Report - www.google.com/amp/s/www.smarttech.host/New/Auth/oprbim/dG9tQGRkZWxldmF0b3IuY29t

Report Overview

Visited public
2023-10-03 13:49:02
Tags
phishing microsoft outlook
URL
www.google.com/amp/s/www.smarttech.host/New/Auth/oprbim/dG9tQGRkZWxldmF0b3IuY29t
Finishing URL
nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
IP / ASN
142.250.74.132
#15169 GOOGLE
Title
Sign in to your Microsoft account
Phishing - Microsoft Outlook

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.google.com	7	1997-09-15	2015-05-10 13:11:19	2023-09-20 20:05:47	536 B	1.6 kB	142.250.74.132
tracking-protection.cdn.mozilla.net	9282	1998-01-31	2015-09-17 19:00:28	2023-10-02 20:14:01	5.3 kB	1.9 MB	34.120.158.37
nwwam9z.iji5hp.ru	unknown	unknown	No data	No data	20 kB	765 kB	172.67.170.108
aadcdn.msftauth.net	1455	2018-10-25	2018-11-19 11:50:32	2023-10-03 05:17:16	1.5 kB	11 kB	152.199.23.37
ocsp.pki.goog	175	2016-06-13	2018-07-01 08:43:07	2023-10-02 18:12:06	666 B	1.4 kB	142.250.74.131
logincdn.msauth.net	2330	2018-10-25	2019-04-23 03:13:28	2023-10-02 18:33:06	501 B	992 B	192.229.221.185
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20 07:02:03	2023-10-02 18:15:59	3.6 kB	247 kB	104.17.3.184
aadcdn.msauth.net	1421	2018-10-25	2018-11-19 11:50:03	2023-10-02 18:12:52	493 B	1.6 kB	13.107.213.53
adfs.heart.org	unknown	1995-01-12	2016-10-10 20:42:57	2023-10-03 05:17:16	439 B	6.9 kB	69.152.183.140
code.jquery.com	634	2005-12-10	2012-05-21 19:28:02	2023-10-02 21:21:18	415 B	90 kB	151.101.2.137
www.smarttech.host	unknown	2021-05-24	2021-05-28 08:11:19	2023-08-28 23:18:39	515 B	252 B	203.161.61.132

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (12)

	URL	From	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.6.0.min.js	ScriptElement	90 kB	2023-03-07	2025-05-11
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.2.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-11 20:44 Times Seen205917 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	unknown	ScriptElement	318 B	2023-10-03	2024-08-21
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-03 00:32 Last Seen2024-08-21 05:20 Times Seen69 Hash 5049c119470aab5c7eb3bca3f6fbd854 fdb38e1db2794aede748dfc9f502b47a2361ed1d 53df32dfbeb951a925c56c590b118a21aec6a7d6710a99107dd3441d3d6f98a6 Loading...

	nwwam9z.iji5hp.ru/web3/assets/js/pages-head-web.min.js?cb=1696340927178	ScriptElement	10 kB	2023-09-27	2023-10-14
Pretty URL nwwam9z.iji5hp.ru/web3/assets/js/pages-head-web.min.js?cb=1696340927178 IP 172.67.170.108 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-27 21:30 Last Seen2023-10-14 14:45 Times Seen2812 Hash 91ca724283fd63e0366176adac255a3c 1657c9af872393e385b399d72471dd7c8b476d03 8e7b8fe78eb8a61b0d77628fe1a02c9569fcd0ef4c44ee1b1d06069b8a2787e7 Loading...

	nwwam9z.iji5hp.ru/web3/assets/js/pages.js?cb=1696340927178	ScriptElement	81 kB	2023-09-27	2024-08-21
Pretty URL nwwam9z.iji5hp.ru/web3/assets/js/pages.js?cb=1696340927178 IP 172.67.170.108 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-27 21:42 Last Seen2024-08-21 05:39 Times Seen3172 Hash 218f006287340a5c13cc18e43123292c e29a4767c1731f4f3ec266abe1ce800a48605894 72a12d7ce5530539f1f3d2b6865bc856d9b8853871ea165beec2acbd92e71ab6 Loading...

	nwwam9z.iji5hp.ru/web3/assets/js/pages-head-top-web.min.js?cb=1696340925998	ScriptElement	2.2 kB	2023-09-27	2024-08-21
Pretty URL nwwam9z.iji5hp.ru/web3/assets/js/pages-head-top-web.min.js?cb=1696340925998 IP 172.67.170.108 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-27 22:15 Last Seen2024-08-21 05:39 Times Seen1278 Hash fa1f840915acf78aa9b1ce7ee561fe11 c8941c14af74dbc1bc5edf62643ebd2c9cc7b26d 9ce8f46879aceca12b8bfb09ffc672089640f8801c5a831640a3721eb9586371 Loading...

	challenges.cloudflare.com/turnstile/v0/api.js?render=explicit	ScriptElement	34 kB	2023-09-22	2023-11-27
Pretty URL challenges.cloudflare.com/turnstile/v0/api.js?render=explicit IP 104.17.3.184 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-22 02:43 Last Seen2023-11-27 19:36 Times Seen13990 Hash cc3e43876d80dbb4f1bff1e8b15a9c60 3b43cbd347df372f7c1daf463b1229e4a8849195 06d063d7e58bade3ae244489087afa82f9f7c59276cdd7dcfbb2a9b5b600c5da Loading...

	nwwam9z.iji5hp.ru/myscr112471.js	ScriptElement	26 kB	2023-10-03	2023-10-06
Pretty URL nwwam9z.iji5hp.ru/myscr112471.js IP 172.67.170.108 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-03 00:32 Last Seen2023-10-06 14:45 Times Seen69 Hash f7c2b4e41b99a2aff8842a091ecf9f47 d17fd0adde19956fcf4d55b19d3ca578715b65d2 6cc929d460c735df5b05d377a36153f9ba47f864080ad710e36e12815d45626b Loading...

		Size	First Seen	Last Seen
	#1 Eval - 9e925e9341b490bfd3b4c4ca3b0c1ef2	4 B	2023-03-07 01:03	2025-05-11 20:20
Pretty Observations First Seen2023-03-07 01:03 Last Seen2025-05-11 20:20 Times Seen369113 Hash 9e925e9341b490bfd3b4c4ca3b0c1ef2 c2543fff3bfa6f144c2f06a7de6cd10c0b650cae 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408 Loading...

	#2 Eval - b9af56ce01a5a955db186f48d70a35c4	1.1 kB	2024-08-21 05:18	2024-08-21 05:18
Pretty Observations First Seen2024-08-21 05:18 Last Seen2024-08-21 05:18 Times Seen1 Hash b9af56ce01a5a955db186f48d70a35c4 11e6d9ccbe949bc9ac96339f48c87198dd05ceec 2d0dfff6b3655d00cc34b944b3efc004280ce35fe8183d26cb7b3af74ed86bc8 Loading...

	#3 Eval - 62e25eae867bb2c422126d57971906fc	163 B	2023-09-22 02:33	2024-08-21 06:07
Pretty Observations First Seen2023-09-22 02:33 Last Seen2024-08-21 06:07 Times Seen7143 Hash 62e25eae867bb2c422126d57971906fc 81d0898bace510a76f96dfea087fbaa5e05235b8 6afa1f750904a72226860727e2f8dd4891abc6dac37bf07bdd60d7afbd207a4a Loading...

		Size	First Seen	Last Seen
	#1 Write - 548740753fa1cb352a4c641978a2b4e9	4.5 kB	2023-10-03 00:32	2024-08-21 05:20
Pretty Observations First Seen2023-10-03 00:32 Last Seen2024-08-21 05:20 Times Seen69 Hash 548740753fa1cb352a4c641978a2b4e9 9ae92ac657dff30d7d96d55af8d12971a635f743 d090ceb1692868134f004c3edb65e6e3f9fe64860c0009b92daee4a3e548e774 Loading...

	#2 Write - adfb1bc5b6ba91ec5ab5c54ddc225a7a	3.6 kB	2023-09-22 02:30	2024-08-21 06:07
Pretty Observations First Seen2023-09-22 02:30 Last Seen2024-08-21 06:07 Times Seen41377 Hash adfb1bc5b6ba91ec5ab5c54ddc225a7a 16d4d2247f8f343811417dce829fe7595e73995c ca2d1c64f76c12b39444ddb57fb6a2def9521e9d0d29df80eb309ac34ed23b80 Loading...

HTTP Transactions (57)

URL IP Response Size

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
16224c5d98111b880317d7abe78acc6f
adc7242b1cc72d0d28675518e765755ed741e76f
3eee85d77f21c34e07df868b943097d75fc001626742941f5427c3e89f8cdf41

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 03 Oct 2023 13:48:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.google.com/amp/s/www.smarttech.host/New/Auth/oprbim/dG9tQGRkZWxldmF0b3IuY29t

142.250.74.132

264 B

URL
www.google.com/amp/s/www.smarttech.host/New/Auth/oprbim/dG9tQGRkZWxldmF0b3IuY29t
IP
142.250.74.132:0
ASN
#15169 GOOGLE

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF, LF line terminators
Size
264 B (264 bytes)
Hash
5cfa65002f67c7ab6f96dd78096d3a30
5524d8599f9735a0ab22f69365d531c5a891afbc
e11755754a25f303315a802cb1bef9ce3114c2b6c45cc7692081010a1185fa57

HTTP Headers

GET /amp/s/www.smarttech.host/New/Auth/oprbim/dG9tQGRkZWxldmF0b3IuY29t HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
location: https://www.smarttech.host/New/Auth/oprbim/dG9tQGRkZWxldmF0b3IuY29t
cache-control: private
x-robots-tag: noindex
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-GneqWVx2ElxiPZIaCpXLOA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/fff
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/fff"}]}
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Tue, 03 Oct 2023 13:48:42 GMT
server: gws
content-length: 264
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: __Secure-ENID=15.SE=Cb3EBC8ZaTdUxT_4NledWYs3mwzUZ89AYSN3PE8E7s8QcTOEqII5TMjV4uS7ZJn0b8mjBIvBCEteoYXJVRFxIVoQifp31FkmVMnzl9nTKitrGJQMFK6RQmhTiAmZ2DXoVXcIgHoFJssK2iMJJLezz6EKGOC7k6em-SL9HnhV5QU; expires=Sat, 02-Nov-2024 06:07:00 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
CONSENT=PENDING+397; expires=Thu, 02-Oct-2025 13:48:42 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
6ffe1b36da5cedc55de7d1ed94560b53
b702312a32734e128385a9d3fa8c4a31c81c5d93
e73c164604fc8cb1809f6a15f7d7dce29e9ea36ef085a782b081e17a2caa42e7

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 03 Oct 2023 13:48:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

www.smarttech.host/New/Auth/oprbim/dG9tQGRkZWxldmF0b3IuY29t

203.161.61.132

0 B

URL
www.smarttech.host/New/Auth/oprbim/dG9tQGRkZWxldmF0b3IuY29t
IP
203.161.61.132:0
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /New/Auth/oprbim/dG9tQGRkZWxldmF0b3IuY29t HTTP/1.1
Host: www.smarttech.host
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 03 Oct 2023 13:48:43 GMT
Server: Apache
refresh: 0;url=https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

tracking-protection.cdn.mozilla.net/ads-track-digest256/111.0/1684443982

34.120.158.37

56 kB

URL
tracking-protection.cdn.mozilla.net/ads-track-digest256/111.0/1684443982
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
56 kB (56118 bytes)
Hash
eccf8436aa08de0d355cd2c068568453
e05e69cb2970888f00770ab772d77354df830f05
71a2d75150b4656ff17a9589a66e9e03661fa4ea1dfdf16c1d848efaae082439

HTTP Headers

GET /ads-track-digest256/111.0/1684443982 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: O7srLousV23H4C3Tjgef49sSgXPK5qLty6UJlvbh/0J7BqwRbO5vJZGBv1akQ1utg7JvAr8Tbzg=
x-amz-request-id: 9KXRHVEN6X81KSD9
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 56118
via: 1.1 google
date: Mon, 02 Oct 2023 21:40:02 GMT
age: 58121
last-modified: Thu, 18 May 2023 21:16:40 GMT
etag: "eccf8436aa08de0d355cd2c068568453"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/analytics-track-digest256/111.0/1683905755

34.120.158.37

10 kB

URL
tracking-protection.cdn.mozilla.net/analytics-track-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
10 kB (10262 bytes)
Hash
27ca7a562ad626165a25126b5975bc58
de8e9d89b673f3e1375e2a70f3c9d696726dfbe4
405d79f4b44125a2147ac70652ea7e7a544c1a5b34b376f683ea3e90445e7e42

HTTP Headers

GET /analytics-track-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: G3Me/oHwXP9qp+TEFi1NonztnLF2KXcXc8iXx5eVI2XFKg5aU0GCOC9w5JTDctXukNt7lmOwcI8=
x-amz-request-id: TBHRBPRSM7VEEEKA
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 10262
via: 1.1 google
date: Tue, 03 Oct 2023 11:01:49 GMT
age: 10014
last-modified: Fri, 12 May 2023 15:46:41 GMT
etag: "27ca7a562ad626165a25126b5975bc58"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/base-cryptomining-track-digest256/111.0/1683905755

34.120.158.37

2.3 kB

URL
tracking-protection.cdn.mozilla.net/base-cryptomining-track-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
2.3 kB (2293 bytes)
Hash
7938ce04b9288ce2553c06df7544718e
0f6bcdb2770858cfc9018dd76d3ac16386afd3e0
efedbe30e6f1ac7617b022b31ccd2920f0d518e9a7f8818447e117fbc7cd30ee

HTTP Headers

GET /base-cryptomining-track-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: bekehSEssdbPv3dq4TnfE3LGDtgxy6fhnAEOdwDkuHR1QdHETBTUXdE8tRVR+EeF2wkJDGRIVMg=
x-amz-request-id: PCQB8B5NH14PR2Z2
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 2293
via: 1.1 google
date: Mon, 02 Oct 2023 21:43:34 GMT
age: 57909
last-modified: Fri, 12 May 2023 15:46:54 GMT
etag: "7938ce04b9288ce2553c06df7544718e"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/base-email-track-digest256/111.0/1683905755

34.120.158.37

7.0 kB

URL
tracking-protection.cdn.mozilla.net/base-email-track-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
7.0 kB (6965 bytes)
Hash
02560eef6a3e694713d21ba526dbf2d2
c300dbaeeb367bd302eaf2941a97cdd54c84bde9
6796e1d3ffc1d5316c498c022fd22be9e15842a3b3166f664d14042b614e491c

HTTP Headers

GET /base-email-track-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: 3y42mMXv8L4GuuBQr6sOrQDrk+2c22flyFeeIOk1nqnK0NdlRRRg0pSd4MGmJP+peQeh5gtDrOQ=
x-amz-request-id: PYJ723WBT5GSHZB7
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 6965
via: 1.1 google
date: Mon, 02 Oct 2023 18:18:09 GMT
age: 70234
last-modified: Fri, 12 May 2023 15:46:56 GMT
etag: "02560eef6a3e694713d21ba526dbf2d2"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/base-fingerprinting-track-digest256/111.0/1683905755

34.120.158.37

3.6 kB

URL
tracking-protection.cdn.mozilla.net/base-fingerprinting-track-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
3.6 kB (3637 bytes)
Hash
84a28e1e64a4aca618879e590fb29c47
ddea829bfd334fe48e25374f36119c6ce19bdfeb
e87ee13b3afbcefcfd7f87bdd26b12aa18b79437ebd4a3cf689f78aefa0a7d1e

HTTP Headers

GET /base-fingerprinting-track-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: 2vHSopCGxEm4OMS9mkE5bgNsgRuGpXBr74OV9U+D6DUp+ybD8ilxQG0XNke3qd74bgWOnQV8ASg=
x-amz-request-id: HV0J2N8ACR2RP4PX
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 3637
via: 1.1 google
date: Mon, 02 Oct 2023 16:28:30 GMT
age: 76813
last-modified: Fri, 12 May 2023 15:46:52 GMT
etag: "84a28e1e64a4aca618879e590fb29c47"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/content-email-track-digest256/111.0/1683905755

34.120.158.37

8.9 kB

URL
tracking-protection.cdn.mozilla.net/content-email-track-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
8.9 kB (8853 bytes)
Hash
b9c2809ffc057abb94df0750c8cb57dd
e8ab5e486a0b53147eb8d66ca4585a06c5bbd210
b9816319448d2ccb8ef6a6e2aaefe13a9fa96335bdc1fd57c281dfe7ff95ede9

HTTP Headers

GET /content-email-track-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: 7wDHpY7V868upjpIjG34be5wY6xOux24VtL1Pj6PHC7JslKqVyimVrHfetMl2ETSYdVQmGwNJ3I=
x-amz-request-id: ZMC3QBKQH0ZKC6SV
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 8853
via: 1.1 google
date: Mon, 02 Oct 2023 22:32:02 GMT
age: 55001
last-modified: Fri, 12 May 2023 15:46:57 GMT
etag: "b9c2809ffc057abb94df0750c8cb57dd"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/content-track-digest256/111.0/1683905755

34.120.158.37

15 kB

URL
tracking-protection.cdn.mozilla.net/content-track-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
15 kB (15382 bytes)
Hash
d78d9f71f82fcce3a0d9079ec988ed05
13f8a07b0437728b11cefeda36b6211262d3af16
7449b095579811871ecad49889db2ae188486b18ab96f903a20941e34cfef7ee

HTTP Headers

GET /content-track-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: NauefqV+3GtUCKY7K1YfAc6m2kpkEQdXG83O4O/MTdsfG6uJkxMTmFllcjOMo9iS392gGKpqqAQ=
x-amz-request-id: 8NEZBD4JXGG40EYF
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 15382
via: 1.1 google
date: Mon, 02 Oct 2023 15:42:35 GMT
age: 79568
last-modified: Fri, 12 May 2023 15:46:39 GMT
etag: "d78d9f71f82fcce3a0d9079ec988ed05"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/google-trackwhite-digest256/111.0/1683905755

34.120.158.37

1.5 MB

URL
tracking-protection.cdn.mozilla.net/google-trackwhite-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
1.5 MB (1470328 bytes)
Hash
2146c997750a1c7e55eb69a5a1a5e5b4
69ba29aca5c6a4bea1365e895b3c5b31df31220a
507d674f59748ff86ff629a2eb98b3cd343aec0a21e58089793341dc96361188

HTTP Headers

GET /google-trackwhite-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: Gm1jtQat9jjk3lLIumDIBI4JHgORpsRIaR4HjO4FQ/+IdOpnNFFo+e9MYvJQHL+ZBVRtx6yhSnA=
x-amz-request-id: XSQ0PM4CNBHGTE92
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
via: 1.1 google
date: Tue, 03 Oct 2023 05:59:40 GMT
age: 28143
last-modified: Fri, 12 May 2023 15:46:50 GMT
etag: "2146c997750a1c7e55eb69a5a1a5e5b4"
content-type: application/octet-stream
content-length: 1470328
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/mozstd-trackwhite-digest256/111.0/1684443982

34.120.158.37

345 kB

URL
tracking-protection.cdn.mozilla.net/mozstd-trackwhite-digest256/111.0/1684443982
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
345 kB (344663 bytes)
Hash
aacf54fd5b2994c73b3e4e5e13f4b5a2
10494f54553c768432a556492e655aa774456927
bee12d3c1d013147f78ee8ce7d9fa5e83679cc650763c6f4f49a10ff2d4537e5

HTTP Headers

GET /mozstd-trackwhite-digest256/111.0/1684443982 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: 6J5s9j6mYWrRh3KkZyK2FfLgniUDMSDBK86KUlw2wbwK05y07P9r2N7gnr7ASk5wzUhTmLszt7itocf19h7N3A==
x-amz-request-id: TK9Y6CT2FDBN4WW2
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 344663
via: 1.1 google
date: Mon, 02 Oct 2023 21:45:56 GMT
age: 57768
last-modified: Thu, 18 May 2023 21:16:46 GMT
etag: "aacf54fd5b2994c73b3e4e5e13f4b5a2"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/social-track-digest256/111.0/1683905755

34.120.158.37

2.2 kB

URL
tracking-protection.cdn.mozilla.net/social-track-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
2.2 kB (2197 bytes)
Hash
f901679cf935d4b6067610a7287d0b99
fffa5389bec50a175f18deaf8933401edc4bd262
d553a4537f796d580ea8f696062c19540f1d332e2b478942f6ddea3952c6df4c

HTTP Headers

GET /social-track-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: uYxC4gPbk4s7XVP1wJIpn2J7MBSTEr1xwHGkt/LWfc8qZ67ex1HfblO/J9tMwqhHFZjzHgLbWm8=
x-amz-request-id: CFFKJ9RXHBBR3R6F
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 2197
via: 1.1 google
date: Tue, 03 Oct 2023 06:11:04 GMT
age: 27460
last-modified: Fri, 12 May 2023 15:46:42 GMT
etag: "f901679cf935d4b6067610a7287d0b99"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/social-tracking-protection-facebook-digest256/111.0/1683905755

34.120.158.37

468 B

URL
tracking-protection.cdn.mozilla.net/social-tracking-protection-facebook-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
468 B (468 bytes)
Hash
092bf11bed810e853f65d296f1e8b9e3
fed3b3a85aaf2bf1790fb115201b0dfdefe3982c
8c89c977f2c3f91b1050c645843453edc3d5bfcbe5e4af4b945b385f1b60046f

HTTP Headers

GET /social-tracking-protection-facebook-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: Bv/87FWdFWwQtJObBkWRM/HxxYO8qahmjEScyBpKDcRofZthX5p4wjSMsBGMpZHAQSaJ+58YlUk=
x-amz-request-id: 54KBDPJSMYFC1BCN
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 468
via: 1.1 google
date: Mon, 02 Oct 2023 15:54:21 GMT
age: 78863
last-modified: Fri, 12 May 2023 15:46:44 GMT
etag: "092bf11bed810e853f65d296f1e8b9e3"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/social-tracking-protection-linkedin-digest256/111.0/1683905755

34.120.158.37

148 B

URL
tracking-protection.cdn.mozilla.net/social-tracking-protection-linkedin-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
148 B (148 bytes)
Hash
90a72e82e4192224c509d557fd1d0d0c
19fe3346057c74364b7a2a2c1de0011a19c153d8
1024a91771abf18dd0a4de9dcc166ba7f9d224c803b6a5854f3f2db8d9a3c4a2

HTTP Headers

GET /social-tracking-protection-linkedin-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: X8PmD7LofoyuhJgdustFqUuGagxaUjLSoT5f/IoAN4sDHyWSYkDc+wmAHEmM2H91qGUCVgzatpAjcKtaw2qauQ==
x-amz-request-id: 4PBZ9HVSZ8ARMC9W
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 148
via: 1.1 google
date: Mon, 02 Oct 2023 21:42:48 GMT
age: 57956
last-modified: Fri, 12 May 2023 15:46:46 GMT
etag: "90a72e82e4192224c509d557fd1d0d0c"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

tracking-protection.cdn.mozilla.net/social-tracking-protection-twitter-digest256/111.0/1683905755

34.120.158.37

244 B

URL
tracking-protection.cdn.mozilla.net/social-tracking-protection-twitter-digest256/111.0/1683905755
IP
34.120.158.37:0
ASN
#15169 GOOGLE

File type
data
Size
244 B (244 bytes)
Hash
44186218fd668b3ffe6d95bc9c2acf06
e5b11bad035d82c42f2783024bb40fb2fa00d7e6
6d7715ed174a8438063ca39237b2e0c7e204dd68d0396866bc898a7e7aa70372

HTTP Headers

GET /social-tracking-protection-twitter-digest256/111.0/1683905755 HTTP/1.1
Host: tracking-protection.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: none
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: tXsG3wLQO/L6krPTTa+2EoGwSKQWDtsuWVqMgAODea2FswPtCSl4YzB1EyyJSKnwSVJiTIcdLhWJc6cWsTp1wg==
x-amz-request-id: 2ZFCJQDYE8G8328J
x-amz-server-side-encryption: AES256
accept-ranges: bytes
server: AmazonS3
content-length: 244
via: 1.1 google
date: Mon, 02 Oct 2023 16:22:03 GMT
age: 77201
last-modified: Fri, 12 May 2023 15:46:45 GMT
etag: "44186218fd668b3ffe6d95bc9c2acf06"
content-type: application/octet-stream
cache-control: public,max-age=86400
alt-svc: clear
X-Firefox-Spdy: h2

nwwam9z.iji5hp.ru/jKD51

172.67.170.108

31 kB

URL
nwwam9z.iji5hp.ru/jKD51
IP
172.67.170.108:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
31 kB (30948 bytes)
Hash
221af48d66c591ddde7dcadd7ce958af
8592d8a411e64bc4163098fc9d1d7bf9ede22814
57f07f7ab9a42fd2407a423da17b2383525f4ba11c2aaeb3f5c0ff1e11a82c8d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /jKD51 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 03 Oct 2023 13:48:45 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SEz1rHJ%2FJhmTEVULofxqwafxlO1b0Q4u5WIQe%2F2usIcqWotLPTWH%2FuIPCcLcKkRJ6Kdy%2BP72PgUCbzy79YJRFcLqnUO4wIveWjqfClbiT1%2BDVZdkfnj3QzF8El%2BZSSBsZgBXIw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8105a4f4fb1eb52d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-bold.woff2

172.67.170.108

200 OK

28 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-bold.woff2
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28000, version 1.66\012- data
Size
28 kB (28000 bytes)
Hash
a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f

HTTP Headers

GET /web3/assets/fonts/GDSherpa-bold.woff2 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nwwam9z.iji5hp.ru/jKD51
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:46 GMT
content-type: font/woff2
content-length: 28000
last-modified: Fri, 25 Aug 2023 04:00:16 GMT
etag: "6d60-603b761e42cdb"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7974
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ddGXBw3kiwGBdOe3ZqtcGwS0eCqFOkzAzuIUV0f5RI1KuNprMlBLHnBDm2jmT%2FZ7qMQhVv8OqOb4xTsQ%2B%2B5g6%2BmCJeVOqAKGbBSq1HEN%2FcKALcUIFXL%2Bgd3q73zwErz2UxH8ZtVjfZtrAHQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a50898d5b50b-OSL

nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-bold.woff

172.67.170.108

200 OK

36 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-bold.woff
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
Web Open Font Format, TrueType, length 35970, version 1.0\012- data
Size
36 kB (35970 bytes)
Hash
496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

HTTP Headers

GET /web3/assets/fonts/GDSherpa-bold.woff HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nwwam9z.iji5hp.ru/jKD51
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:46 GMT
content-type: font/woff
content-length: 35970
last-modified: Fri, 25 Aug 2023 04:00:22 GMT
etag: "8c82-603b7623b006b"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7974
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qv2ZHT88%2Fe6n0x31ctDEX0GG53IFggX2z0h%2BJPFghwhymjK4FRueRxZbZpEaWKYTTyS7Ajftbpj%2F%2BxqKt%2BO6YMzILLNmlWLx%2F9RDPG3EMdDb2aoSCpGoFHtu2Nkqbc%2FFH4%2BxxfB8AiRVAn4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a50898d6b50b-OSL

nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-regular.woff2

172.67.170.108

200 OK

29 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-regular.woff2
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28584, version 1.66\012- data
Size
29 kB (28584 bytes)
Hash
17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

HTTP Headers

GET /web3/assets/fonts/GDSherpa-regular.woff2 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nwwam9z.iji5hp.ru/jKD51
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:46 GMT
content-type: font/woff2
content-length: 28584
last-modified: Fri, 25 Aug 2023 04:00:25 GMT
etag: "6fa8-603b76269b664"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7973
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FsoFJWPy%2BRwGh2E9sTqS8xU4erhcUN3TP7a1Cxx1SHQxF%2FEP3Xbhizp8BghTl55wB5V85lZKFJfUKC4etc0dpWldeoc2TQcBY5%2Fdfl9bDBRNfx4JAGIP%2BuipBwDv0HBBeaRCJ0lpfq4azgM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a50898d8b50b-OSL

nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-regular.woff

172.67.170.108

200 OK

37 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-regular.woff
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
Web Open Font Format, TrueType, length 36696, version 1.0\012- data
Size
37 kB (36696 bytes)
Hash
a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf

HTTP Headers

GET /web3/assets/fonts/GDSherpa-regular.woff HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nwwam9z.iji5hp.ru/jKD51
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:46 GMT
content-type: font/woff
content-length: 36696
last-modified: Fri, 25 Aug 2023 04:00:28 GMT
etag: "8f58-603b762947b93"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7973
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8LagLsaDImTzLBoXK%2FU3trtANV3FShEWGi9nwi38GATIMu2dKriFWwI%2BY%2FglCMAkyluLUPnvHGBbuK3VFpctpbCbrhfzJSC2csEZvh5JwioYvga22mOONY0Lv3R4PO2WsTFTEEtKeUf0rn8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a50898d9b50b-OSL

nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-vf.woff2

172.67.170.108

200 OK

44 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-vf.woff2
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
Web Open Font Format (Version 2), TrueType, length 43596, version 1.0\012- data
Size
44 kB (43596 bytes)
Hash
2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

HTTP Headers

GET /web3/assets/fonts/GDSherpa-vf.woff2 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nwwam9z.iji5hp.ru/jKD51
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:46 GMT
content-type: font/woff2
content-length: 43596
last-modified: Fri, 25 Aug 2023 04:00:36 GMT
etag: "aa4c-603b7631474f7"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7973
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=77sWzyo7WG61OyS1NwexFWcL9aB5jO3IcZrHPIv0CVIXQXuarGIReKL0zK0OAxqqigaqA%2B6KxpCj2XDFUFjSezqkdnth9DMVaH1%2F2M3Pa1V%2BF8ej%2F8LjT6UlmMffUdO1hyerEGT5aum9Yzs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a50898ddb50b-OSL

nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-vf2.woff2

172.67.170.108

200 OK

93 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/fonts/GDSherpa-vf2.woff2
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
Web Open Font Format (Version 2), TrueType, length 93276, version 1.0\012- data
Size
93 kB (93276 bytes)
Hash
bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

HTTP Headers

GET /web3/assets/fonts/GDSherpa-vf2.woff2 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nwwam9z.iji5hp.ru/jKD51
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:46 GMT
content-type: font/woff2
content-length: 93276
last-modified: Fri, 25 Aug 2023 04:00:32 GMT
etag: "16c5c-603b762dd727e"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7973
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KfBBFPkW8ZfzfE0Dx2zi5PsNtcOzpfrZDY89cXCEhrtcAZYd2r7bZeOPAZFNMFggYsvVVZYqcKFa%2BxobwMTlmhcsghMGmEoLyLv%2B%2BwMrJy20%2BHVzsb%2F4hHA%2Bos2l83TUyveqEviBmWl5iyE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a50898e1b50b-OSL

nwwam9z.iji5hp.ru/web3/assets/css/pages-okta.css?cb=1696340927178

172.67.170.108

200 OK

0 B

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/css/pages-okta.css?cb=1696340927178
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /web3/assets/css/pages-okta.css?cb=1696340927178 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:48 GMT
content-type: text/css
content-length: 0
last-modified: Thu, 24 Aug 2023 12:07:13 GMT
etag: "0-603aa11867866"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m3N9z7MNtu5Wirzbt0iCnSfDWToRWtD0vUzSxsleCMQYEHBNQ9Pd0i5U5IRrEgQnWwx7dIzrb%2FcVXTx%2Ba8wameuHDtQF5R5A8Y%2F1HuHClZF5Z0d%2BktGaJ8TFANbdRxdIIks4g%2BnhIPRs7zU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a50888d3b50b-OSL

nwwam9z.iji5hp.ru/web3/assets/js/pages-head-top-web.min.js?cb=1696340925998

172.67.170.108

200 OK

3.4 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/js/pages-head-top-web.min.js?cb=1696340925998
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
ASCII text, with very long lines (817), with CRLF line terminators
Size
3.4 kB (3358 bytes)
Hash
fa1f840915acf78aa9b1ce7ee561fe11
c8941c14af74dbc1bc5edf62643ebd2c9cc7b26d
9ce8f46879aceca12b8bfb09ffc672089640f8801c5a831640a3721eb9586371

HTTP Headers

GET /web3/assets/js/pages-head-top-web.min.js?cb=1696340925998 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:46 GMT
content-type: application/javascript
last-modified: Tue, 26 Sep 2023 09:07:48 GMT
etag: W/"8a1-6063f68a03281"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rquHm%2Fyh6AmUkaJJ69QuH8QBbBY%2FeYmKtC5XS2jyJytlnGKA6hhDPAlW3tzHGcSSsShXyu4QEL2UHsBNXjL4OP9cMRDEOChEzTKMawTYfTy%2F1u9XeaxIT8XXXXL8Ts4hjQSDBCiVceMKEO8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 8105a5011aceb50b-OSL
content-encoding: br

nwwam9z.iji5hp.ru/web3/assets/key.png

172.67.170.108

200 OK

727 B

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/key.png
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Size
727 B (727 bytes)
Hash
839cb0f55c3d2d5c2f740bda95cb2878
93f6fa3a2da8b7184d4b5c5f2065872793370c2e
40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652

HTTP Headers

GET /web3/assets/key.png HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Cookie: XSRF-TOKEN=eyJpdiI6IjBkZlF5cVppWTQvMFQ4dXZrVnNndnc9PSIsInZhbHVlIjoidzluN3dGaVE5cVE0WWJEeHk0d3BBaXR4ZVVBQ0ZQTlhERW5WTG8ydlBIdkJpVzVsRUZVK0lTOWQxQlhFZ1dVZ2tDbGpUWU1xOHBWbG5odkMwdFMyaU1idVZiNW1LazZIS3FJK1FMZzUrcDdzNFNjeWxEV1JUT0o1Wk5DYXhsY1QiLCJtYWMiOiIxNGM5MDg5ODM3N2I5YWVkMmViODRmZDMyMTIxMTIzZWRlM2MwMDU4YmQ5Y2Y2ZDY1YmZhNWM3ZjIwYmE3MTQ0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImprRWhZelZSbTJoSFVhNnIwM3NhUnc9PSIsInZhbHVlIjoiaDBjSjNSUkZaanhEYktvUVZaQ3ViWER3MVorNXZGVndMYmF5bCtFOVBtSEExUGNaMlBjT0EvdXRpNjJLR2lseEJ1Z1ZlT2hTUkRDT1ljcDdSeUR4YWN5Z3RWZVFwRVNNKzNjWThLSjV6b2NmUi9vektqNktuNVV1ak96Wlh5eUkiLCJtYWMiOiJjN2FlYWYxMjNjYzc4YzllNDEyZjk5MjcxZWVlNzQxMWI5YmUzZjQxNGIxZGU2MjczZjVhMTYyNGIyYTk0NzNhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:54 GMT
content-type: image/png
content-length: 727
last-modified: Sun, 19 Mar 2023 15:20:17 GMT
etag: "2d7-5f7425905ae40"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7977
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UcDYKAZQzk3ff9MdRe9OGwx1bNCvmf%2BR6vOpSLFBIYgQH1veKtA6CaaIIAsxS1x8GdAoNy8yBDV%2FKzhVWqsFnXFCgFfoXwAgBGDPEuMLt7jfoC4LAFL1HXMX6Npr%2BjIsk%2FEeF9EcFvgg1sg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a5396ab8b50b-OSL

aadcdn.msftauth.net/shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg

152.199.23.37

200 OK

190 B

URL GET HTTP/2
aadcdn.msftauth.net/shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with no line terminators
Size
190 B (190 bytes)
Hash
40eb39126300b56bf66c20ee75b54093
83678d94097257eb474713dec49e8094f49d2e2a
765709425a5b9209e875dccf2217d3161429d2d48159fc1df7b253b77c1574f4

HTTP Headers

GET /shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 10735167
cache-control: public, max-age=31536000
content-md5: rp+/fadJKxLUo+jgFmYTeQ==
content-type: image/svg+xml
date: Tue, 03 Oct 2023 13:48:54 GMT
etag: 0x8DB5C3F4721247A
last-modified: Wed, 24 May 2023 10:11:44 GMT
server: ECAcc (ska/F697)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: cf4cbdca-101e-0042-0c5d-942f4a000000
x-ms-version: 2009-09-19
content-length: 190
X-Firefox-Spdy: h2

nwwam9z.iji5hp.ru/web2/assets/cloudfavicon.ico

172.67.170.108

200 OK

6.2 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web2/assets/cloudfavicon.ico
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel\012- data
Size
6.2 kB (6219 bytes)
Hash
88415acda09a4cbd9d87543c3ba78180
2dec4705e9ab399efdc6eef36e079aa31d1df8d9
20cccc47c1bac9d2ef36b6a1c58af58c5c169ad5ca084080f0392b86f949641c

HTTP Headers

GET /web2/assets/cloudfavicon.ico HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:45 GMT
content-type: image/x-icon
last-modified: Wed, 16 Aug 2023 15:22:46 GMT
etag: W/"86be-6030bde212b57"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7973
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o0cF%2Fmp7UKKRHLUq8QHs58lsaRYpnuIN4%2BRArk1r5V7ahR8ehjhnPvKM1o25b3HlWU0H3iOa6ALDFHi0zmL1%2B7bVAwhAjc7UGJvI9e96WRitJTPQ9oqUZt%2BTw6ki3AHrcNY2f00pziL14uizvZna5LYLudSlGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 8105a5021be4b50b-OSL
content-encoding: br

aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg

152.199.23.37

200 OK

1.2 kB

URL GET HTTP/2
aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (2905), with no line terminators
Size
1.2 kB (1173 bytes)
Hash
fe87496cc7a44412f7893a72099c120a
a0c1458c08a815df63d3cb0406d60be6607ca699
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1

HTTP Headers

GET /shared/1.0/content/images/picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 10172826
cache-control: public, max-age=31536000
content-md5: XHrPYKKsqlxUvysuxtSE2A==
content-type: image/svg+xml
date: Tue, 03 Oct 2023 13:48:54 GMT
etag: 0x8DB5C3F4A98E9BB
last-modified: Wed, 24 May 2023 10:11:50 GMT
server: ECAcc (ska/F6F3)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 3afb7c4b-e01e-0039-1e7a-99c6de000000
x-ms-version: 2009-09-19
content-length: 1173
X-Firefox-Spdy: h2

logincdn.msauth.net/shared/1.0/content/images/picker_verify_email_958962caa7cf6b75cd412e9e3b687b22.svg

192.229.221.185

200 OK

212 B

URL GET HTTP/2
logincdn.msauth.net/shared/1.0/content/images/picker_verify_email_958962caa7cf6b75cd412e9e3b687b22.svg
IP
192.229.221.185:443
ASN
#15133 EDGECAST

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerMicrosoft Corporation
Subjectidentitycdn.msauth.net
Fingerprint7E:49:E0:7F:53:0A:55:E1:C7:51:9E:26:2E:16:15:30:F1:F6:FB:0A
ValidityThu, 10 Aug 2023 19:09:28 GMT - Thu, 27 Jun 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with no line terminators
Size
212 B (212 bytes)
Hash
59759b80e24a89c8cd029b14700e646d
651b1921c99e143d3c242de3faacfb9ad51dbb53
b02b5df3ecd59d6cd90c60878683477532cbfc24660028657f290bdc7bc774b5

HTTP Headers

GET /shared/1.0/content/images/picker_verify_email_958962caa7cf6b75cd412e9e3b687b22.svg HTTP/1.1
Host: logincdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 10176360
cache-control: public, max-age=31536000
content-md5: pFQUXilUkzYtIbvSwGgVBQ==
content-type: image/svg+xml
date: Tue, 03 Oct 2023 13:48:54 GMT
etag: 0x8DB5C409F549E50
last-modified: Wed, 24 May 2023 10:21:22 GMT
server: ECAcc (ska/F7AD)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: e6e3cc87-601e-0079-1c72-993a7c000000
x-ms-version: 2009-09-19
content-length: 212
X-Firefox-Spdy: h2

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/9DKbiDfWH6ZjHxgSNTG3KHa3ucVmP6rj9MHN3bQn2+U=

104.17.3.184

30 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/9DKbiDfWH6ZjHxgSNTG3KHa3ucVmP6rj9MHN3bQn2+U=
IP
104.17.3.184:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced\012- data
Size
30 kB (29857 bytes)
Hash
12a4789fa26da41f04908cbef836de2a
70a1836376fd2924b09fdd31dd61694e7c028dc9
5215237cec6557d5c064450849b3236fef67f13f758c87592bd29788b1d363af

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/cmg/1/9DKbiDfWH6ZjHxgSNTG3KHa3ucVmP6rj9MHN3bQn2+U= HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hl2ov/0x4AAAAAAALDdS9IWBRIR26Y/auto/normal
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:50 GMT
content-type: image/png
cache-control: max-age=2629800, public
server: cloudflare
cf-ray: 8105a5209c2056a2-OSL
alt-svc: h3=":443"; ma=86400

nwwam9z.iji5hp.ru/web3/assets/css/pages.min.css?cb=1696340927178

172.67.170.108

200 OK

75 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/css/pages.min.css?cb=1696340927178
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
ASCII text, with very long lines (17002), with no line terminators
Size
75 kB (74895 bytes)
Hash
68dd1bcccde5656be56122a5370bbb98
18d1618561916e13668295570a157c32acd9e1f5
bd5a242e3cd9e703a92c7d2667e8f78a3ba2c97cbd04237665782034e4760ed3

HTTP Headers

GET /web3/assets/css/pages.min.css?cb=1696340927178 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:48 GMT
content-type: text/css
last-modified: Thu, 21 Sep 2023 16:09:25 GMT
etag: W/"426a-605e0b73dd2ad"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a2M%2F2n7jUmvHBfs8fHDEXXcp753eHQQKBzHvhHcQPcruMnBB8r33rib9lb%2FhJy4OEJxTlADgkb5SAIBigKQj5E60%2B9LO0rL4QIEZABZrtkTVefBeUUu7uCJa4BZ0ID%2Fs3I2mqMVMquhxMvI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 8105a50888c6b50b-OSL
content-encoding: br

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1893294855:1696338640:F6BwRzJBQPCVYxhFYafvgS25hYWn0XsPSb9JiLCHWMk/8105a5200bad56a2/38fa88179446ddf

104.17.3.184

120 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1893294855:1696338640:F6BwRzJBQPCVYxhFYafvgS25hYWn0XsPSb9JiLCHWMk/8105a5200bad56a2/38fa88179446ddf
IP
104.17.3.184:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (65536), with no line terminators
Size
120 kB (119592 bytes)
Hash
38d6e7afd138f5597d355db99517c73c
8b61ae0a21958c3c9ff6654481597767832ca5f8
f3b0bcf082503d8001763e7a499ad0e8aec41f1754c3d4542015da857e94c787

HTTP Headers

POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1893294855:1696338640:F6BwRzJBQPCVYxhFYafvgS25hYWn0XsPSb9JiLCHWMk/8105a5200bad56a2/38fa88179446ddf HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hl2ov/0x4AAAAAAALDdS9IWBRIR26Y/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 38fa88179446ddf
Content-Length: 2322
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:51 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: pmtiXfEc9fguFdefF47LIsS1Nq6vWqwTZF3zbLb+fQ3837giAU/SbWdrgZgsALwc46CVi/sxv5HOzjroWRFt09a9zvWIfT/l6OeWrODtO7wLG5t1I4FpxBApPOj+wiEqylELUqtTkDDKJnKzvYG7udoU8Ypg3sn0+ESbn1aRdr9uQxM6ax9zYyYr7xHm/V+yCwAD8iR4SLn6oMZp5rAosFhm1f7m0k/RtjPfqucpsBayardMOC6TOrwL/k/tuA3scrVkSv+CNvosIwXje/ilrJFZafnqA7o9vuTYfNr0thpqyiy/szhvkAO1HV66tmP1LKtBqlaVUePGZM8faA/jtSpfI61ZOayxODbFYyeD5Fr/eeyUcnDUJHpHtjxgX0XkmbEZelzopGG8ITPHme8lsrjQiYyOncBqsj9Ot86NMCOBxDQ6H3yJMD9jk0hkm1iMTQtWvEQOumwYOYaqieK0sUJwEH0QqwMcZYYezY6ucEyUIchaLKBlGsW0A+3LooWSpyBM5oYuzjpQK8kjNJrSosc1zl0bitk62AJSQ1WVxKE=$19l14rzwr5DiqTN6dQw7Cg==
server: cloudflare
cf-ray: 8105a522be7156a2-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

nwwam9z.iji5hp.ru/web3/assets/officelogo.png

172.67.170.108

200 OK

1.4 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/officelogo.png
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size
1.4 kB (1400 bytes)
Hash
333ee830e5ab72c41dd9126a27b4d878
12d8d66ebb3076f3d6069e133c3212f97c8774e1
8702292cbc365e9f0488143e2b309b85efe09c61fd2e0a2e21c53735a309313c

HTTP Headers

GET /web3/assets/officelogo.png HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/web3/assets/pages/mcum393n9.css?cb=1696340927178
Cookie: XSRF-TOKEN=eyJpdiI6IjBkZlF5cVppWTQvMFQ4dXZrVnNndnc9PSIsInZhbHVlIjoidzluN3dGaVE5cVE0WWJEeHk0d3BBaXR4ZVVBQ0ZQTlhERW5WTG8ydlBIdkJpVzVsRUZVK0lTOWQxQlhFZ1dVZ2tDbGpUWU1xOHBWbG5odkMwdFMyaU1idVZiNW1LazZIS3FJK1FMZzUrcDdzNFNjeWxEV1JUT0o1Wk5DYXhsY1QiLCJtYWMiOiIxNGM5MDg5ODM3N2I5YWVkMmViODRmZDMyMTIxMTIzZWRlM2MwMDU4YmQ5Y2Y2ZDY1YmZhNWM3ZjIwYmE3MTQ0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImprRWhZelZSbTJoSFVhNnIwM3NhUnc9PSIsInZhbHVlIjoiaDBjSjNSUkZaanhEYktvUVZaQ3ViWER3MVorNXZGVndMYmF5bCtFOVBtSEExUGNaMlBjT0EvdXRpNjJLR2lseEJ1Z1ZlT2hTUkRDT1ljcDdSeUR4YWN5Z3RWZVFwRVNNKzNjWThLSjV6b2NmUi9vektqNktuNVV1ak96Wlh5eUkiLCJtYWMiOiJjN2FlYWYxMjNjYzc4YzllNDEyZjk5MjcxZWVlNzQxMWI5YmUzZjQxNGIxZGU2MjczZjVhMTYyNGIyYTk0NzNhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:55 GMT
content-type: image/png
content-length: 1400
last-modified: Sun, 19 Mar 2023 15:20:17 GMT
etag: "578-5f7425905ae40"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7978
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LejVnGbxWVy8pY9zF2uQGtvcbp6f1Hfy%2BFlMBru2Wm88f4GxKEcVzhkeWnPrTbkVJEviejr4BjD584HZWIuEV30A38CCyV37wflE56My73zfOfhCYCDSm9ZTk3VFbMf7d3TMaklUMCKDGhs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a53bcc8eb50b-OSL

aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg

13.107.213.53

200 OK

673 B

URL GET HTTP/2
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
IP
13.107.213.53:443
ASN
#8068 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint44:5F:75:46:1C:BE:AF:E4:F2:BF:F3:04:1D:0B:56:0F:EE:DA:A0:96
ValiditySat, 29 Jul 2023 00:00:00 GMT - Mon, 29 Jul 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1864), with no line terminators
Size
673 B (673 bytes)
Hash
bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

HTTP Headers

GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: public, max-age=31536000
content-length: 673
content-type: image/svg+xml
content-encoding: gzip
content-md5: DhdidjYrlCeaRJJRG/y9mA==
last-modified: Wed, 24 May 2023 10:11:46 GMT
etag: 0x8DB5C3F47E260FD
x-cache: TCP_HIT
x-ms-request-id: c3a8794e-901e-0056-7a46-eeae4c000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0tSoRZQAAAAAwCmjQvNnvTp3JZcxN+wkjQU1TMDRFREdFMTkxMQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 0xxscZQAAAABKYNDFejg7RpTsI1zkVzh9U1ZHMjBFREdFMDYxMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Tue, 03 Oct 2023 13:48:54 GMT
X-Firefox-Spdy: h2

adfs.heart.org/adfs/portal/logo/logo.png

69.152.183.140

200 OK

6.4 kB

URL GET HTTP/1.1
adfs.heart.org/adfs/portal/logo/logo.png
IP
69.152.183.140:443
ASN
#7018 ATT-INTERNET4

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerSectigo Limited
Subjectadfs.heart.org
Fingerprint11:D1:74:EB:5A:DF:CB:58:DE:8A:EE:06:70:FD:78:6D:A5:F4:22:58
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
PNG image data, 260 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
6.4 kB (6428 bytes)
Hash
d3f69be16baf7acef2e7f4dd03729866
e11aa0084b93253a24dd3ed57ddde66d27c84d2b
3a5eeea11e1041db96b81498ab69c050dd045d9e56c69e19bd98430ba752165f

HTTP Headers

GET /adfs/portal/logo/logo.png HTTP/1.1
Host: adfs.heart.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 6428
Content-Type: image/png
Expires: Thu, 02 Nov 2023 13:48:55 GMT
ETag: 3A5EEEA11E1041DB96B81498AB69C050DD045D9E56C69E19BD98430BA752165F
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Strict-Transport-Security: max-age = 31536000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Date: Tue, 03 Oct 2023 13:48:55 GMT

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hl2ov/0x4AAAAAAALDdS9IWBRIR26Y/auto/normal

0.0.0.0

0 B

URL GET
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hl2ov/0x4AAAAAAALDdS9IWBRIR26Y/auto/normal
IP
0.0.0.0:0
ASN
#0

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hl2ov/0x4AAAAAAALDdS9IWBRIR26Y/auto/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

challenges.cloudflare.com/turnstile/v0/g/dffb14d6/api.js?render=explicit

104.17.3.184

200 OK

34 kB

URL GET HTTP/3
challenges.cloudflare.com/turnstile/v0/g/dffb14d6/api.js?render=explicit
IP
104.17.3.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
ASCII text, with very long lines (33998)
Size
34 kB (33999 bytes)
Hash
cc3e43876d80dbb4f1bff1e8b15a9c60
3b43cbd347df372f7c1daf463b1229e4a8849195
06d063d7e58bade3ae244489087afa82f9f7c59276cdd7dcfbb2a9b5b600c5da

HTTP Headers

GET /turnstile/v0/g/dffb14d6/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nwwam9z.iji5hp.ru/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:45 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 8105a4ff9cef56a2-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

nwwam9z.iji5hp.ru/web3/assets/css/pages-godaddy.css?cb=1696340927178

172.67.170.108

200 OK

38 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/css/pages-godaddy.css?cb=1696340927178
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
ASCII text, with very long lines (1632), with CRLF line terminators
Size
38 kB (38536 bytes)
Hash
362e1251222d2b83e2f795eb75e641df
b4308285d6b6ee7368dc2f98d7fb7f2c152bdf87
cc084d22c8995e0d4f9ecb29b7e942bae434073f052182bf21038a585b89cfd4

HTTP Headers

GET /web3/assets/css/pages-godaddy.css?cb=1696340927178 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:48 GMT
content-type: text/css
last-modified: Tue, 26 Sep 2023 08:42:47 GMT
etag: W/"9688-6063f0f2903b0"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QgUWNo2ltYeOKhNE1W%2FIvRRToFQ5PFVJBJitkzHneVHSC%2BadwShR9As2uvLfCXELg5dZ5tfwPrUDG5U7XNQ99fd8sDtfWwndSEjSCe3WvE%2BkPLHhkKNGcA0MZvpuWuUJ1u5lJVnmNKwCiyc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 8105a50888cfb50b-OSL
content-encoding: br

nwwam9z.iji5hp.ru/web3/assets/back.png

172.67.170.108

200 OK

231 B

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/back.png
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size
231 B (231 bytes)
Hash
547988bac5584b4608466d761e16f370
c11bb71049702528402a31027f200184910a7e23
70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4

HTTP Headers

GET /web3/assets/back.png HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Cookie: XSRF-TOKEN=eyJpdiI6IjBkZlF5cVppWTQvMFQ4dXZrVnNndnc9PSIsInZhbHVlIjoidzluN3dGaVE5cVE0WWJEeHk0d3BBaXR4ZVVBQ0ZQTlhERW5WTG8ydlBIdkJpVzVsRUZVK0lTOWQxQlhFZ1dVZ2tDbGpUWU1xOHBWbG5odkMwdFMyaU1idVZiNW1LazZIS3FJK1FMZzUrcDdzNFNjeWxEV1JUT0o1Wk5DYXhsY1QiLCJtYWMiOiIxNGM5MDg5ODM3N2I5YWVkMmViODRmZDMyMTIxMTIzZWRlM2MwMDU4YmQ5Y2Y2ZDY1YmZhNWM3ZjIwYmE3MTQ0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImprRWhZelZSbTJoSFVhNnIwM3NhUnc9PSIsInZhbHVlIjoiaDBjSjNSUkZaanhEYktvUVZaQ3ViWER3MVorNXZGVndMYmF5bCtFOVBtSEExUGNaMlBjT0EvdXRpNjJLR2lseEJ1Z1ZlT2hTUkRDT1ljcDdSeUR4YWN5Z3RWZVFwRVNNKzNjWThLSjV6b2NmUi9vektqNktuNVV1ak96Wlh5eUkiLCJtYWMiOiJjN2FlYWYxMjNjYzc4YzllNDEyZjk5MjcxZWVlNzQxMWI5YmUzZjQxNGIxZGU2MjczZjVhMTYyNGIyYTk0NzNhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:54 GMT
content-type: image/png
content-length: 231
last-modified: Sun, 19 Mar 2023 15:20:17 GMT
etag: "e7-5f7425905ae40"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7977
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pS4ui0k5nmo48qKg0ccL2aXbWjDviX9tuOcNy4ooH%2Bz4KQ4YPKTzVYlIrYcVX3ecmIvgX6ZhhyzVTP6F5vfkFrGozl6eP78r04Ee1Hw9Rk%2FtYX%2BR3ChyrSHtdcc%2Bfx5kXd0gbkVrIYCJsus%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a5396ab5b50b-OSL

nwwam9z.iji5hp.ru/web3/assets/godaddy-logo.png

172.67.170.108

200 OK

50 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/godaddy-logo.png
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced\012- data
Size
50 kB (49602 bytes)
Hash
db783743cd246ff4d77f4a3694285989
b9466716904457641b7831868b47162d8d378d41
5913b1ec0fc58ab2bec576804b9e9b566a584ea3d21a1bf74a7b40051a447fdc

HTTP Headers

GET /web3/assets/godaddy-logo.png HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Cookie: XSRF-TOKEN=eyJpdiI6IjBkZlF5cVppWTQvMFQ4dXZrVnNndnc9PSIsInZhbHVlIjoidzluN3dGaVE5cVE0WWJEeHk0d3BBaXR4ZVVBQ0ZQTlhERW5WTG8ydlBIdkJpVzVsRUZVK0lTOWQxQlhFZ1dVZ2tDbGpUWU1xOHBWbG5odkMwdFMyaU1idVZiNW1LazZIS3FJK1FMZzUrcDdzNFNjeWxEV1JUT0o1Wk5DYXhsY1QiLCJtYWMiOiIxNGM5MDg5ODM3N2I5YWVkMmViODRmZDMyMTIxMTIzZWRlM2MwMDU4YmQ5Y2Y2ZDY1YmZhNWM3ZjIwYmE3MTQ0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImprRWhZelZSbTJoSFVhNnIwM3NhUnc9PSIsInZhbHVlIjoiaDBjSjNSUkZaanhEYktvUVZaQ3ViWER3MVorNXZGVndMYmF5bCtFOVBtSEExUGNaMlBjT0EvdXRpNjJLR2lseEJ1Z1ZlT2hTUkRDT1ljcDdSeUR4YWN5Z3RWZVFwRVNNKzNjWThLSjV6b2NmUi9vektqNktuNVV1ak96Wlh5eUkiLCJtYWMiOiJjN2FlYWYxMjNjYzc4YzllNDEyZjk5MjcxZWVlNzQxMWI5YmUzZjQxNGIxZGU2MjczZjVhMTYyNGIyYTk0NzNhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:54 GMT
content-type: image/png
content-length: 49602
last-modified: Thu, 24 Aug 2023 13:40:53 GMT
etag: "c1c2-603ab607e0f57"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7977
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pq0Amgl5MeqVbLoAnok9RF1tJYdTazXUlVs568THi5lABMayXSD8%2FpG7jUePl6Rv6A2M4Zbr6Dd2d%2BBKBY%2BLhw51WQ7vPrLW6BwBR1KU%2Bwk8WScxhrghozm6imOJch14p927E6bUEkjp0Hs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a53b8c42b50b-OSL

nwwam9z.iji5hp.ru/jKD51

172.67.170.108

200 OK

103 B

URL User Request GET HTTP/2
nwwam9z.iji5hp.ru/jKD51
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
HTML document text\012- HTML document, ASCII text, with no line terminators
Size
103 B (103 bytes)
Hash
9f1ccff9a701e4926efc0ab5ab2d8209
b405b0fcdade3c450f4197a873ad99209b3d8030
7cce470b4f2b52f1ee96aa91730948cf13fce6fc5182a97a5e6d5a36ee59e584

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /jKD51 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 03 Oct 2023 13:48:45 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SEz1rHJ%2FJhmTEVULofxqwafxlO1b0Q4u5WIQe%2F2usIcqWotLPTWH%2FuIPCcLcKkRJ6Kdy%2BP72PgUCbzy79YJRFcLqnUO4wIveWjqfClbiT1%2BDVZdkfnj3QzF8El%2BZSSBsZgBXIw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8105a4f4fb1eb52d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

nwwam9z.iji5hp.ru/web3/info

172.67.170.108

200 OK

156 B

URL POST HTTP/3
nwwam9z.iji5hp.ru/web3/info
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
156 B (156 bytes)
Hash
65c76a3356e60a4aa47e6de5324a140e
e43352d3598d2a452dcb8fda2e533c1179172319
e9d427933be7e2d1cd8fe3fa06aaf31cc79a947bceea188572867e3274326895

HTTP Headers

POST /web3/info HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 25
Origin: https://nwwam9z.iji5hp.ru
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:50 GMT
content-type: application/json
x-powered-by: PHP/8.1.10
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rDfWYzzPRAFFg4FIl5WUDZRWpJsTCrGF9wcNjj7385PyOLwvGg1qpFll0NFXAaQ0ok9xKY8wl1TJtJobYS%2B5Tav6fW7cG8FNP2e0VyP%2BKT39uQw8lCVfMQYN4PklryFs1dJoPfqW7I64%2FJE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6Img2bzZYNVZIWEVLTlJDS0lkVU0vbnc9PSIsInZhbHVlIjoiYTdZMmI4bFNsUGI4TXR2ZUdzZVV1SDRHZ1d0OW40RFhYb3RBaDlEY0lkR2FpZXJ5d1Q3WUFmeE1UUk5odkFvbU04VmlsSzgwUkpyU3NCUzBDVnRiMFNaZENmNW1hTmNqQU9WektsYmEwcWREMElTanZNZHdLM2xtZGVGcEhVOFQiLCJtYWMiOiI1YjYwMDEwZDJhOWJiNWQ5Nzk1NDg4Y2ZiNmE3Mzc3M2QwZWY1ZGE2ZTlkOWE2MjlhZGJiMGQxZjhlMmY0YmU2IiwidGFnIjoiIn0%3D; expires=Tue, 03-Oct-2023 15:48:50 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6ImhBSlo5cC9sdWhyS2hFRmI5UHBxUHc9PSIsInZhbHVlIjoiWlV1SitFQkdYZ1lMNTBoSExDaHQxNFBYTjJEZkpGYnpyWkNRK3dxaWU4NTl5WGlCWldGaG9WSERrZVJobytKZzNNcUxldHozcFNya21Ka2hLaHl3d3pMMkZjZDYybXV3ZlJNMnRDRTVqZjlnQW1KSXQ3WmUvaFpLY1JCSXBUMHciLCJtYWMiOiJjZmU5YjBiZmViZTg2MmY3ODEwMDY2NWU4MjVlZDAwODRiOGQyMGYwYzAxYzNhNDc2NjAxN2Y4YmYzZWIxM2VjIiwidGFnIjoiIn0%3D; expires=Tue, 03-Oct-2023 15:48:50 GMT; Max-Age=7200; path=/; httponly; samesite=lax
server: cloudflare
cf-ray: 8105a512a958b50b-OSL
content-encoding: br

aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg

152.199.23.37

200 OK

7.4 kB

URL GET HTTP/2
aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (7438), with no line terminators
Size
7.4 kB (7390 bytes)
Hash
bca9b46fee32162356ba5b4783e614dc
cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5
fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec

HTTP Headers

GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 10741631
cache-control: public, max-age=31536000
content-md5: nTculR1Fom7eLci0F6rk+A==
content-type: image/svg+xml
date: Tue, 03 Oct 2023 13:48:54 GMT
etag: 0x8DB5C3F4ADC079A
last-modified: Wed, 24 May 2023 10:11:51 GMT
server: ECAcc (ska/F7B6)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 9d35d246-701e-009b-604e-944da7000000
x-ms-version: 2009-09-19
content-length: 2407
X-Firefox-Spdy: h2

nwwam9z.iji5hp.ru/myscr112471.js

172.67.170.108

200 OK

26 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/myscr112471.js
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
ASCII text
Size
26 kB (26217 bytes)
Hash
f7c2b4e41b99a2aff8842a091ecf9f47
d17fd0adde19956fcf4d55b19d3ca578715b65d2
6cc929d460c735df5b05d377a36153f9ba47f864080ad710e36e12815d45626b

HTTP Headers

GET /myscr112471.js HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:45 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 20:39:31 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 745
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qTHqONaQRwncBY72mWgmdmOVbA4jwwaZLicc2QYCRQy0nNaBiTZbjnXn1LY4MK1DfO2G5ELsWvZ%2BmAHNALtQ5Q7EEk0LakwR%2FDiEqvdf00vEeO93xdOYejg3WYEr1zGNroeh5w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8105a4fec869b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

nwwam9z.iji5hp.ru/web3/assets/js/pages.js?cb=1696340927178

172.67.170.108

200 OK

81 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/js/pages.js?cb=1696340927178
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type

Size
81 kB (80770 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /web3/assets/js/pages.js?cb=1696340927178 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Cookie: XSRF-TOKEN=eyJpdiI6IjBkZlF5cVppWTQvMFQ4dXZrVnNndnc9PSIsInZhbHVlIjoidzluN3dGaVE5cVE0WWJEeHk0d3BBaXR4ZVVBQ0ZQTlhERW5WTG8ydlBIdkJpVzVsRUZVK0lTOWQxQlhFZ1dVZ2tDbGpUWU1xOHBWbG5odkMwdFMyaU1idVZiNW1LazZIS3FJK1FMZzUrcDdzNFNjeWxEV1JUT0o1Wk5DYXhsY1QiLCJtYWMiOiIxNGM5MDg5ODM3N2I5YWVkMmViODRmZDMyMTIxMTIzZWRlM2MwMDU4YmQ5Y2Y2ZDY1YmZhNWM3ZjIwYmE3MTQ0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImprRWhZelZSbTJoSFVhNnIwM3NhUnc9PSIsInZhbHVlIjoiaDBjSjNSUkZaanhEYktvUVZaQ3ViWER3MVorNXZGVndMYmF5bCtFOVBtSEExUGNaMlBjT0EvdXRpNjJLR2lseEJ1Z1ZlT2hTUkRDT1ljcDdSeUR4YWN5Z3RWZVFwRVNNKzNjWThLSjV6b2NmUi9vektqNktuNVV1ak96Wlh5eUkiLCJtYWMiOiJjN2FlYWYxMjNjYzc4YzllNDEyZjk5MjcxZWVlNzQxMWI5YmUzZjQxNGIxZGU2MjczZjVhMTYyNGIyYTk0NzNhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:56 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 20:22:34 GMT
etag: W/"13b82-60634b7f30722"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YdofrgWAfiQOLSGqQqX%2BVq4ZifMheo3HO5eEYcHJPPCSa98FgHdgHZPGKRhqQJWEwroSaa1%2FYxUtIcRvjZpIK5IHKU0NNO7WEOVc0tofsBCSZ2ZrJOh64XiIjcZ6YYygAHYsC9jpgNQwePU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 8105a53b9c4eb50b-OSL
content-encoding: br

nwwam9z.iji5hp.ru/web3/assets/pages/mcum393n9.css?cb=1696340927178

172.67.170.108

200 OK

1.1 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/pages/mcum393n9.css?cb=1696340927178
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
ASCII text, with very long lines (1164), with no line terminators
Size
1.1 kB (1121 bytes)
Hash
8df051d96dc42dcf512865e1ecf2772c
22a58ecb19edbcc1aec5b108de92b114a3dddbb9
37e27bca08d0a35b7e24e859e726d5bc662b12d7d41a5318f60734def264037d

HTTP Headers

GET /web3/assets/pages/mcum393n9.css?cb=1696340927178 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:48 GMT
content-type: text/css
last-modified: Mon, 02 Oct 2023 21:58:17 GMT
etag: W/"461-606c2df24fd85"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yAW%2F21h28pa5vWIcY%2FBo3eEoSQkym%2Bja5DQTp7%2B29FroKtCpEFCJ0jXv34frDZFnyt7JT3EZv6%2FEcyHnDZCjwcQ24i%2FMO0TXJNzbPprHa71WJ3Qc6r6xM0jqqQFEN7p%2Fax8ero5rufv3u0A%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 8105a50868acb50b-OSL
content-encoding: br

code.jquery.com/jquery-3.6.0.min.js

151.101.2.137

200 OK

90 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.2.137:443
ASN
#54113 FASTLY

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65447)
Size
90 kB (89501 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 03 Oct 2023 13:48:45 GMT
age: 1102825
x-served-by: cache-lga21931-LGA, cache-bma1675-BMA
x-cache: HIT, HIT
x-cache-hits: 30, 304413
x-timer: S1696340925.367481,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

challenges.cloudflare.com/turnstile/v0/api.js?render=explicit

104.17.3.184

302 Found

34 kB

URL GET HTTP/2
challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
IP
104.17.3.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type

Size
34 kB (33999 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Tue, 03 Oct 2023 13:48:45 GMT
access-control-allow-origin: *
cache-control: max-age=300, public
vary: accept-encoding
location: /turnstile/v0/g/dffb14d6/api.js?render=explicit
server: cloudflare
cf-ray: 8105a4ff6edc569b-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

nwwam9z.iji5hp.ru/web3/validatecaptcha

172.67.170.108

200 OK

20 B

URL POST HTTP/3
nwwam9z.iji5hp.ru/web3/validatecaptcha
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
20 B (20 bytes)
Hash
0b35866f4a3aa4d34ce5dda2d14c2cd8
d2b80911f09c3106fdf0df9920f983945d644083
493851374626d927bfe1c7d084fa977a0e636c03f163fda258ab6b638edc2f0d

HTTP Headers

POST /web3/validatecaptcha HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 565
Origin: https://nwwam9z.iji5hp.ru
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Cookie: XSRF-TOKEN=eyJpdiI6Img2bzZYNVZIWEVLTlJDS0lkVU0vbnc9PSIsInZhbHVlIjoiYTdZMmI4bFNsUGI4TXR2ZUdzZVV1SDRHZ1d0OW40RFhYb3RBaDlEY0lkR2FpZXJ5d1Q3WUFmeE1UUk5odkFvbU04VmlsSzgwUkpyU3NCUzBDVnRiMFNaZENmNW1hTmNqQU9WektsYmEwcWREMElTanZNZHdLM2xtZGVGcEhVOFQiLCJtYWMiOiI1YjYwMDEwZDJhOWJiNWQ5Nzk1NDg4Y2ZiNmE3Mzc3M2QwZWY1ZGE2ZTlkOWE2MjlhZGJiMGQxZjhlMmY0YmU2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImhBSlo5cC9sdWhyS2hFRmI5UHBxUHc9PSIsInZhbHVlIjoiWlV1SitFQkdYZ1lMNTBoSExDaHQxNFBYTjJEZkpGYnpyWkNRK3dxaWU4NTl5WGlCWldGaG9WSERrZVJobytKZzNNcUxldHozcFNya21Ka2hLaHl3d3pMMkZjZDYybXV3ZlJNMnRDRTVqZjlnQW1KSXQ3WmUvaFpLY1JCSXBUMHciLCJtYWMiOiJjZmU5YjBiZmViZTg2MmY3ODEwMDY2NWU4MjVlZDAwODRiOGQyMGYwYzAxYzNhNDc2NjAxN2Y4YmYzZWIxM2VjIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:54 GMT
content-type: application/json
x-powered-by: PHP/8.1.10
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oU28stsNdPq2UC2K0y%2BJ%2F3X4rbAQgqR29tcqQ2%2Fu5gsDZ3WEb4tlkt6%2F6YE5gvQRBuEBdtbQoXdi3W49v6Nt5WvHCSoUV3fXOM2tjAb2FidopTuN99M04hLkdQhkuz%2FzC%2FJrW%2BpwOE9ypKg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IlhSSVFCZWo5SmJKUDNLbEVPZVE5anc9PSIsInZhbHVlIjoieWJlWHhUd1VCQzd6bFJvUWk4enk5L1N0dW5OMkp0VnFpUlNEd1N3blFmdW9wMUMzTEFGVGUzNUVpaTdnVnYrQUhCV0k0MDRDZzQ5aDBHS1FPOFd5aUFoc2hqbDBEOHl4WnlwUnFQK0dSVVJDWDNNUVdBSkxuWjdONTFYYlRBbHUiLCJtYWMiOiI3YTliZTdiNDdjYWE0MTEyOGRhMjYyZGVhZTY1NmVjOTViZWRhMTZjMDRhYTc0NTM3ZjliYTBhNzc0NGE5Mjg2IiwidGFnIjoiIn0%3D; expires=Tue, 03-Oct-2023 15:48:54 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6InVRK0FHMXhLK2NkbzhydTV0S3M5aGc9PSIsInZhbHVlIjoiUDNuUlFGOHVnQjVzKzlvNVM5Ynk0ZlNWVFkrTzQvaHRiWkdtc2dGNmlsemh2Q1UyMDQwUEZmUXIvdVhQcGczUzhGcWZEV09vWGtSSmpUbjM5TENuOS8yZktIZmJ5VEhuVnhycXpXeFlkUVJNU2FIYmhWT25nVEk1NzFWU3ZESTgiLCJtYWMiOiIyNDFmYzRiOGU0ODViYmQ2OGJiMjc1YzJkM2IwZjg1OGZlNWMzYzQxYzEwM2Y0ODIzZTc4NzMzNTlkMTcwNTUwIiwidGFnIjoiIn0%3D; expires=Tue, 03-Oct-2023 15:48:54 GMT; Max-Age=7200; path=/; httponly; samesite=lax
server: cloudflare
cf-ray: 8105a531dc22b50b-OSL
content-encoding: br

nwwam9z.iji5hp.ru/web3/info

172.67.170.108

200 OK

33 kB

URL POST HTTP/3
nwwam9z.iji5hp.ru/web3/info
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type

Size
33 kB (33141 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /web3/info HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 26
Origin: https://nwwam9z.iji5hp.ru
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Cookie: XSRF-TOKEN=eyJpdiI6IlhSSVFCZWo5SmJKUDNLbEVPZVE5anc9PSIsInZhbHVlIjoieWJlWHhUd1VCQzd6bFJvUWk4enk5L1N0dW5OMkp0VnFpUlNEd1N3blFmdW9wMUMzTEFGVGUzNUVpaTdnVnYrQUhCV0k0MDRDZzQ5aDBHS1FPOFd5aUFoc2hqbDBEOHl4WnlwUnFQK0dSVVJDWDNNUVdBSkxuWjdONTFYYlRBbHUiLCJtYWMiOiI3YTliZTdiNDdjYWE0MTEyOGRhMjYyZGVhZTY1NmVjOTViZWRhMTZjMDRhYTc0NTM3ZjliYTBhNzc0NGE5Mjg2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InVRK0FHMXhLK2NkbzhydTV0S3M5aGc9PSIsInZhbHVlIjoiUDNuUlFGOHVnQjVzKzlvNVM5Ynk0ZlNWVFkrTzQvaHRiWkdtc2dGNmlsemh2Q1UyMDQwUEZmUXIvdVhQcGczUzhGcWZEV09vWGtSSmpUbjM5TENuOS8yZktIZmJ5VEhuVnhycXpXeFlkUVJNU2FIYmhWT25nVEk1NzFWU3ZESTgiLCJtYWMiOiIyNDFmYzRiOGU0ODViYmQ2OGJiMjc1YzJkM2IwZjg1OGZlNWMzYzQxYzEwM2Y0ODIzZTc4NzMzNTlkMTcwNTUwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:54 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.1.10
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iwBI2HS2iLkfQy9HnZ1xOqNO0b1YdbVbdxBlQ5Cq2WO7H2f7LHx7H4GzdHx4T68%2Ftvf68A5iUEciTOefKykzfxsw2938uU5OpNMod4gK9j4qXnBvyJXNBv5IcGsO1NAz0P%2FAYBzabe9GRTI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IjBkZlF5cVppWTQvMFQ4dXZrVnNndnc9PSIsInZhbHVlIjoidzluN3dGaVE5cVE0WWJEeHk0d3BBaXR4ZVVBQ0ZQTlhERW5WTG8ydlBIdkJpVzVsRUZVK0lTOWQxQlhFZ1dVZ2tDbGpUWU1xOHBWbG5odkMwdFMyaU1idVZiNW1LazZIS3FJK1FMZzUrcDdzNFNjeWxEV1JUT0o1Wk5DYXhsY1QiLCJtYWMiOiIxNGM5MDg5ODM3N2I5YWVkMmViODRmZDMyMTIxMTIzZWRlM2MwMDU4YmQ5Y2Y2ZDY1YmZhNWM3ZjIwYmE3MTQ0IiwidGFnIjoiIn0%3D; expires=Tue, 03-Oct-2023 15:48:54 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6ImprRWhZelZSbTJoSFVhNnIwM3NhUnc9PSIsInZhbHVlIjoiaDBjSjNSUkZaanhEYktvUVZaQ3ViWER3MVorNXZGVndMYmF5bCtFOVBtSEExUGNaMlBjT0EvdXRpNjJLR2lseEJ1Z1ZlT2hTUkRDT1ljcDdSeUR4YWN5Z3RWZVFwRVNNKzNjWThLSjV6b2NmUi9vektqNktuNVV1ak96Wlh5eUkiLCJtYWMiOiJjN2FlYWYxMjNjYzc4YzllNDEyZjk5MjcxZWVlNzQxMWI5YmUzZjQxNGIxZGU2MjczZjVhMTYyNGIyYTk0NzNhIiwidGFnIjoiIn0%3D; expires=Tue, 03-Oct-2023 15:48:54 GMT; Max-Age=7200; path=/; httponly; samesite=lax
server: cloudflare
cf-ray: 8105a53708cdb50b-OSL
content-encoding: br

nwwam9z.iji5hp.ru/web3/assets/godaddy-left.png

172.67.170.108

200 OK

30 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/godaddy-left.png
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced\012- data
Size
30 kB (29796 bytes)
Hash
210433a8774859368f3a7b86d125a2a7
408bacddc39f12cad285579c102fe4a629862d88
9c6addfc339ce1c1d262290ab4cc2de8d38d4b54b11a8e85afd44fbb0acc2561

HTTP Headers

GET /web3/assets/godaddy-left.png HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Cookie: XSRF-TOKEN=eyJpdiI6IjBkZlF5cVppWTQvMFQ4dXZrVnNndnc9PSIsInZhbHVlIjoidzluN3dGaVE5cVE0WWJEeHk0d3BBaXR4ZVVBQ0ZQTlhERW5WTG8ydlBIdkJpVzVsRUZVK0lTOWQxQlhFZ1dVZ2tDbGpUWU1xOHBWbG5odkMwdFMyaU1idVZiNW1LazZIS3FJK1FMZzUrcDdzNFNjeWxEV1JUT0o1Wk5DYXhsY1QiLCJtYWMiOiIxNGM5MDg5ODM3N2I5YWVkMmViODRmZDMyMTIxMTIzZWRlM2MwMDU4YmQ5Y2Y2ZDY1YmZhNWM3ZjIwYmE3MTQ0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImprRWhZelZSbTJoSFVhNnIwM3NhUnc9PSIsInZhbHVlIjoiaDBjSjNSUkZaanhEYktvUVZaQ3ViWER3MVorNXZGVndMYmF5bCtFOVBtSEExUGNaMlBjT0EvdXRpNjJLR2lseEJ1Z1ZlT2hTUkRDT1ljcDdSeUR4YWN5Z3RWZVFwRVNNKzNjWThLSjV6b2NmUi9vektqNktuNVV1ak96Wlh5eUkiLCJtYWMiOiJjN2FlYWYxMjNjYzc4YzllNDEyZjk5MjcxZWVlNzQxMWI5YmUzZjQxNGIxZGU2MjczZjVhMTYyNGIyYTk0NzNhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:54 GMT
content-type: image/png
content-length: 29796
last-modified: Thu, 24 Aug 2023 14:10:07 GMT
etag: "7464-603abc9079d32"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7977
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BW6cS1RbaBYIkaLd2Vn9y3HzEJLPh0qa45dLXfoSYdw2qW0seOhKRGQu5phpLfCEiUsD9PBSZrJtXsbqy24Rp4MAxJOiQ5z1zBPQ5V6v4zFa8vN3GTOF4%2FrDAc8Efo0%2FuJ2L3RChP12%2BTho%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a53b8c44b50b-OSL

nwwam9z.iji5hp.ru/web3/assets/godaddy-microsoftlogo.png

172.67.170.108

200 OK

71 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/godaddy-microsoftlogo.png
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced\012- data
Size
71 kB (70712 bytes)
Hash
f70ff06d19498d80b130ec78176fd3ff
9d8a3b74c5164ff7ae2c7930b6d7b14707b404fc
df6dbab5251e56b405e48aaf57d3cd4188f073ffba71131fa6cd26e6742923ae

HTTP Headers

GET /web3/assets/godaddy-microsoftlogo.png HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Cookie: XSRF-TOKEN=eyJpdiI6IjBkZlF5cVppWTQvMFQ4dXZrVnNndnc9PSIsInZhbHVlIjoidzluN3dGaVE5cVE0WWJEeHk0d3BBaXR4ZVVBQ0ZQTlhERW5WTG8ydlBIdkJpVzVsRUZVK0lTOWQxQlhFZ1dVZ2tDbGpUWU1xOHBWbG5odkMwdFMyaU1idVZiNW1LazZIS3FJK1FMZzUrcDdzNFNjeWxEV1JUT0o1Wk5DYXhsY1QiLCJtYWMiOiIxNGM5MDg5ODM3N2I5YWVkMmViODRmZDMyMTIxMTIzZWRlM2MwMDU4YmQ5Y2Y2ZDY1YmZhNWM3ZjIwYmE3MTQ0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImprRWhZelZSbTJoSFVhNnIwM3NhUnc9PSIsInZhbHVlIjoiaDBjSjNSUkZaanhEYktvUVZaQ3ViWER3MVorNXZGVndMYmF5bCtFOVBtSEExUGNaMlBjT0EvdXRpNjJLR2lseEJ1Z1ZlT2hTUkRDT1ljcDdSeUR4YWN5Z3RWZVFwRVNNKzNjWThLSjV6b2NmUi9vektqNktuNVV1ak96Wlh5eUkiLCJtYWMiOiJjN2FlYWYxMjNjYzc4YzllNDEyZjk5MjcxZWVlNzQxMWI5YmUzZjQxNGIxZGU2MjczZjVhMTYyNGIyYTk0NzNhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:54 GMT
content-type: image/png
content-length: 70712
last-modified: Thu, 24 Aug 2023 12:58:17 GMT
etag: "11438-603aac821e121"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7977
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BUK5hD1taIiMRZqPn656TaJmFVm0ZsLri0%2Bf4h06iuHo0DFb2%2FZQS%2B9WchTgFPd4pGsYZ%2BTtHlA0gQOL1KggsOzsoosnJHaymGnA7Oo7f%2F4SC8VsE%2Bqgyl0JWdzgexxhlkopVe22q%2FgeKmw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 8105a53b8c47b50b-OSL

nwwam9z.iji5hp.ru/web3/assets/microsoftfavicon.ico

172.67.170.108

200 OK

17 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/microsoftfavicon.ico
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors\012- data
Size
17 kB (17174 bytes)
Hash
12e3dac858061d088023b2bd48e2fa96
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

HTTP Headers

GET /web3/assets/microsoftfavicon.ico HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Cookie: XSRF-TOKEN=eyJpdiI6IjBkZlF5cVppWTQvMFQ4dXZrVnNndnc9PSIsInZhbHVlIjoidzluN3dGaVE5cVE0WWJEeHk0d3BBaXR4ZVVBQ0ZQTlhERW5WTG8ydlBIdkJpVzVsRUZVK0lTOWQxQlhFZ1dVZ2tDbGpUWU1xOHBWbG5odkMwdFMyaU1idVZiNW1LazZIS3FJK1FMZzUrcDdzNFNjeWxEV1JUT0o1Wk5DYXhsY1QiLCJtYWMiOiIxNGM5MDg5ODM3N2I5YWVkMmViODRmZDMyMTIxMTIzZWRlM2MwMDU4YmQ5Y2Y2ZDY1YmZhNWM3ZjIwYmE3MTQ0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImprRWhZelZSbTJoSFVhNnIwM3NhUnc9PSIsInZhbHVlIjoiaDBjSjNSUkZaanhEYktvUVZaQ3ViWER3MVorNXZGVndMYmF5bCtFOVBtSEExUGNaMlBjT0EvdXRpNjJLR2lseEJ1Z1ZlT2hTUkRDT1ljcDdSeUR4YWN5Z3RWZVFwRVNNKzNjWThLSjV6b2NmUi9vektqNktuNVV1ak96Wlh5eUkiLCJtYWMiOiJjN2FlYWYxMjNjYzc4YzllNDEyZjk5MjcxZWVlNzQxMWI5YmUzZjQxNGIxZGU2MjczZjVhMTYyNGIyYTk0NzNhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:55 GMT
content-type: image/x-icon
last-modified: Sun, 19 Mar 2023 15:20:17 GMT
etag: W/"4316-5f7425905ae40"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 7977
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JzQJz6%2BPjnpsrOziwHC01X3i%2BGGN6biiylCkLA96WobvGi1J%2BmwiJLfZJe96kbij91MGES0%2B3txVo%2FvbZiQC8eJLipi%2BI2qSI63KdQTlMK7fIOpd2r6mjldkstJw1DAU9kuUkJC2TRZdyRU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 8105a53eef62b50b-OSL
content-encoding: br

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hl2ov/0x4AAAAAAALDdS9IWBRIR26Y/auto/normal

104.17.3.184

200 OK

27 kB

URL GET HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hl2ov/0x4AAAAAAALDdS9IWBRIR26Y/auto/normal
IP
104.17.3.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (14577)
Size
27 kB (27300 bytes)
Hash
8f8a72a516d5cdae853d8be3a8cf75eb
a9124389fddbd545f2907f2bd5c9564c5f6d46b4
5879c66b82bb136912970d0dba22df03d0b274f892e3468899376986af5a8f37

HTTP Headers

GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/hl2ov/0x4AAAAAAALDdS9IWBRIR26Y/auto/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:50 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 8105a5200bad56a2-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

nwwam9z.iji5hp.ru/web3/assets/js/pages-head-web.min.js?cb=1696340927178

172.67.170.108

200 OK

10 kB

URL GET HTTP/3
nwwam9z.iji5hp.ru/web3/assets/js/pages-head-web.min.js?cb=1696340927178
IP
172.67.170.108:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nwwam9z.iji5hp.ru/jKD51#tom@ddelevator.com
Certificate
IssuerLet's Encrypt
Subjectiji5hp.ru
Fingerprint85:B3:51:BA:47:F8:8A:4B:A3:01:D6:CC:1D:17:F1:91:05:EC:B8:66
ValidityMon, 02 Oct 2023 18:27:34 GMT - Sun, 31 Dec 2023 18:27:33 GMT

File type
ASCII text, with very long lines (10179), with no line terminators
Size
10 kB (10179 bytes)
Hash
91ca724283fd63e0366176adac255a3c
1657c9af872393e385b399d72471dd7c8b476d03
8e7b8fe78eb8a61b0d77628fe1a02c9569fcd0ef4c44ee1b1d06069b8a2787e7

HTTP Headers

GET /web3/assets/js/pages-head-web.min.js?cb=1696340927178 HTTP/1.1
Host: nwwam9z.iji5hp.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nwwam9z.iji5hp.ru/jKD51
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 03 Oct 2023 13:48:48 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 19:33:09 GMT
etag: W/"27c3-6063407397648"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bYAul1J9wL6BEkVb4qGTE2y%2FxHReDFzOmQibj3sBlgU8KoRHCEFEb2xPn2bptEaKG6rE415aEZQ%2F9sZONqHrnlHWATBjOgy0axD6azWsw3oJC40lKEiJh62TR3CykuMIxQFf434wdUUBNHQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 8105a50898d4b50b-OSL
content-encoding: br

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (57)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN