negociosverdes.org/css/admine/fhbhb/sf_rand_string_lowercase6/bW1lZGluYUB0YXNtYW4tZ2VvLmNvbQ==
198.59.144.130
200 OK
0
URL
User Request
GET
HTTP/2
negociosverdes.org/css/admine/fhbhb/sf_rand_string_lowercase6/bW1lZGluYUB0YXNtYW4tZ2VvLmNvbQ==
IP
198.59.144.130:443
ASN
#36024 AS-TIERP-36024
Certificate
IssuerLet's Encrypt
Subjectnegociosverdes.org
FingerprintD7:30:7B:88:41:CE:6E:AB:90:08:8B:CC:E9:0A:22:7D:7E:27:45:AB
ValiditySun, 04 Jun 2023 02:06:11 GMT - Sat, 02 Sep 2023 02:06:10 GMT
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer
Verdict
Alert
urlquery
phishing
Phishing - Microsoft Outlook
GET /css/admine/fhbhb/sf_rand_string_lowercase6/bW1lZGluYUB0YXNtYW4tZ2VvLmNvbQ== HTTP/1.1
Host: negociosverdes.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
x-powered-by: PHP/7.4.33
refresh: 0;url=https://nxdbku.cyttek.ru/Mmmedina@tasman-geo.com
strict-transport-security: max-age=31536000
x-xss-protection: 1
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
referrer-policy: no-referrer-when-downgrade
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 09 Jun 2023 22:24:20 GMT
server: Apache
X-Firefox-Spdy: h2
nxdbku.cyttek.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7d4cc8bee9ffb4fd
188.114.97.1
42
URL
nxdbku.cyttek.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7d4cc8bee9ffb4fd
IP
188.114.97.1:0
Magic
GIF image data, version 89a, 1 x 1\012- data
Hash
d89746888da2d9510b64a9f031eaecd5
d5fceb6532643d0d84ffe09c40c481ecdf59e15a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
GET /cdn-cgi/images/trace/managed/js/transparent.gif?ray=7d4cc8bee9ffb4fd HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nxdbku.cyttek.ru/Mmmedina@tasman-geo.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:20 GMT
content-type: image/gif
content-length: 42
last-modified: Tue, 06 Jun 2023 11:54:00 GMT
etag: "647f1e58-2a"
server: cloudflare
cf-ray: 7d4cc8bfd8d91bfe-OSL
x-frame-options: DENY
x-content-type-options: nosniff
vary: Accept-Encoding
expires: Sat, 10 Jun 2023 00:24:20 GMT
cache-control: max-age=7200, public
accept-ranges: bytes
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/7d4cc8c1585bb4f1/1686349461013/9ffea692c54dc4b91b0a828f8a5b5a7a960f1c1a9a316f9df87f6674246a6159/UT3wFvwyXyBjAcb
104.18.7.185
14635
URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/7d4cc8c1585bb4f1/1686349461013/9ffea692c54dc4b91b0a828f8a5b5a7a960f1c1a9a316f9df87f6674246a6159/UT3wFvwyXyBjAcb
IP
104.18.7.185:0
Hash
42f638f020b8c8541165082bf75f9d18
b4eaec7f49ad8f2927ea6d59e38c7b2a005ac19a
b709c82faff65e04511882bc123e108baa9baa2c95ea0dad4a9bbf2d1c9a41b6
GET /cdn-cgi/challenge-platform/h/b/pat/7d4cc8c1585bb4f1/1686349461013/9ffea692c54dc4b91b0a828f8a5b5a7a960f1c1a9a316f9df87f6674246a6159/UT3wFvwyXyBjAcb HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/1syyt/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 401 Unauthorized
date: Fri, 09 Jun 2023 22:24:22 GMT
content-type: text/plain; charset=UTF-8
www-authenticate: PrivateToken challenge=AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gn_6mksVNxLkbCoKPiltaepYPHBqaMW-d-H9mdCRqYVkAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAojBPEhHbcKehbsRgb6MQwTLnz6FfOWY3U7htx8zvI-_YjK6t2DJdiGR2PgLAZTWqUHvv7eW53jhfv6u2qjbB0GhscHTQPn82jBzC5A9LjI7Y6_IOaPVsbnKqPWxPTNAND0HPMBt1t_vRUWrh142sUJwPDLdW4nQ04c-fuBJFSbNk1hDr8_t-WuQKb52Kf7pyde3Nvk_e6oJs_Ebm1EZ_XYcove1AKMrM5Mf0rIsbI8gZRw1qcUtHJZN12i5le0Ocw6qj2gfeojfbTcmwDgUscUtJTnFKFGTMiRrV2rc2F_oAwbqOCH6BSKzO54OWUwWXFfQ8upcvrBhu6JWg-MBRBwIDAQAB, max-age=20
server: cloudflare
cf-ray: 7d4cc8c98807b4f1-OSL
alt-svc: h3=":443"; ma=86400
aadcdn.msauthimages.net/dbd5a2dd-fbor6pk9rhq2-qyycxqpjcz-kvne4kzzlm5mxdxn-d4/logintenantbranding/0/illustration?ts=637764854529070467
152.199.23.72
200 OK
294506
URL
GET
HTTP/2
aadcdn.msauthimages.net/dbd5a2dd-fbor6pk9rhq2-qyycxqpjcz-kvne4kzzlm5mxdxn-d4/logintenantbranding/0/illustration?ts=637764854529070467
IP
152.199.23.72:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerMicrosoft Corporation
Subjectaadcdn.msauthimages.net
Fingerprint6B:EB:AC:06:FC:06:82:11:17:1C:6B:72:7D:B5:95:2D:CF:E7:A3:5D
ValidityWed, 08 Mar 2023 11:16:34 GMT - Sat, 02 Mar 2024 11:16:34 GMT
Magic
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, components 3\012- data
Hash
56afa77b24f07513666304c4b6a496a6
dfecdf8de83dd7a342252fa41b123b5d3ffe265a
eaa5de8d1df1d66f5f870f908f2e01b9c570a3dc83311b80c1b64cf80536eae8
GET /dbd5a2dd-fbor6pk9rhq2-qyycxqpjcz-kvne4kzzlm5mxdxn-d4/logintenantbranding/0/illustration?ts=637764854529070467 HTTP/1.1
Host: aadcdn.msauthimages.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
cache-control: public, max-age=86400
content-md5: Vq+neyTwdRNmYwTEtqSWpg==
content-type: image/*
date: Fri, 09 Jun 2023 22:24:26 GMT
etag: 0x8D9CBC194C471ED
last-modified: Thu, 30 Dec 2021 18:24:13 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
vary: Origin
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 90f5435a-801e-0052-1021-9b9dab000000
x-ms-version: 2009-09-19
content-length: 294506
X-Firefox-Spdy: h2
nxdbku.cyttek.ru/o/b632c8a1809ce98b3c632df0d13d6bb66483a69871d59
188.114.97.1
200 OK
3651
URL
GET
HTTP/3
nxdbku.cyttek.ru/o/b632c8a1809ce98b3c632df0d13d6bb66483a69871d59
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (3695), with no line terminators
Hash
d633a913e6f3b1f45774b9874dfc85e0
5ba1344048578062c93cfddfdf8458477eaca476
c1fbfbd9a81fc4d9c9539a65bdfb4c6738926b8d4681b0346706196413e92714
GET /o/b632c8a1809ce98b3c632df0d13d6bb66483a69871d59 HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:25 GMT
content-type: image/svg+xml
cache-control: public, max-age=604800
expires: Fri, 16 Jun 2023 22:24:24 GMT
last-modified: Fri, 02 Jun 2023 16:02:03 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5kJeRFLKdyKSN7pDIhabEjPTp6X3kArGfXk1gozKJrb4RnClcsNAPAgyHmT24ijKYsjCHsWBOENUETBMCbnR9ujuanbtC7Z8C9w7hvuHC7DwctLNZ6GCnvVUHt0ifQ5JTyX%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8dbfb0d1bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
nxdbku.cyttek.ru/api-as1f?email=mmedina@tasman-geo.com&data=background
188.114.97.1
200 OK
176
URL
GET
HTTP/3
nxdbku.cyttek.ru/api-as1f?email=mmedina@tasman-geo.com&data=background
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
troff or preprocessor input, ASCII text, with no line terminators
Hash
58c634c4bd6acd6a656958f4068ca3a2
dfec40b768ddd9955fa79947f7ab489e1a37e29b
0f79e53c3877d615ded912957bb2ecfc18271384de857c4482605a805ecc40bc
GET /api-as1f?email=mmedina@tasman-geo.com&data=background HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:26 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6KuusI1FobN9ZSqSDwabc%2BmOPrPySpt8oALyBJBkrufeqXDwHuro%2Fals59Fw2kaiKS8BQknujfH1ohJNAnFTJ4sFfwFGxWpbrRTwqnFZd2mjSCulvuSbDlcwEVPEnHAbRliq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8dc2b331bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
188.114.97.1
200 OK
24167
URL
User Request
GET
HTTP/3
nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
IP
188.114.97.1:443
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (22448)
Hash
6fc6189c8df511dd4c49aed5f6ffcef9
7dd8a3c1784386ce692c4e725e4514cd36685d9e
7bd12699af4ddc591fb87e4f8807250f2d74f297bdb7b2da50786549c4271331
GET /beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nxdbku.cyttek.ru/Mmmedina@tasman-geo.com?__cf_chl_tk=Op0tkDhEKxR.3iMcCsp0.NWfHhtowe6jqTjszUOHvZo-1686349460-0-gaNycGzNC6U
DNT: 1
Connection: keep-alive
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:23 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9N8BDAHLHbGR4bbvu06kmreR1giqgTPpofIDWJkSal%2FRSdGA26gkcZpyF%2BhAXmrmHtgSTT7Thk4XI7qhnT7ktIXWXWzg2Sh3igfwdLfc14MXt02qa7ru7rJlYdr91nXjXwv1"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8d31a8b1bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
nxdbku.cyttek.ru/boot/b632c8a1809ce98b3c632df0d13d6bb66483a6971c7c8
188.114.97.1
200 OK
51039
URL
GET
HTTP/3
nxdbku.cyttek.ru/boot/b632c8a1809ce98b3c632df0d13d6bb66483a6971c7c8
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
ASCII text, with very long lines (50758)
Hash
67176c242e1bdc20603c878dee836df3
27a71b00383d61ef3c489326b3564d698fc1227c
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
GET /boot/b632c8a1809ce98b3c632df0d13d6bb66483a6971c7c8 HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:23 GMT
content-type: application/javascript
cache-control: public, max-age=604800
expires: Fri, 16 Jun 2023 22:24:23 GMT
last-modified: Fri, 02 Jun 2023 16:02:03 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FiCnCo09HkkDLDQ7M4%2F%2F1O%2BU3hjtIuee3da34KQn4PCCFlhX3WKUGB%2F5S%2Brz6TEbrJybZNdGNJugnVbg1PzNoq5QwVaj0cf4u6v1cFWPwb2mMQ0N8fvdGS1t1iVQIQKHe%2BWV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8d43b681bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
nxdbku.cyttek.ru/Mmmedina@tasman-geo.com
188.114.97.1
403 Forbidden
7672
URL
User Request
GET
HTTP/2
nxdbku.cyttek.ru/Mmmedina@tasman-geo.com
IP
188.114.97.1:443
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (7841), with no line terminators
Hash
8fee99b73543704136425ae68af8a833
fa59f4fdf4cd0065efd4c9a810c969b3c06de9bb
5e3156e8891ef9ff74fe2b5e85c856dfe8119bd45ce326af95d1747ca756f84f
Analyzer
Verdict
Alert
urlquery
phishing
Phishing - Microsoft Outlook
GET /Mmmedina@tasman-geo.com HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
date: Fri, 09 Jun 2023 22:24:20 GMT
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oxam1v6bF9D%2B1Eam9sIB37w3WbZWOtEb8q4DQKGheDAJbDPIgzpmvpB%2B5n0dMRHg3644D98ni5hh4lIt3yK5I4U66lRj8e6xEYC4T8buygpEKQJJlmj%2FjhAbX8MohY%2BBSF6l"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d4cc8bee9ffb4fd-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
nxdbku.cyttek.ru/favicon.ico
188.114.97.1
404 Not Found
1238
URL
GET
HTTP/3
nxdbku.cyttek.ru/favicon.ico
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (1276), with no line terminators
Hash
24b426fea67958554911ff4c943fdfe4
b92889146d4c1bbddccabe58ca15c814ea066f72
335fd88e127ff1b19e6c5af3c801186182f064e4c6747b9a76a0b3988553716c
GET /favicon.ico HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 09 Jun 2023 22:24:25 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HlAz66QYAcZHl74DYl9JsSRtet0U%2FY84YEb%2B%2FDX3KWCC64WllRowFgQXWlkb3dQurIkSSIILJaEO5XOmT4%2Fm8VrRuAlfNZXeNC0%2ByuWowsINlXUW2gvKt69m%2FzvpwgB8Nc6N"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7d4cc8dbeaf71bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
nxdbku.cyttek.ru/Mmmedina@tasman-geo.com
188.114.97.1
302 Found
24167
URL
User Request
POST
HTTP/3
nxdbku.cyttek.ru/Mmmedina@tasman-geo.com
IP
188.114.97.1:443
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer
Verdict
Alert
urlquery
phishing
Phishing - Microsoft Outlook
POST /Mmmedina@tasman-geo.com HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nxdbku.cyttek.ru/Mmmedina@tasman-geo.com?__cf_chl_tk=Op0tkDhEKxR.3iMcCsp0.NWfHhtowe6jqTjszUOHvZo-1686349460-0-gaNycGzNC6U
Content-Type: application/x-www-form-urlencoded
Content-Length: 3147
Origin: https://nxdbku.cyttek.ru
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 302 Found
date: Fri, 09 Jun 2023 22:24:23 GMT
content-type: text/html; charset=UTF-8
location: ./beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
set-cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; path=/; expires=Sat, 08-Jun-24 22:24:22 GMT; domain=.cyttek.ru; HttpOnly; Secure; SameSite=None
PHPSESSID=55c1401f94658777c12c247c8639ba89; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mQcEyWU99TE%2FVQ1qA3QuiQTD%2FdKB0JlCEWF%2BXLh5RY9jok94Gxb0%2BBkv1naHiUNbrLNSlr6tNBikipntmCJ0XLqySIt4vy27Y3QBHSIro0zw6yyc2hNVz%2FgQJVkB5p4pFOVf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8ce1daf1bfe-OSL
alt-svc: h3=":443"; ma=86400
nxdbku.cyttek.ru/2
188.114.97.1
200 OK
38239
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /2 HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:24 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xms1MOynM1DF8T4MeTKEmJCxXfcvDszNWrx6GaPeTFdtRIY%2Fa%2BdcNJtPNRpZ%2FCQQ2knRJ7S2LJc902JDHzf3NxsRD3X9C2U%2BmlqB8fJQhyAhrU6ow%2F7rgr6afd2%2FEOJ5%2BEgl"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8db8ac31bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
nxdbku.cyttek.ru/jq/b632c8a1809ce98b3c632df0d13d6bb66483a6971c7c6
188.114.97.1
200 OK
85578
URL
GET
HTTP/3
nxdbku.cyttek.ru/jq/b632c8a1809ce98b3c632df0d13d6bb66483a6971c7c6
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
ASCII text, with very long lines (32065)
Hash
2f6b11a7e914718e0290410e85366fe9
69bb69e25ca7d5ef0935317584e6153f3fd9a88c
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
GET /jq/b632c8a1809ce98b3c632df0d13d6bb66483a6971c7c6 HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:23 GMT
content-type: application/javascript
cache-control: public, max-age=604800
expires: Fri, 16 Jun 2023 22:24:23 GMT
last-modified: Fri, 02 Jun 2023 16:02:03 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ppunx9Ogs%2BlGmETeb0%2FlXaewUQmy8FWA378uxs%2FNMqk8OXxbkTQds2R2ICe7fK6EBbtbPdxIgSX8W6bD%2FOc%2FxcK8ilLk%2BfZFiTEcjNXqji%2Fg3V6pvBPKKVfW1k3v8JJ7Ch%2BK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8d42b661bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
unpkg.com/axios/dist/axios.min.js
104.16.122.175
302 Found
31842
URL
GET
HTTP/2
unpkg.com/axios/dist/axios.min.js
IP
104.16.122.175:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F
ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /axios/dist/axios.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 09 Jun 2023 22:24:23 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=600, max-age=60
location: /axios@1.4.0/dist/axios.min.js
vary: Accept, Accept-Encoding
via: 1.1 fly.io
fly-request-id: 01H2H41RP19F27DTXWEBAY10KY-fra
cf-cache-status: HIT
age: 122
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 7d4cc8d46b07b4ee-OSL
X-Firefox-Spdy: h2
nxdbku.cyttek.ru/ic/b632c8a1809ce98b3c632df0d13d6bb66483a69871d34
188.114.97.1
200 OK
17174
URL
GET
HTTP/3
nxdbku.cyttek.ru/ic/b632c8a1809ce98b3c632df0d13d6bb66483a69871d34
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors\012- data
Hash
12e3dac858061d088023b2bd48e2fa96
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
GET /ic/b632c8a1809ce98b3c632df0d13d6bb66483a69871d34 HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:25 GMT
content-type: image/x-icon
cache-control: public, max-age=604800
expires: Fri, 16 Jun 2023 22:24:24 GMT
last-modified: Fri, 02 Jun 2023 16:02:03 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ky%2BZasdyxgkP3xSbT4EJc%2BS6DFY%2BCnjm5LVIIQKcWZiVoLQF4oMcVeYmVL%2F4ueHCkNrOmLCd2nZ1FJPnaY%2FkLNGh6nj6p2vND2YvY5jlB1UPHgY6xWXm%2B8zTym3rtJbRRyTn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8de8d031bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
aadcdn.msauthimages.net/dbd5a2dd-fbor6pk9rhq2-qyycxqpjcz-kvne4kzzlm5mxdxn-d4/logintenantbranding/0/bannerlogo?ts=637764854540053079
152.199.23.72
200 OK
2423
URL
GET
HTTP/2
aadcdn.msauthimages.net/dbd5a2dd-fbor6pk9rhq2-qyycxqpjcz-kvne4kzzlm5mxdxn-d4/logintenantbranding/0/bannerlogo?ts=637764854540053079
IP
152.199.23.72:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerMicrosoft Corporation
Subjectaadcdn.msauthimages.net
Fingerprint6B:EB:AC:06:FC:06:82:11:17:1C:6B:72:7D:B5:95:2D:CF:E7:A3:5D
ValidityWed, 08 Mar 2023 11:16:34 GMT - Sat, 02 Mar 2024 11:16:34 GMT
Magic
PNG image data, 280 x 60, 8-bit colormap, non-interlaced\012- data
Hash
2f5c4d0bde8fffc3841f6174533ed62e
7b919076c2ce1a93db9f87124c347ddcbebc169b
c93296fee1a086c71e7de135ffd420fcdb01482130acdeea5471e61bf1232a8c
GET /dbd5a2dd-fbor6pk9rhq2-qyycxqpjcz-kvne4kzzlm5mxdxn-d4/logintenantbranding/0/bannerlogo?ts=637764854540053079 HTTP/1.1
Host: aadcdn.msauthimages.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: public, max-age=86400
content-md5: L1xNC96P/8OEH2F0Uz7WLg==
content-type: image/*
date: Fri, 09 Jun 2023 22:24:26 GMT
etag: 0x8D9CBC195510B57
last-modified: Thu, 30 Dec 2021 18:24:14 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
vary: Origin
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 0c8b01c6-f01e-0116-6821-9b0792000000
x-ms-version: 2009-09-19
content-length: 2423
X-Firefox-Spdy: h2
nxdbku.cyttek.ru/e/b632c8a1809ce98b3c632df0d13d6bb66483a69871d61
188.114.97.1
200 OK
513
URL
GET
HTTP/3
nxdbku.cyttek.ru/e/b632c8a1809ce98b3c632df0d13d6bb66483a69871d61
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (529), with no line terminators
Hash
adc405f5fd089662209870ca5d2106f7
3a8b776df84bf251afc6ddd802cc5bbeddfb0e36
e7bacc97751689afaae192e103fe9851664365c57c7d783560860ad456db7e49
GET /e/b632c8a1809ce98b3c632df0d13d6bb66483a69871d61 HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:25 GMT
content-type: image/svg+xml
cache-control: public, max-age=604800
expires: Fri, 16 Jun 2023 22:24:24 GMT
last-modified: Fri, 02 Jun 2023 16:02:03 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VezC54yECO1nccFOJMP7KeQR66PhOis1%2BbMbBSewEpFKE3FPARv2vfiZv5L7HO9EcQoKHK6t4mZrDkQznlE4EVlH9nVBzn2mm6Jx7II4QfWUCxFeI%2BnFgDlZS6zcN6qUYO5y"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8dbfb0e1bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
nxdbku.cyttek.ru/api-as1f?email=mmedina@tasman-geo.com&data=logo
188.114.97.1
200 OK
168
URL
GET
HTTP/3
nxdbku.cyttek.ru/api-as1f?email=mmedina@tasman-geo.com&data=logo
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
troff or preprocessor input, ASCII text, with no line terminators
Hash
2073c0c07ac403af7a826c55f82985e9
a52268ba2afca69129ca6c770838fc2365aa4361
3a8d24e2e370d1bb8db73ca7d5a5c369ad7b109a98f68e99016a21d34a034650
GET /api-as1f?email=mmedina@tasman-geo.com&data=logo HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:25 GMT
content-type: text/html; charset=UTF-8
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9RHbtRBPFirQxVW6k0lag9N4uSzmrJLp5yC6y2oGm7%2FxXxlv6Rq8DbBQWRdCjb2qRQqUVBN2NGzHL%2FeWqay2LqGvsW76Bq7hy8wjEIHjt9xXDi1NgbaVxnTZ59EhOtt7XHIw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8dc0b1e1bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
nxdbku.cyttek.ru/jm/b632c8a1809ce98b3c632df0d13d6bb66483a6971c7cc
188.114.97.1
200 OK
6149
URL
GET
HTTP/3
nxdbku.cyttek.ru/jm/b632c8a1809ce98b3c632df0d13d6bb66483a6971c7cc
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
ASCII text, with very long lines (6175), with no line terminators
Hash
0b3cd9bfcbe6444742df90b00f63efc3
0c978b0541c9659215908034b6299f78135c935c
2065edfabc7924bff8e65b4b4ade30bb341d70ab350518bfbad98e1d4f35266f
GET /jm/b632c8a1809ce98b3c632df0d13d6bb66483a6971c7cc HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:24 GMT
content-type: application/javascript
cache-control: public, max-age=604800
expires: Fri, 16 Jun 2023 22:24:24 GMT
last-modified: Fri, 02 Jun 2023 16:02:03 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ItAIg%2FxfQyAI2kdkbFgHI4NQ32VaAy88vXv23L053nU%2FGyp3EjqDJTKVIKFjeF7XopGmx7NdX6T4ndK%2F2s%2FBOgTH9Up49k6eGeTwfU8qnUsRFHtTWSiybIN3To0K0nEWuWmg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8d43b691bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
unpkg.com/axios@1.4.0/dist/axios.min.js
104.16.122.175
200 OK
31842
URL
GET
HTTP/2
unpkg.com/axios@1.4.0/dist/axios.min.js
IP
104.16.122.175:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintF7:B6:41:CA:15:FD:D1:0C:27:39:55:5D:C5:CE:3F:1C:A6:BB:9D:6F
ValidityTue, 02 May 2023 00:00:00 GMT - Wed, 01 May 2024 23:59:59 GMT
Magic
ASCII text, with very long lines (31803)
Hash
6470a918ba1fd4b8d0882df0269ddb82
97814fdab64aa7d1b30f082f9eb272d4b1ce18a2
fd4ce12a87594281afcee9c73a40fe7acc282bcc9e764fbb3afa1481a96a091e
GET /axios@1.4.0/dist/axios.min.js HTTP/1.1
Host: unpkg.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nxdbku.cyttek.ru/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 09 Jun 2023 22:24:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
etag: W/"7c62-l4FP2rZKp9GzDwgvnrJy1LHOGKI"
via: 1.1 fly.io
fly-request-id: 01GZP8TZEXW4PFCT61FHX2WRTS-fra
cf-cache-status: HIT
age: 3048555
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 7d4cc8d48b32b4ee-OSL
content-encoding: br
X-Firefox-Spdy: h2
nxdbku.cyttek.ru/APP-LR2XHT/b632c8a1809ce98b3c632df0d13d6bb66483a69871d38
188.114.97.1
200 OK
105369
URL
GET
HTTP/3
nxdbku.cyttek.ru/APP-LR2XHT/b632c8a1809ce98b3c632df0d13d6bb66483a69871d38
IP
188.114.97.1:443
Requested by
https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Certificate
IssuerLet's Encrypt
Subjectcyttek.ru
FingerprintFA:85:04:1B:BD:CA:E3:02:45:6A:AD:C7:E6:DC:EB:4B:CA:A6:5A:91
ValidityTue, 30 May 2023 14:28:15 GMT - Mon, 28 Aug 2023 14:28:14 GMT
Magic
ASCII text, with very long lines (65536), with no line terminators
Hash
8e6b0f88563f9c33f78bce65cf287df7
ef7765cd2a7d64ed27dd7344702597aff6f8c397
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a
GET /APP-LR2XHT/b632c8a1809ce98b3c632df0d13d6bb66483a69871d38 HTTP/1.1
Host: nxdbku.cyttek.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nxdbku.cyttek.ru/beebb091955c06fa68b3eb8afc0bae516483a6970f04cPASbeebb091955c06fa68b3eb8afc0bae516483a6970f04d
Cookie: cf_clearance=cy9b83P4vgMWgXn1dI1hODwxKVuhnlItM6WqwVKwVkg-1686349460-0-160; PHPSESSID=55c1401f94658777c12c247c8639ba89
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 09 Jun 2023 22:24:25 GMT
content-type: text/css
cache-control: public, max-age=604800
expires: Fri, 16 Jun 2023 22:24:24 GMT
last-modified: Fri, 02 Jun 2023 16:02:03 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QD%2FLs0kI25pWMT6jWhdQZaN8%2BSK5kOKQxHew5r9LoxS3ymaY3VviAha7JUqSZffY8uCKTy7f1%2BIRO%2FQIEDLKGSDgKZpDWm504QO2nXq4qx7m%2FhdZLVT6j9QMFyD51%2BTfu7pb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d4cc8dc3b3a1bfe-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400