Report - manage.kmail-lists.com/subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=minusdesigns.net/new/auth/jbdelasalle/BZ33O0J2U6UPUDDSYUQBH2/WER1cG90eUBqYmRlbGFzYWxsZS5jb20=

Report Overview

Submitted URL
manage.kmail-lists.com/subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=minusdesigns.net/new/auth/jbdelasalle/BZ33O0J2U6UPUDDSYUQBH2/WER1cG90eUBqYmRlbGFzYWxsZS5jb20=
IP
54.227.49.76
ASN
#14618 AMAZON-AES
Submitted
2024-03-29 14:12:32
Access
public
Website Title
aZBlIXhcIM
Final URL
nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Tags
microsoft phishing
urlquery detections
Phishing - Microsoft

Detections

urlquery
23
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
manage.kmail-lists.com	42475	2013-05-03	2014-04-09	2024-03-28	711 B	516 B	54.227.49.76
nztgp.idaefulpet.com	unknown	unknown	No data	No data	36 kB	976 kB	172.67.147.101
www.google.com	7	1997-09-15	2015-05-10	2024-03-23	410 B	1.5 kB	142.250.74.132
httpbin.org	352975	2011-06-12	2013-07-23	2024-03-28	472 B	281 B	18.208.241.22
www.gstatic.com	unknown	2008-02-11	2016-07-26	2024-03-29	492 B	512 kB	142.250.74.35
ocsp.r2m03.amazontrust.com	unknown	2007-05-11	2023-02-21	2024-03-28	338 B	942 B	143.204.53.97
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20	2024-03-28	440 B	372 B	104.17.2.184
code.jquery.com	634	2005-12-10	2012-05-21	2024-03-28	414 B	32 kB	151.101.130.137
cdn.socket.io	62068	2010-04-18	2015-03-23	2024-03-28	417 B	46 kB	52.85.243.50
minusdesigns.net	unknown	2021-03-23	2021-03-23	2024-03-28	463 B	729 B	172.67.128.180

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (22)

	URL	Size	First Seen	Last Seen
	www.google.com/recaptcha/api.js	850 B	2024-03-29	2024-04-04
Pretty URL www.google.com/recaptcha/api.js IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-29 02:14:38 Last Seen2024-04-04 11:53:37 Times Seen364 Hash a0b2d07fa8cb78d8057423360e2b5843 df34550dcf9a4b220bf79330937fe2d6612b8700 ed504324f919ac243bf232dec1b6980738df27a04304a8c10098b198681044b3 Loading...

	nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI	59 kB	2024-03-29	2024-03-29
Pretty URL nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI IP 172.67.147.101 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash d51564f84cc56f0d8321a39146230337 73ef6fd9b2689816bcdedb4fb3583ce08ce5bb96 7c5f050513274c00fc414892497228f89956207fae3e00005524ad69a67708b0 Loading...

	www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js	511 kB	2024-03-29	2024-04-04
Pretty URL www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js IP 142.250.74.35 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-29 02:01:50 Last Seen2024-04-04 11:53:37 Times Seen1826 Hash 48c590d47c8b1868cecab334e9a34cbe 5f1a9f94294ec337f657ac2ebec1c74e097ce5b3 f3756825df5194a174b7a55ebd3b484c276766eef21343d34b053b98ed386801 Loading...

	cdn.socket.io/4.6.0/socket.io.min.js	46 kB	2023-04-05	2024-04-27
Pretty URL cdn.socket.io/4.6.0/socket.io.min.js IP 52.85.243.50 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 03:09:50 Last Seen2024-04-27 07:55:25 Times Seen71108 Hash 80f5b8c6a9eeac15de93e5a112036a06 f7174635137d37581b11937fc90e9cb325077bce 0401de33701f1cad16ecf952899d23990b6437d0a5b7335524edf6bdfb932542 Loading...

	code.jquery.com/jquery-3.6.0.min.js	90 kB	2023-03-07	2024-04-27
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2024-04-27 10:13:05 Times Seen262173 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	unknown	9.5 kB	2024-03-29	2024-03-29
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash ee2e8f8605a98e60492edce5cd374131 f772d80bacabba825f207a90ac1480d06c453235 529f198638d65ae19218d20cb331a98d71b07fcc8405d67373b48ffa242c4fc4 Loading...

	nztgp.idaefulpet.com/56ugA7RxGmhYZxQtPaJlgOKK6klR3AkVCBayNRSzQ89110	108 kB	2024-03-11	2024-04-08
Pretty URL nztgp.idaefulpet.com/56ugA7RxGmhYZxQtPaJlgOKK6klR3AkVCBayNRSzQ89110 IP 172.67.147.101 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-11 17:40:24 Last Seen2024-04-08 20:16:59 Times Seen193 Hash b08a5ca838b60a0807cc1101229805ff ce92c8047d2b3d092f9a1188ee864059f2750d76 8039faac672390bafcb7d6bf3f1686806437910ea12a9bcde5cc03299485a68f Loading...

		Size	First Seen	Last Seen
	#1 Eval - 203ae541713f45c049f5efe1291d1c37	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash 203ae541713f45c049f5efe1291d1c37 d80c9e9a846a1d6aa9314690e815271dd408a0b6 d4f63eaae7917c3523451da7fe5e12d3fc6f3beb6acb5e17038161f72a4c0514 Loading...

	#2 Eval - 2a2658e071c3bf591e626bbab9df1f44	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash 2a2658e071c3bf591e626bbab9df1f44 2aa1f77ee971a631e5ff58ee1e51cfb2577cf791 d16bdaad868a3dec24cfb8392a0cffcb7260ef33cb926be3442540bcac073095 Loading...

	#3 Eval - 029cc0cfc65a0d21891c5b99e4978d35	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash 029cc0cfc65a0d21891c5b99e4978d35 8582ba20d987122049c0fa8f762906dbcf2d2c75 6ae9ff67420fb91eebec1bd2aebd9e8ac7c4879fc055bb0c5de9d76326f8add3 Loading...

	#4 Eval - 190ef4edaf4aba9ce6829ea860b2cb65	61 B	2024-03-22	2024-04-04
Pretty Observations First Seen2024-03-22 10:35:33 Last Seen2024-04-04 15:56:11 Times Seen1815 Hash 190ef4edaf4aba9ce6829ea860b2cb65 84010fdde06dc04427d11aafdf4ba6495e14eff8 0334ef3ce9e77db17376ce3e320fe96b901743f1baa1096cc4066922ac672f8c Loading...

	#5 Eval - 13789448b86609f7ef5607abc2854b7c	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash 13789448b86609f7ef5607abc2854b7c e583819e257b9f0f8414bc80949b414f69ee8307 ec0bac98eddcb23ddc3416493285232ecc448b31abf79745992450336d8ae9e2 Loading...

	#6 Eval - 15b9c4c4e6e93fae245c73edb522bcdb	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash 15b9c4c4e6e93fae245c73edb522bcdb 48b218843b39b94b0e84c4b34669ea29f0073610 29e208e2534da2cd5e78dfec68f9cdbc4ac65c9386a10ee35844516abc5b483b Loading...

	#7 Eval - 9e925e9341b490bfd3b4c4ca3b0c1ef2	4 B	2023-03-07	2024-04-27
Pretty Observations First Seen2023-03-07 01:03:43 Last Seen2024-04-27 09:40:34 Times Seen350208 Hash 9e925e9341b490bfd3b4c4ca3b0c1ef2 c2543fff3bfa6f144c2f06a7de6cd10c0b650cae 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408 Loading...

	#8 Eval - 0cf2b1a7696411fcfc6de2c2a63803cb	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash 0cf2b1a7696411fcfc6de2c2a63803cb 40c9c7be9637c913b7fa8b3aa8f83349ff07c872 527cd4a33f48e496a1534885d1fcd28f17b14fe083f8f2d6a34fae8ac7ddbb04 Loading...

	#9 Eval - 5c97a2368862e5562a691cfd35bd2f62	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash 5c97a2368862e5562a691cfd35bd2f62 709aab3dc9175ebcf2b8f1c0a9434152b4bf6dbf db73feab19d9fc749cb5b1a41442c50fde0667fcfbbbb6d3928252b3a753bb4b Loading...

	#10 Eval - f36f59d197ea3d3e8c9da95d9392d912	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash f36f59d197ea3d3e8c9da95d9392d912 03074546cf41129018666463990eff919e76f1ff cd2915fecdafbe29046b9cd511fdeee2d22e744f37c40746388a2cfa69aac941 Loading...

	#11 Eval - 550b345df7171acdc795de7b3f53d257	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash 550b345df7171acdc795de7b3f53d257 c7e7b42847d1a9b78536ddd68a04366206aabf69 22a7133181946782e0f4fa7c126c3bf8703ba9da6f0d12d9219b092e69d6f557 Loading...

	#12 Eval - 81f7847274cf3f364d791cc7216d21fb	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash 81f7847274cf3f364d791cc7216d21fb b8c438f19dc7ef1ecec77b731084b6767da4a23d e7dc1dee9e0983e49948e0e68f9cc605d44fd1d822b9f5f537b945bb812e54cd Loading...

		Size	First Seen	Last Seen
	#1 Write - f101c8e134d1e11f1175e8f1764bc6ef	1.0 kB	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash f101c8e134d1e11f1175e8f1764bc6ef ade71bde8c33103a454b96364ee2b5f543ed2c3f ca28764b0683706d1118824dc5f2ada3c9ebda391b52a02ce696075698da9b51 Loading...

	#2 Write - e9475e7ad8526836f0973db5297bb69a	44 kB	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:39 Last Seen2024-03-29 15:12:39 Times Seen1 Hash e9475e7ad8526836f0973db5297bb69a 466c2b25e14ee805bf5c860745f30403dc3b4a6a 4a3155c2741884a4bbb512ab43f7d8c6d4799969d874b9e17ddd5535e7a35e5b Loading...

	#3 Write - d8847455125e915ed1b39526765a4be2	4.4 kB	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 15:12:40 Last Seen2024-03-29 15:12:40 Times Seen1 Hash d8847455125e915ed1b39526765a4be2 dd6f614d45e77a7db35e80e8750ddbf574c7c361 cc1adf41fc99891e977c428d1f158ac2a56eb4628ac6260c00f60cb55a3b7d6c Loading...

HTTP Transactions (36)

URL IP Response Size

ocsp.r2m03.amazontrust.com/

143.204.53.97

471 B

URL
ocsp.r2m03.amazontrust.com/
IP
143.204.53.97:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
46110f04c3a68ee8c0059c0e658b8cfa
547fdc71642379002a7dd0434467e84cd7dbc50f
e975c0002c18bf9f515a96cd6b3ccb015d1099928b1f771cabca287a30304b2d

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Fri, 29 Mar 2024 14:12:06 GMT
Last-Modified: Fri, 29 Mar 2024 12:45:07 GMT
Server: ECAcc (ska/F6E3)
X-Cache: Miss from cloudfront
Via: 1.1 aa34a836095df9de9d246a53dd63f1d6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: mNyrfMdnCduPtud5XnPBT_ezdkQStqczVg2-5EyhuWa6_jb9F_eQWA==
Age: 5219

manage.kmail-lists.com/subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=minusdesigns.net/new/auth/jbdelasalle/BZ33O0J2U6UPUDDSYUQBH2/WER1cG90eUBqYmRlbGFzYWxsZS5jb20=

54.227.49.76

0 B

URL
manage.kmail-lists.com/subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=minusdesigns.net/new/auth/jbdelasalle/BZ33O0J2U6UPUDDSYUQBH2/WER1cG90eUBqYmRlbGFzYWxsZS5jb20=
IP
54.227.49.76:0
ASN
#14618 AMAZON-AES

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=minusdesigns.net/new/auth/jbdelasalle/BZ33O0J2U6UPUDDSYUQBH2/WER1cG90eUBqYmRlbGFzYWxsZS5jb20= HTTP/1.1
Host: manage.kmail-lists.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Allow: POST, GET, OPTIONS
Content-Language: en-us
Content-Security-Policy: script-src 'report-sample' 'strict-dynamic' 'unsafe-eval' https://cdn.ampproject.org/; object-src 'none'; base-uri 'none'; report-uri /csp/
Content-Type: text/html; charset=utf-8
Date: Fri, 29 Mar 2024 14:12:06 GMT
Location: http://minusdesigns.net/new/auth/jbdelasalle/BZ33O0J2U6UPUDDSYUQBH2/WER1cG90eUBqYmRlbGFzYWxsZS5jb20=
Server: nginx
Vary: Accept-Language, Cookie
Content-Length: 0
Connection: keep-alive

minusdesigns.net/new/auth/jbdelasalle/BZ33O0J2U6UPUDDSYUQBH2/WER1cG90eUBqYmRlbGFzYWxsZS5jb20=

172.67.128.180

20 B

URL
minusdesigns.net/new/auth/jbdelasalle/BZ33O0J2U6UPUDDSYUQBH2/WER1cG90eUBqYmRlbGFzYWxsZS5jb20=
IP
172.67.128.180:0
ASN
#13335 CLOUDFLARENET

File type
gzip compressed data, from Unix
Size
20 B (20 bytes)
Hash
7029066c27ac6f5ef18d660d5741979a
46c6643f07aa7f6bfe7118de926b86defc5087c4
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /new/auth/jbdelasalle/BZ33O0J2U6UPUDDSYUQBH2/WER1cG90eUBqYmRlbGFzYWxsZS5jb20= HTTP/1.1
Host: minusdesigns.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 29 Mar 2024 14:12:06 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
refresh: 0;url=https://nztgp.idaefulpet.com/typsegra/#HXDupoty@jbdelasalle.com
x-turbo-charged-by: LiteSpeed
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KfiPA1%2FrBAe80i216%2BYDe9g3yKpl91wXXH44QiDiKQHhPhyQD4871YXmsC25D65GXFTaZk7fLhT%2Bw6i8rc7KqEcanMYGoCmLbUKTkUpQyLHZnsNbwalA1l3WT1ct%2Fu6M94L6"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 86c073f37fa70b4d-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

challenges.cloudflare.com/turnstile/v0/api.js?render=explicit

104.17.2.184

0 B

URL
challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Fri, 29 Mar 2024 14:12:07 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/g/dc6b543c1346/api.js?render=explicit
vary: Accept-Encoding
server: cloudflare
cf-ray: 86c073fcae9bb521-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.0.min.js

151.101.130.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 29 Mar 2024 14:12:07 GMT
age: 4179146
x-served-by: cache-lga21931-LGA, cache-hel1410034-HEL
x-cache: HIT, HIT
x-cache-hits: 22, 482752
x-timer: S1711721528.835985,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

nztgp.idaefulpet.com/favicon.ico

172.67.147.101

404 Not Found

7.5 kB

URL GET HTTP/3
nztgp.idaefulpet.com/favicon.ico
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
data
Size
7.5 kB (7456 bytes)
Hash
9e71554443d743a0425ac689d77c07ca
60cd15d4692e50b3856b918a18753596f5d17e4b
19408a26c609fa73ea5e6119e4ef2ac3c3125ce66285918b8b13b6e9bcdf98c2

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/typsegra/
Cookie: XSRF-TOKEN=eyJpdiI6InpxUUpvVnpPeVdtRnozK1FBMXRTZWc9PSIsInZhbHVlIjoicnNDMmx4eDJnc0VzaXltVFg4c0J4UUVBaHdKbzRRcFRScHZzdEVyRDJiT0Npeit6ZHduME1PMlBRRWt3OVdlNWZucnZhNVhSdU45TWV1UHJoYlp1aTR2akxRcjE1TFQwcUs2ZThVQVU5bHowazlxWnlUN1R0Q2ZxR2p4N3N1Z0YiLCJtYWMiOiIxYjk3ZDQ1MjE0YzNlZjM3MmIyMGZiNmI2OTkwMTRkM2Y3Y2EzMzk4YmFmNjU0NGU3MWVhZTM4OTYzYTU0YjUzIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ildla3Z1Y3BTcDBwbFdsd2dRWG9oVHc9PSIsInZhbHVlIjoieklrNG41MFZYcjVmdnBQWEE3c0hFTmxZTXYxWkJXYWpJU3BlcUlNK1dXK3BIMVhWYjVNdUdKUTNpL0psckF1dVVjWHRzRHp2c29pOWJMU0dNZ0s1RzljSXZCSXNraDRqTlJETE5ya3E0alhuZ0N4S3NlUkZORzBHQW1BK2sydmIiLCJtYWMiOiJhMjZlZjM4NDU4ZjM5NDZmYzVkNjk2YjZkZTgxOTkwMjVjOGY0MmU3NjViMWU0YWE4MTY3ODc1ZGM1ZmQ2Njk4IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Fri, 29 Mar 2024 14:12:08 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b8H0aICwCWfw6OMXU3PsE%2F6pbdRPu5cDt%2FTVVmBIRl%2Bcsm6VsJJ%2FDk0ZCkRqV2h47jd6SoV%2Bvk2pATDyxXMyxLSeb24jWYaGR2fO4xp19FrrXjLBczAht2MvGKo6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
server: cloudflare
cf-ray: 86c073fe2840b4fd-OSL
content-encoding: br

nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI

172.67.147.101

200 OK

57 kB

URL User Request GET HTTP/3
nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
HTML document, ASCII text, with very long lines (58949), with CRLF line terminators
Size
57 kB (57096 bytes)
Hash
c678fc9d8c131f1614cb3d4d23e100e4
46d3c783b671ae29ea125e13b9284bd788871dbc
967b5ba5cc7b1d0ce0a0438eed52508c1ded1dde3f312f9d1bac176ebb96cc3a

HTTP Headers

GET /170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/typsegra/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6InJRTmd3eFIra25xdmgxemdsZzAwZVE9PSIsInZhbHVlIjoidS93djFYdm5vRnM5NzRCVERCV2dsOHlCK21ZUHdmWmdNenZ2eEtvdytFRDVoeEUyUnpEUTh4V2taWnJqQ0MxSG1CMDhza2xSd0lneDZzYUd0U2hpZHhacU5aTUxiWUpKK1laMDNtcjlEaWtsTzhtRXE3eVhVdzFiT2oyQkxKeEYiLCJtYWMiOiJiNmU1NmMyODBkMjEwYjhjYTNiNDU4NDljZmY0YTM5ZTE1NzJkYmU2Y2Y2MmMyZDExMmE1MTkxYjczYzE1MGMwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjhZZ1lpQXR1QUF3TUpKb2U0MmdPTWc9PSIsInZhbHVlIjoiQnZ2OTc3NzdBeW1BNXdiMzVIMTc4WkxJMlo4Qm5kLzZ0dTdWYkE2OUpVZlZUc3B0NndIZnJqbGltWlFIdWtJWnpGZ1AyWkZzNFRrWVpOM2owckpnM01yZm1oNkwrL1gzbVFZTzhJVTFuNDl4TEFucTlFekFuMmVCQ0xrcGxDdXIiLCJtYWMiOiI5ZTNmZDFhMDQ4ZTY2YjdhY2RlN2U0NzhiYjQwOWI2NjQ4NzU3Nzk2YjZmYmU1NGI0YmM2NTk1ZmQwZmM3Y2E0IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:14 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CEXV68%2FT5l2dGyHia4kEfo4JN2Id2%2BVOboD9QbIY3sWPJit3Pm4mzAw1WZYWzNQXlkGObIl2vuw419Z%2B0oPA37Ar6Zy0LgjF0drdme%2FU2Y9%2BVsecSQAuW1xL7fyR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 16:12:14 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 16:12:14 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86c074270d77b4fd-OSL
content-encoding: br

www.google.com/recaptcha/api.js

142.250.74.132

200 OK

1.0 kB

URL GET HTTP/2
www.google.com/recaptcha/api.js
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerGoogle Trust Services LLC
Subjectwww.google.com
Fingerprint32:A3:19:7A:6B:D5:C7:5E:CA:7C:C8:08:79:14:56:FD:FC:3E:06:F0
ValidityMon, 26 Feb 2024 08:18:59 GMT - Mon, 20 May 2024 08:18:58 GMT

File type
gzip compressed data
Size
1.0 kB (1025 bytes)
Hash
41f38361b39e948f4bac9a680956a2bb
3af01d69b1440497e90da5ea117b04372294a520
5fc98e7ee5b4c6d7dcf942735cd666322bd976a071d214d912da292a3ccd7573

HTTP Headers

GET /recaptcha/api.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
expires: Fri, 29 Mar 2024 14:12:15 GMT
date: Fri, 29 Mar 2024 14:12:15 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

nztgp.idaefulpet.com/opmYcfnhurO3kORf7VKKIIjMlMembN8def2sM07TUKf9vD67135

172.67.147.101

200 OK

727 B

URL GET HTTP/3
nztgp.idaefulpet.com/opmYcfnhurO3kORf7VKKIIjMlMembN8def2sM07TUKf9vD67135
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Size
727 B (727 bytes)
Hash
839cb0f55c3d2d5c2f740bda95cb2878
93f6fa3a2da8b7184d4b5c5f2065872793370c2e
40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /opmYcfnhurO3kORf7VKKIIjMlMembN8def2sM07TUKf9vD67135 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/png
content-length: 727
content-disposition: inline; filename="opmYcfnhurO3kORf7VKKIIjMlMembN8def2sM07TUKf9vD67135"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CobtOclld1WiZkK%2FzhB9msrzv4q9a2nEw7oLEWsdNr2rOtSpmHjaRVkIzeFqYOOFJQkReDfQgIJmJyyoM5KL1YzST265maSx1rk%2F8Icz0%2BGYSzguag5WKZi42gk9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a3831b4fd-OSL

nztgp.idaefulpet.com/wx8UAmLHVhePLB4HuJeyqrx1hX5W1Xef012124

172.67.147.101

200 OK

231 B

URL GET HTTP/3
nztgp.idaefulpet.com/wx8UAmLHVhePLB4HuJeyqrx1hX5W1Xef012124
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Size
231 B (231 bytes)
Hash
547988bac5584b4608466d761e16f370
c11bb71049702528402a31027f200184910a7e23
70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /wx8UAmLHVhePLB4HuJeyqrx1hX5W1Xef012124 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/png
content-length: 231
content-disposition: inline; filename="wx8UAmLHVhePLB4HuJeyqrx1hX5W1Xef012124"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vTklWD%2BJPLtwcLKSKGP9FxrM8WO0SrcYQztqs0omvMNcjsyzlIotJdxhBmHRSbz6TkBR7dbLZVVQxdHJuADo38jW1MdLvhm2P5BNcfFcNcNt04gzAgqKx2%2FrhpHC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a382db4fd-OSL

nztgp.idaefulpet.com/rsXjbEVVL12j1Hnwx39

172.67.147.101

200 OK

28 kB

URL GET HTTP/3
nztgp.idaefulpet.com/rsXjbEVVL12j1Hnwx39
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Size
28 kB (28000 bytes)
Hash
a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /rsXjbEVVL12j1Hnwx39 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: font/woff2
content-length: 28000
content-disposition: inline; filename="rsXjbEVVL12j1Hnwx39"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IKfXN%2FMdKWxJiU0E%2B6SqPOX45zrESASCVHVTHmjPybePznASB5qoLKh2haeVkZ7ubjDfS0DglEAwwUTE1L3qvN0PxqFAHaSOqaqf7GZdtSPhIGxKg0WWPYfHVXK7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a281cb4fd-OSL

nztgp.idaefulpet.com/typsegra/

172.67.147.101

30 kB

URL
nztgp.idaefulpet.com/typsegra/
IP
172.67.147.101:0
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
HTML document, ASCII text, with very long lines (1445), with CRLF line terminators
Size
30 kB (29907 bytes)
Hash
7dd3fdcbd1508d7ebf319e8adeb2e4a5
05f6b4bb02ce2d781d9713219cec3b94eca4a816
92ea0ec943c4b39c8e52b1a0cc5ab0b257e897be5a69065be9e0be032bdcf8d0

HTTP Headers

GET /typsegra/ HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Im0xcnlsUE1nekRJeVRWYUZXYStOMlE9PSIsInZhbHVlIjoiVHBjbzZaakRjaUpKSitlcXNFNXF2ckx0NXNMUUlaS2wwbTlrMFJBZkFGTXozNWw1eXE0SklJcTJzTjNDY3JvYnI1YzdtaVJ0M1lhVGdGOVRkS3NSV3ZSMEEwRklBbyt1UEdTeG9MVGFZTjE5YThiZXFCK2piMGhNWE02aU5XUVIiLCJtYWMiOiJlYjEzYjZhOTZlOTgzNzdlNTcyYjE2NDNkNDE0NzkwNzUyZjBmZTE3NWNhN2E5Zjg0NzYyMzY3ODAxMDU0NGM3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImRUVk5jSzNIMVZkUzI2MW4yQXNtbnc9PSIsInZhbHVlIjoib3piSVdBb2NhUUVjcXVpVGdNOGs2eThoVUJnY1Njd0dOTFE0dTRFaXRraFE5ZlVvTkhrNVBLbjRZNGVMWjRuTXBCWEFSdGI3WndnSHBjZnhFMGxvNUlha3lnQzVLSS9ITnFhSy9qOFpKcXdVZ2ZRV3VVbHdQWW9IbFdmalJnamIiLCJtYWMiOiJiNzVjYjNlNTM2M2E2ZDllOGJmYjFmMTBlM2EwNjBmYmY2YWI3ODMxODIzZDk3MzI1MjM3MWQxNzBhNTc0NzI2IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:14 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mNT3O7qb7t6tOPV87Rl%2Bp4zFqX16jfpBfacbqN6CrVf4p9BN8ZV9mU1EJhftqtlCxqtVhDEQzrXeOmu5Qer6W3ypZl%2B9%2B4wKf9HdlV3go8QtwJSi9MzrnCXgEljY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6InE3SEdoUVdSOWw5MUpHU2xVaml3Qmc9PSIsInZhbHVlIjoibXRlUGRBN215SzVsSHc0bHBPMmREN3VZTTZjUkxDNzdZQXpLNHRLSjlXakFnTEpuTE0wYnFWMUlLV2hxTHFhK0txZm9kVmsyK05pZGZJZkZUNlJ4ZTc5azZNcmpSMS9qMFRaZ3U5Q2N2WURWSVUvMGNDMVVIMTRuMjVNSmNLS2QiLCJtYWMiOiJiNWJhMDgxZjBhMzA0YWMzNWIyMGQ1Y2JiODY2ZWY4YzU4NmU0ZDQzZDBiNzI4NGNmYWQwNzdiYWExYmIxN2JhIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 16:12:14 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImpydElGS21zKzJxOGo0RzFqWTF0eHc9PSIsInZhbHVlIjoiOEYxRUNTMnE2RGh3eWgzU2szbCtnNndPQ2VGK01mWC9NK0ppeXVNYk9mNGJjd2E4OEhQWkFnOERRcTVadzZTUlZ6YUJHTVg1TFhaaXZTdENKUFUzMzJWVFdwZVFKcmJKRHNxVy9pd2lhejVvRDBab1pCaW50ejgvdVBqOVpLTkIiLCJtYWMiOiI4NTQ3ZDk4Yjg2YzAyOTAzYWYyY2JiYmM5MDM2OGRiN2EwNTBiNmJhZjg1MzRhMGM0MGU1ZmYyNGY2NjI1OTdjIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 16:12:14 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86c07422c8eeb4fd-OSL
content-encoding: br

nztgp.idaefulpet.com/qrRNOjuJGLWuyYQGSMw6z4dzTkptbThVSaWns1QYlzgstNZdLibXfWFNOzP2MkTQvzskXEef240

172.67.147.101

200 OK

30 kB

URL GET HTTP/3
nztgp.idaefulpet.com/qrRNOjuJGLWuyYQGSMw6z4dzTkptbThVSaWns1QYlzgstNZdLibXfWFNOzP2MkTQvzskXEef240
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced
Size
30 kB (29796 bytes)
Hash
210433a8774859368f3a7b86d125a2a7
408bacddc39f12cad285579c102fe4a629862d88
9c6addfc339ce1c1d262290ab4cc2de8d38d4b54b11a8e85afd44fbb0acc2561

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /qrRNOjuJGLWuyYQGSMw6z4dzTkptbThVSaWns1QYlzgstNZdLibXfWFNOzP2MkTQvzskXEef240 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/png
content-length: 29796
content-disposition: inline; filename="qrRNOjuJGLWuyYQGSMw6z4dzTkptbThVSaWns1QYlzgstNZdLibXfWFNOzP2MkTQvzskXEef240"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mULR5a9pEuJr0AvHAkB8ZCD%2B49DZ6aw0cVvcBvNlIIepTAvjYspI9DR2fnSI315QkRCi3WgrlZM%2FXr8lO5uuCB9hPgEPxXtw4%2B3As84INW%2FixrL9ZRwosYxdN7rT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a484cb4fd-OSL

nztgp.idaefulpet.com/238eKwbuMJxm0SkvborLzb90Ke0PIb5nZvw67

172.67.147.101

200 OK

37 kB

URL GET HTTP/3
nztgp.idaefulpet.com/238eKwbuMJxm0SkvborLzb90Ke0PIb5nZvw67
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format, TrueType, length 36696, version 1.0
Size
37 kB (36696 bytes)
Hash
a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /238eKwbuMJxm0SkvborLzb90Ke0PIb5nZvw67 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: font/woff
content-length: 36696
content-disposition: inline; filename="238eKwbuMJxm0SkvborLzb90Ke0PIb5nZvw67"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UV8ZtCthaDvLhlTkUjN76tTSIXpVz7keUqW5lwEJhGgMrO2qJQHPlGR6ReNJzpiZIwM4v81XZlHf%2F6Q5tlofTAMEIFTQu%2BcN%2FXPH1X1fAEBzuZ0MAkAsnnOfC4DY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a2825b4fd-OSL

nztgp.idaefulpet.com/yzVE0E5RypftWX78IJDbfNBpqr45

172.67.147.101

200 OK

36 kB

URL GET HTTP/3
nztgp.idaefulpet.com/yzVE0E5RypftWX78IJDbfNBpqr45
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format, TrueType, length 35970, version 1.0
Size
36 kB (35970 bytes)
Hash
496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /yzVE0E5RypftWX78IJDbfNBpqr45 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: font/woff
content-length: 35970
content-disposition: inline; filename="yzVE0E5RypftWX78IJDbfNBpqr45"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LfEZxngvk9yTCGufMwvx9yCYueYC6khUcP1C4cmSEJxSax4E4DMjXcfEtwZzEwVM4rnyWaxNoCFqn5Rz8QJjWBidAkQXKW68oBmrAzN1GhP6e6l6SXTPnt1OD75l"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a2820b4fd-OSL

nztgp.idaefulpet.com/web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket

172.67.147.101

0 B

URL
nztgp.idaefulpet.com/web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket
IP
172.67.147.101:0
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://nztgp.idaefulpet.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: qAXwxIHZ0sMh6w1tsHhmLw==
DNT: 1
Connection: keep-alive, Upgrade
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Date: Fri, 29 Mar 2024 14:12:15 GMT
Connection: upgrade
Sec-WebSocket-Accept: 9YvBrSkNBG258gF/hp8I4CllaXQ=
Upgrade: websocket
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ogHZeCh%2BnrIhUDpRHUyVln9PQS%2FTIIetrzmImxSePvNqoWcwdF8FZQTUl%2FUIENGyCjXLpxlUV4stpuz%2BQpSBfDJsnGW3H%2BVt%2Bsjjg%2B7ayaIpN2Zl7jyCGkvggO80eExzvtjDaxar%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 86c0742bdfa70afe-OSL
alt-svc: h3=":443"; ma=86400

nztgp.idaefulpet.com/89hvHOacu73iMbpVkZPefb0eEk5mfO4Uab80

172.67.147.101

200 OK

44 kB

URL GET HTTP/3
nztgp.idaefulpet.com/89hvHOacu73iMbpVkZPefb0eEk5mfO4Uab80
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Size
44 kB (43596 bytes)
Hash
2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /89hvHOacu73iMbpVkZPefb0eEk5mfO4Uab80 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: font/woff2
content-length: 43596
content-disposition: inline; filename="89hvHOacu73iMbpVkZPefb0eEk5mfO4Uab80"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P6XeX%2FetMVQW1%2FA8qfCqb5s4p4ACqiAKprUoRfc2SZxDwFVIKOT1tthZVZes6hY57Tu3KXU2%2FruzJhOviZpn6Yr5UZRUMN9gE%2B%2BC3VOZVXuHiiJF%2FMeQ5NCLSA%2B9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a3829b4fd-OSL

nztgp.idaefulpet.com/ijs4zoiME6NSaQ917COatQSIK11uJjklzKGsLOu10lSgaMpsFKn712204

172.67.147.101

200 OK

50 kB

URL GET HTTP/3
nztgp.idaefulpet.com/ijs4zoiME6NSaQ917COatQSIK11uJjklzKGsLOu10lSgaMpsFKn712204
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced
Size
50 kB (49602 bytes)
Hash
db783743cd246ff4d77f4a3694285989
b9466716904457641b7831868b47162d8d378d41
5913b1ec0fc58ab2bec576804b9e9b566a584ea3d21a1bf74a7b40051a447fdc

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ijs4zoiME6NSaQ917COatQSIK11uJjklzKGsLOu10lSgaMpsFKn712204 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/png
content-length: 49602
content-disposition: inline; filename="ijs4zoiME6NSaQ917COatQSIK11uJjklzKGsLOu10lSgaMpsFKn712204"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1AVlc2OMzI8ZUOrJROHWvnB92uhd1PCtXbjDYXd%2BBuUCT7PkhdOCrt4933bP%2B8g2FjDW%2FuMDNmoPEc9F9%2Fbn859Wd7MhGFSU4CNR2BHeB%2FCmhFigLjb2otM3mh7K"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a484ab4fd-OSL

nztgp.idaefulpet.com/uvmNJuXBqIhq2s3eWDi80p3CoH8i845Yf8ziO8ds4tXzHfL17fYUgE95EB8WZRENTH2Ref260

172.67.147.101

200 OK

71 kB

URL GET HTTP/3
nztgp.idaefulpet.com/uvmNJuXBqIhq2s3eWDi80p3CoH8i845Yf8ziO8ds4tXzHfL17fYUgE95EB8WZRENTH2Ref260
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced
Size
71 kB (70712 bytes)
Hash
f70ff06d19498d80b130ec78176fd3ff
9d8a3b74c5164ff7ae2c7930b6d7b14707b404fc
df6dbab5251e56b405e48aaf57d3cd4188f073ffba71131fa6cd26e6742923ae

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /uvmNJuXBqIhq2s3eWDi80p3CoH8i845Yf8ziO8ds4tXzHfL17fYUgE95EB8WZRENTH2Ref260 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/png
content-length: 70712
content-disposition: inline; filename="uvmNJuXBqIhq2s3eWDi80p3CoH8i845Yf8ziO8ds4tXzHfL17fYUgE95EB8WZRENTH2Ref260"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fwyt%2BIW6atuXXNa4rfiUhht74DzyRCtD13%2Fzue%2B%2F6G8zgVpypsKD6AwPrKIev0bl3FySZElBxBIwCVPKjc3lXltBeQHepEMC7gvXuO5K0tcB6hsQKBDLTrPS2tcz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a585bb4fd-OSL

nztgp.idaefulpet.com/56BZyKrMt9Fab6kMoW56720

172.67.147.101

200 OK

6.9 kB

URL GET HTTP/3
nztgp.idaefulpet.com/56BZyKrMt9Fab6kMoW56720
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
ASCII text, with very long lines (23398), with no line terminators
Size
6.9 kB (6878 bytes)
Hash
c1c51d30d5e7094136f2d828349e520f
10ae8971ad7a8798bc9732707fe4896b57541557
0c55057782e3b346c2b819574bfa916852bc8ac5bb4e01d56e8fbffc22043c98

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /56BZyKrMt9Fab6kMoW56720 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="56BZyKrMt9Fab6kMoW56720"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a%2BsFwGo22llfpLLBVsWcIVxXemJkxC34bhf8CUTH9uR%2FrFSgdiVuXIPPmaoyfNctSAvHPJ7u1Q4Oh0o1SZW2t2ZY1%2Bp8h3X7gu2iDs8JHkD0q5VtSCOzKO2DDIg7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a180cb4fd-OSL
content-encoding: br

nztgp.idaefulpet.com/efxhEBv59hrvWqFujrF56LxSbePPkykl91

172.67.147.101

200 OK

93 kB

URL GET HTTP/3
nztgp.idaefulpet.com/efxhEBv59hrvWqFujrF56LxSbePPkykl91
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Size
93 kB (93276 bytes)
Hash
bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /efxhEBv59hrvWqFujrF56LxSbePPkykl91 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: font/woff2
content-length: 93276
content-disposition: inline; filename="efxhEBv59hrvWqFujrF56LxSbePPkykl91"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vLVOk2K0j2umjL6nLTiJHxYUOpvENTJuNJx9l%2BW4MZp38RgFm6mEQMB8hNoq5%2FLYEe22lrSonlXgZp174OGluX%2FUIvhArOE1ZJsXnEfXCFYZ1iyvAFOFwN2GgfGD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a382bb4fd-OSL

nztgp.idaefulpet.com/wr1tM2Y6lGmtYEVUZu8Nl30WePA5a93texufh74gpjAA8JiG1YW48Cg53ST4QMn1

172.67.147.101

200 OK

204 kB

URL POST HTTP/3
nztgp.idaefulpet.com/wr1tM2Y6lGmtYEVUZu8Nl30WePA5a93texufh74gpjAA8JiG1YW48Cg53ST4QMn1
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
JSON text data
Size
204 kB (203493 bytes)
Hash
a2f34ca5e0995b045fe450a03081e413
a12ecc45a251cfc27c60ebc4083e7b512367e461
25d5f415ae93ed1d6d30a42f8615e6c5e0e69756d2aaafaeb3a5df19c7f18b87

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

POST /wr1tM2Y6lGmtYEVUZu8Nl30WePA5a93texufh74gpjAA8JiG1YW48Cg53ST4QMn1 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 33
Origin: https://nztgp.idaefulpet.com
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: application/json
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QKJ%2FqHVNuR67H0jWBLCcbf45bXUp3r7BnWCvHH1eDHgrFORSsUpYQs4mM1I4eTyV8vHTRW7GrLv4XLFmRjHzwhXg7xn9ifd1vVp8yb72%2F094XDFlky9fV5iMuTs4"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImxjaGNFeTZ6UUk5dlhyVHJIZGFjZlE9PSIsInZhbHVlIjoiQmcxZmFqVUFvdWFuTW5mUFMrTy9FQnJaM05OS2JmREtEZVlYTXNPY1IzYVBVWCtqQTRHS2RnSU4yd3JPZVJodXhSb01aUUIwckx1QVBTNU9BYWlycm80ckRxQUQ0LzEySE1BTjFucCsrZzNDYnJGc0x3a0ovMHlDc0VGd1VsV2oiLCJtYWMiOiI5YmYzOWY2MDgyYTViMzU5NzYyMTkyMWZkZTVjMzgyMDE2OTg4MGNmZGE2NWExMTk3Nzk5MGQ5NjJiNTEyYTA5IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 16:12:15 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImVTSDRaSVl0SjhUK3R4T1pveU9vMUE9PSIsInZhbHVlIjoidkc4SXQweTlzTVJ3eGxYVEg1ZWJxM3Fac3B5NVBIVTBXRTJyRjMyYnlIb0l4RXM5YjlDQ3FZeDRoM2dyQTVJRDBMM0hqeHk2Uk1lWU5HWFdiU09JY1paV2lyMjRQemRidGRuWUtDZ3lsK0VGWVdQSERKUXdoS2ZWempEMjQrUEUiLCJtYWMiOiIxZmMyYjlmZDkyZGVmMTc4Y2E2NTQzZjU0OGJkN2U4NTc0M2UwNjMxNWRlZjA3NTg3YTAyYzg1NmU5NzQxNzc1IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 16:12:15 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86c0742b7937b4fd-OSL
content-encoding: br

nztgp.idaefulpet.com/wxPRYQ1NZ63bzX5w6wjJqYpwGLWop6Yy8esbs2TeQpWZ3gM90180

172.67.147.101

200 OK

14 kB

URL GET HTTP/3
nztgp.idaefulpet.com/wxPRYQ1NZ63bzX5w6wjJqYpwGLWop6Yy8esbs2TeQpWZ3gM90180
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
14 kB (14096 bytes)
Hash
fe87496cc7a44412f7893a72099c120a
a0c1458c08a815df63d3cb0406d60be6607ca699
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /wxPRYQ1NZ63bzX5w6wjJqYpwGLWop6Yy8esbs2TeQpWZ3gM90180 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/svg+xml
content-disposition: inline; filename="wxPRYQ1NZ63bzX5w6wjJqYpwGLWop6Yy8esbs2TeQpWZ3gM90180"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d6d1S2YFDD0T81PoCsnqFxUCKv6iFeyO1MLJyEs52lJL0yg5nMi%2ByCgrbzpOgwfyRvaUvb50zALsMMG5Eej9MFfA%2B64Z%2Bx1FY6UFtVKIUFXu7MuiB7UrXS9cxzMM"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a383ab4fd-OSL
content-encoding: br

nztgp.idaefulpet.com/mnINfrpUUqTEJbTC8ZfhSklTK8jYudy9KbeEQfLOtYCpZhj78150

172.67.147.101

200 OK

211 B

URL GET HTTP/3
nztgp.idaefulpet.com/mnINfrpUUqTEJbTC8ZfhSklTK8jYudy9KbeEQfLOtYCpZhj78150
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
211 B (211 bytes)
Hash
40eb39126300b56bf66c20ee75b54093
83678d94097257eb474713dec49e8094f49d2e2a
765709425a5b9209e875dccf2217d3161429d2d48159fc1df7b253b77c1574f4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /mnINfrpUUqTEJbTC8ZfhSklTK8jYudy9KbeEQfLOtYCpZhj78150 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/svg+xml
content-disposition: inline; filename="mnINfrpUUqTEJbTC8ZfhSklTK8jYudy9KbeEQfLOtYCpZhj78150"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AI70rywMMYxNJoHdkr33dMdXrfbs%2Bx8hLgeIqTZ31Dge7joLbk%2Fr4ZKgAUyiGXckGdROJISZqxRdF9t67jhKFrHlEi7%2BlUWaW6QVTdp%2BCPuRNMZEbLaXH%2B9qOV7O"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a3833b4fd-OSL
content-encoding: br

nztgp.idaefulpet.com/klnw3oUakq3wRH0S0qPlePj8nAVXEcdrrjRJQLXFl6G1wPsB78165

172.67.147.101

200 OK

7.4 kB

URL GET HTTP/3
nztgp.idaefulpet.com/klnw3oUakq3wRH0S0qPlePj8nAVXEcdrrjRJQLXFl6G1wPsB78165
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
7.4 kB (7390 bytes)
Hash
bca9b46fee32162356ba5b4783e614dc
cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5
fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /klnw3oUakq3wRH0S0qPlePj8nAVXEcdrrjRJQLXFl6G1wPsB78165 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/svg+xml
content-disposition: inline; filename="klnw3oUakq3wRH0S0qPlePj8nAVXEcdrrjRJQLXFl6G1wPsB78165"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xfug5d59xQRukErSqP8WzXaYWZn2%2F60voM9lLoRlOmcMbRGpegyeXZJskTjAQPzvDFihSFkcjMnm2h5wNTwkpB6v81AQZLnnCDQuOus38V2GRAaq%2FTBi8Q%2BQL7AH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a3836b4fd-OSL
content-encoding: br

nztgp.idaefulpet.com/56ugA7RxGmhYZxQtPaJlgOKK6klR3AkVCBayNRSzQ89110

172.67.147.101

200 OK

108 kB

URL GET HTTP/3
nztgp.idaefulpet.com/56ugA7RxGmhYZxQtPaJlgOKK6klR3AkVCBayNRSzQ89110
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type

Size
108 kB (108270 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /56ugA7RxGmhYZxQtPaJlgOKK6klR3AkVCBayNRSzQ89110 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: application/javascript
content-disposition: inline; filename="56ugA7RxGmhYZxQtPaJlgOKK6klR3AkVCBayNRSzQ89110"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3nWH6kRFkYggq7llZIXIGiv4Vj0IpK3ZrSDuf37Th6PEEQGNJWbfXA5jHMWVWLtIq%2BpjBZSSB5cgqWdScpYUGR6XUElXADkVNgpcCgFV3cAbGZyRXi2N1D1ueOYs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a5861b4fd-OSL
content-encoding: br

nztgp.idaefulpet.com/xyRONI7RTSjEUvpqJgh30

172.67.147.101

200 OK

38 kB

URL GET HTTP/3
nztgp.idaefulpet.com/xyRONI7RTSjEUvpqJgh30
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
ASCII text, with very long lines (1437), with CRLF line terminators
Size
38 kB (38221 bytes)
Hash
0a40b289b9ecb589387f31cbd2807033
dbb02f7d438a952b55cab142749c648cd6417af5
c17e32e67edc46c2720b01a4a716996809ad8335c875f6980319a1440de6c245

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /xyRONI7RTSjEUvpqJgh30 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="xyRONI7RTSjEUvpqJgh30"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r83Hgskkt4k6shTI4L7ZKeu%2BJQsg7ntp2%2Bxwfo4NSyq5W1iqV6e9QhV%2BlSwuikBl820TeCtD4tJlrsLeWDDRr3LYdLOgbmkjZFjCgNJKzfWCZncMAtYl5Reonij7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a1810b4fd-OSL
content-encoding: br

cdn.socket.io/4.6.0/socket.io.min.js

52.85.243.50

200 OK

46 kB

URL GET HTTP/2
cdn.socket.io/4.6.0/socket.io.min.js
IP
52.85.243.50:443
ASN
#16509 AMAZON-02

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerAmazon
Subjectcdn.socket.io
FingerprintBB:7D:4E:26:70:F6:06:2A:12:E9:92:A8:F1:9F:CD:82:0B:BF:48:ED
ValiditySun, 22 Oct 2023 00:00:00 GMT - Sun, 17 Nov 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (45667)
Size
46 kB (45806 bytes)
Hash
80f5b8c6a9eeac15de93e5a112036a06
f7174635137d37581b11937fc90e9cb325077bce
0401de33701f1cad16ecf952899d23990b6437d0a5b7335524edf6bdfb932542

HTTP Headers

GET /4.6.0/socket.io.min.js HTTP/1.1
Host: cdn.socket.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
content-disposition: inline; filename="socket.io.min.js"
content-encoding: gzip
date: Tue, 13 Feb 2024 01:53:41 GMT
etag: W/"80f5b8c6a9eeac15de93e5a112036a06"
server: Vercel
strict-transport-security: max-age=63072000
x-vercel-cache: HIT
x-vercel-id: lhr1::v6xnr-1707789221556-562b1a554579
x-cache: Hit from cloudfront
via: 1.1 d2344bac503cfadf51884e9930680ffe.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN1-C1
x-amz-cf-id: cbVKME5mmAw4hfhhlCXKQwSIfjnY5wVUZfcoiEsNc8UddEcUGFujwg==
age: 4620797
X-Firefox-Spdy: h2

nztgp.idaefulpet.com/typsegra/?hHXDupoty@jbdelasalle.com

172.67.147.101

302 Found

59 kB

URL User Request GET HTTP/3
nztgp.idaefulpet.com/typsegra/?hHXDupoty@jbdelasalle.com
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type

Size
59 kB (59316 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /typsegra/?hHXDupoty@jbdelasalle.com HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/typsegra/
Cookie: XSRF-TOKEN=eyJpdiI6InE3SEdoUVdSOWw5MUpHU2xVaml3Qmc9PSIsInZhbHVlIjoibXRlUGRBN215SzVsSHc0bHBPMmREN3VZTTZjUkxDNzdZQXpLNHRLSjlXakFnTEpuTE0wYnFWMUlLV2hxTHFhK0txZm9kVmsyK05pZGZJZkZUNlJ4ZTc5azZNcmpSMS9qMFRaZ3U5Q2N2WURWSVUvMGNDMVVIMTRuMjVNSmNLS2QiLCJtYWMiOiJiNWJhMDgxZjBhMzA0YWMzNWIyMGQ1Y2JiODY2ZWY4YzU4NmU0ZDQzZDBiNzI4NGNmYWQwNzdiYWExYmIxN2JhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImpydElGS21zKzJxOGo0RzFqWTF0eHc9PSIsInZhbHVlIjoiOEYxRUNTMnE2RGh3eWgzU2szbCtnNndPQ2VGK01mWC9NK0ppeXVNYk9mNGJjd2E4OEhQWkFnOERRcTVadzZTUlZ6YUJHTVg1TFhaaXZTdENKUFUzMzJWVFdwZVFKcmJKRHNxVy9pd2lhejVvRDBab1pCaW50ejgvdVBqOVpLTkIiLCJtYWMiOiI4NTQ3ZDk4Yjg2YzAyOTAzYWYyY2JiYmM5MDM2OGRiN2EwNTBiNmJhZjg1MzRhMGM0MGU1ZmYyNGY2NjI1OTdjIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 302 Found
date: Fri, 29 Mar 2024 14:12:14 GMT
content-type: text/html; charset=UTF-8
location: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0oW3apx0b%2BsyR7ucsnm%2F6w7kKXUYhC8iH9eV0Vm2Fae1J6uvrLYT9ycKbdZxaNXd006IOaD1czn3T23DCgtvpaivhX58Rr2axI91oBqOUqE97vrqJTbD%2BygZrimJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6InJRTmd3eFIra25xdmgxemdsZzAwZVE9PSIsInZhbHVlIjoidS93djFYdm5vRnM5NzRCVERCV2dsOHlCK21ZUHdmWmdNenZ2eEtvdytFRDVoeEUyUnpEUTh4V2taWnJqQ0MxSG1CMDhza2xSd0lneDZzYUd0U2hpZHhacU5aTUxiWUpKK1laMDNtcjlEaWtsTzhtRXE3eVhVdzFiT2oyQkxKeEYiLCJtYWMiOiJiNmU1NmMyODBkMjEwYjhjYTNiNDU4NDljZmY0YTM5ZTE1NzJkYmU2Y2Y2MmMyZDExMmE1MTkxYjczYzE1MGMwIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 16:12:14 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IjhZZ1lpQXR1QUF3TUpKb2U0MmdPTWc9PSIsInZhbHVlIjoiQnZ2OTc3NzdBeW1BNXdiMzVIMTc4WkxJMlo4Qm5kLzZ0dTdWYkE2OUpVZlZUc3B0NndIZnJqbGltWlFIdWtJWnpGZ1AyWkZzNFRrWVpOM2owckpnM01yZm1oNkwrL1gzbVFZTzhJVTFuNDl4TEFucTlFekFuMmVCQ0xrcGxDdXIiLCJtYWMiOiI5ZTNmZDFhMDQ4ZTY2YjdhY2RlN2U0NzhiYjQwOWI2NjQ4NzU3Nzk2YjZmYmU1NGI0YmM2NTk1ZmQwZmM3Y2E0IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 16:12:14 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86c074251b79b4fd-OSL

nztgp.idaefulpet.com/56fhIcOikf450dmGst52

172.67.147.101

200 OK

29 kB

URL GET HTTP/3
nztgp.idaefulpet.com/56fhIcOikf450dmGst52
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Size
29 kB (28584 bytes)
Hash
17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /56fhIcOikf450dmGst52 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: font/woff2
content-length: 28584
content-disposition: inline; filename="56fhIcOikf450dmGst52"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mxpGOVftMVqxS8NFgGta75Skn94JszGf%2Fh6wRTkKMGFaY0cthvOnOokFCfiuAEHoJjmwfWzUvTcAIKk1o7lrVdSo%2BLIYquyLu7guMIwc4wcWX0QqxUstZAUIcyRC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a2824b4fd-OSL

nztgp.idaefulpet.com/mnzTChY0xsGpGjd2DX1yP5tQ8QyGfQw2fcUg56aIababgmB5Z5Bqq9eRaB827wx217

172.67.147.101

200 OK

1.9 kB

URL GET HTTP/3
nztgp.idaefulpet.com/mnzTChY0xsGpGjd2DX1yP5tQ8QyGfQw2fcUg56aIababgmB5Z5Bqq9eRaB827wx217
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
1.9 kB (1864 bytes)
Hash
4b5c228b4faba433d06ec569ed855b2d
a7d3882b93e332460e7c59510a6a811ef011983f
eb19d76cd1fad39abf0f2778991883a5cf9ff560117ce8f7c64124e71471b4ed

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /mnzTChY0xsGpGjd2DX1yP5tQ8QyGfQw2fcUg56aIababgmB5Z5Bqq9eRaB827wx217 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/svg+xml
content-disposition: inline; filename="mnzTChY0xsGpGjd2DX1yP5tQ8QyGfQw2fcUg56aIababgmB5Z5Bqq9eRaB827wx217"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=184uq1v3RnpC76BTM34lv1%2BuegvMwO8gIrzljo189mvHJGQI6HjTQXQy68RvQJCK%2FueIHLAfzNoB06DuNAjw%2BCcHUxDUBldAjYl9tk9FMmgOrUzRlz09Dy%2F6bTqK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742d9b37b4fd-OSL
content-encoding: br

httpbin.org/ip

18.208.241.22

200 OK

31 B

URL GET HTTP/2
httpbin.org/ip
IP
18.208.241.22:443
ASN
#14618 AMAZON-AES

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerAmazon
Subjecthttpbin.org
Fingerprint14:0C:C7:A8:EC:FA:7F:9C:9D:D2:B8:7E:C9:B8:93:3A:A1:11:F6:01
ValidityThu, 21 Sep 2023 00:00:00 GMT - Fri, 18 Oct 2024 23:59:59 GMT

File type
ASCII text, with no line terminators
Size
31 B (31 bytes)
Hash
b90b7b460267d7067015fd46f3cd1a1e
3c164e9136c246dffb5fb4ef3927dda99d880121
885fd87e71d0651d917c1483aaf061a95e9c52371afb3970abf85c50caa8dfbf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ip HTTP/1.1
Host: httpbin.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://nztgp.idaefulpet.com
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 29 Mar 2024 14:12:17 GMT
content-type: application/json
content-length: 31
server: gunicorn/19.9.0
access-control-allow-origin: https://nztgp.idaefulpet.com
access-control-allow-credentials: true
X-Firefox-Spdy: h2

nztgp.idaefulpet.com/web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket

172.67.147.101

101 Switching Protocols

0 B

URL GET HTTP/1.1
nztgp.idaefulpet.com/web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://nztgp.idaefulpet.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: qAXwxIHZ0sMh6w1tsHhmLw==
DNT: 1
Connection: keep-alive, Upgrade
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Date: Fri, 29 Mar 2024 14:12:15 GMT
Connection: upgrade
Sec-WebSocket-Accept: 9YvBrSkNBG258gF/hp8I4CllaXQ=
Upgrade: websocket
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ogHZeCh%2BnrIhUDpRHUyVln9PQS%2FTIIetrzmImxSePvNqoWcwdF8FZQTUl%2FUIENGyCjXLpxlUV4stpuz%2BQpSBfDJsnGW3H%2BVt%2Bsjjg%2B7ayaIpN2Zl7jyCGkvggO80eExzvtjDaxar%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 86c0742bdfa70afe-OSL
alt-svc: h3=":443"; ma=86400

nztgp.idaefulpet.com/kliiORK8sWbt2NHfIeD4bPzTeXkBapskpJMmGP3d3qrqrB5hDvARGnHemy1L5vcZab230

172.67.147.101

200 OK

1.4 kB

URL GET HTTP/3
nztgp.idaefulpet.com/kliiORK8sWbt2NHfIeD4bPzTeXkBapskpJMmGP3d3qrqrB5hDvARGnHemy1L5vcZab230
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Size
1.4 kB (1400 bytes)
Hash
333ee830e5ab72c41dd9126a27b4d878
12d8d66ebb3076f3d6069e133c3212f97c8774e1
8702292cbc365e9f0488143e2b309b85efe09c61fd2e0a2e21c53735a309313c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /kliiORK8sWbt2NHfIeD4bPzTeXkBapskpJMmGP3d3qrqrB5hDvARGnHemy1L5vcZab230 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/png
content-length: 1400
content-disposition: inline; filename="kliiORK8sWbt2NHfIeD4bPzTeXkBapskpJMmGP3d3qrqrB5hDvARGnHemy1L5vcZab230"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HH%2BDV89NrREyrrev03JuHQwVw%2BdSuy53Du1s6i7VHv7Nbem5n8%2BMY3HKjDG85%2FBzhTO9L2nBITI%2FIG6D0dTHfKk74gXefi9bJLj7Vx%2Bx47HLF%2BeB1Qjmm3Al%2FfZ%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742d9b38b4fd-OSL

nztgp.idaefulpet.com/opotnpINEUUjWrQ31B03MIrvUZ6uA3gXQNuA5jgz0ijeGty93cES24LXvRzKnDtTe2cd195

172.67.147.101

200 OK

268 B

URL GET HTTP/3
nztgp.idaefulpet.com/opotnpINEUUjWrQ31B03MIrvUZ6uA3gXQNuA5jgz0ijeGty93cES24LXvRzKnDtTe2cd195
IP
172.67.147.101:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
268 B (268 bytes)
Hash
1318aafc1fb9ded0c623e5b9a557e6df
0917cdd7633cd1642b02b2b785416ec7e5106dcc
d86660a84daa211b121ec9fe0df83d6b945f61b888384391eabc7d6b4e941dc4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /opotnpINEUUjWrQ31B03MIrvUZ6uA3gXQNuA5jgz0ijeGty93cES24LXvRzKnDtTe2cd195 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Cookie: XSRF-TOKEN=eyJpdiI6ImlOdDNaS0YvUVJqOGg5dU9uZVJCTUE9PSIsInZhbHVlIjoiL29UUEtjUk02M0RDM0xFeHBldi9FQkpleGQzMW9CYnRyb3Zxem5hbHRXTmhkQWZqZHBpeVZMRDVwMHVOVHVoc09ITmdORDB5MjNiL09tQlJYZ1k0WUZRVEtMSDBwUjY4N0w1eHljMFp3c0pweTB6ODM4R2lxWmw4WFBPbjhtWFQiLCJtYWMiOiJiYTI4ZjVhMTY4MWY1MjFiMTRkNmFjZTg4NjdhOGY1ZjBjMzlkMjBkNDI1Mzc4NTUzMmI0NjJhMjZkNDRkMjk3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImtFV3dpMDV1eHJYVWpoazN2eFF6cHc9PSIsInZhbHVlIjoiSnlzdmFrd2J6ZlE3ZWMrbUdHUGt1cnBNdTB2ZnFoeGpTaVhzZVhFODZyQkFUYlJ4c3FMeWlJTkpVM2lncTUzNjdLeklMRW5IL2hOaWZSZ2tqRmwvbUducTVMZGVWL2R2anc3L0VjZjZnUDExN1gvdVJ4NitSZUEzS2pTUjhNMTEiLCJtYWMiOiJjZDczNDI2OGE3MjVmM2RmMzQyZjU4N2EyYjFmMDY5MzVlYmUxMGUzNmMyMDU3YjI2MGM5NTMzN2Y3YmJkY2QwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 14:12:15 GMT
content-type: image/svg+xml
content-disposition: inline; filename="opotnpINEUUjWrQ31B03MIrvUZ6uA3gXQNuA5jgz0ijeGty93cES24LXvRzKnDtTe2cd195"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jXvsWaBAW8HZ8f5LpUE07l3dS58mJ7dU9s99CVPPtosDeYe8TmeUZEmCS6DLeQbkMlhZ5pHP8tsiVCFBYk%2FWxmZET9vO2sJSI0lapOzt9LjBxmetxDpPh6ehkTYS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86c0742a4843b4fd-OSL
content-encoding: br

www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js

142.250.74.35

200 OK

511 kB

URL GET HTTP/2
www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js
IP
142.250.74.35:443
ASN
#15169 GOOGLE

Requested by
https://nztgp.idaefulpet.com/170200312004073CpfkAYYPAVXZRILDZXMJABBGCXZNIOUMHJIMAQKD?821573661771217626pVJJFUZIMYANECFXEETBFEBVMDCCDAYBFMFOFRUDJGUKAMI
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF3:56:10:42:A8:3C:BF:F5:89:9C:4C:C0:F8:E3:DC:C4:1C:E9:34:9E
ValidityMon, 26 Feb 2024 08:18:21 GMT - Mon, 20 May 2024 08:18:20 GMT

File type
JavaScript source, ASCII text, with very long lines (596)
Size
511 kB (511331 bytes)
Hash
48c590d47c8b1868cecab334e9a34cbe
5f1a9f94294ec337f657ac2ebec1c74e097ce5b3
f3756825df5194a174b7a55ebd3b484c276766eef21343d34b053b98ed386801

HTTP Headers

GET /recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://nztgp.idaefulpet.com
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 203410
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 28 Mar 2024 17:31:50 GMT
expires: Fri, 28 Mar 2025 17:31:50 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 25 Mar 2024 04:00:24 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 74426
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (22)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash