174&rtt_var=456&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2146&delivery_rate=2337368&cwnd=251&unsent_bytes=0&cid=759156d2499e282e&ts=133&x=0", cfL4;desc="?proto=QUIC&rtt=3272&min_rtt=906&rtt_var=3306&sent=277&recv=60&lost=0&retrans=0&sent_bytes=275331&recv_bytes=24769&delivery_rate=3941260&cwnd=96000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6861&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/favicon.ico

172.67.146.141

404 Not Found

6.2 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/favicon.ico
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
data
Size
6.2 kB (6237 bytes)
Hash
e57fafab2d05c65831d703d59c6c1284
93e5d6345616ec48b9f126afa0dec3d5bb46dc3e
55763b4cd3a1d05ac3fce969a54a2a623e4a9758a4df6b25f376597c0fc19362

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6ImIwaVRtSU55bkJWaVpRNHZyV0E5dFE9PSIsInZhbHVlIjoiZStSb3RvWGhrT0pTTnZ4WldsUkZ6TEcvdHVGWG4rdTBEVHNTWmJxYk9ucjlCNWhLUUdjcVlxY2o3OFhVejB3OUpUUnZnWTZHV1BqSTBSZDkvYnlzN1ZHd2gwOCtDWXdETmRrdFpCTnZJOG9IU244VGpnMUZhdnZKQU5Za1RsV0wiLCJtYWMiOiJhMjYzMjNlYWM1MTcwOWMyOWU5MDc2NjUyZjVjOTNmYmE2OGNkYzMzNWVjZmU1MDA4YzExMjZhOWU1OTE4Yjg5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVxNjlycS85Qzd0cVMzUHExcW9CZFE9PSIsInZhbHVlIjoiU0NzL0pObXRuWFdZY2lJUldWMGJjSDMyazhXbXd1SS8vVVJRdHBNNVB0QkJyZzlpeVpUeU4yOVlsajVEUG5WblJWVnE4WDR5TjhyWDgwL2FYOWNqaGdqeUQxQnAyd281MGViMTNxYW9pNnJXOGNLQ2pjWWdaZ3QwbjZLa09RSG8iLCJtYWMiOiI3Y2ExOGVjODU0ZTk2NGQ4MGU3ZTYzMDc0NjhkNDc5NTY5NzM1OWM5NTJkMDI4MWFmYjA1YjA4ZGM1MDkzMjBkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Fri, 14 Feb 2025 16:49:54 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LHjObq0TNmpt7i8M1aWGrDoJoH%2FhnlvE6AclU645BX1cPw5TNKNW8LAvfo26flE8ZgDQryvjiEOnGTrixKmUDyvALh3EYABMuc96ahyANHJfxBOaOYSBdK7lw%2F%2BUow%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 2
priority: u=6,i=?0
server: cloudflare
cf-ray: 911e8dda780bb50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1177&min_rtt=1163&rtt_var=353&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2120&delivery_rate=2356387&cwnd=251&unsent_bytes=0&cid=8484fafdf551c458&ts=98&x=0", cfL4;desc="?proto=QUIC&rtt=1461&min_rtt=757&rtt_var=655&sent=852&recv=103&lost=0&retrans=0&sent_bytes=932606&recv_bytes=30409&delivery_rate=1514978&cwnd=192000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=8278&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/56YYNIh9xPxycato8919

172.67.146.141

200 OK

27 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/56YYNIh9xPxycato8919
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
ASCII text, with very long lines (26765), with no line terminators
Size
27 kB (26765 bytes)
Hash
1a862a89d5633fac83d763886726740d
e5ce3aa454c992a13fd406a9647d7afbf831051f
5c22fd904edb792331a7307ddf4a790e0d1318924f6d8e7362fa6b55d5ab6fbb

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /56YYNIh9xPxycato8919 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="56YYNIh9xPxycato8919"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NL45Uc7s8sOHxwsbzB%2FV%2BWxvP7WUN36flujui1ZOQZZiR7mrPc%2FHX3oQYBPyRdoA2QY3Wtqyb%2BAzo5AhLrFUCLyKL11Zp1TsppGZNanuLfYrSXlLMEQnLTh4iIjNCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 911e8dd00ca6b50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1338&min_rtt=1248&rtt_var=532&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2156&delivery_rate=2320512&cwnd=251&unsent_bytes=0&cid=92df026190a933d5&ts=90&x=0", cfL4;desc="?proto=QUIC&rtt=1655&min_rtt=906&rtt_var=958&sent=118&recv=49&lost=0&retrans=0&sent_bytes=94866&recv_bytes=24267&delivery_rate=2122481&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6765&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/mnOurAFOXo4JEW92fuqilC1n5EqLzQprs5qijGiWapYEuRUM544Fzky878150

172.67.146.141

200 OK

270 B

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/mnOurAFOXo4JEW92fuqilC1n5EqLzQprs5qijGiWapYEuRUM544Fzky878150
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
SVG Scalable Vector Graphics image
Size
270 B (270 bytes)
Hash
0c09c5ea7c28d6feb4d124957dde0a0d
1b9efde2d8f0e2a3d9d5315117e597c2d622fc5e
b3c39d2c15327b7ae68940502a2d7bf457fe521e075e6e671d0340edc58bcb3a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /mnOurAFOXo4JEW92fuqilC1n5EqLzQprs5qijGiWapYEuRUM544Fzky878150 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/svg+xml
content-disposition: inline; filename="mnOurAFOXo4JEW92fuqilC1n5EqLzQprs5qijGiWapYEuRUM544Fzky878150"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CCxwxIGHXRFpKxoW21pzHlx880Mu3t8e3Jzs%2Fh2DK7dYtt1wg9n9KqL8bFzzf6ezhuPFMCCEHmFirvu3Gq%2FzdjDqbkSdCWVxU19adxvR2%2FBEw1zI%2BnyOKIdmqxfcjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd03cf9b50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1155&min_rtt=1129&rtt_var=367&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2204&delivery_rate=2244961&cwnd=251&unsent_bytes=0&cid=81ea9c90e76a1632&ts=115&x=0", cfL4;desc="?proto=QUIC&rtt=1449&min_rtt=906&rtt_var=450&sent=145&recv=54&lost=0&retrans=0&sent_bytes=122743&recv_bytes=24494&delivery_rate=1669122&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6811&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/ijbQr2NlfF1pwTzx8bRbbLuByz4tUhJePvx2DxA78170

172.67.146.141

200 OK

7.4 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/ijbQr2NlfF1pwTzx8bRbbLuByz4tUhJePvx2DxA78170
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
SVG Scalable Vector Graphics image
Size
7.4 kB (7390 bytes)
Hash
bca9b46fee32162356ba5b4783e614dc
cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5
fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ijbQr2NlfF1pwTzx8bRbbLuByz4tUhJePvx2DxA78170 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/svg+xml
content-disposition: inline; filename="ijbQr2NlfF1pwTzx8bRbbLuByz4tUhJePvx2DxA78170"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jx8%2BoVaI6sfnIWHr5nDcDllXYn%2Bwi%2BrZHkuG%2B7zERhhN6hBcHKtxNDDFUXDrpHUFymU9l8jf%2BdojAyGmpmlgGNMNQCVHF%2BkFgE24qCaWxmzksTVyPXkm0FucI%2BK%2FXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd03cfdb50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1027&min_rtt=990&rtt_var=348&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2187&delivery_rate=2367947&cwnd=251&unsent_bytes=0&cid=9d96a8acd83e4de5&ts=102&x=0", cfL4;desc="?proto=QUIC&rtt=1546&min_rtt=906&rtt_var=730&sent=126&recv=51&lost=0&retrans=0&sent_bytes=102543&recv_bytes=24359&delivery_rate=909638&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6798&x=1", cfExtPri, cfHdrFlush;dur=0

ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css

143.204.55.47

200 OK

10 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
ASCII text, with very long lines (10450)
Size
10 kB (10498 bytes)
Hash
e0d37a504604ef874bad26435d62011f
4301f0d2b729ae22adece657d79eccaa25f429b1
c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179

HTTP Headers

GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Thu, 14 Mar 2024 00:03:58 GMT
x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Fri, 31 Jan 2025 02:19:39 GMT
expires: Sat, 31 Jan 2026 02:19:39 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: UhETpeTXXJqhr3ggU9nVuGfEERfZVfievHEh8Y1SR9eCZBJvpDY_kg==
age: 1261813
X-Firefox-Spdy: h2

eiku5vqro5.brightnexst.ru/qxkmXjI0gqKOiFK0EKlEACzm9kc0BY71DlvmY3eudNw9mhx

172.67.146.141

200 OK

2.8 kB

URL POST HTTP/3
eiku5vqro5.brightnexst.ru/qxkmXjI0gqKOiFK0EKlEACzm9kc0BY71DlvmY3eudNw9mhx
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
troff or preprocessor input, ASCII text, with very long lines (2849), with no line terminators
Size
2.8 kB (2836 bytes)
Hash
15de793ee8df02ff2f2e1cc883b8326b
4fa973ad2b9083398df143d1792a348f32cfd828
7033ee1f03a3b1aba7a96be408de95809c4cbe63ba14d2a80e1805c6b5771857

HTTP Headers

POST /qxkmXjI0gqKOiFK0EKlEACzm9kc0BY71DlvmY3eudNw9mhx HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 55
Origin: https://eiku5vqro5.brightnexst.ru
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:53 GMT
content-type: application/json
cache-control: no-cache, private
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GFOKJR8qPz3pdNWX5JA6rVowVNqjWeHcIfnIXKA2cnZgcTBDWD9mRs%2Bydn%2FlsJw%2BeA1ixJTdgDq9Vk0vg7i7ppjLj8MFOgXvTxpR0h5riEe%2BQAiFn0PXI8IXKknd8g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImIwaVRtSU55bkJWaVpRNHZyV0E5dFE9PSIsInZhbHVlIjoiZStSb3RvWGhrT0pTTnZ4WldsUkZ6TEcvdHVGWG4rdTBEVHNTWmJxYk9ucjlCNWhLUUdjcVlxY2o3OFhVejB3OUpUUnZnWTZHV1BqSTBSZDkvYnlzN1ZHd2gwOCtDWXdETmRrdFpCTnZJOG9IU244VGpnMUZhdnZKQU5Za1RsV0wiLCJtYWMiOiJhMjYzMjNlYWM1MTcwOWMyOWU5MDc2NjUyZjVjOTNmYmE2OGNkYzMzNWVjZmU1MDA4YzExMjZhOWU1OTE4Yjg5IiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:53 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IjVxNjlycS85Qzd0cVMzUHExcW9CZFE9PSIsInZhbHVlIjoiU0NzL0pObXRuWFdZY2lJUldWMGJjSDMyazhXbXd1SS8vVVJRdHBNNVB0QkJyZzlpeVpUeU4yOVlsajVEUG5WblJWVnE4WDR5TjhyWDgwL2FYOWNqaGdqeUQxQnAyd281MGViMTNxYW9pNnJXOGNLQ2pjWWdaZ3QwbjZLa09RSG8iLCJtYWMiOiI3Y2ExOGVjODU0ZTk2NGQ4MGU3ZTYzMDc0NjhkNDc5NTY5NzM1OWM5NTJkMDI4MWFmYjA1YjA4ZGM1MDkzMjBkIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 18:49:53 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dd6887ab50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1041&min_rtt=1027&rtt_var=414&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2367&delivery_rate=2529257&cwnd=251&unsent_bytes=0&cid=598d486325bc3079&ts=131&x=0", cfL4;desc="?proto=QUIC&rtt=1615&min_rtt=757&rtt_var=699&sent=845&recv=100&lost=0&retrans=0&sent_bytes=927461&recv_bytes=29402&delivery_rate=9279&cwnd=192000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=7812&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/wxMnwd6tKZDr6ncBghLlSqMi33KGmnZgcuJNTgnQV5DAbbJTp90173

172.67.146.141

200 OK

2.9 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/wxMnwd6tKZDr6ncBghLlSqMi33KGmnZgcuJNTgnQV5DAbbJTp90173
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
SVG Scalable Vector Graphics image
Size
2.9 kB (2905 bytes)
Hash
e924de0d471df54b6280f3dc8b187cb8
857f03226070b502a9e06b4249710ec10be4c9e9
24ce135a31ce83ac3d62471fcc0e1a82ce6f1533c993ee59ca4e110d5f2fae33

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /wxMnwd6tKZDr6ncBghLlSqMi33KGmnZgcuJNTgnQV5DAbbJTp90173 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/svg+xml
content-disposition: inline; filename="wxMnwd6tKZDr6ncBghLlSqMi33KGmnZgcuJNTgnQV5DAbbJTp90173"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aLJJVmVm%2Bfio%2BOq9ybvAF%2BKeGu4fXQeXXZlxaJa7Nwp8uW%2F9aPmRImigSSxBwVcKqdkyfw8jvDH4okjUrQdKLX67kcqUFIEtfYBixammcwjpMRKcKdZgb6QttDCuiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd03cffb50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1121&min_rtt=1109&rtt_var=441&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2197&delivery_rate=2395368&cwnd=251&unsent_bytes=0&cid=4874bd7da67c2fa7&ts=139&x=0", cfL4;desc="?proto=QUIC&rtt=1557&min_rtt=906&rtt_var=340&sent=258&recv=58&lost=0&retrans=0&sent_bytes=255079&recv_bytes=24677&delivery_rate=7197880&cwnd=96000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6840&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/xyOOZIYrpqFYcd30

172.67.146.141

200 OK

36 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/xyOOZIYrpqFYcd30
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
ASCII text, with CRLF line terminators
Size
36 kB (35786 bytes)
Hash
38501e3fbbbd89b56aa5ba35de1a32fe
d9b31981b6f834e8480ba28fbc1cff1be772f589
a1ca6b381cb01968851c98512c6e7f6c5309a49f7a16b864813135cbff82a85b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /xyOOZIYrpqFYcd30 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="xyOOZIYrpqFYcd30"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BSvXjXBg7IQdDicGF5DMBA4Ah%2BUoRBkc2SRxcZ8iCp%2BAsUGse4O8cHnGfxMg00rMoyQ7cQDUG6VPJjI%2FI8zTT%2FY5%2BJ%2F6lf2ItB2qx6sUHLxfQPqWiZasS9LOcT99BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 911e8dd00cb0b50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1075&min_rtt=1025&rtt_var=377&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2152&delivery_rate=2326104&cwnd=251&unsent_bytes=0&cid=3825fb140493cfd8&ts=85&x=0", cfL4;desc="?proto=QUIC&rtt=1920&min_rtt=906&rtt_var=1274&sent=110&recv=46&lost=0&retrans=0&sent_bytes=88196&recv_bytes=24131&delivery_rate=3426012&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6722&x=1", cfExtPri, cfHdrFlush;dur=0

eiku5vqro5.brightnexst.ru/oppnmLJDV0UqxdfJs2jUIiZn3ffvkcMgOWYOij7SeM7QGIkXMc6fVcd200

172.67.146.141

200 OK

268 B

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/oppnmLJDV0UqxdfJs2jUIiZn3ffvkcMgOWYOij7SeM7QGIkXMc6fVcd200
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
SVG Scalable Vector Graphics image
Size
268 B (268 bytes)
Hash
1318aafc1fb9ded0c623e5b9a557e6df
0917cdd7633cd1642b02b2b785416ec7e5106dcc
d86660a84daa211b121ec9fe0df83d6b945f61b888384391eabc7d6b4e941dc4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /oppnmLJDV0UqxdfJs2jUIiZn3ffvkcMgOWYOij7SeM7QGIkXMc6fVcd200 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: image/svg+xml
content-disposition: inline; filename="oppnmLJDV0UqxdfJs2jUIiZn3ffvkcMgOWYOij7SeM7QGIkXMc6fVcd200"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=itIb0tyWz476wLRTzoDrLhpjnWFoUzLyzeAw8cgLk%2FEDD7MZTPxsHvnOmErs9RyGtGLWJuDO3eI18l122k74kr3f7OVUsHUn8BCVKQaiY0lz7Jib1jGG%2FmVDyD0%2Fig%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911e8dd03d00b50f-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1146&min_rtt=1122&rtt_var=343&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2201&delivery_rate=2385502&cwnd=251&unsent_bytes=0&cid=cc8deea2574b40ef&ts=120&x=0", cfL4;desc="?proto=QUIC&rtt=1496&min_rtt=906&rtt_var=431&sent=146&recv=55&lost=0&retrans=0&sent_bytes=123796&recv_bytes=24539&delivery_rate=6484891&cwnd=48000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6816&x=1", cfExtPri, cfHdrFlush;dur=0

ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css

143.204.55.47

200 OK

223 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type

Size
223 kB (222931 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://eiku5vqro5.brightnexst.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Tue, 14 May 2024 21:48:24 GMT
x-amz-meta-sha1sum: 7b5499b46660a0348cc2b22cae927dcc3fda8b20
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Wed, 29 Jan 2025 17:13:28 GMT
expires: Thu, 29 Jan 2026 17:13:28 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"0329c939fca7c78756b94fbcd95e322b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 96c778ce6156d12f24b8b6cdaa0cbf66.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: n19O1JR-uXAvFs7Kh6K_vQPYu2ofm-yxbabtPHGN3_hUgcbc38RyJQ==
age: 1380984
X-Firefox-Spdy: h2

eiku5vqro5.brightnexst.ru/GDSherpa-bold.woff2

172.67.146.141

200 OK

28 kB

URL GET HTTP/3
eiku5vqro5.brightnexst.ru/GDSherpa-bold.woff2
IP
172.67.146.141:443
ASN
#13335 CLOUDFLARENET

Requested by
https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
Certificate
IssuerGoogle Trust Services
Subjectbrightnexst.ru
Fingerprint8A:38:FA:93:2C:16:E2:E3:FB:AA:BA:B4:10:91:92:39:E0:65:8F:89
ValidityFri, 10 Jan 2025 20:25:30 GMT - Thu, 10 Apr 2025 21:24:18 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Size
28 kB (28000 bytes)
Hash
a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-bold.woff2 HTTP/1.1
Host: eiku5vqro5.brightnexst.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://eiku5vqro5.brightnexst.ru/zoiuckhdbjrwdebh0o14974puriap?MTUGDOABDVUY
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Im5LenFCRTRQZ2Z2L3VVdVlOc3pQWHc9PSIsInZhbHVlIjoiS0Vhc1ozcU5HQXoxdHBoS1ExdHpuNDBlQ04veWZraWZFeDZtbU5XblU0dzV6L3VZMlpCbEVXVVMrS0lOdTV5YUFmdHBkbGN6YW5qMzhYaFBoK3NuR0F3Qi9kMFc1KzFDaGp3bE5WTVZONXJKTERMVXZiZndyTUhNQWpyRmRFZ0ciLCJtYWMiOiIyMTU2OGUyMGI4YmNjMzk0YTRhZmJhYmIwZTBlMmY1ZWIwNjNhYWY2N2Q4MzAwMGRiNGZmMWNiYWM0MjM2YzRiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImJZN29TV0Y2VjIwSEtvYmdLbHdQSEE9PSIsInZhbHVlIjoiNHAyMCtxM3ZweTZUbSt3RWlWdndHMk9PcEpWQ2p0U1JuTkFYai84S1BsYmdxWmtPS2x4L2FUV2NLd21xeHVTTUIvNHB1Yk9uTUV0N0g0MWc3czlyeWtySUtKM1VUeUgyWnEvdms0cmdCeDd1cnhsYk4xS1RxMlphVHE0Z0VwNEkiLCJtYWMiOiIxMTdkZjNhY2M4MTU1NjNiZjVjMTM0NzFkNzg2NDdhM2I3YTg2YWE2ODJjOWUyZTEzMjg4ZWU5ZDZiMmViZDhkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 14 Feb 2025 16:49:52 GMT
content-type: font/woff2
content-length: 28000
content-disposition: inline; filename="GDSherpa-bold.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 16:49:52 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XfSxVY8YS3Moe7RyvIZz7TNJ1NJ%2BBvZG%2FUtbP1uOW%2Bw9n%2B7KL0HGGgz8rSRfspcakYzZ4v%2F6UB%2BtFFDqJ3L5suNQxuT2RU8bvBUWXFYywh%2FVUjhh4hu6glA%2FWsl76Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911e8dd00cb3b50f-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1112&min_rtt=1097&rtt_var=443&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2235&delivery_rate=2367947&cwnd=251&unsent_bytes=0&cid=177b2e24a895e2be&ts=129&x=0", cfL4;desc="?proto=QUIC&rtt=1557&min_rtt=906&rtt_var=340&sent=231&recv=58&lost=0&retrans=0&sent_bytes=223767&recv_bytes=24677&delivery_rate=7197880&cwnd=96000&unsent_bytes=0&cid=bd3d49ab878b99fe&ts=6836&x=1", cfExtPri, cfHdrFlush;dur=0

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (16)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash