Report - minusdesigns.net/new/auth/animalcaresystems/5I84HB30HZ2Q2IIXS508D5/bWhhbGFsQGFuaW1hbGNhcmVzeXN0ZW1zLmNvbQ==

Report Overview

Submitted URL
minusdesigns.net/new/auth/animalcaresystems/5I84HB30HZ2Q2IIXS508D5/bWhhbGFsQGFuaW1hbGNhcmVzeXN0ZW1zLmNvbQ==
IP
104.21.1.60
ASN
#13335 CLOUDFLARENET
Submitted
2024-03-29 09:03:13
Access
public
Website Title
VhKqpeescF
Final URL
nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Tags
microsoft phishing
urlquery detections
Phishing - Microsoft

Detections

urlquery
25
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
www.google.com	7	1997-09-15	2015-05-10	2024-03-23	410 B	1.5 kB	142.250.74.164
minusdesigns.net	unknown	2021-03-23	2021-03-23	2024-03-28	561 B	1.4 kB	172.67.128.180
www.gstatic.com	unknown	2008-02-11	2016-07-26	2024-03-29	490 B	204 kB	142.250.74.35
httpbin.org	352975	2011-06-12	2013-07-23	2024-03-28	472 B	281 B	52.201.199.27
cdn.socket.io	62068	2010-04-18	2015-03-23	2024-03-28	417 B	46 kB	143.204.55.70
nztgp.idaefulpet.com	unknown	unknown	No data	No data	42 kB	863 kB	104.21.39.174
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20	2024-03-28	1.2 kB	48 kB	104.17.3.184
code.jquery.com	634	2005-12-10	2012-05-21	2024-03-28	842 B	63 kB	151.101.66.137

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (23)

	URL	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.6.0.min.js	90 kB	2023-03-07	2024-04-29
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.66.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:13 Last Seen2024-04-29 00:41:58 Times Seen262890 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	nztgp.idaefulpet.com/348e8h0o7hoFJxQclRij64Fmf3eaj0tHLY89110	108 kB	2024-03-11	2024-04-08
Pretty URL nztgp.idaefulpet.com/348e8h0o7hoFJxQclRij64Fmf3eaj0tHLY89110 IP 104.21.39.174 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-11 17:40:24 Last Seen2024-04-08 20:16:59 Times Seen193 Hash b08a5ca838b60a0807cc1101229805ff ce92c8047d2b3d092f9a1188ee864059f2750d76 8039faac672390bafcb7d6bf3f1686806437910ea12a9bcde5cc03299485a68f Loading...

	www.google.com/recaptcha/api.js	850 B	2024-03-29	2024-04-04
Pretty URL www.google.com/recaptcha/api.js IP 142.250.74.164 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-29 02:14:38 Last Seen2024-04-04 11:53:37 Times Seen364 Hash a0b2d07fa8cb78d8057423360e2b5843 df34550dcf9a4b220bf79330937fe2d6612b8700 ed504324f919ac243bf232dec1b6980738df27a04304a8c10098b198681044b3 Loading...

	unknown	9.5 kB	2024-03-29	2024-03-29
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash c01b77a10a977f8307ee1777d75c8e60 9c5a30706b4aad2c3befc55214d1e2d1a99ec586 3c2b4b4df01ac8dc5f4cdf79e8140792afb21097978f1fd3ddda1011f52bc433 Loading...

	nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA	59 kB	2024-03-29	2024-03-29
Pretty URL nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA IP 104.21.39.174 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 8b2eacc3a50b5fe440f0d5df5ad7885d b768066da017eb40b753c8a57dd4a5bb6e7c5682 e81a53f231665ed17eb5473f4d1def3e88fc87382cdfcc5f77769d74a4b7ae2a Loading...

	cdn.socket.io/4.6.0/socket.io.min.js	46 kB	2023-04-05	2024-04-28
Pretty URL cdn.socket.io/4.6.0/socket.io.min.js IP 143.204.55.70 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-05 03:09:50 Last Seen2024-04-28 23:34:04 Times Seen71112 Hash 80f5b8c6a9eeac15de93e5a112036a06 f7174635137d37581b11937fc90e9cb325077bce 0401de33701f1cad16ecf952899d23990b6437d0a5b7335524edf6bdfb932542 Loading...

	www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js	511 kB	2024-03-29	2024-04-04
Pretty URL www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js IP 142.250.74.35 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-29 02:01:50 Last Seen2024-04-04 11:53:37 Times Seen1826 Hash 48c590d47c8b1868cecab334e9a34cbe 5f1a9f94294ec337f657ac2ebec1c74e097ce5b3 f3756825df5194a174b7a55ebd3b484c276766eef21343d34b053b98ed386801 Loading...

		Size	First Seen	Last Seen
	#1 Eval - afe23beb116a13ebfab3a45ca9e173a3	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash afe23beb116a13ebfab3a45ca9e173a3 6917e52b4c6ce7afdf53bf758ceca3468f0cd277 bd7ddbfaeacf9d94d91e9f93ba684df1663d3574d651d09e98a4eff1c4a0b47f Loading...

	#2 Eval - 7ae4c7cd3879f2968ba1bc094fd1b722	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 7ae4c7cd3879f2968ba1bc094fd1b722 7880464f332d4f9880e22324eccd71ae5c5408df fdd6eed132c8c00790d7ccc6ae27c998d438ac7957bf520234d965d2db90f3b4 Loading...

	#3 Eval - 9e925e9341b490bfd3b4c4ca3b0c1ef2	4 B	2023-03-07	2024-04-28
Pretty Observations First Seen2023-03-07 01:03:43 Last Seen2024-04-28 23:08:11 Times Seen350272 Hash 9e925e9341b490bfd3b4c4ca3b0c1ef2 c2543fff3bfa6f144c2f06a7de6cd10c0b650cae 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408 Loading...

	#4 Eval - 47779b965288c039125cbc6119dc6eb4	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 47779b965288c039125cbc6119dc6eb4 9f998a65834b15e8f8fbda5f73c4a2e9f7737ab2 08a98f471aafb69d42e6d3750e05e31e590d97da51e3cfd1068b3a9d2af6bb9c Loading...

	#5 Eval - 73cf348667cf416c347dca99dbb9907e	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 73cf348667cf416c347dca99dbb9907e 05b8b7a0a720de1ffa2f5f1165db6f5e20c8a9fa 194cd3f5935d0279a6670d079fa15c0a8ec79c18f5f469f2217412107eb73a4b Loading...

	#6 Eval - 75d3d1d6b2c31cf397834d04e701fbec	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 75d3d1d6b2c31cf397834d04e701fbec 2eb9f3677d5cfe49f80aa05d1962446ea6c70b8f 752ce3c3f3d387b1221543b649ae33df5455e9c73032eca9dbc668c577363bac Loading...

	#7 Eval - 58551ed0ba5f88bed9cafb26a7cc6911	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 58551ed0ba5f88bed9cafb26a7cc6911 cc8ae1100129b6fe59f56808865756f96cf043b3 7f9ca4d5ca5557fc58df5d68f0668b7da061cfeac4dc15fbad3b6b6006cb045d Loading...

	#8 Eval - 50beee1bd86dcc70d020afb707fc0901	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 50beee1bd86dcc70d020afb707fc0901 04f44d289334da5900b13485930acbfd9df694d9 d93da3c0b11f61d6000bf41e09680a3d91f0991ffcbba5770732b859f279c518 Loading...

	#9 Eval - 190ef4edaf4aba9ce6829ea860b2cb65	61 B	2024-03-22	2024-04-04
Pretty Observations First Seen2024-03-22 10:35:33 Last Seen2024-04-04 15:56:11 Times Seen1815 Hash 190ef4edaf4aba9ce6829ea860b2cb65 84010fdde06dc04427d11aafdf4ba6495e14eff8 0334ef3ce9e77db17376ce3e320fe96b901743f1baa1096cc4066922ac672f8c Loading...

	#10 Eval - 4584eb5e2e7ce9e06d1b20b3f840589e	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 4584eb5e2e7ce9e06d1b20b3f840589e dfe323d81c9198918d1616ebc79f41ece62e96b6 1b4f666d38fbcb192225c4f5f8864c6c506e18588fd92f40bc8ea1cb5cebd92c Loading...

	#11 Eval - 66ec8ef1097464400067be039ba6397a	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 66ec8ef1097464400067be039ba6397a b396d329815cfb714805f1592b13e179c18b652c aa65aec88f634ab58e1500c7864ed11afc090ff8f7c65d281a0adab25274b593 Loading...

	#12 Eval - c65599921042026f2752a65a4f56bbea	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash c65599921042026f2752a65a4f56bbea 61612fdee82aa708fb75268470904b00fb984ac5 02781deff364355903937b8f57e06622d45662b46243a21fc609df0ba44f7571 Loading...

	#13 Eval - 9feef674f3bf2cf89c43553001c3f68a	28 B	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash 9feef674f3bf2cf89c43553001c3f68a fcd684228fe44f71885c7bc00495c51545a0f0b1 19f4d453af7c2d2b8e7ba2187e216eef9b5b3e8a5e2867064e76e9ec8543d436 Loading...

		Size	First Seen	Last Seen
	#1 Write - f28f84f0b6cd75d1cff59857e2a94c18	44 kB	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash f28f84f0b6cd75d1cff59857e2a94c18 64dd6ed6f6145b18280139a4658e928cbbdaf10c 11d635906f171d89f141ad798ec0eb8d921e8299b63b3359bd0f0af66f8a48ad Loading...

	#2 Write - b8e2c83c17788b8c8defdcbc038b053f	4.4 kB	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash b8e2c83c17788b8c8defdcbc038b053f ac598e184773087ff2eef8f88ad12a9e1910ddef d150c5b9f5d7c28dc782253bdec63c5e286c2758c2294ed8140389c52ca02d03 Loading...

	#3 Write - d365e2f4ce281fb23e4fdbe28aeb19aa	1.0 kB	2024-03-29	2024-03-29
Pretty Observations First Seen2024-03-29 10:03:20 Last Seen2024-03-29 10:03:20 Times Seen1 Hash d365e2f4ce281fb23e4fdbe28aeb19aa 71cc86c5ef89740b9ca19cfb98316707878129f7 5b7efbf2b27d2547769ee2d1017a544d2358f1e29fc3cdabf6a96d909f93b92f Loading...

HTTP Transactions (41)

URL IP Response Size

nztgp.idaefulpet.com/typsegra/

104.21.39.174

3.6 kB

URL
nztgp.idaefulpet.com/typsegra/
IP
104.21.39.174:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with very long lines (5986), with no line terminators
Size
3.6 kB (3600 bytes)
Hash
ac271069c53b73b3218634a2be7c7d15
2a7a877b6065822cfc28fa9d1cb4015d5ced979a
4d7bcf4f8f8964d4cd137939c09a7810feca88c1d5264a352f3f704552d31a72

HTTP Headers

GET /typsegra/ HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 29 Mar 2024 09:02:47 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G%2Fqfls%2BtsOFHSFGARjJdxJcsM0GN5xmE5JOumbhWRxIliw7xNMH4lPz7h8MWYHCbNI%2BEOWABWY3MIzuWokuNUM7Gz0HcuumCPc3cI6f8waJDpmEpNbF3NfTdavre"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImFSSWFxbnM5YjcrbXNOVnRYR211UHc9PSIsInZhbHVlIjoiN0JJQmwyUTZuQW4yS0pkbDVVTlZlUHk4YllhOGtjalhGd05ManN2SXdrbUlyczlPaXpiUTYxTWRZUUtvRDJDbThBLzNzQVdEU0xtWUFKVmtZM0MwQ3FTRGFZaGw0L0Z4eWNWMGhQdUptalFuM3V2N3diVUc3Ty9wSmhDUU5EWisiLCJtYWMiOiJlYjU4NGU1MjM5ODczYjhmMTE3YTQ1NTJjZjFmZGU5MDViYzI1NzkxOTY1Y2RkMWJkNWJhNjdhYWI0ZGY0MmFlIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:47 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6InhLd3dNMXQ0c3RCdEZWNExTSzNwUlE9PSIsInZhbHVlIjoiRU9PQWREcUs0alZmbTFzQnUvUzlWTUwySHdsVFZQY2p0T1pyQ1F5U0VhckxsdHd1NGtBazFZWmQ0WUM5cW9jWmo4TmdPakNlTVhnQkhqN3FpM0dYb0t1RmpmTGphZmE0bW5WakYzRld4NWR4dTFwV0xxZVlITlhWNGxmY2NUSUUiLCJtYWMiOiJlODMyY2NhMjU1NzFiYjBjMmQ1N2U4NWMzYTc4N2I0MzcyODNhNmQwMGExZTM3YTQ3ZDQ5NTYwNGVhNDEwZGU3IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:47 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86beaed63d54b4f4-OSL
content-encoding: br
X-Firefox-Spdy: h2

challenges.cloudflare.com/turnstile/v0/api.js?render=explicit

104.17.3.184

0 B

URL
challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
IP
104.17.3.184:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Fri, 29 Mar 2024 09:02:47 GMT
content-length: 0
location: /turnstile/v0/g/dc6b543c1346/api.js?render=explicit
cache-control: max-age=300, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 86beaeda0ecb5697-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.0.min.js

151.101.66.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.66.137:443
ASN
#54113 FASTLY

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 29 Mar 2024 09:02:47 GMT
age: 4160586
x-served-by: cache-lga21931-LGA, cache-hel1410020-HEL
x-cache: HIT, HIT
x-cache-hits: 22, 267138
x-timer: S1711702967.399544,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.0.min.js

151.101.66.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.66.137:443
ASN
#54113 FASTLY

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 29 Mar 2024 09:02:55 GMT
age: 4160594
x-served-by: cache-lga21931-LGA, cache-hel1410020-HEL
x-cache: HIT, HIT
x-cache-hits: 22, 267153
x-timer: S1711702975.148785,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

www.google.com/recaptcha/api.js

142.250.74.164

200 OK

1.0 kB

URL GET HTTP/2
www.google.com/recaptcha/api.js
IP
142.250.74.164:443
ASN
#15169 GOOGLE

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerGoogle Trust Services LLC
Subjectwww.google.com
Fingerprint32:A3:19:7A:6B:D5:C7:5E:CA:7C:C8:08:79:14:56:FD:FC:3E:06:F0
ValidityMon, 26 Feb 2024 08:18:59 GMT - Mon, 20 May 2024 08:18:58 GMT

File type
gzip compressed data
Size
1.0 kB (1025 bytes)
Hash
41f38361b39e948f4bac9a680956a2bb
3af01d69b1440497e90da5ea117b04372294a520
5fc98e7ee5b4c6d7dcf942735cd666322bd976a071d214d912da292a3ccd7573

HTTP Headers

GET /recaptcha/api.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
expires: Fri, 29 Mar 2024 09:02:55 GMT
date: Fri, 29 Mar 2024 09:02:55 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

nztgp.idaefulpet.com/favicon.ico

104.21.39.174

404 Not Found

28 kB

URL GET HTTP/3
nztgp.idaefulpet.com/favicon.ico
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Targa image data - Mono 27904 x 96 x 16 +1 ""
Size
28 kB (28003 bytes)
Hash
9ad4c6097736c6deca64f7dcaf97adc5
a93a53bf8da983f3aa3909c3daf53619dacecbfc
ba7d4453a418478ecbfc9600093eef6d287421d298631e9107e057ca0b6beb54

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/typsegra/
Cookie: XSRF-TOKEN=eyJpdiI6ImFSSWFxbnM5YjcrbXNOVnRYR211UHc9PSIsInZhbHVlIjoiN0JJQmwyUTZuQW4yS0pkbDVVTlZlUHk4YllhOGtjalhGd05ManN2SXdrbUlyczlPaXpiUTYxTWRZUUtvRDJDbThBLzNzQVdEU0xtWUFKVmtZM0MwQ3FTRGFZaGw0L0Z4eWNWMGhQdUptalFuM3V2N3diVUc3Ty9wSmhDUU5EWisiLCJtYWMiOiJlYjU4NGU1MjM5ODczYjhmMTE3YTQ1NTJjZjFmZGU5MDViYzI1NzkxOTY1Y2RkMWJkNWJhNjdhYWI0ZGY0MmFlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InhLd3dNMXQ0c3RCdEZWNExTSzNwUlE9PSIsInZhbHVlIjoiRU9PQWREcUs0alZmbTFzQnUvUzlWTUwySHdsVFZQY2p0T1pyQ1F5U0VhckxsdHd1NGtBazFZWmQ0WUM5cW9jWmo4TmdPakNlTVhnQkhqN3FpM0dYb0t1RmpmTGphZmE0bW5WakYzRld4NWR4dTFwV0xxZVlITlhWNGxmY2NUSUUiLCJtYWMiOiJlODMyY2NhMjU1NzFiYjBjMmQ1N2U4NWMzYTc4N2I0MzcyODNhNmQwMGExZTM3YTQ3ZDQ5NTYwNGVhNDEwZGU3IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Fri, 29 Mar 2024 09:02:47 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G%2B3StOuvWQXdKU%2FCdU6RIOQEHlAmaLP8tv5ICBuuH0hsvCa7fJDnJUFAK2e%2FBzXekLjHAeU5AIGmDB4h7i7xnBPV6zcMJV7KhbPk2DtQvX0o7Wr90AZBwiQdr18o"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 86beaedb7f30b4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/uviexcExvHBgj5LDopA1SpukBTd012130

104.21.39.174

200 OK

231 B

URL GET HTTP/3
nztgp.idaefulpet.com/uviexcExvHBgj5LDopA1SpukBTd012130
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Size
231 B (231 bytes)
Hash
547988bac5584b4608466d761e16f370
c11bb71049702528402a31027f200184910a7e23
70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /uviexcExvHBgj5LDopA1SpukBTd012130 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: image/png
content-length: 231
content-disposition: inline; filename="uviexcExvHBgj5LDopA1SpukBTd012130"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iJv9SWkQCnIz73hXrRxbkTB6kpGXnWgzadK%2Brts%2B7b7YQqzxuijSwU9aDAcntHOybVihgseZG%2FJeADA%2F0R%2FwCXTK29pGCVgB8WZlLwsGJcb3gmgxvPmf%2Ft1tRD3S"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ad9e5b4ff-OSL

minusdesigns.net/new/auth/animalcaresystems/5I84HB30HZ2Q2IIXS508D5/bWhhbGFsQGFuaW1hbGNhcmVzeXN0ZW1zLmNvbQ==

172.67.128.180

728 B

URL
minusdesigns.net/new/auth/animalcaresystems/5I84HB30HZ2Q2IIXS508D5/bWhhbGFsQGFuaW1hbGNhcmVzeXN0ZW1zLmNvbQ==
IP
172.67.128.180:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
728 B (728 bytes)
Hash
7b741d6b97a0d8addc5d4c87da64118a
0a593a8c4ea41d79895c2edfc49ad5690be99695
a4bb1762933a8f07615958f27ed396eaf0b965961fc7b43e45bd7ca912c1050a

HTTP Headers

GET /new/auth/animalcaresystems/5I84HB30HZ2Q2IIXS508D5/bWhhbGFsQGFuaW1hbGNhcmVzeXN0ZW1zLmNvbQ== HTTP/1.1
Host: minusdesigns.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 29 Mar 2024 09:02:46 GMT
content-type: text/html; charset=UTF-8
refresh: 0;url=https://nztgp.idaefulpet.com/typsegra/#Hmhalal@animalcaresystems.com
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Db791m4je4eWOB%2BOCOdu2pTL2hkB3OA4n7x8bKoCBGSK0hxg439GMAZvWVMromvnuooSJaCJbee085l3JAhAH1ToVq53IQb4Fy4IAWv2gT%2FW67A7rCb3SqvAHEfm35HZfH7r"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 86beaed15d6b568a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1901509726:1711699813:5MJjiWpvUxoiaM1tRz9MdjTJOXJko_25UwpfG2cYpI8/86beaedb6fe95684/9ffd0a45cdc89e8

104.17.3.184

46 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1901509726:1711699813:5MJjiWpvUxoiaM1tRz9MdjTJOXJko_25UwpfG2cYpI8/86beaedb6fe95684/9ffd0a45cdc89e8
IP
104.17.3.184:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (3420), with no line terminators
Size
46 kB (46190 bytes)
Hash
03259ab03161fd25aefd700ec33e0c04
bc69436bf0ef70bf5de8b9fbb8c62fd30d022d85
afc3b2a7b77fbdaec5e897ddf16af8a088c86fb938661285a4680cb91cf54ce9

HTTP Headers

POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1901509726:1711699813:5MJjiWpvUxoiaM1tRz9MdjTJOXJko_25UwpfG2cYpI8/86beaedb6fe95684/9ffd0a45cdc89e8 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/p4o2s/0x4AAAAAAAVTPjIP4MmTkkbv/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 9ffd0a45cdc89e8
Content-Length: 35489
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:53 GMT
content-type: text/html; charset=UTF-8
cf-chl-out: 49S/3bAd77pX23hozxzUbPD2cGxyQcqwDVkmk9H0zT2+KglU2utGOWHVUimhqd1Del60oSRXCGhqhYFU5ox4VsoS7o/it4f+yvi40Tz4wk488EUAc5yT6f1mPeG2SvL7$Q/vgfWvYEpf1DpVzt98dgg==
cf-chl-out-s: 1hYjM3IIUWv9Y4U2l0ORfpTqy/O68VM45eWc75obZ0IqaeJS0B6qslkO3BqRS+KLe78QhYHjNub8RpJTnPkfFiv1lRLiJESUVsLtfi+Dzw6jWhdlEAo/Punq3oIJs+NNwugOn4CIPJAS4EipA4juxObHFrmU92wD3HPFpPvXRTwrCYJpYiBewFKZxhNYOQy8b24sHLYRD/a1rYoRbiQ4J5B2uQQxg4WxhggCF2N97okerC1SDYbjzgcy8tkHPb/DD7imYWZiSWoyWjc5tmOwZ1Xj5Arx2cwkFrnEp5LVnYWWoewjV8zOeUlrKKyQ9o8uLCH65s5Vw4ubz4hhcuxTaDywBTFopBq89IDdwuYoryl0MSzZOXYyjvU66LYF7LMfz2WByW/MmGKIXUlWl4nMtZ8rluzaScnelwt0csJbcdA9Pg3JY+U6pHezaaMgNdrj5C5bS2Mha54XP3R1u2pCZQmsBXrm0RF1M75ngDNqQV24UcpLijStoPRnu7ALP4+5ONaVWyTHbg8U9DF4MvdTsHmHIfuCtovpzClkPfKt7rdyj73OPOVGZ5Qrg1ibnf8MnsuPLvJseTVOnPgXJ7OK8BCu1KTqOsP2lmFT/Ju9gWeI6OXgrUyDLCtBNDpYwYMN$1OpFmWyKP14h/ofhA+6frQ==
server: cloudflare
cf-ray: 86beaeffca6c5684-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

nztgp.idaefulpet.com/56ZrdltV0EcggqmkYl23cgmUXaCst60

104.21.39.174

200 OK

29 kB

URL GET HTTP/3
nztgp.idaefulpet.com/56ZrdltV0EcggqmkYl23cgmUXaCst60
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Size
29 kB (28584 bytes)
Hash
17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /56ZrdltV0EcggqmkYl23cgmUXaCst60 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: font/woff2
content-length: 28584
content-disposition: inline; filename="56ZrdltV0EcggqmkYl23cgmUXaCst60"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pm4H5CzfOvcMGRpU1xktV85c85K8GZjkRbSWOITjdFoBYp%2BawU9dto%2BAREM4xIkH6F1HxiESrAmUcocIZR6KyJgVIcOUa8E7SHsJtqbRso2Y70Fs%2FvIc9eAZuJDX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ac9d8b4ff-OSL

nztgp.idaefulpet.com/238mVQcy3HDCPOGekeDpOo89ASs558Hxy70

104.21.39.174

200 OK

37 kB

URL GET HTTP/3
nztgp.idaefulpet.com/238mVQcy3HDCPOGekeDpOo89ASs558Hxy70
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format, TrueType, length 36696, version 1.0
Size
37 kB (36696 bytes)
Hash
a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /238mVQcy3HDCPOGekeDpOo89ASs558Hxy70 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: font/woff
content-length: 36696
content-disposition: inline; filename="238mVQcy3HDCPOGekeDpOo89ASs558Hxy70"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yzPZvhRwDlbPoC7KzDwRlpLqtU9h80N0VoFAW%2FsxsdZJ6giu%2BIysuInZ%2Fl%2BXzKUgIDTL1WI60yF0Z%2BK1TxIAJ%2B%2FzzreqrnoVyEn6YUqpkJUzt1%2BtTqlTJt%2FVp69O"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ac9d9b4ff-OSL

nztgp.idaefulpet.com/yzVEZMoPpz26As0784QkJNjop43

104.21.39.174

200 OK

36 kB

URL GET HTTP/3
nztgp.idaefulpet.com/yzVEZMoPpz26As0784QkJNjop43
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format, TrueType, length 35970, version 1.0
Size
36 kB (35970 bytes)
Hash
496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /yzVEZMoPpz26As0784QkJNjop43 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: font/woff
content-length: 35970
content-disposition: inline; filename="yzVEZMoPpz26As0784QkJNjop43"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0RIYv7Ym%2BSjjPFWSwASE%2FNtyLArw9%2B3%2B0mIRWN2qTFJ1ies74QCE0oiW%2B5YA6EpG2gklY8pt1PyHMC3kHi15T70gHHvKTi33VuQDI1Ab6wqEnL8WS6VD2nR5YA0r"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ac9d5b4ff-OSL

nztgp.idaefulpet.com/ijzejg8uoZAoyNo57BJOcYKmPab0OwWYnAhHR89VVgUJIPbjf3e4UzIG6ygtVDtab223

104.21.39.174

200 OK

1.4 kB

URL GET HTTP/3
nztgp.idaefulpet.com/ijzejg8uoZAoyNo57BJOcYKmPab0OwWYnAhHR89VVgUJIPbjf3e4UzIG6ygtVDtab223
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Size
1.4 kB (1400 bytes)
Hash
333ee830e5ab72c41dd9126a27b4d878
12d8d66ebb3076f3d6069e133c3212f97c8774e1
8702292cbc365e9f0488143e2b309b85efe09c61fd2e0a2e21c53735a309313c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ijzejg8uoZAoyNo57BJOcYKmPab0OwWYnAhHR89VVgUJIPbjf3e4UzIG6ygtVDtab223 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:56 GMT
content-type: image/png
content-length: 1400
content-disposition: inline; filename="ijzejg8uoZAoyNo57BJOcYKmPab0OwWYnAhHR89VVgUJIPbjf3e4UzIG6ygtVDtab223"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nuTnW5q9yxQvhPaZ1joaUPT2Cjl6zw5pET1tmtLDnLz3kwyXrm9KeFM4sEAS%2FppE%2F3VUXFIuOEY%2B8BQjgmQduSta8IfgtQeFCHSILc8PWbaGjOX3tF5sBQjB74tN"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0e8d55b4ff-OSL

nztgp.idaefulpet.com/typsegra/

104.21.39.174

51 kB

URL
nztgp.idaefulpet.com/typsegra/
IP
104.21.39.174:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with very long lines (1445), with CRLF line terminators
Size
51 kB (50929 bytes)
Hash
d1027fd025077c0f4abe406ecd91f305
137bd87eee270938e635d16359a5cef35680fb33
0386d5068fc263805de54ec288aaeed910328ac78259054ff52467d383d43856

HTTP Headers

GET /typsegra/ HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkNjSjJzUVJTcmFab0tsdTlNM0piVEE9PSIsInZhbHVlIjoibDZmR2FaSkNkMDVIN0M2VS82NGtWUFZSZHBUaFpmK2lKM1JnY3FxKytBc3Q1aWlpaWRuTEgxNTFUeWhIdk5lQW1XeE8rT0JyYnFqZXVqdXNxT1lodWo5N1gyOStoVTlpNC9xOExxU2ZsN1ZDajZqUGIweW9GWHBhMXF1T0hWaTciLCJtYWMiOiJlMWJlMDVjNzJkYWMxMWQ2YzBiNmFkYWFiY2I5NWZkYmMxYzM4ZDU4ZmRhZGY5ZWEwZjMzY2Y1M2ViMWQ0NTY1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjF2MEFqY0FldytVdW04U3Juc1llNlE9PSIsInZhbHVlIjoicGJyMjFhTnBrY3ZZSzZVdFNaVUlNVUhOcW0ybFE5Rkh3WVdsbU55eVhMcUR0Ly9JenRoVEQvY3BGRElCRFplanRDdlpEa0NaTkNjUU5aTWEwRnNOeFgwdm5NblQvbGFpY3FtUGViWnhNSTNPNVhrdm1GVERYQWVwaXVLaFR4d2UiLCJtYWMiOiJhOThiZDkwNjlhMWQxZTU1ODhhNTFmMmEyM2YwODRiZjEyZTFjYWI2YWY4OTYwNTI3NWJiZDYxNThkNTgyZGJjIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:54 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DPZDof6pM%2BB1b291Pr91WwiO%2BSP0aII104bF0364IgDz43%2B0uVjzB7%2FH3Q1ljrZi1tas5reU9sH67v1JIHpGHbYMifXGNNMLB%2FiQVP1meZiBISiW3WiYJbSewOfX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IndXd3lJSDczUWM3MVIrUjdIMEF3RlE9PSIsInZhbHVlIjoid3hIMm83a1QxcTBScjdzYUVmbW00ZXk0VHFRbUtWK2E3bDBxMjd3WWZ6SmZkUnJxVXZ4bTBva0FzaDFqWFZFU2UxU21HcVp3RDhkV3VvamFQN2pKSGZCOVU1MjRiVkk4alFLU2NidjdVdDBJM3ViZ0cwR3UwUCtTTU1IckNYaVIiLCJtYWMiOiJjYmMwYzA5M2NiOGU3MWNhOTZjOTMwODNjMTdiM2NmZGFiNWJkNDdmMGU3Njc2Mjk4YjUzMzE0NjlhN2UxZmVhIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:54 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IkdmUkkxdFFoYzJ2czMzSWVlRGFPMkE9PSIsInZhbHVlIjoibmM5Rzcxaldtam5hN05YcVd3OE94c2ZsbnVhTDlBNHFQL3pGalNyY2ZnamhCSE90MlFKdmhjc0hVT3B3bXg3amxCTHBBSnkzWjdFei9mZVFqV3dTTFFlZGJVZkhveUlZU0JOL3lLbmtOeVNvaGlPbVZYUmx1WkNiT1ppdElxSDMiLCJtYWMiOiI3YWM5NzljZTU1MGFjYjFjM2NjMjE5ZDhiYjE4NTkyOTViNjZhOWNiMWNjMTc0OWY1MTE5MmVmYjFjMWNiY2E4IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:54 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86beaf039b54b4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket

104.21.39.174

0 B

URL
nztgp.idaefulpet.com/web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket
IP
104.21.39.174:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://nztgp.idaefulpet.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: fl6pJ81HO4fhHH+wyMgiMw==
DNT: 1
Connection: keep-alive, Upgrade
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Date: Fri, 29 Mar 2024 09:02:56 GMT
Connection: upgrade
Sec-WebSocket-Accept: wvPZ7nd0RJU2JoSJKopAY+in0As=
Upgrade: websocket
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0tCT14cOZcWpo9x4anncJbBHuDZoDQW2OWu0SFDMeCZqVKTb6pt8TzwkRnercUr91PEoswGGyA0O7GVz7ZBbM96IUdWe0VU9f0aYyvlaoq0XB5cq8fzWPKS1F9NaRn0n%2FK0SWURFbg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 86beaf0d5a9a56c9-OSL
alt-svc: h3=":443"; ma=86400

nztgp.idaefulpet.com/efAFgaAd8IE0yZghGucmAS78pLAOEVMY9DQByLkl93

104.21.39.174

200 OK

93 kB

URL GET HTTP/3
nztgp.idaefulpet.com/efAFgaAd8IE0yZghGucmAS78pLAOEVMY9DQByLkl93
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Size
93 kB (93276 bytes)
Hash
bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /efAFgaAd8IE0yZghGucmAS78pLAOEVMY9DQByLkl93 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: font/woff2
content-length: 93276
content-disposition: inline; filename="efAFgaAd8IE0yZghGucmAS78pLAOEVMY9DQByLkl93"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tkjewKB8JuFTZiPUMZuuolcNTf1WUHxdhXewf9Q314w35P3xQ%2FDEEsCxwtAbgHYOlmrcKBr1WUArRYENsFwwqBxOjn3HAgUU%2Fbmgp9v8Rv7Ik%2BN2QsJisIKQzQ9M"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ad9e3b4ff-OSL

nztgp.idaefulpet.com/uvi0HFTrwmmagxxFjbKC0DOI7KFwAaTNV8JR3UxKtmnbtdFJPWtkE1aZJzhXLCV1eyUgZBAF9sZpwMsbef254

104.21.39.174

200 OK

71 kB

URL GET HTTP/3
nztgp.idaefulpet.com/uvi0HFTrwmmagxxFjbKC0DOI7KFwAaTNV8JR3UxKtmnbtdFJPWtkE1aZJzhXLCV1eyUgZBAF9sZpwMsbef254
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced
Size
71 kB (70712 bytes)
Hash
f70ff06d19498d80b130ec78176fd3ff
9d8a3b74c5164ff7ae2c7930b6d7b14707b404fc
df6dbab5251e56b405e48aaf57d3cd4188f073ffba71131fa6cd26e6742923ae

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /uvi0HFTrwmmagxxFjbKC0DOI7KFwAaTNV8JR3UxKtmnbtdFJPWtkE1aZJzhXLCV1eyUgZBAF9sZpwMsbef254 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:56 GMT
content-type: image/png
content-length: 70712
content-disposition: inline; filename="uvi0HFTrwmmagxxFjbKC0DOI7KFwAaTNV8JR3UxKtmnbtdFJPWtkE1aZJzhXLCV1eyUgZBAF9sZpwMsbef254"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=COZLDr86tnHcq4OCDHcQI5a18qYNs1PU09tTE4h42LYOxnBBBT6voEEt3FA2RUojyx3NI9D%2BD2adkiY%2FjKFRL4OW2DuknPLA323pO7KM27qdDa%2FxjS8rvYsL8RhW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0af9f8b4ff-OSL

nztgp.idaefulpet.com/ab95PCw75rsTef24

104.21.39.174

200 OK

13 kB

URL GET HTTP/3
nztgp.idaefulpet.com/ab95PCw75rsTef24
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
ASCII text, with very long lines (1437), with CRLF line terminators
Size
13 kB (12980 bytes)
Hash
0a40b289b9ecb589387f31cbd2807033
dbb02f7d438a952b55cab142749c648cd6417af5
c17e32e67edc46c2720b01a4a716996809ad8335c875f6980319a1440de6c245

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ab95PCw75rsTef24 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="ab95PCw75rsTef24"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IQybhNFTbUMrBE2NM2qOledttGZi3vEYqhJQedEYjFajaOuSvcDiXrztpCFLHttb%2B43OwWh4jFbpm%2FOTfENfOmHf6JqVL6V2QEEhZO4cRuDjf7HYKd7XwhbGKEY3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ac9d1b4ff-OSL
content-encoding: br

www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js

142.250.74.35

200 OK

203 kB

URL GET HTTP/2
www.gstatic.com/recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js
IP
142.250.74.35:443
ASN
#15169 GOOGLE

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
FingerprintF3:56:10:42:A8:3C:BF:F5:89:9C:4C:C0:F8:E3:DC:C4:1C:E9:34:9E
ValidityMon, 26 Feb 2024 08:18:21 GMT - Mon, 20 May 2024 08:18:20 GMT

File type
JavaScript source, ASCII text, with very long lines (596)
Size
203 kB (203410 bytes)
Hash
48c590d47c8b1868cecab334e9a34cbe
5f1a9f94294ec337f657ac2ebec1c74e097ce5b3
f3756825df5194a174b7a55ebd3b484c276766eef21343d34b053b98ed386801

HTTP Headers

GET /recaptcha/releases/moV1mTgQ6S91nuTnmll4Y9yf/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://nztgp.idaefulpet.com
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 203410
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 28 Mar 2024 17:31:50 GMT
expires: Fri, 28 Mar 2025 17:31:50 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 25 Mar 2024 04:00:24 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 55867
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

nztgp.idaefulpet.com/ricsgxQJuzCBnMvZL6MMxSwNvwdkIUuSbIwntVC5qvd

104.21.39.174

56 kB

URL
nztgp.idaefulpet.com/ricsgxQJuzCBnMvZL6MMxSwNvwdkIUuSbIwntVC5qvd
IP
104.21.39.174:0
ASN
#13335 CLOUDFLARENET

File type
JSON text data
Size
56 kB (56248 bytes)
Hash
5820854f62a6eb3d38ba7ba0d1b3ea75
639df0b84fe699b4a290a713fd6b9a94bd4deb95
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

POST /ricsgxQJuzCBnMvZL6MMxSwNvwdkIUuSbIwntVC5qvd HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/typsegra/
Content-Type: multipart/form-data; boundary=---------------------------345765989413488689553526947970
Content-Length: 1381
Origin: https://nztgp.idaefulpet.com
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImFSSWFxbnM5YjcrbXNOVnRYR211UHc9PSIsInZhbHVlIjoiN0JJQmwyUTZuQW4yS0pkbDVVTlZlUHk4YllhOGtjalhGd05ManN2SXdrbUlyczlPaXpiUTYxTWRZUUtvRDJDbThBLzNzQVdEU0xtWUFKVmtZM0MwQ3FTRGFZaGw0L0Z4eWNWMGhQdUptalFuM3V2N3diVUc3Ty9wSmhDUU5EWisiLCJtYWMiOiJlYjU4NGU1MjM5ODczYjhmMTE3YTQ1NTJjZjFmZGU5MDViYzI1NzkxOTY1Y2RkMWJkNWJhNjdhYWI0ZGY0MmFlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InhLd3dNMXQ0c3RCdEZWNExTSzNwUlE9PSIsInZhbHVlIjoiRU9PQWREcUs0alZmbTFzQnUvUzlWTUwySHdsVFZQY2p0T1pyQ1F5U0VhckxsdHd1NGtBazFZWmQ0WUM5cW9jWmo4TmdPakNlTVhnQkhqN3FpM0dYb0t1RmpmTGphZmE0bW5WakYzRld4NWR4dTFwV0xxZVlITlhWNGxmY2NUSUUiLCJtYWMiOiJlODMyY2NhMjU1NzFiYjBjMmQ1N2U4NWMzYTc4N2I0MzcyODNhNmQwMGExZTM3YTQ3ZDQ5NTYwNGVhNDEwZGU3IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:53 GMT
content-type: application/json
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FbuHtC%2B5kuHUEGmOfvVmn9GWlIDICO3XRPsTiHDBjjmJFPIBad9rzWlwge7Ux4VD5HiJOGFOG6WntD5aTC4GogP8Ko4XcF1fiGRCkIFzCs5Zc6V9EUxWGeAwzqEw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IkNjSjJzUVJTcmFab0tsdTlNM0piVEE9PSIsInZhbHVlIjoibDZmR2FaSkNkMDVIN0M2VS82NGtWUFZSZHBUaFpmK2lKM1JnY3FxKytBc3Q1aWlpaWRuTEgxNTFUeWhIdk5lQW1XeE8rT0JyYnFqZXVqdXNxT1lodWo5N1gyOStoVTlpNC9xOExxU2ZsN1ZDajZqUGIweW9GWHBhMXF1T0hWaTciLCJtYWMiOiJlMWJlMDVjNzJkYWMxMWQ2YzBiNmFkYWFiY2I5NWZkYmMxYzM4ZDU4ZmRhZGY5ZWEwZjMzY2Y1M2ViMWQ0NTY1IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:53 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IjF2MEFqY0FldytVdW04U3Juc1llNlE9PSIsInZhbHVlIjoicGJyMjFhTnBrY3ZZSzZVdFNaVUlNVUhOcW0ybFE5Rkh3WVdsbU55eVhMcUR0Ly9JenRoVEQvY3BGRElCRFplanRDdlpEa0NaTkNjUU5aTWEwRnNOeFgwdm5NblQvbGFpY3FtUGViWnhNSTNPNVhrdm1GVERYQWVwaXVLaFR4d2UiLCJtYWMiOiJhOThiZDkwNjlhMWQxZTU1ODhhNTFmMmEyM2YwODRiZjEyZTFjYWI2YWY4OTYwNTI3NWJiZDYxNThkNTgyZGJjIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:53 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86beaf001fe7b4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/favicon.ico

104.21.39.174

404 Not Found

34 B

URL GET HTTP/3
nztgp.idaefulpet.com/favicon.ico
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Targa image data - Mono 28265 x 14882 x 32 +29295 +26473 - 2-bit alpha - top "91.90.42.154""
Size
34 B (34 bytes)
Hash
5dbf10668b6282988198575142b2cd88
418b2c667ff883a2c3f73a368e66f3e2ce02291e
45763b69b16e4bbc331f0db48bc0c89ef25166fd0d74f205ea6f4011116ff2b2

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6Ilk1L09FTHRRWGFNeGJpNzE1dVltNWc9PSIsInZhbHVlIjoiWTN6d01XY3V2MlZYNTdhWWhXdlM4SXRWUTR2djlhY2NVcVk0dEx4SWlDSGlkL2lCWkRxQ2V4KzFZL2JLdGdnRjVEVi9lS3BrQVBKM3R3L0NuTDFKNkt1ZnNEeVV3bkx6eUNiT1o4dElpK2Nva3pRRmtjeEVyYnRaNWlZQUxIdnMiLCJtYWMiOiI1ZTg5NDhlMDY4ZWFmY2MzODMwMzNlN2Q3NTg1OWVjYTRhYjBhNTRkM2M5MzZlNzhiZDJlYTk0YTMwMWQ1OTFkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdOdXh2NVh4clR5YmJHKzNFMzVGRmc9PSIsInZhbHVlIjoiL1NtTlJXOFFHd2t1bm9VUFhiUTZHV3Z4UEdXdlY4U29FOTRKV3REeDBJd0krdHp5REE2OVBQWTB2a25ZdUpDeTM5N1VmUVdsdlpJa3ZNSk05UzZyQjVsOXdFM2UwbE8zSURNZEEwdGdNb2QyVjhpemFBNll5a09JSXpNOEJJS3AiLCJtYWMiOiJjZGFkZGRlNTQ2Yzc4ZjExYzg3ZjAyY2EyNGJmOWFlMTI0MzI3MWY4MzIwMGVlMjRiYjA1NDM1NzFkNmYyNzRmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Fri, 29 Mar 2024 09:02:57 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: max-age=14400
age: 10
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G%2B3StOuvWQXdKU%2FCdU6RIOQEHlAmaLP8tv5ICBuuH0hsvCa7fJDnJUFAK2e%2FBzXekLjHAeU5AIGmDB4h7i7xnBPV6zcMJV7KhbPk2DtQvX0o7Wr90AZBwiQdr18o"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 86beaf1ad85ab4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/34TVHGiqrcdwSU8912

104.21.39.174

200 OK

23 kB

URL GET HTTP/3
nztgp.idaefulpet.com/34TVHGiqrcdwSU8912
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
ASCII text, with very long lines (23398), with no line terminators
Size
23 kB (23398 bytes)
Hash
c1c51d30d5e7094136f2d828349e520f
10ae8971ad7a8798bc9732707fe4896b57541557
0c55057782e3b346c2b819574bfa916852bc8ac5bb4e01d56e8fbffc22043c98

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /34TVHGiqrcdwSU8912 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="34TVHGiqrcdwSU8912"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f%2BaB1qrPzmkbh4jsBQd1xoBgLN2h5IQEBMIN95z5%2BsyIqojvqSv6bSNmoYROrdPQRret9%2FR6haAmS6Uw1zTGQvFJv12%2BTNncen9UU%2FRkRuQ1VjBQfVUIgblugG3A"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ac9cdb4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/ghRSFy8WpoVinClmsc94vBJ4vBryXWH1C5mnp72S6EChxD0ID5DHnGK3xGsGef208

104.21.39.174

200 OK

50 kB

URL GET HTTP/3
nztgp.idaefulpet.com/ghRSFy8WpoVinClmsc94vBJ4vBryXWH1C5mnp72S6EChxD0ID5DHnGK3xGsGef208
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced
Size
50 kB (49602 bytes)
Hash
db783743cd246ff4d77f4a3694285989
b9466716904457641b7831868b47162d8d378d41
5913b1ec0fc58ab2bec576804b9e9b566a584ea3d21a1bf74a7b40051a447fdc

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ghRSFy8WpoVinClmsc94vBJ4vBryXWH1C5mnp72S6EChxD0ID5DHnGK3xGsGef208 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: image/png
content-length: 49602
content-disposition: inline; filename="ghRSFy8WpoVinClmsc94vBJ4vBryXWH1C5mnp72S6EChxD0ID5DHnGK3xGsGef208"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GQO0qJymeCRWUgK4xT%2FFk2ysrn7Yjry0G2CxS8d4Q%2FszzOUrUJ5cy6qeAqUOsPjK7QXBdIs1S4%2BQElXvvAxFm6lgfXApeE8JzCTHSJUV4wSVVSKTUAmLUWjd7R6F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ae9f1b4ff-OSL

nztgp.idaefulpet.com/wxH6wt5xVkH4xLS7X0OQmcX8Twj0DNPc6mnoxpbhX0IRvU9BhykqCghWrY90180

104.21.39.174

200 OK

2.9 kB

URL GET HTTP/3
nztgp.idaefulpet.com/wxH6wt5xVkH4xLS7X0OQmcX8Twj0DNPc6mnoxpbhX0IRvU9BhykqCghWrY90180
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
2.9 kB (2905 bytes)
Hash
e924de0d471df54b6280f3dc8b187cb8
857f03226070b502a9e06b4249710ec10be4c9e9
24ce135a31ce83ac3d62471fcc0e1a82ce6f1533c993ee59ca4e110d5f2fae33

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /wxH6wt5xVkH4xLS7X0OQmcX8Twj0DNPc6mnoxpbhX0IRvU9BhykqCghWrY90180 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:57 GMT
content-type: image/svg+xml
content-disposition: inline; filename="wxH6wt5xVkH4xLS7X0OQmcX8Twj0DNPc6mnoxpbhX0IRvU9BhykqCghWrY90180"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OhXu%2B4uuK4iqXHK1BM07WnadzR7YyRvs4XgwA6SeEltRZEYvBfjk%2BHhsoWhqLVDEGq5axG8o2kc77it5m5%2Bq5bQTWbms93ik9brk8BmrUcSmNbrSStpEpTjI9SL5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ae9edb4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/rsManandVPo2ZJk8Lvsor8xAMX46drauvzEpVAhbMMvOgktMNcd197

104.21.39.174

200 OK

268 B

URL GET HTTP/3
nztgp.idaefulpet.com/rsManandVPo2ZJk8Lvsor8xAMX46drauvzEpVAhbMMvOgktMNcd197
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
268 B (268 bytes)
Hash
1318aafc1fb9ded0c623e5b9a557e6df
0917cdd7633cd1642b02b2b785416ec7e5106dcc
d86660a84daa211b121ec9fe0df83d6b945f61b888384391eabc7d6b4e941dc4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /rsManandVPo2ZJk8Lvsor8xAMX46drauvzEpVAhbMMvOgktMNcd197 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: image/svg+xml
content-disposition: inline; filename="rsManandVPo2ZJk8Lvsor8xAMX46drauvzEpVAhbMMvOgktMNcd197"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XHo6lYiYG1koS1nIBc9vfUu9kmO%2Bro88vyxr2eyFIDtF8gscUvDjGIiPpFRY0KOjFGzIq%2BV3fr09B0s6yrrX3yR4XclbHuzmD28llXoV%2FCOAfi3gwJ7wA3zHI0tf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ae9efb4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/pwHDnAE0gTkmBMJlvBgKdx2UgHYVMjMpYKl2bzi06kYptmsP7Qz5Arvdi05

104.21.39.174

200 OK

91 B

URL POST HTTP/3
nztgp.idaefulpet.com/pwHDnAE0gTkmBMJlvBgKdx2UgHYVMjMpYKl2bzi06kYptmsP7Qz5Arvdi05
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
91 B (91 bytes)
Hash
348478242d981ddc47795f90e6f89d2a
8f862536625baf2d0eb45d44acc9802c71df79e1
99691950fad5cb4b6df0bab904cc60d404840fe839c3614ffb841898ecdb3ddb

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

POST /pwHDnAE0gTkmBMJlvBgKdx2UgHYVMjMpYKl2bzi06kYptmsP7Qz5Arvdi05 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 33
Origin: https://nztgp.idaefulpet.com
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: application/json
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7O4LTyP9m0ZExdJoLS%2FrELMkpjdy%2FQDoWDeNhdN3vBg3XDXM4tCXosEzQraMewkZrT0l52zmwoNSXLYqG%2BAjNiZ0oYUWGhqnfm1dwKRHROsgTPftJYmAoReIC0Mw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6Ilk1L09FTHRRWGFNeGJpNzE1dVltNWc9PSIsInZhbHVlIjoiWTN6d01XY3V2MlZYNTdhWWhXdlM4SXRWUTR2djlhY2NVcVk0dEx4SWlDSGlkL2lCWkRxQ2V4KzFZL2JLdGdnRjVEVi9lS3BrQVBKM3R3L0NuTDFKNkt1ZnNEeVV3bkx6eUNiT1o4dElpK2Nva3pRRmtjeEVyYnRaNWlZQUxIdnMiLCJtYWMiOiI1ZTg5NDhlMDY4ZWFmY2MzODMwMzNlN2Q3NTg1OWVjYTRhYjBhNTRkM2M5MzZlNzhiZDJlYTk0YTMwMWQ1OTFkIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:55 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IkdOdXh2NVh4clR5YmJHKzNFMzVGRmc9PSIsInZhbHVlIjoiL1NtTlJXOFFHd2t1bm9VUFhiUTZHV3Z4UEdXdlY4U29FOTRKV3REeDBJd0krdHp5REE2OVBQWTB2a25ZdUpDeTM5N1VmUVdsdlpJa3ZNSk05UzZyQjVsOXdFM2UwbE8zSURNZEEwdGdNb2QyVjhpemFBNll5a09JSXpNOEJJS3AiLCJtYWMiOiJjZGFkZGRlNTQ2Yzc4ZjExYzg3ZjAyY2EyNGJmOWFlMTI0MzI3MWY4MzIwMGVlMjRiYjA1NDM1NzFkNmYyNzRmIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:55 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86beaf0ceb8ab4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/klvoTUaF5eKQ9yIhvlHltkZKprAQMfHpisnVDklF1JQQWxmHkoJKKWVH9KDe2wx220

104.21.39.174

200 OK

1.9 kB

URL GET HTTP/3
nztgp.idaefulpet.com/klvoTUaF5eKQ9yIhvlHltkZKprAQMfHpisnVDklF1JQQWxmHkoJKKWVH9KDe2wx220
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
1.9 kB (1864 bytes)
Hash
4b5c228b4faba433d06ec569ed855b2d
a7d3882b93e332460e7c59510a6a811ef011983f
eb19d76cd1fad39abf0f2778991883a5cf9ff560117ce8f7c64124e71471b4ed

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /klvoTUaF5eKQ9yIhvlHltkZKprAQMfHpisnVDklF1JQQWxmHkoJKKWVH9KDe2wx220 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:56 GMT
content-type: image/svg+xml
content-disposition: inline; filename="klvoTUaF5eKQ9yIhvlHltkZKprAQMfHpisnVDklF1JQQWxmHkoJKKWVH9KDe2wx220"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FUYL1O%2FGNl2Qf3Eu5SnlIap9LnjafJ4ZmHYoKwvNea%2FrqDZwJRtm3Rmf%2BihLs5pjQDmHCavGMYulMUzVa8OAxUB07wueteBMXIZD5Y508eFA1hB1%2FbSoGI12tIxp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0e8d50b4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/opbVoP6VmDmbCqIKJuefRDep009j6OjBKN45140

104.21.39.174

200 OK

727 B

URL GET HTTP/3
nztgp.idaefulpet.com/opbVoP6VmDmbCqIKJuefRDep009j6OjBKN45140
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Size
727 B (727 bytes)
Hash
839cb0f55c3d2d5c2f740bda95cb2878
93f6fa3a2da8b7184d4b5c5f2065872793370c2e
40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /opbVoP6VmDmbCqIKJuefRDep009j6OjBKN45140 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: image/png
content-length: 727
content-disposition: inline; filename="opbVoP6VmDmbCqIKJuefRDep009j6OjBKN45140"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o5UqLSOHp5yIlQkLmCeVXC2sLdLKUrm8s265xtyiMxaundkaH4v1k2nGHlf8y0WSHzF0iMwIVpE4t%2FnNtID3eFScN7Ov2IgfLSsXoEF46xizvYkQOBOtP201DAIb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ad9e6b4ff-OSL

nztgp.idaefulpet.com/efGxcxQXTloziZSwCl14l3RakwKCxDPCijismTs8DizmWeoMoO2g78143

104.21.39.174

200 OK

270 B

URL GET HTTP/3
nztgp.idaefulpet.com/efGxcxQXTloziZSwCl14l3RakwKCxDPCijismTs8DizmWeoMoO2g78143
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
270 B (270 bytes)
Hash
0c09c5ea7c28d6feb4d124957dde0a0d
1b9efde2d8f0e2a3d9d5315117e597c2d622fc5e
b3c39d2c15327b7ae68940502a2d7bf457fe521e075e6e671d0340edc58bcb3a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /efGxcxQXTloziZSwCl14l3RakwKCxDPCijismTs8DizmWeoMoO2g78143 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: image/svg+xml
content-disposition: inline; filename="efGxcxQXTloziZSwCl14l3RakwKCxDPCijismTs8DizmWeoMoO2g78143"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QiwAWpqIoC9wL4kkaWxYIIJhJi19Q8Jfb2RUWQ5hfDcMX3KQdGZMarW9yWVYCeVuwvDXfbqFHGQgxNBZYscpb1DgETeGpkOhM7witTs1fGPRniHH7lndO%2B8%2FBwTo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ad9e8b4ff-OSL
content-encoding: br

httpbin.org/ip

52.201.199.27

200 OK

31 B

URL GET HTTP/2
httpbin.org/ip
IP
52.201.199.27:443
ASN
#14618 AMAZON-AES

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerAmazon
Subjecthttpbin.org
Fingerprint14:0C:C7:A8:EC:FA:7F:9C:9D:D2:B8:7E:C9:B8:93:3A:A1:11:F6:01
ValidityThu, 21 Sep 2023 00:00:00 GMT - Fri, 18 Oct 2024 23:59:59 GMT

File type
ASCII text, with no line terminators
Size
31 B (31 bytes)
Hash
b90b7b460267d7067015fd46f3cd1a1e
3c164e9136c246dffb5fb4ef3927dda99d880121
885fd87e71d0651d917c1483aaf061a95e9c52371afb3970abf85c50caa8dfbf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ip HTTP/1.1
Host: httpbin.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://nztgp.idaefulpet.com
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 29 Mar 2024 09:02:59 GMT
content-type: application/json
content-length: 31
server: gunicorn/19.9.0
access-control-allow-origin: https://nztgp.idaefulpet.com
access-control-allow-credentials: true
X-Firefox-Spdy: h2

nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA

104.21.39.174

200 OK

59 kB

URL User Request GET HTTP/3
nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
HTML document, ASCII text, with very long lines (58921), with CRLF line terminators
Size
59 kB (59288 bytes)
Hash
3d0ad3f70c3ed75365e98a74981cd651
bba82432f42b5540e37a146e2e178a0348d3011d
d232df08aff214de8d72db452be75f8c6d735081b0c6efc8488ac523dadc0543

HTTP Headers

GET /656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/typsegra/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImphT2JsRktaQUdwaEdyUUpEZmR2OUE9PSIsInZhbHVlIjoibHZyUXhZL3BnOEFRUE13WnpzQ0djMkgxNkVvM3JSSDhwc05kcUgvRlYra0liSXhIaWY1WURXRkNRMVVKYzZqTWd4SGZtVXJqZWQrY2pSd2JLTnhTZ09VS1RhVlR6Lzk4Z3BBZzR2L2ZHd1E1b2J1cTdwN2R1UWpXQXVib1NtN1IiLCJtYWMiOiJjM2MyNjVlODM4MDliYTgzNjQzMmQ3N2NhYTNmM2VhODUzN2QwZGNlNDc3OGQ1M2JhZTJhZjk1NWRlYzVkNTAyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkovS1JVTUxjL21BKzFmcytxQnFJd0E9PSIsInZhbHVlIjoiREJUb2lNSHA2SnhLbzN3c1ZpZTdHb0lqZC9kb3RjMTJ3R25rUHI2em1oWkUyTHYxbkQ1Z09lNkhCZlp4SVF2VXdvYWQydFdaRjdEUzBiMjJ4VERHUzFCVkhDS2theWE1eVg5TnF2TmhNa05QQVdHMWY1enVKdFJHem56U2FEQ2YiLCJtYWMiOiJjMWY0MmZjM2I4ZGJkM2E2NmI4NmE5NTA3YzI5YTE0MWY4NTI3YjgzMzZlODlmZGVhMmFhMjRlMjJjNzAwYTc0IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:54 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3dLo1ZVoyFXl5GItzD6eKl3SOZkSJHUORViS4kB4oxL7sFPgPWjrgQNso%2F%2BV%2FxilmlA2glotd8nfh2b95abKZbVizhvOsVapE1NjZVTm32m1%2B4eHceNGnxl1yUUU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:54 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:54 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86beaf07befdb4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/pq0NN1G7kxHJ12sRdm5duv40

104.21.39.174

200 OK

28 kB

URL GET HTTP/3
nztgp.idaefulpet.com/pq0NN1G7kxHJ12sRdm5duv40
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Size
28 kB (28000 bytes)
Hash
a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /pq0NN1G7kxHJ12sRdm5duv40 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: font/woff2
content-length: 28000
content-disposition: inline; filename="pq0NN1G7kxHJ12sRdm5duv40"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eKaBiNzuhH9X3eVJN6SzjlFj4%2BaHyYRLOjWvX%2BTh8HFpca3rZBItuKxx9QQVh1w7oJb6pTM4NWYslbXOwkYvNIoHFoxg%2Bl0UDoGy0rP0KLHgMQ4zxhPAMPg6ouWx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ac9d4b4ff-OSL

nztgp.idaefulpet.com/opzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxz1210csEibC8DNKk2zdEbovE58H0Kv7encd240

104.21.39.174

200 OK

30 kB

URL GET HTTP/3
nztgp.idaefulpet.com/opzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxz1210csEibC8DNKk2zdEbovE58H0Kv7encd240
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced
Size
30 kB (29796 bytes)
Hash
210433a8774859368f3a7b86d125a2a7
408bacddc39f12cad285579c102fe4a629862d88
9c6addfc339ce1c1d262290ab4cc2de8d38d4b54b11a8e85afd44fbb0acc2561

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /opzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxz1210csEibC8DNKk2zdEbovE58H0Kv7encd240 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:58 GMT
content-type: image/png
content-length: 29796
content-disposition: inline; filename="opzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxz1210csEibC8DNKk2zdEbovE58H0Kv7encd240"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gpx%2BayO68awY74f2zdn5%2BQ%2Fm1AVbOFFHnFhoWYNMvGcfaOyJ1SKozhBPNNxlwObeEPPgRMPbGhPLM9pecJm51V0ajL5vwt%2BqVxYcurVfUQwrO%2BNzaRrBRO10jA5t"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ae9f7b4ff-OSL

nztgp.idaefulpet.com/pwHDnAE0gTkmBMJlvBgKdx2UgHYVMjMpYKl2bzi06kYptmsP7Qz5Arvdi05

104.21.39.174

200 OK

20 B

URL POST HTTP/3
nztgp.idaefulpet.com/pwHDnAE0gTkmBMJlvBgKdx2UgHYVMjMpYKl2bzi06kYptmsP7Qz5Arvdi05
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
20 B (20 bytes)
Hash
0b35866f4a3aa4d34ce5dda2d14c2cd8
d2b80911f09c3106fdf0df9920f983945d644083
493851374626d927bfe1c7d084fa977a0e636c03f163fda258ab6b638edc2f0d

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

POST /pwHDnAE0gTkmBMJlvBgKdx2UgHYVMjMpYKl2bzi06kYptmsP7Qz5Arvdi05 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 33
Origin: https://nztgp.idaefulpet.com
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6Ilk1L09FTHRRWGFNeGJpNzE1dVltNWc9PSIsInZhbHVlIjoiWTN6d01XY3V2MlZYNTdhWWhXdlM4SXRWUTR2djlhY2NVcVk0dEx4SWlDSGlkL2lCWkRxQ2V4KzFZL2JLdGdnRjVEVi9lS3BrQVBKM3R3L0NuTDFKNkt1ZnNEeVV3bkx6eUNiT1o4dElpK2Nva3pRRmtjeEVyYnRaNWlZQUxIdnMiLCJtYWMiOiI1ZTg5NDhlMDY4ZWFmY2MzODMwMzNlN2Q3NTg1OWVjYTRhYjBhNTRkM2M5MzZlNzhiZDJlYTk0YTMwMWQ1OTFkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdOdXh2NVh4clR5YmJHKzNFMzVGRmc9PSIsInZhbHVlIjoiL1NtTlJXOFFHd2t1bm9VUFhiUTZHV3Z4UEdXdlY4U29FOTRKV3REeDBJd0krdHp5REE2OVBQWTB2a25ZdUpDeTM5N1VmUVdsdlpJa3ZNSk05UzZyQjVsOXdFM2UwbE8zSURNZEEwdGdNb2QyVjhpemFBNll5a09JSXpNOEJJS3AiLCJtYWMiOiJjZGFkZGRlNTQ2Yzc4ZjExYzg3ZjAyY2EyNGJmOWFlMTI0MzI3MWY4MzIwMGVlMjRiYjA1NDM1NzFkNmYyNzRmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:58 GMT
content-type: application/json
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=grq7dxk0BYxyLuaPGxIHOFi7PMAc14xDg37loOqj1mWrTtl2LO1kTgFWZr4uzGGtXRoKB930PDMCfjRb2hJwMZ3G6QuHqcdaznjkWHNSXlHP3FQyHvDHKjRiVNks"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImlLaWNiZXdsTWFaNUJISHNmQ2JCdFE9PSIsInZhbHVlIjoia3FTVlpCMURhZGFyQTZWaUVRQVhWdUNBY04vQnN3SHFRZVpkN2x5N0Z1ZTVlOGFocklTcHd1ckpEM3NJcUFKVFdjRk9wL20yOTQwcTBwUFh0cGozN0tEN3habSs5ZllxdnA5NjJ3REllVHR6ZGc2WVdjNGxVcWpGdTViOVFUWCsiLCJtYWMiOiI1OTg2YWIwZmJjMDA0ZjcxODJkMDkwYTFmYzdlNDdkNzFkNGIyNDdkOGNhMzA0NzlkMDRjMTVmYjQyY2EyNWZjIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:58 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6ImZpNVhUSkZ2MjJQSDU4ZGlrdFc1dHc9PSIsInZhbHVlIjoiTGxTZmpKZFpUT0ZmZkdqaElaQlVvb29zeWtZcklPcTRPcDZid0M3WGE4MHQyVTYrSmh5ZEhBckVmUDdQU0Z3Z05oUFhhSy9EOVZuNE1kdlZ3WnhMbW1KUWpidEpMWGNrN1ZkQ280TUVtV1AzcmFrMUlsTDBYK2orZ20xVnowUjQiLCJtYWMiOiI5OThhZTBlMzVhZmEwMTQ5MjdhMThkY2FhNWM3NjU1MjhlYWY5NTEwODE0NTVhYzAwYWE3YmUwODc4ZGEzOTRkIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:58 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86beaf1fbc76b4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/typsegra/?GHmhalal@animalcaresystems.com

104.21.39.174

302 Found

59 kB

URL User Request GET HTTP/3
nztgp.idaefulpet.com/typsegra/?GHmhalal@animalcaresystems.com
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type

Size
59 kB (59288 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /typsegra/?GHmhalal@animalcaresystems.com HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/typsegra/
Cookie: XSRF-TOKEN=eyJpdiI6IndXd3lJSDczUWM3MVIrUjdIMEF3RlE9PSIsInZhbHVlIjoid3hIMm83a1QxcTBScjdzYUVmbW00ZXk0VHFRbUtWK2E3bDBxMjd3WWZ6SmZkUnJxVXZ4bTBva0FzaDFqWFZFU2UxU21HcVp3RDhkV3VvamFQN2pKSGZCOVU1MjRiVkk4alFLU2NidjdVdDBJM3ViZ0cwR3UwUCtTTU1IckNYaVIiLCJtYWMiOiJjYmMwYzA5M2NiOGU3MWNhOTZjOTMwODNjMTdiM2NmZGFiNWJkNDdmMGU3Njc2Mjk4YjUzMzE0NjlhN2UxZmVhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdmUkkxdFFoYzJ2czMzSWVlRGFPMkE9PSIsInZhbHVlIjoibmM5Rzcxaldtam5hN05YcVd3OE94c2ZsbnVhTDlBNHFQL3pGalNyY2ZnamhCSE90MlFKdmhjc0hVT3B3bXg3amxCTHBBSnkzWjdFei9mZVFqV3dTTFFlZGJVZkhveUlZU0JOL3lLbmtOeVNvaGlPbVZYUmx1WkNiT1ppdElxSDMiLCJtYWMiOiI3YWM5NzljZTU1MGFjYjFjM2NjMjE5ZDhiYjE4NTkyOTViNjZhOWNiMWNjMTc0OWY1MTE5MmVmYjFjMWNiY2E4IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 302 Found
date: Fri, 29 Mar 2024 09:02:54 GMT
content-type: text/html; charset=UTF-8
location: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OjOMCafZLCTs3CjUEE5zCKGdFR6AJ6m5L1mgKZhMj9SUc5qnrEsmYDM0%2FlZ4qvrkd2qMq2ZTSyKnjWAydjljQ%2FhK3KZtfnwlhYrnNK%2B2uhqkAq4Hbcma1NfyjUj6"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImphT2JsRktaQUdwaEdyUUpEZmR2OUE9PSIsInZhbHVlIjoibHZyUXhZL3BnOEFRUE13WnpzQ0djMkgxNkVvM3JSSDhwc05kcUgvRlYra0liSXhIaWY1WURXRkNRMVVKYzZqTWd4SGZtVXJqZWQrY2pSd2JLTnhTZ09VS1RhVlR6Lzk4Z3BBZzR2L2ZHd1E1b2J1cTdwN2R1UWpXQXVib1NtN1IiLCJtYWMiOiJjM2MyNjVlODM4MDliYTgzNjQzMmQ3N2NhYTNmM2VhODUzN2QwZGNlNDc3OGQ1M2JhZTJhZjk1NWRlYzVkNTAyIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:54 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IkovS1JVTUxjL21BKzFmcytxQnFJd0E9PSIsInZhbHVlIjoiREJUb2lNSHA2SnhLbzN3c1ZpZTdHb0lqZC9kb3RjMTJ3R25rUHI2em1oWkUyTHYxbkQ1Z09lNkhCZlp4SVF2VXdvYWQydFdaRjdEUzBiMjJ4VERHUzFCVkhDS2theWE1eVg5TnF2TmhNa05QQVdHMWY1enVKdFJHem56U2FEQ2YiLCJtYWMiOiJjMWY0MmZjM2I4ZGJkM2E2NmI4NmE5NTA3YzI5YTE0MWY4NTI3YjgzMzZlODlmZGVhMmFhMjRlMjJjNzAwYTc0IiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:02:54 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86beaf05dd5bb4ff-OSL

nztgp.idaefulpet.com/348e8h0o7hoFJxQclRij64Fmf3eaj0tHLY89110

104.21.39.174

200 OK

108 kB

URL GET HTTP/3
nztgp.idaefulpet.com/348e8h0o7hoFJxQclRij64Fmf3eaj0tHLY89110
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type

Size
108 kB (108270 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /348e8h0o7hoFJxQclRij64Fmf3eaj0tHLY89110 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:57 GMT
content-type: application/javascript
content-disposition: inline; filename="348e8h0o7hoFJxQclRij64Fmf3eaj0tHLY89110"
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=krF07cOT4kDUZWe9D1Iprp1xxa4D4yqG0ZrMYgBj%2BFZqrVI%2FnZMbPdrGE%2BZn4cg3AgI9EX79kubCmNKccXBY3QXCE1yb%2F%2BOfnu2JQBOXmWBMiruBeXn%2FzicV0hNw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0af9f9b4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket

104.21.39.174

101 Switching Protocols

0 B

URL GET HTTP/1.1
nztgp.idaefulpet.com/web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /web6socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://nztgp.idaefulpet.com
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: fl6pJ81HO4fhHH+wyMgiMw==
DNT: 1
Connection: keep-alive, Upgrade
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

HTTP/1.1 101 Switching Protocols
Date: Fri, 29 Mar 2024 09:02:56 GMT
Connection: upgrade
Sec-WebSocket-Accept: wvPZ7nd0RJU2JoSJKopAY+in0As=
Upgrade: websocket
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0tCT14cOZcWpo9x4anncJbBHuDZoDQW2OWu0SFDMeCZqVKTb6pt8TzwkRnercUr91PEoswGGyA0O7GVz7ZBbM96IUdWe0VU9f0aYyvlaoq0XB5cq8fzWPKS1F9NaRn0n%2FK0SWURFbg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 86beaf0d5a9a56c9-OSL
alt-svc: h3=":443"; ma=86400

cdn.socket.io/4.6.0/socket.io.min.js

143.204.55.70

200 OK

46 kB

URL GET HTTP/2
cdn.socket.io/4.6.0/socket.io.min.js
IP
143.204.55.70:443
ASN
#16509 AMAZON-02

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerAmazon
Subjectcdn.socket.io
FingerprintBB:7D:4E:26:70:F6:06:2A:12:E9:92:A8:F1:9F:CD:82:0B:BF:48:ED
ValiditySun, 22 Oct 2023 00:00:00 GMT - Sun, 17 Nov 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (45667)
Size
46 kB (45806 bytes)
Hash
80f5b8c6a9eeac15de93e5a112036a06
f7174635137d37581b11937fc90e9cb325077bce
0401de33701f1cad16ecf952899d23990b6437d0a5b7335524edf6bdfb932542

HTTP Headers

GET /4.6.0/socket.io.min.js HTTP/1.1
Host: cdn.socket.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
content-disposition: inline; filename="socket.io.min.js"
content-encoding: gzip
date: Mon, 15 Jan 2024 16:33:26 GMT
etag: W/"80f5b8c6a9eeac15de93e5a112036a06"
server: Vercel
strict-transport-security: max-age=63072000
x-vercel-cache: HIT
x-vercel-id: fra1::gsg9m-1705336406533-adf1f7d78a76
x-cache: Hit from cloudfront
via: 1.1 f66e3db0f0449307dba3fbf72bbf3bac.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: BehExazfAJw8wmUhZ_kt00ce-gRmQH-bjMxYGukNhjIZeLjz6BoBYw==
age: 6366569
X-Firefox-Spdy: h2

nztgp.idaefulpet.com/90LgnuxMRKgNLtiZObiai125X5Vig8d6yz80

104.21.39.174

200 OK

44 kB

URL GET HTTP/3
nztgp.idaefulpet.com/90LgnuxMRKgNLtiZObiai125X5Vig8d6yz80
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Size
44 kB (43596 bytes)
Hash
2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /90LgnuxMRKgNLtiZObiai125X5Vig8d6yz80 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: font/woff2
content-length: 43596
content-disposition: inline; filename="90LgnuxMRKgNLtiZObiai125X5Vig8d6yz80"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xlsRoUA05gKixMEcIekomT2y8WekGIxpKZksyWw8m9bUqL6AvZygitmvZJxb4RZqARyV3YY6UcstQu8Dgsetob3rDgxeLUh%2FtLxTqnrvdgkBSIdSF31DxkpyWUph"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ad9dfb4ff-OSL

nztgp.idaefulpet.com/klaJ0z87gJWPDewLzF1LbaK75A8K7cdDFYz9YC9q1GqsJfm1Lrg78165

104.21.39.174

200 OK

7.4 kB

URL GET HTTP/3
nztgp.idaefulpet.com/klaJ0z87gJWPDewLzF1LbaK75A8K7cdDFYz9YC9q1GqsJfm1Lrg78165
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
SVG Scalable Vector Graphics image
Size
7.4 kB (7390 bytes)
Hash
bca9b46fee32162356ba5b4783e614dc
cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5
fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /klaJ0z87gJWPDewLzF1LbaK75A8K7cdDFYz9YC9q1GqsJfm1Lrg78165 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6IlZheitvYSt3SFZtMjhBYUVNTlg1b1E9PSIsInZhbHVlIjoiZG5UV2lPMXF4WThLNXpsS0l6bGF3ZEhPaFYxYjMyU0o5aWN6YkRtbCtlTTNkUWJES1RMc2lhTG4yK1k1aWw1aUdtY2xienNkbkR4dkpCN2tTbGh5aGFuU3RFUWY2ZndySEhzbjNxY0ZzTy9VdUcvRHI2aVk3aHR4SlZWYlVaYnkiLCJtYWMiOiJmYTg2MGE1ZjNhZDM1NGIwMDRiM2YzMjNkMjE4NTA1NTEzZjU1NjkzYmEyYjYzM2Y4Y2MyNzc2NDhhOGJhYTE1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImEwdEZjYkV0V01CMVBYMzgxWkRqekE9PSIsInZhbHVlIjoieWs5bEo0TmRIV1lzdE5PbnQ2MmdTVlNSRld3bGhoa2xDaGx2eGRwcVJmTUMyRm90b0Mzdm1ZK3pJYWh1ZjNtekZoQVhHdUY4RElYa0tCN1VUMU1kNG82N3owbG9GeGh0dWRBYng3Tm10VUFMZlBjWHE3MzNvc0p0SjJIZE4zOWoiLCJtYWMiOiI3OGI2ZjcwNzhhODlhZThmNmEyNjg3ZjQ2YWYzM2M4YTRjYjYwNWExMDM3NjAzYWQ3MDEzMjBkMTNmYWM3MTM5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:02:55 GMT
content-type: image/svg+xml
content-disposition: inline; filename="klaJ0z87gJWPDewLzF1LbaK75A8K7cdDFYz9YC9q1GqsJfm1Lrg78165"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vGpfRBxXGWU3F5%2B3s0GEhcTTyiiWwIN3hgCn29%2FY5ZgP%2Fio40YYpprutl81ljz5ePfpwHpLJ5NplQS%2FYBETckN%2BRuJrBs8RH2aHVGqoGUvnwzCDHY7L0nsH%2FJd1D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
cf-ray: 86beaf0ad9e9b4ff-OSL
content-encoding: br

nztgp.idaefulpet.com/pwHDnAE0gTkmBMJlvBgKdx2UgHYVMjMpYKl2bzi06kYptmsP7Qz5Arvdi05

104.21.39.174

200 OK

1 B

URL POST HTTP/3
nztgp.idaefulpet.com/pwHDnAE0gTkmBMJlvBgKdx2UgHYVMjMpYKl2bzi06kYptmsP7Qz5Arvdi05
IP
104.21.39.174:443
ASN
#13335 CLOUDFLARENET

Requested by
https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Certificate
IssuerLet's Encrypt
Subjectidaefulpet.com
FingerprintEB:92:E7:76:C9:5E:A3:92:E3:A2:33:9C:05:88:CD:68:0E:FE:BC:8F
ValidityThu, 21 Mar 2024 12:19:22 GMT - Wed, 19 Jun 2024 12:19:21 GMT

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
c4ca4238a0b923820dcc509a6f75849b
356a192b7913b04c54574d18c28d46e6395428ab
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

POST /pwHDnAE0gTkmBMJlvBgKdx2UgHYVMjMpYKl2bzi06kYptmsP7Qz5Arvdi05 HTTP/1.1
Host: nztgp.idaefulpet.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 140
Origin: https://nztgp.idaefulpet.com
DNT: 1
Connection: keep-alive
Referer: https://nztgp.idaefulpet.com/656701934165400XgXHpgCACDVRIJTCMGXIWPOLSIGMIEOQMQU?xDRaevyEWiZsbWWLVhvBfQTffGKxqiTJNWDVEJBEPMRIUGKJMKWLPIILZOOLHDSA
Cookie: XSRF-TOKEN=eyJpdiI6ImlLaWNiZXdsTWFaNUJISHNmQ2JCdFE9PSIsInZhbHVlIjoia3FTVlpCMURhZGFyQTZWaUVRQVhWdUNBY04vQnN3SHFRZVpkN2x5N0Z1ZTVlOGFocklTcHd1ckpEM3NJcUFKVFdjRk9wL20yOTQwcTBwUFh0cGozN0tEN3habSs5ZllxdnA5NjJ3REllVHR6ZGc2WVdjNGxVcWpGdTViOVFUWCsiLCJtYWMiOiI1OTg2YWIwZmJjMDA0ZjcxODJkMDkwYTFmYzdlNDdkNzFkNGIyNDdkOGNhMzA0NzlkMDRjMTVmYjQyY2EyNWZjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImZpNVhUSkZ2MjJQSDU4ZGlrdFc1dHc9PSIsInZhbHVlIjoiTGxTZmpKZFpUT0ZmZkdqaElaQlVvb29zeWtZcklPcTRPcDZid0M3WGE4MHQyVTYrSmh5ZEhBckVmUDdQU0Z3Z05oUFhhSy9EOVZuNE1kdlZ3WnhMbW1KUWpidEpMWGNrN1ZkQ280TUVtV1AzcmFrMUlsTDBYK2orZ20xVnowUjQiLCJtYWMiOiI5OThhZTBlMzVhZmEwMTQ5MjdhMThkY2FhNWM3NjU1MjhlYWY5NTEwODE0NTVhYzAwYWE3YmUwODc4ZGEzOTRkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 29 Mar 2024 09:03:02 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
vary: Accept-Encoding
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L5mJ6WoxIxMuAtF1HUj4euKK5TXGbieT32g6zaWYTC6VVMkTmzFjF4DTNXNO0o7yG0HzmlxS1mTFumnpgNYQt3qIxU7XQCuzf9HNDBVpie7joPv%2Be2hl8JnBsBet"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6Ink2MEZpc0RSY2dmVzdiT2wzUk0yTHc9PSIsInZhbHVlIjoiRFZLT2dZRjQ5MVBmNVZBWk8veVBoeFhURW1FZkkxRnl0Wk5xUUQxSVc2aE9wOGZKMVJZQnpZM0dHcFJRQ0tjOFFIV1pON2lCMEt1VFd0ajhhdDdXRi9FK0lZM0xvYUdhMmJSYSsvb0h6OFkvVTh4d0U0RkxKNytpOEM0UEwvdTAiLCJtYWMiOiIzNTkxYzM1MzJkODFlYTU0NzBiNmZjMDllNjhhZTI5MjE1YTJlNmIyOWI1MTk4NmQwZGQ2NDE2MzNjNjdhZWNkIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:03:02 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IjRwNDBMQnhJeG1kZXFoaXd1SkFsZHc9PSIsInZhbHVlIjoiVzlMR2lucCtvUXBTY1FPMzcySnNZdUdBR0ZOTXdaK2psdXpsOUNVcHkvRld3VXczS2ZOOFk5andma1RBaFBGajA0WjZ4UjNZM1BSOXJpUm1DOU81Y0dOaDliSDMwSTNER3hScHViU1E0VHN6cWhGandXNnh4VlFDTFVaQTBSZ1kiLCJtYWMiOiIzMmNkMTM3Nzc1YmU1YjFiNmY5YjExYzUwODc3NWFmY2EwYjcyMjBmNzM3MmRhMjk3ZmZjMGRmMTg4M2VlY2EwIiwidGFnIjoiIn0%3D; expires=Fri, 29-Mar-2024 11:03:02 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
server: cloudflare
cf-ray: 86beaf385b42b4ff-OSL
content-encoding: br

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (23)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash