GET code.jquery.com/jquery-3.6.0.min.js
200 OK 90 kB URL GET code.jquery.com/jquery-3.6.0.min.js
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerSectigo Limited
Subject*.jquery.com
Fingerprint56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE
ValidityThu, 12 Jun 2025 00:00:00 GMT - Fri, 26 Jun 2026 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Wed, 02 Jul 2025 23:22:06 GMT
age: 3227527
x-served-by: cache-lga21931-LGA, cache-hel1410029-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 1055124
x-timer: S1751498527.663649,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
GET a1hgm.yjpocjj.es/GDSherpa-regular.woff
200 OK 37 kB URL GET a1hgm.yjpocjj.es/GDSherpa-regular.woff
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type Web Open Font Format, TrueType, length 36696, version 1.0
Hash a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-regular.woff HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: font/woff
content-length: 36696
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-regular.woff"
cf-cache-status: MISS
last-modified: Wed, 02 Jul 2025 23:22:07 GMT
accept-ranges: bytes
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hoWWv%2FjKxSvx9yd6r%2Bm57rMWU%2FrVTWJT6BTuo9KwDXpEFqhOcEsfqm58zTWd93B2f2TQ6g4DnrwRUQJ6qxkshOO6PNmk2pIeLv0%3D"}]}
cache-control: max-age=14400
cf-ray: 9591e21fde9c5685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2857&min_rtt=0&rtt_var=1697&sent=383&recv=180&lost=5&retrans=6&sent_bytes=369368&recv_bytes=36249&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24667&inflight_dur=273&x=40"
GET a1hgm.yjpocjj.es/GDSherpa-vf.woff2
200 OK 44 kB URL GET a1hgm.yjpocjj.es/GDSherpa-vf.woff2
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Hash 2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-vf.woff2 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: font/woff2
content-length: 43596
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-vf.woff2"
cf-cache-status: MISS
last-modified: Wed, 02 Jul 2025 23:22:07 GMT
accept-ranges: bytes
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=v3rHp0xo5AFQnpjdqolBrNm8gCqHR3mx3%2Fc6ArmEubVwphLfyCpiITcXdFuF%2FVV%2FWdwC9od4Y9Fhu3jwR7yXHNNlycvi5aLzidQ%3D"}]}
cache-control: max-age=14400
cf-ray: 9591e21fde9b5685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2408&min_rtt=0&rtt_var=1991&sent=435&recv=185&lost=5&retrans=6&sent_bytes=440149&recv_bytes=36489&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24850&inflight_dur=289&x=40"
GET a1hgm.yjpocjj.es/uvYrVpP9jHkytpRfpcIzOcUNSvDst2xAjp4aMacQKN8XV12130
200 OK 644 B URL GET a1hgm.yjpocjj.es/uvYrVpP9jHkytpRfpcIzOcUNSvDst2xAjp4aMacQKN8XV12130
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type RIFF (little-endian) data, Web/P image
Hash 541b83c2195088043337e4353b6fd60d
f09630596b6713217984785a64f6ea83e91b49c5
2658b8874f0d2a12e8726df78ac8954324c3bbe4695e66bdef89195fde64322f
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /uvYrVpP9jHkytpRfpcIzOcUNSvDst2xAjp4aMacQKN8XV12130 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: image/webp
content-length: 644
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="uvYrVpP9jHkytpRfpcIzOcUNSvDst2xAjp4aMacQKN8XV12130"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Ch5Hw%2B1WAAmnFDOjVvQ6apbE%2BYuwL8%2FEXPto8%2Fw9GUSyK9g76WShmY2Ks6gq0h%2BXMK3osgsenFFQncesYm0urpOvOf9KsjKAer0%3D"}]}
cf-ray: 9591e21fde9e5685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=984&min_rtt=0&rtt_var=843&sent=262&recv=163&lost=5&retrans=6&sent_bytes=221901&recv_bytes=35455&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24303&inflight_dur=187&x=40"
POST a1hgm.yjpocjj.es/vs44ynG7JCkzkiUOMrK3Pia486XuE0zFf8csBW7Jmy3Z3hn1guy4rOo1a
200 OK 1 B URL POST a1hgm.yjpocjj.es/vs44ynG7JCkzkiUOMrK3Pia486XuE0zFf8csBW7Jmy3Z3hn1guy4rOo1a
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type very short file (no magic)
Hash c4ca4238a0b923820dcc509a6f75849b
356a192b7913b04c54574d18c28d46e6395428ab
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
POST /vs44ynG7JCkzkiUOMrK3Pia486XuE0zFf8csBW7Jmy3Z3hn1guy4rOo1a HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 2832
Origin: https://a1hgm.yjpocjj.es
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:08 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e2296f345685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hZnYDztROWvpzXJMohV9R0BQw%2BIf7ODu2ZxTlrCmgyVg70ZLcr8r0wN%2FO2qm3k%2B%2FI5pvVQd2m1vwlzSXIq2YX%2FSX3wjeQNxSOTI%3D"}]}
cf-cache-status: DYNAMIC
set-cookie: XSRF-TOKEN=eyJpdiI6IjFrSC9uZVREMUpNbDNrUG10UVBiOEE9PSIsInZhbHVlIjoiN1hRa1Yza3U0OVZLelg1UHZPRGUvZ1lvNHcxc1hhcHIvQks4bno2ckR4YmdaTjloSkdQQUdTZW9YdHFVbFBCcHMxd3NhdUFIWGc4alo5dGpqY2h6UGV2bzJvNW5ia0NaNTFwRUJOdXRzRzhDS1pYZWJyUXRPbzJrNWJ3Nm55c2MiLCJtYWMiOiI1OTE4ZjQ5MWZlNzFmMjY3MDkwYzNmZTdjNDc4ZDg5MGM2ZmM3NzdlOGRhYWU0ODQ1ODRlMjk0MzkyNTZkMTkxIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:08 GMT
laravel_session=eyJpdiI6IlhmUHpiZFZBL0xraWlTVGRuaTV4YkE9PSIsInZhbHVlIjoiMFhlaWhuY0E2enIxNzhoNElDSVQ5V3hwZUNFcU05OUVHakwvQzFRVGxNMFRwa3FrcXI3bU9EdWFINVRoNW5pSG9lWmYwSXVmcERlbndKS01CWFY4c3QzNXl6cHJrdWdGWWdJNHZBOHJxbDRYc0FETGlBampoSy8vS1NtdklBWm0iLCJtYWMiOiI4YTVlMGRkMWE0MjE0NmI1ZTM2ZjM0ZWQ4ZmRkODVjNjVkYjgwMTAyNjVhNzZlZjcwODM5NzU1MzMyYzBkMWVmIiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:08 GMT
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=911&min_rtt=0&rtt_var=207&sent=692&recv=220&lost=5&retrans=6&sent_bytes=781006&recv_bytes=42975&delivery_rate=22269676&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=28136&unsent_bytes=0&cid=7f87c123822d7329&ts=25535&inflight_dur=332&x=40"
GET hsrdeai.net/cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d
200 OK 3.8 kB URL User Request GET hsrdeai.net/cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d
IP
ASN #48452 Traffic Broadband Communications Ltd.
Certificate IssuerLet's Encrypt
Subjecthsrdeai.net
FingerprintBA:94:2D:6B:0A:72:74:92:62:11:4D:E3:09:29:0B:B3:49:ED:46:A9
ValiditySat, 14 Jun 2025 20:36:21 GMT - Fri, 12 Sep 2025 20:36:20 GMT
File type HTML document, ASCII text, with very long lines (1377), with CRLF line terminators
Hash a99acfd6daf215ec4520aa6093bd89ec
f2e7bea7d794a05c0d1ef14cf5d6b889d12286ea
1eec449ffbc782705038fef96d97ea644f03cbaa16f8e9379a6ca6a76af0ef5b
GET /cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d HTTP/1.1
Host: hsrdeai.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 02 Jul 2025 23:21:41 GMT
Server: Apache
Access-Control-Allow-Origin: *
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1476054246:1751494731:s-dZyrRg4WPuC9pg8XvgxIiIvy-pnF4g82TwEnr0tXc/9591e18f3ab756b7/ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0
200 OK 285 kB URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1476054246:1751494731:s-dZyrRg4WPuC9pg8XvgxIiIvy-pnF4g82TwEnr0tXc/9591e18f3ab756b7/ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 285 kB (285324 bytes)
Hash c82972e533443bb952f383f07db4ac5d
d86c8584fde1104f323227cefb7c3041150c4935
dabd53737a7371312a10eefc11f99001f92ece40873190c6f55fbd96b9b3ab01
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1476054246:1751494731:s-dZyrRg4WPuC9pg8XvgxIiIvy-pnF4g82TwEnr0tXc/9591e18f3ab756b7/ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
cf-chl: ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 3383
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:21:44 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: dW0h/KUhuol/YGdTBHtQ09oog0A3+d70+wlQce7v8GM7w6bS9+Z3sBoSPziypzN1uc7zvUH7qOmpv3m8aKvSlBSXTHju+zNZNH7YeZWuigUKeH7nySlR3GD8XAXgzH2azscBqx3UZ38/k8U+LOlzuJh80fNgzcRhlleIVoV9MSLgs6763FX+33Xoq8bVD2O+XQo6BX+12UcnNLX8Ha2d61mJKIVEK0SDK5CaSci3Az8IXK0LEdnW0Uj1wcJTR0rTqajlbMkS86N2U8sIDRtqW2f/S/2SFyHaEYosFKCDdlqFeE9FFoEoJRsak2z+/oiPpvtzIPrQ3EY4aE/x3D+R6xBmxVbuV2rPQQrgr965huvUBmeBJ7tsM2qHBie71srmUbTutncYD4mljuBYYivb0JAcE7nDARfdPgDNQXirShUWh7Au7Dfpjc7iqZsrafHU6W/X5FEUrbYYtEZqIIIoh9r5YrkkWVMX7oi8k33jJ8ml80grjeuJCh6ShvASbJdddFMfys6RlI9ljPzdxhssVW+th+qS3HaW7DZdmYujPbZLVzgoKzXgf+MgMiHIf09p0tJlA+S2iFETAyZRusAlmQ9musbHhdqNbLcZkR/e4qL3o9mzXTSaZSWvKKGkbjQdE03zY9Do4+6B0jJP6sC+dVWrm8F8kN/HDmW7e8hS9u50ybDEWHVKcsGU4ssYMtM5FZa3klKxEDSrLaFWsWh6j4T0S0sjiD3bQe1Ncw+LZGM6thcWFpT9ahDiNd8QDLrSsIRgs+NHA1ZiRR7zazhMUg==$5xCoNa70dMT9vP8+0Pi1Zw==
priority: u=3,i=?0
server: cloudflare
cf-ray: 9591e1932e4d56b7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/9591e18f3ab756b7/1751498504206/Bku3q0wH7Y06yIO
200 OK 378 B URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/d/9591e18f3ab756b7/1751498504206/Bku3q0wH7Y06yIO
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type PNG image data, 8 x 91, 8-bit/color RGBA, non-interlaced
Hash 68e8b8fc0f0052b39b36f1a06e4c2f4b
b23c884488d6eaf87e4eab941ce5fb735b92c6d5
810403dc642653ff7e9fd652582472b392bfd2862f3a5fd2f78fb1b8aaff00b2
GET /cdn-cgi/challenge-platform/h/g/d/9591e18f3ab756b7/1751498504206/Bku3q0wH7Y06yIO HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:21:47 GMT
content-type: image/png
content-length: 378
priority: u=4,i=?0
server: cloudflare
cf-ray: 9591e1aaeab156b7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST a1hgm.yjpocjj.es/4pK163NVhm2T!J/
200 OK 90 B URL User Request POST a1hgm.yjpocjj.es/4pK163NVhm2T!J/
IP
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type HTML document, ASCII text, with no line terminators
Hash 7828f7ae07241c0978ce44e5cc4a0a83
a9c93817a15b03507c3c21021fba863d3ac62b7f
a65713ab569fbcda76f7d8cd7827b5cc51b58eb5d1b03b50c91924ba9c785fd9
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
POST /4pK163NVhm2T!J/ HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 1008
Origin: https://a1hgm.yjpocjj.es
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Cookie: XSRF-TOKEN=eyJpdiI6IlJtSjRSaWJZM0diZDl0OThvZExmUEE9PSIsInZhbHVlIjoiNFIza1lONEhrY3RFNmpiNjFrc0RKLzZrWmJ4RytrUmRiaWszVUdzL2duaFZENyszSGFIb2x5MnVnOFZPRXFIQ1ZOWFh6em5tY3UzRlV4U00zdC9abFZCQXdVdE04Z3pFZngrUDhwUkpMSEQ5dVpZMncwL0czRnR5WlJ5TTJMNWUiLCJtYWMiOiJlMWYwN2RlNjk2N2M2NTJhYTkwZDllNjExZWRjYWFkNGUwYTkwZTAyOWZhNGEwMTRiMDg4ZTMzNmYzY2U1MmM5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjJKaDFrRUhYRlI4S2dhUzlvaEJpamc9PSIsInZhbHVlIjoiZklsL2ZFUjgwVzFReG1CR3ZXRVUxeHpWTkNtbUJzMmdtUWRZdDZsUDhXYkRyMFU0UkVZVFBSYW5UaWp5UGtlVFRZbTRtNEJyWTgxT3VlZTZJeHZkQUJHWjM1d0kwUXBPcml2SWhzWGpaV0xoYmRibG9nWERBbTdGbVhwcitIQU4iLCJtYWMiOiJlZGZmMGY3NTFhOTM3MTIyZWU1ZWY2YmZhY2Y0NTMxYjVmMmJkNjkzZDhhZDUzZGVjN2QxMmU2MjQzOWE0NTk3IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:00 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e1f7ad075685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=04Fn4VVJWq23hQZyEAqA6JToMK926xBhoDJ3r1KnqWDW%2FUPi93PUih8AvFPf%2BhjY4alP8J4KTUj4hPppbhAXGGF9XyQNxtQWNl0%3D"}]}
cf-cache-status: DYNAMIC
set-cookie: XSRF-TOKEN=eyJpdiI6Im1oUkRYNmg2VDMwWVRDQ0toa09BNWc9PSIsInZhbHVlIjoiTTdjL3VTZ2JNSFd5Sm5lNGNTazhsUjlpc1BpYXJSeGxFZXA1Ui91eXRiK1BsYTVxV3lxRSt5MXM1YWhOeGpkY21FelJid041QkxKT3g2UTFNRjZvK1U1OVZ2dmhsNEpPc2NZMDNjZTdQQ29ac1RvZ2V3dEt4dkIyN20vb3FSTjEiLCJtYWMiOiJmMTJiZmIxYzM2NGNhMWQ5NWFkY2JhYmNjYmNmZTk3MGY3OWQxY2E2MmZiMTBjNmRiMjdkYzliNWY1NmQyZGQyIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:00 GMT
laravel_session=eyJpdiI6Ik1KMjVPajRGL0lPaU1SSk1MdmlXNGc9PSIsInZhbHVlIjoiZG9wYmVLMXdCZkpGdjdpdEFYdkhNTVJWNlRrMngwNll4UGt6UXlZaVlacFBnUTJXd0gyYmYycXpQeTZuVHdYVXhScENCRzlIZy9KemRDL2hIWDFIUGxWTExKQXA3TVpURmJMVG9XdCszNVVVbzkzQ0ZiS0lmV1dtQi9mQ0lyaVEiLCJtYWMiOiIwNTkzZWM1OWUxOTFiMTUyMmQ3Yzg2Y2QwMWYxNDk1YTE0YzRmNWEwODhjMmJjMWU2MmFlNjM2MTM2YzA5YmQwIiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:00 GMT
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3927&min_rtt=604&rtt_var=3262&sent=70&recv=93&lost=0&retrans=0&sent_bytes=8765&recv_bytes=8134&delivery_rate=527737&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=18705&unsent_bytes=0&cid=7f87c123822d7329&ts=17866&inflight_dur=63&x=40"
GET github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
302 Found 10 kB URL GET github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerSectigo Limited
Subjectgithub.com
FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A
ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: text/html; charset=utf-8
content-length: 0
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With,Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250702%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250702T232207Z&X-Amz-Expires=1800&X-Amz-Signature=36517d3a704e60afb20fbc295fd0e76c6fe20551020237902c7bab57c893a003&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
x-github-request-id: E1F7:EDE93:22B6921:23B12F6:6865BF1E
X-Firefox-Spdy: h2
GET a1hgm.yjpocjj.es/4pK163NVhm2T!J/
200 OK 26 kB URL User Request GET a1hgm.yjpocjj.es/4pK163NVhm2T!J/
IP
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type JavaScript source, ASCII text, with very long lines (24661), with CRLF line terminators
Hash d8dd043404d3eb54858ee6857e79c86e
6ae38e3f2e62600bad405a455921ab1b1ff1dcae
afcca55dfb29f0e33261985b523fbf32aded01232d99ebb861dd64e221029f0c
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
GET /4pK163NVhm2T!J/ HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjVTMjBUS1VwaGRsNkY5LytyQlZPQ1E9PSIsInZhbHVlIjoiT2t0VzY1b0hYS1MxUHZCRWNqc0dzUmlxdlIzRVIxTGkrOEZ6d0RwVEdtUm9KemErL3ZtcjVOenoxb1lIbVRMRDYybFVkeTBvZzhCVlB3M0lHelcrKzVWa0FFYVN1N0hnZXFvM1ZKTk1WemZtejRycklwQXAyLzB4V0lieWdnM20iLCJtYWMiOiI1MzgzMWYxOWM4NmY5OTNkZWQ3NjI2MjE3NjJhYzBjNzdmZjVhZjE2NDExYzRkMzcwOWFkODM5OWNhMmJlY2FlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImNHajduOHZuWjdBKzFwOGVLeUZ5UXc9PSIsInZhbHVlIjoiQ09aZUlpK2VCQ3VqRURCRVFJa010TG9vQTFoeEFTMituelB5c3hmMDBBbCttajNUS1hXcWVESDI3R0RIWk5NVUw0NUhVVU55RmhKOHB2RlJjMWRKSndBUWxmbXFENm5DYVBBZnFoM0lVdU1xeDBiUk92RFByOU93RGozMHQ3cDMiLCJtYWMiOiJkNzY5NDBiYTUyOGY3ZjY5Y2ZiMjE1YmI0NzBiMDYxZWU4NDA5MTUzZTVjMzJhMDc1Mzk4ZGIzMTVhOTYwOWUzIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:04 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e20c2daf5685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=tteH%2Bn1KOiCjyIdJFW1ht84O8Y%2B%2FIRWwl33OJdFwo8t1MpN0KlDDsBL4XDoYl355fguPPUR%2BdueQKuF9TT5VDuAsg%2BJev0Dg%2BB4%3D"}]}
cf-cache-status: DYNAMIC
set-cookie: XSRF-TOKEN=eyJpdiI6InNNUGNDRVhuVkZzS01EWTNrTmNDdkE9PSIsInZhbHVlIjoiRTZ5TnVST08vQ2VrdXZiZ0s3MFFadkl6bGxTUGhqbXdVY0hXcTZxbjZoUEZrb1hqS0ZVbFNXR3c1ZjN2OU9VRHQ5QmZ2TmVLNXRXZ2l3UjY4bHJWQ2lhYisrc3hnSG93RmxsRjV3SGQvSkNGOEVjSG8zQitabm1xUnYxZWZrZG8iLCJtYWMiOiIxMWUwZDY0M2U5ZWU0OTI4MDQ2OTZmYTViMDI5OGNjNjBlMzk1NTJmOTk1ZDBjZTE1YTc4OWI2NjIxY2IwNzdiIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:03 GMT
laravel_session=eyJpdiI6IjJnbngyQlY5WlhrYmJvNXJYVWVnT3c9PSIsInZhbHVlIjoiUDRzWU5peCtOOUc3Q0JQTHRNU3ZvZ1dFem05Qy9DQU9XbmhTekhDWE8vMzB6TjZGK05wREs1Y1pkeC9DS1hoQXBRL2lGQ1Y0aUx2TlV3TjBZUGpGOEoxOEl3Z2d1QmdocUFrUGxRbmJ2ck5weWJsSW9jaFArcWhBUi9YT3J1T2YiLCJtYWMiOiJhNWM5OTEzNWUyNjE2ZDI1ZGU2YzI1MjgzZGRmZDViNTBlYmNhYjE5NDk2Y2NhNWViOWYwMTY0YTEwYzNlYTkwIiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:03 GMT
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2469&min_rtt=604&rtt_var=2410&sent=85&recv=102&lost=0&retrans=0&sent_bytes=17869&recv_bytes=12396&delivery_rate=2170111&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=27705&unsent_bytes=0&cid=7f87c123822d7329&ts=20901&inflight_dur=72&x=40"
GET a1hgm.yjpocjj.es/ef8ZVvUQ8gG0SsDqvEaK7klvlPwstRuqXCTKF90150
200 OK 270 B URL GET a1hgm.yjpocjj.es/ef8ZVvUQ8gG0SsDqvEaK7klvlPwstRuqXCTKF90150
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type SVG Scalable Vector Graphics image
Hash 40eb39126300b56bf66c20ee75b54093
83678d94097257eb474713dec49e8094f49d2e2a
765709425a5b9209e875dccf2217d3161429d2d48159fc1df7b253b77c1574f4
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /ef8ZVvUQ8gG0SsDqvEaK7klvlPwstRuqXCTKF90150 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: image/svg+xml
cf-ray: 9591e21fdea05685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="ef8ZVvUQ8gG0SsDqvEaK7klvlPwstRuqXCTKF90150"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=q21uPf76VkxQFeL5R%2F4fGoRHaHhiBxEP%2BSaRiTFaRJzMQJkoQqlvS1PyhkIJTK2hwsa9R58GfoETEL5fi5qBDA7uKZh7SuhT"}]}
vary: accept-encoding
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=984&min_rtt=0&rtt_var=380&sent=270&recv=166&lost=5&retrans=6&sent_bytes=228186&recv_bytes=35588&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24313&inflight_dur=194&x=40"
GET a1hgm.yjpocjj.es/qrsLDauDG5ACMl4XBpX3NetX9X7cPYgYxAcsFSTFVdzdOdotst06heH0GJIxM4A3qyU1mxFQHxPef231
200 OK 9.6 kB URL GET a1hgm.yjpocjj.es/qrsLDauDG5ACMl4XBpX3NetX9X7cPYgYxAcsFSTFVdzdOdotst06heH0GJIxM4A3qyU1mxFQHxPef231
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type RIFF (little-endian) data, Web/P image
Hash 4946eb373b18d178c93d473489673bb6
16477acb73b63ca251d37401249e7e4515febd24
666bc574c9f3fb28a8ac626fa8105c187c2a313736494a06bd5a937473673c92
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /qrsLDauDG5ACMl4XBpX3NetX9X7cPYgYxAcsFSTFVdzdOdotst06heH0GJIxM4A3qyU1mxFQHxPef231 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: image/webp
content-length: 9648
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="qrsLDauDG5ACMl4XBpX3NetX9X7cPYgYxAcsFSTFVdzdOdotst06heH0GJIxM4A3qyU1mxFQHxPef231"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=87NrL1PeyNsGAp7OVq8g0AHipYNPO9xHRfMAS246C%2FUmwCTINGKKyJMgwjOo4u5Adz3xzyAhoz2b8pr5ZohKEiEQOxGFv0g5h1E%3D"}]}
cf-ray: 9591e21ffea75685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=984&min_rtt=0&rtt_var=380&sent=272&recv=166&lost=5&retrans=6&sent_bytes=229854&recv_bytes=35588&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24314&inflight_dur=194&x=40"
POST a1hgm.yjpocjj.es/hip7gQK5lVR4zdBP02eR21a0IfgJZ3htroKGmT7u4TSpt
200 OK 20 B URL POST a1hgm.yjpocjj.es/hip7gQK5lVR4zdBP02eR21a0IfgJZ3htroKGmT7u4TSpt
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
Hash 5820854f62a6eb3d38ba7ba0d1b3ea75
639df0b84fe699b4a290a713fd6b9a94bd4deb95
912d0c07da7bdb22cdae025b96da26d01523aaab7362edb28544e3949deb369d
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
POST /hip7gQK5lVR4zdBP02eR21a0IfgJZ3htroKGmT7u4TSpt HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Content-Type: multipart/form-data; boundary=---------------------------13346658891826477697555245243
Content-Length: 324
Origin: https://a1hgm.yjpocjj.es
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkhVNDBPZFNzL3phdVo4TForNjBpSUE9PSIsInZhbHVlIjoiSmR6RjNKbnpsbDhKbnhyb1g2MGxJZlV4czhIeGI4V0lWL3htbVFyTWlHZDh0bmJKQmsweE1tYkVjVE1uNmc3NVIrYWNhL1JoUnExRUZwQnlJU2NzQkxJYXVEano4VHFHRkQ0Uk1BMkRoL0xGbWc0WmZkZHlSQzJLMDF5MER0WDgiLCJtYWMiOiI2ZWI0YjdhZjhjZmZhZTM4YmY5YjZmYWViYzk3ZmM0ODdjYWFmMDRkZjVhMzFmMzYwYTAzMDBiOTE3MTEyMzkxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjV2cG1iV29uNGpmemwraFJiN3loL0E9PSIsInZhbHVlIjoibDQrMnd2Y3d1SUpoOFR0YWRLd2Qza3ZmZ2R4aXdlcEptNGRaL21Meko2MmdHVlhOQ2FBYTJIZGtJYXlNdDJhN3RqYXlEcWZYTGRwczVKemhnZGMvenQwYUJrd2xackFuS3ZRbmFSdkIrSnh4bEtvZE1WTFMvdlphWC9jaUJERU4iLCJtYWMiOiJjM2VmZjQ5ZTAzZTg4MTNjYmI3OTIyOGRiODg0YjU5NmU4OTNhZTNmMThhNWYwMGYxODk3NzBhZjE5YjE5YmNkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:03 GMT
content-type: application/json
cf-ray: 9591e2094d9d5685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ePpFp%2F1Mz9LwuVBU14HAhXZ%2B8swvjgYo6RIPlNXsRP63XEYHse6I0pa0eqwxbe1ScQnkI9G6f%2B7MTaNJTvoOVOvP6Z6hvQLClJM%3D"}]}
set-cookie: XSRF-TOKEN=eyJpdiI6IjVTMjBUS1VwaGRsNkY5LytyQlZPQ1E9PSIsInZhbHVlIjoiT2t0VzY1b0hYS1MxUHZCRWNqc0dzUmlxdlIzRVIxTGkrOEZ6d0RwVEdtUm9KemErL3ZtcjVOenoxb1lIbVRMRDYybFVkeTBvZzhCVlB3M0lHelcrKzVWa0FFYVN1N0hnZXFvM1ZKTk1WemZtejRycklwQXAyLzB4V0lieWdnM20iLCJtYWMiOiI1MzgzMWYxOWM4NmY5OTNkZWQ3NjI2MjE3NjJhYzBjNzdmZjVhZjE2NDExYzRkMzcwOWFkODM5OWNhMmJlY2FlIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:03 GMT
laravel_session=eyJpdiI6ImNHajduOHZuWjdBKzFwOGVLeUZ5UXc9PSIsInZhbHVlIjoiQ09aZUlpK2VCQ3VqRURCRVFJa010TG9vQTFoeEFTMituelB5c3hmMDBBbCttajNUS1hXcWVESDI3R0RIWk5NVUw0NUhVVU55RmhKOHB2RlJjMWRKSndBUWxmbXFENm5DYVBBZnFoM0lVdU1xeDBiUk92RFByOU93RGozMHQ3cDMiLCJtYWMiOiJkNzY5NDBiYTUyOGY3ZjY5Y2ZiMjE1YmI0NzBiMDYxZWU4NDA5MTUzZTVjMzJhMDc1Mzk4ZGIzMTVhOTYwOWUzIiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:03 GMT
vary: accept-encoding
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2685&min_rtt=604&rtt_var=2637&sent=82&recv=100&lost=0&retrans=0&sent_bytes=16480&recv_bytes=11419&delivery_rate=2170111&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=26342&unsent_bytes=0&cid=7f87c123822d7329&ts=20387&inflight_dur=70&x=40"
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:04 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 9591e2117af656a5-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 556962
expires: Mon, 22 Jun 2026 23:22:04 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ew3yQoznZJJ4wEuK4ka1CIyQBoRu21BYj%2Buji%2FtC%2BzGZWs5FC3M6yx%2BZyE2VqMYr83qwmpe76gott6FSwaNJcxrWeTQcwXqCaf2BuptkLDiTeSRXSz4V2ytI4WHbJU8nhfhaJByI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
200 OK 220 kB URL User Request GET a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
IP
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type HTML document, ASCII text, with very long lines (6813), with CRLF line terminators
Size 220 kB (220445 bytes)
Hash 133d9e26afc218af4f242f47edd67855
5d2bc1337dcc77f4e3a7fd5b68846d4ce24a8a7d
33ab8b8fab12ab6ca8b766d5511f9b55183595be3e46a0d173b263c80dddadb3
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
GET /u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Cookie: XSRF-TOKEN=eyJpdiI6IkVRZnN4QmpIUUM4eTg0VTNnQ2VkYXc9PSIsInZhbHVlIjoiTVF4VGR2eUNDYW03d20vSGIxa1lGS2JHaFVxSzZEYlFoTVg4UG1CMTM0SGhCU2FsT0FxVXBXNVVOejZqTGpHam1meTM2ZC9wNXZlMVk4UGVENjBiOEZNSjR5ZG15di96SHFaZytaYmdLQk1YMXo4TnQrK3h5VkZ0YUpPWHEvVnAiLCJtYWMiOiJmNDI3MTM3MTEwMzgyNGUzYzU5ZWJhNzc0MmEwNmJiNTZkMjUzNzUzYTc3MWNlMDk2OTNkOGQwYThhODYyM2Y1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IklGWER3djdzZUtScjRybVh6L3Y2OXc9PSIsInZhbHVlIjoiTkxnaENwMWhQM2JJRmJGc0tzMVVJaGVodExtY095NmkzNnc0K0xCUDJOVjAzaUpzN1VFTzkyQnE2QWxUeXZ5YTVxZ2JnRWoxb2d0RklMR3QrOElVd1JsT2lnQTdjL3JxeG1lUmZYaHlKeUVHQmF5Zko3VmNmb2ozOUNsNjZxSVgiLCJtYWMiOiJiNmEzNzQwZjZkMjY2NDZmOTBiMzAwZDQ3NmM0Y2NjOTI3NzhmOWYwMGU1YWI5YTllZGZkNzc4ZjkxOTAwNTY5IiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:05 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e2159e025685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=PHvwDpJV%2FPVaQcXJnr4eejFm3FFecx94FoI%2Fx0cMxTk4oE%2F9kL2UCEHbs6g4voh6sHzav4%2FrZ17g8balBwXgx%2Bqd6Yq8FAGWFpA%3D"}]}
cf-cache-status: DYNAMIC
set-cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:05 GMT
laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:05 GMT
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1586&min_rtt=339&rtt_var=1304&sent=108&recv=111&lost=0&retrans=0&sent_bytes=41053&recv_bytes=15553&delivery_rate=6017726&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=16846&unsent_bytes=0&cid=7f87c123822d7329&ts=22435&inflight_dur=101&x=40"
GET a1hgm.yjpocjj.es/yz4tYkcpV2wirb0wxFySmn2rIy0AphwmqThJhRFysx8nxwxDOab180
200 OK 2.9 kB URL GET a1hgm.yjpocjj.es/yz4tYkcpV2wirb0wxFySmn2rIy0AphwmqThJhRFysx8nxwxDOab180
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type SVG Scalable Vector Graphics image
Hash fe87496cc7a44412f7893a72099c120a
a0c1458c08a815df63d3cb0406d60be6607ca699
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /yz4tYkcpV2wirb0wxFySmn2rIy0AphwmqThJhRFysx8nxwxDOab180 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: image/svg+xml
cf-ray: 9591e21feea25685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="yz4tYkcpV2wirb0wxFySmn2rIy0AphwmqThJhRFysx8nxwxDOab180"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=TdD4yEHZIRjGTkUGJ2au2lBQ5dqKtcuXUuaIATyVSAuJRVaiwhHTfcL6ZTRheX9IZfL3UIVKKekoKFtbdxfLDMI%2BD7G3v2E8LTI%3D"}]}
vary: accept-encoding
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=980&min_rtt=0&rtt_var=496&sent=267&recv=165&lost=5&retrans=6&sent_bytes=226318&recv_bytes=35544&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24309&inflight_dur=192&x=40"
GET challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
302 Found 49 kB URL GET challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Wed, 02 Jul 2025 23:21:43 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/g/5f8a20c0c87c/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 9591e18d886a56ab-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
200 OK 27 kB URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type HTML document, ASCII text, with very long lines (26554), with no line terminators
Hash 16916fb49fa8f3e33137b58b097c0b1a
ce6cfad4a3cd46b8a460db6b24c130e922ac94a6
88caa4ec7e0d2f6625de136749e8663b0a9fbc6ed0ef0bbe68182902ca2e6b5a
GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/ HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:21:43 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
content-security-policy: default-src 'none'; script-src 'nonce-YRx1EiLiEfL7hLt8' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
origin-agent-cluster: ?1
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
referrer-policy: same-origin
document-policy: js-profiling
priority: u=4,i=?0
server: cloudflare
cf-ray: 9591e18f3ab756b7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1476054246:1751494731:s-dZyrRg4WPuC9pg8XvgxIiIvy-pnF4g82TwEnr0tXc/9591e18f3ab756b7/ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0
200 OK 4.9 kB URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1476054246:1751494731:s-dZyrRg4WPuC9pg8XvgxIiIvy-pnF4g82TwEnr0tXc/9591e18f3ab756b7/ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type ASCII text, with very long lines (4944), with no line terminators
Hash ef9865394f961de2bbc395296b6c2052
44e850b59423a82a23c2d415ff36bcc8b4890fc8
dad16beeb8e9a20b9161f8eaa8e3e2a978722d526c118464bc84fd3879921a46
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1476054246:1751494731:s-dZyrRg4WPuC9pg8XvgxIiIvy-pnF4g82TwEnr0tXc/9591e18f3ab756b7/ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
cf-chl: ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 44482
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:00 GMT
content-type: text/html; charset=UTF-8
cf-chl-out-s: /9g+a8QkvnevfTFm25oYAY5ZLrCYa2wlMmBipy0vj73cfrf96Qjh72jsvaIXOASpjhXa4qUN8Q1p4MJTjfutLgSY5k6VLyR9x72nBBuxvNtV0aFs2gJrg7GncDCNEx1nqeWSKl9QlHMVBS8c2dEXyApi3UPcjs/Xg6KDZ1uwINDeSyhRLo/BOrBTLKPixenvQhjgSzkLDGuF6F7hP/jhsOYBLobvfQKZ/qweSpReCcK4xS0t7m53yj8EEIiyMBqila5ra0Na5KSmKYm2QPmbFI4AiOFw6IaUtZDGErXPDr3zxRN1gmK0wTbE43WzRn1J2WTtXi/2ZT0X6rOfPZYCly4bFx/i5Cga5UI7s55tnFNgF58xYx10qT6UIZSv6Jvk9iK7cDLu7hJgzsuWS4fodxkolXczQbAtQS84NMhke2dF10/U2QkZNyB6vWf4+RNQmc1V9r0/ETgzPkqGv3PDlTgR1bI1MUThIo8guDZrOcghHjUYc2q5XIU4wrShmbjeuAf/H+O8plnlXXMrrRQkaKk5FQtEi6EVBrbkp24btfVQxCXdis16rXiRjzIQSHJI9j7bs6O0O/mfkdVmhIBBG2MEl4IrWhxWcmRduMR5PFCLH+5j5+XkUF1QW4AoH9UQY2DHuYoCjWk/65p9tf6kdJLcIpAgfNzzBK6R/YV6QblT4yqlzJCUpx9FqBsGyrANvQKeRdGO55KdEGJJ3/peN/1h0RXdQ89p+ewNO+9A7Fx1Ztjvr3wxNsIn+6XZwxokhhlreY0RUjo+7VspqeKxcc/E++ClSSemJBl3rqkV8hx67G1WMualofoo3nS8VSWv5FtogTsxdyHnDjdf34XY49GyHp6IMvGRvMPYMblujHeBmzSyRFC90NqUf23bNJZiLIdKf1XbaYMjBWQeEuHNscj/cxsvBcsA9Ya48sBttld0gDtagQLUG7ei4U4d+YEs75I0WTvfRBmDL+LkY+g8Z3BbUfD59k8RvliSlzot56gUIqmm8ms57jpaHYtEYL/BIsuDbo6DYhhcHEdUahVsBpGOmzgcQhjffk03J1atYebGI8NJwFqhqo5iT9SsjjMUP9UMDt2SiBfWasuP0nkPBWE/Zicy9BwhERvUPg3lUYbf/a5v2bFmhNo4a8j6LmbrifdsjLQoGLWZWP58xKrTGTfnyx4bSFHfHGLlH2bf9le/CkJ2CctFWowywvafLYLK+3v+MSPevUM68a8GVcEIPq6SFgh87EkODI3WYldTOj68/f+G1mRD0Oi2gjd5jh80iCb6qzOuKzXg6nO6+JVsCOMc+Wed/VfC7CHXlCzeknc=$bJ1wfEFPAsGuGu+DXDxrYg==
cf-chl-out: r6XINTE7Su/XLA5rVqLmJv5yPeeq/jHmb4FptEbxXv5xcybDPWWgc5nXIkHtZbKAHlhhopiBKd8uXqalU9ZQhw==$aIipHOa39UTzPtGbGLTTBQ==
priority: u=3,i=?0
server: cloudflare
cf-ray: 9591e1f68e2f56b7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET a1hgm.yjpocjj.es/stOfinxA7CvHEQtqSiH0dm44FbnChGGY7Mn76sJFMRmjfT6MkN453gNtC3jqEU1i1lztGGW4KECJOkbuAXQXO8COgh252
200 OK 18 kB URL GET a1hgm.yjpocjj.es/stOfinxA7CvHEQtqSiH0dm44FbnChGGY7Mn76sJFMRmjfT6MkN453gNtC3jqEU1i1lztGGW4KECJOkbuAXQXO8COgh252
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type RIFF (little-endian) data, Web/P image
Hash 4b52ecdc33382c9dca874f551990e704
8f3bf8e41cd4cdddb17836b261e73f827b84341b
cce050cc3b150c0b370751021bb15018ee2b64ac369e230fe3b571a9b00d4342
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /stOfinxA7CvHEQtqSiH0dm44FbnChGGY7Mn76sJFMRmjfT6MkN453gNtC3jqEU1i1lztGGW4KECJOkbuAXQXO8COgh252 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: image/webp
content-length: 17842
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="stOfinxA7CvHEQtqSiH0dm44FbnChGGY7Mn76sJFMRmjfT6MkN453gNtC3jqEU1i1lztGGW4KECJOkbuAXQXO8COgh252"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=zoOz6o4puNgZg%2B2jssSli2tLQjrBqDdLeKof5uCdQRAFEQAtvmR0UUYTd88b0DX65i%2BmzOiUKVc5bp1VwNSVsRv67VNJ2DhZWJI%3D"}]}
cf-ray: 9591e21ffea65685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1204&min_rtt=0&rtt_var=492&sent=283&recv=169&lost=5&retrans=6&sent_bytes=242562&recv_bytes=35725&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24322&inflight_dur=200&x=40"
GET aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
200 OK 1.9 kB URL GET aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
IP
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint38:05:DB:30:B5:83:1A:A0:A9:AD:24:B2:62:0F:E7:F6:60:9B:7C:00
ValidityTue, 29 Oct 2024 00:00:00 GMT - Wed, 29 Oct 2025 23:59:59 GMT
File type SVG Scalable Vector Graphics image
Hash bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 02 Jul 2025 23:22:08 GMT
content-type: image/svg+xml
content-length: 673
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Wed, 24 May 2023 10:11:46 GMT
etag: 0x8DB5C3F47E260FD
x-ms-request-id: 8f437342-e01e-0036-594f-e73999000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20250702T232208Z-17dfff74684hrqhchC1SVG8htg0000000h4g000000000z70
x-fd-int-roxy-purgeid: 4554691
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
200 OK 20 kB URL GET ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type Web Open Font Format (Version 2), TrueType, length 20416, version 2.197
Hash d99a7377dabb55772ca9f986b0a04b57
2b5fcd8431953c44e410d0489899e74f6d2cfecc
affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149
GET /assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://a1hgm.yjpocjj.es
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20416
date: Mon, 23 Jun 2025 13:02:15 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:56:28 GMT
etag: "d99a7377dabb55772ca9f986b0a04b57"
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
expires: Tue, 23 Jun 2026 13:02:15 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 0bc6ea800eda1e813056323cb53f8c70.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: 9NHmXM7SnZrfEMcnQiQqx_kcvRNNUjwH0dKvBOzlZlh1pu1j1dPPFA==
age: 814793
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9591e18f3ab756b7&lang=auto
200 OK 142 kB URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9591e18f3ab756b7&lang=auto
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size 142 kB (141520 bytes)
Hash 7582099f5c2e168e4a3babd944aa5ac6
40a8b6d3714ffa04220e20091da710c359ccd525
bc1ab188986402f8e136cf1baa230c7f23b7ea2d307004627c7d537cf3de7beb
GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=9591e18f3ab756b7&lang=auto HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:21:43 GMT
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
priority: u=3,i=?0
server: cloudflare
cf-ray: 9591e1902bd656b7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET a1hgm.yjpocjj.es/4pK163NVhm2T!J/
200 OK 6.8 kB URL User Request GET a1hgm.yjpocjj.es/4pK163NVhm2T!J/
IP
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type HTML document, ASCII text, with very long lines (2245), with CRLF line terminators
Hash afdb7354f3e02b7d5ef5a075610b95a6
2ea04b0c9959b1f0021eb456ecd2e318de23e988
0c7174f8dc726172521e6343d7b3730016f2256388fc843d53aeaba13ef13ba0
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
GET /4pK163NVhm2T!J/ HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Cookie: XSRF-TOKEN=eyJpdiI6Im1oUkRYNmg2VDMwWVRDQ0toa09BNWc9PSIsInZhbHVlIjoiTTdjL3VTZ2JNSFd5Sm5lNGNTazhsUjlpc1BpYXJSeGxFZXA1Ui91eXRiK1BsYTVxV3lxRSt5MXM1YWhOeGpkY21FelJid041QkxKT3g2UTFNRjZvK1U1OVZ2dmhsNEpPc2NZMDNjZTdQQ29ac1RvZ2V3dEt4dkIyN20vb3FSTjEiLCJtYWMiOiJmMTJiZmIxYzM2NGNhMWQ5NWFkY2JhYmNjYmNmZTk3MGY3OWQxY2E2MmZiMTBjNmRiMjdkYzliNWY1NmQyZGQyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik1KMjVPajRGL0lPaU1SSk1MdmlXNGc9PSIsInZhbHVlIjoiZG9wYmVLMXdCZkpGdjdpdEFYdkhNTVJWNlRrMngwNll4UGt6UXlZaVlacFBnUTJXd0gyYmYycXpQeTZuVHdYVXhScENCRzlIZy9KemRDL2hIWDFIUGxWTExKQXA3TVpURmJMVG9XdCszNVVVbzkzQ0ZiS0lmV1dtQi9mQ0lyaVEiLCJtYWMiOiIwNTkzZWM1OWUxOTFiMTUyMmQ3Yzg2Y2QwMWYxNDk1YTE0YzRmNWEwODhjMmJjMWU2MmFlNjM2MTM2YzA5YmQwIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:01 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e1fccd325685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=H9EX%2B40jrw6G1IoYrKfLMPGpgcZbzOIfq4%2B6tCYiGgEhuc%2BvDjFL2AU0pi6fIYa16ywt5lan5yCxTSia3uImmlMAvWd4j%2BFNN70%3D"}]}
cf-cache-status: DYNAMIC
set-cookie: XSRF-TOKEN=eyJpdiI6IkhVNDBPZFNzL3phdVo4TForNjBpSUE9PSIsInZhbHVlIjoiSmR6RjNKbnpsbDhKbnhyb1g2MGxJZlV4czhIeGI4V0lWL3htbVFyTWlHZDh0bmJKQmsweE1tYkVjVE1uNmc3NVIrYWNhL1JoUnExRUZwQnlJU2NzQkxJYXVEano4VHFHRkQ0Uk1BMkRoL0xGbWc0WmZkZHlSQzJLMDF5MER0WDgiLCJtYWMiOiI2ZWI0YjdhZjhjZmZhZTM4YmY5YjZmYWViYzk3ZmM0ODdjYWFmMDRkZjVhMzFmMzYwYTAzMDBiOTE3MTEyMzkxIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:01 GMT
laravel_session=eyJpdiI6IjV2cG1iV29uNGpmemwraFJiN3loL0E9PSIsInZhbHVlIjoibDQrMnd2Y3d1SUpoOFR0YWRLd2Qza3ZmZ2R4aXdlcEptNGRaL21Meko2MmdHVlhOQ2FBYTJIZGtJYXlNdDJhN3RqYXlEcWZYTGRwczVKemhnZGMvenQwYUJrd2xackFuS3ZRbmFSdkIrSnh4bEtvZE1WTFMvdlphWC9jaUJERU4iLCJtYWMiOiJjM2VmZjQ5ZTAzZTg4MTNjYmI3OTIyOGRiODg0YjU5NmU4OTNhZTNmMThhNWYwMGYxODk3NzBhZjE5YjE5YmNkIiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:01 GMT
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=3527&min_rtt=604&rtt_var=3247&sent=73&recv=95&lost=0&retrans=0&sent_bytes=10211&recv_bytes=9109&delivery_rate=711725&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=20125&unsent_bytes=0&cid=7f87c123822d7329&ts=18423&inflight_dur=65&x=40"
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:06 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 9591e21c9cc156a5-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 556964
expires: Mon, 22 Jun 2026 23:22:06 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ChOLsNpDxPFciqJDcfWfU4vhY1sxpt1WLulU8E12nXpesMgzu%2BofVoZwyvTVQmpes9HZxXVdgJ9KxOxn%2F2AEMZ1rNVV%2FX1XIpmD3dht0L236%2Bp2hsD9rxxyTOO5kanBnQX2wdaoS"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET a1hgm.yjpocjj.es/GDSherpa-bold.woff2
200 OK 28 kB URL GET a1hgm.yjpocjj.es/GDSherpa-bold.woff2
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Hash a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-bold.woff2 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: font/woff2
content-length: 28000
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-bold.woff2"
cf-cache-status: MISS
last-modified: Wed, 02 Jul 2025 23:22:07 GMT
accept-ranges: bytes
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Vc94cMrwNB8NADtYglrVJl7jbMq9XV4Ry1JiSnAvSXo85DjdicV6uSD4nNj4uHryrzD3eHP45vOcw0fy%2Ffj00liCbqBxYFWvth0%3D"}]}
cache-control: max-age=14400
cf-ray: 9591e21fbe955685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1231&min_rtt=0&rtt_var=423&sent=301&recv=170&lost=5&retrans=6&sent_bytes=264271&recv_bytes=35772&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24468&inflight_dur=206&x=40"
GET a1hgm.yjpocjj.es/GDSherpa-regular.woff2
200 OK 29 kB URL GET a1hgm.yjpocjj.es/GDSherpa-regular.woff2
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Hash 17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-regular.woff2 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: font/woff2
content-length: 28584
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-regular.woff2"
cf-cache-status: MISS
last-modified: Wed, 02 Jul 2025 23:22:07 GMT
accept-ranges: bytes
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=soLAWhE%2B6HTgYPopafif6Tn5%2FR04aQpeKbnVSMDEWWYAmURqjo4estlPh9FLPvg5wUAdYrqb%2FB2%2BI6Uoi6xpSoML0%2FY4BKPn10I%3D"}]}
cache-control: max-age=14400
cf-ray: 9591e21fce985685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2703&min_rtt=0&rtt_var=1981&sent=377&recv=178&lost=5&retrans=6&sent_bytes=360999&recv_bytes=36157&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24630&inflight_dur=267&x=40"
GET a1hgm.yjpocjj.es/ijxoZafsKDuxUqjsrPcbj6GUIUSmnhJ7NmBHuhIpjAkspqBG312209
200 OK 25 kB URL GET a1hgm.yjpocjj.es/ijxoZafsKDuxUqjsrPcbj6GUIUSmnhJ7NmBHuhIpjAkspqBG312209
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type RIFF (little-endian) data, Web/P image
Hash f9a795e2270664a7a169c73b6d84a575
0fbb60ab27ab88c064eb347d0722c8ed4cf5e8b8
d00203b2eea6e418c31baafa949ada5349a9f9b7e99fa003aec7406822693740
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /ijxoZafsKDuxUqjsrPcbj6GUIUSmnhJ7NmBHuhIpjAkspqBG312209 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: image/webp
content-length: 25216
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="ijxoZafsKDuxUqjsrPcbj6GUIUSmnhJ7NmBHuhIpjAkspqBG312209"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=stGxOSHUF0y7UI8i2sE6kAOvY8z1dFPo41ttAKOGBu7LftCQ%2BhNIubEZWJcRt%2F64STLdKA%2BLKKYhta1gqCcfWnC1V%2Bf1VK%2Bg%2FT4%3D"}]}
cf-ray: 9591e21ffea45685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1204&min_rtt=0&rtt_var=492&sent=291&recv=169&lost=5&retrans=6&sent_bytes=252401&recv_bytes=35725&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24324&inflight_dur=202&x=40"
GET get.geojs.io/v1/ip/geo.json
200 OK 335 B URL GET get.geojs.io/v1/ip/geo.json
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectgeojs.io
FingerprintA3:C6:58:F9:E8:49:67:61:59:AC:B4:7D:C8:2F:CB:C3:EC:B2:82:9B
ValidityThu, 26 Jun 2025 06:15:54 GMT - Wed, 24 Sep 2025 07:15:44 GMT
Hash 3d97dcaa4218acfe417b53e4b0c3bb65
55c94912bce8abc9dbdb153f537871b6674976a9
3273f73ed53e4f130fb419990b134c2dcb8e0720dea93bc34f3da97cf64a7925
GET /v1/ip/geo.json HTTP/1.1
Host: get.geojs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://a1hgm.yjpocjj.es
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 02 Jul 2025 23:22:08 GMT
content-type: application/json
server: cloudflare
x-request-id: 2fec01c26b0dcaacee3bc7935e786f03-ASH
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
geojs-backend: ash-01
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
x-content-type-options: nosniff
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZsX1LqrJl%2BzyAlAJ1%2F5jkoHEforD1R8qMT1ngbo8UFSz8XWs3umiT9RSWDVxZmQYKcbrNTYMvzWgcqhA301cG7C8XuFcBRw%3D"}]}
content-encoding: br
cf-ray: 9591e227db86712a-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET a1hgm.yjpocjj.es/favicon.ico
404 Not Found 0 B URL GET a1hgm.yjpocjj.es/favicon.ico
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /favicon.ico HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Cookie: XSRF-TOKEN=eyJpdiI6IkhVNDBPZFNzL3phdVo4TForNjBpSUE9PSIsInZhbHVlIjoiSmR6RjNKbnpsbDhKbnhyb1g2MGxJZlV4czhIeGI4V0lWL3htbVFyTWlHZDh0bmJKQmsweE1tYkVjVE1uNmc3NVIrYWNhL1JoUnExRUZwQnlJU2NzQkxJYXVEano4VHFHRkQ0Uk1BMkRoL0xGbWc0WmZkZHlSQzJLMDF5MER0WDgiLCJtYWMiOiI2ZWI0YjdhZjhjZmZhZTM4YmY5YjZmYWViYzk3ZmM0ODdjYWFmMDRkZjVhMzFmMzYwYTAzMDBiOTE3MTEyMzkxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjV2cG1iV29uNGpmemwraFJiN3loL0E9PSIsInZhbHVlIjoibDQrMnd2Y3d1SUpoOFR0YWRLd2Qza3ZmZ2R4aXdlcEptNGRaL21Meko2MmdHVlhOQ2FBYTJIZGtJYXlNdDJhN3RqYXlEcWZYTGRwczVKemhnZGMvenQwYUJrd2xackFuS3ZRbmFSdkIrSnh4bEtvZE1WTFMvdlphWC9jaUJERU4iLCJtYWMiOiJjM2VmZjQ5ZTAzZTg4MTNjYmI3OTIyOGRiODg0YjU5NmU4OTNhZTNmMThhNWYwMGYxODk3NzBhZjE5YjE5YmNkIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Wed, 02 Jul 2025 23:22:01 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e2026d665685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rHPYQQnetmNBK%2BSK2EijB0pO%2FoQpGyukgtJYhp3pRNVOdnjr0MwDBCW8oc3Ti9mBzhV31E5yjNoNbgrFQAmkjqa8V0%2BVQc9NCv0%3D"}]}
cf-cache-status: HIT
age: 17
vary: accept-encoding
cache-control: max-age=14400
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2928&min_rtt=604&rtt_var=2869&sent=79&recv=98&lost=0&retrans=0&sent_bytes=15815&recv_bytes=10075&delivery_rate=2170111&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=25703&unsent_bytes=0&cid=7f87c123822d7329&ts=18861&inflight_dur=68&x=40"
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:06 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 9591e21c3c7456a5-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 556964
expires: Mon, 22 Jun 2026 23:22:06 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jLWhDCc52mzB5x8%2BncSyEdyPAx%2FVPnjZE3fpQ5Glwtpl1TWF6IV2myydeobkO2RrsFcZPYDodcAB6A4HwYYIZzHljXUwsR5IpCGDSuH7AnJsLWmQwGor%2BFIcP2PqbObJsvFu9DIt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET a1hgm.yjpocjj.es/56AO8XuxyIWhfUt6720
200 OK 28 kB URL GET a1hgm.yjpocjj.es/56AO8XuxyIWhfUt6720
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type ASCII text, with very long lines (28186), with no line terminators
Hash a1606fe4c64f4a7649b295a56b8d4b47
ffea9bddd62c0ddfe5f3c314f885da0bc2cf8a1e
8734d2dcfa9c93df3e755660ba1c6bb54ed5fb2a7bfac1b0410d017f11129746
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /56AO8XuxyIWhfUt6720 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: text/css;charset=UTF-8
cf-ray: 9591e21fbe925685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="56AO8XuxyIWhfUt6720"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6nMgYRRaz7cHX29%2FYeI6CPKpWA%2Fh%2FZGWNsRVwF21OwEsDOJlFmymRF8qv7DE3f6bW8RZnNQmmJ88d%2FSQo7V79QXVhaAjl30RoL4%3D"}]}
vary: accept-encoding
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=415&min_rtt=0&rtt_var=214&sent=254&recv=160&lost=5&retrans=5&sent_bytes=214006&recv_bytes=35321&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=23964&inflight_dur=140&x=40"
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/9591e18f3ab756b7/1751498504204/c820a3a4f50787d2c9daf406a54b15a1de0306ef583f561238a5815f8006f876/KIltJMhK2Wib08_
401 Unauthorized 1 B URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/9591e18f3ab756b7/1751498504204/c820a3a4f50787d2c9daf406a54b15a1de0306ef583f561238a5815f8006f876/KIltJMhK2Wib08_
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type very short file (no magic)
Hash ff44570aca8241914870afbc310cdb85
58668e7669fd564d99db5d581fcdb6a5618440b5
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
GET /cdn-cgi/challenge-platform/h/g/pat/9591e18f3ab756b7/1751498504204/c820a3a4f50787d2c9daf406a54b15a1de0306ef583f561238a5815f8006f876/KIltJMhK2Wib08_ HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 401 Unauthorized
date: Wed, 02 Jul 2025 23:21:45 GMT
content-type: text/plain; charset=utf-8
content-length: 1
www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gyCCjpPUHh9LJ2vQGpUsVod4DBu9YP1YSOKWBX4AG-HYAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAscjm_UO_k901rNdCKgLw5bvI4i6M_jDNCIXpfs2LRbtxwLOrUyplqVvML_hVlB5tIDMuj0ihhaOFHose-Y0_UjQnNUGE_vol46VvGgscTMtTjU4xINriap8AMTIygvljEBt6my-nBwkUGhY3U9v5iKC-eWR5bTfvrqFsuIVxafkSfhHqDXB4KLGNjvOOV71GGJ9x4yxA-C2OcULZ1uDDKuvAaMhuiWdF6OzSTXruP9yPg1vmuteavOW1re0YDbCbtK16PhHdSzWym7v_FrvId-2zf26j50FlTd_vl_DcKNDVCgWDoU0uX3cU6V3rSQoVXREEqPr-2ywSGru8ZuXRoQIDAQAB", max-age=20, PrivateToken challenge="AAIAHXNhdC5wYXQtaXNzdWVyLmNsb3VkZmxhcmUuY29tIMggo6T1B4fSydr0BqVLFaHeAwbvWD9WEjilgV-ABvh2ABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAsLS4HBnLGydwK-bLQGRCaoyMsrXBRrDgQVmxS06j3UF0nYSd6GdTGCKIu1WV60eg-tJtTttfEVq7wHVQf4vzjYBidmCh88ebzxKv2GB6PESSodf5MsEup9xd5dxpkYScgL1CCJq89kRrOQ_CS61bvkL_oGyZf4ffqG5THgaOsopqj8dFLH6_SMy9yf8EgMYqpyjxfKsD-1_qb1m1DRjJEKPWKIGwmHXIKQJUqsxZFm4_Inwkxx7QMpVP4GyqlTxFVz7stWwJRSkMLHjEM_IWLUYfPhuwIUVqmRjGsY1n8flA1bRfxaWHNDxoi25-M2BKTP9NkNNJBbTKErhrZ9LGywIDAQAB", max-age=20, PrivateToken challenge="AAIALHBwLWlzc3Vlci1wcm9kdWN0aW9uLnJlc2VhcmNoLmNsb3VkZmxhcmUuY29tIMggo6T1B4fSydr0BqVLFaHeAwbvWD9WEjilgV-ABvh2ABljaGFsbGVuZ2VzLmNsb3VkZmxhcmUuY29t", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEArFBSpY0YPcNslVpklXsEb2gfZsCpmIVdQhoS4K7cHrhquWhyk4MLkyi7_s6aWrx_Xf7HlTYTdYhnNJYeSmBvNR-rT9Jr-vgHew2EKxCRkzFMKPiBFgHMw6CQNwFmH4vtDoB7QjzQGuScPRdzh7kPu8509ew2xkFnr9tjB-6n7HM01yE-AK-YLGAsO2pnr7E7uB1wVPOxxon_JAZ3bYOfTUgjOOdXlFNC8lcuocjbz6S74A95qx_Ud-iEvXXfOoBv5KLuG4xndLeZHQmGd8Zt7VxbSldzBAmsB7NLLExZxPD-x71RLAY9HVS2lcMOPbQ3diWMBwpfS95tytYOn-a5rwIDAQAB", max-age=20
priority: u=4,i=?0
server: cloudflare
cf-ray: 9591e19e6f6556b7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1476054246:1751494731:s-dZyrRg4WPuC9pg8XvgxIiIvy-pnF4g82TwEnr0tXc/9591e18f3ab756b7/ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0
200 OK 30 kB URL POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1476054246:1751494731:s-dZyrRg4WPuC9pg8XvgxIiIvy-pnF4g82TwEnr0tXc/9591e18f3ab756b7/ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type ASCII text, with very long lines (29696), with no line terminators
Hash d55818d79dbcb9bc0af158378a1471b4
b4af43740d32b05188ce585c2f1c77a4fa77fd35
eda9aa2067b885178f98c9d44f478eccd38ebb2cd777456cb1109a59dff66efb
POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1476054246:1751494731:s-dZyrRg4WPuC9pg8XvgxIiIvy-pnF4g82TwEnr0tXc/9591e18f3ab756b7/ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
cf-chl: ZaROWAdK2HJbBQTStMxRgB0SPaio_rSlC6KAqhI9mig-1751498503-1.2.1.1-pl1I0oNtI4SAxxl9xSme63nEoXHU4.s.DxoKkYpq6s8PTdV5SrLwYAtXPk281ZX0
cf-chl-ra: 0
Content-Type: text/plain;charset=UTF-8
Content-Length: 34796
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:21:50 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: xXe55nSXb9eiMHHN7yA8coVdFcUhZpB7DMncjKV3P1ZhC4lF4xuRg+QNak/gYORD$23RRZ99EgzgE+uH191TuuA==
priority: u=3,i=?0
server: cloudflare
cf-ray: 9591e1bae8bc56b7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET a1hgm.yjpocjj.es/4pK163NVhm2T!J/
200 OK 1.1 kB URL User Request GET a1hgm.yjpocjj.es/4pK163NVhm2T!J/
IP
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type HTML document, ASCII text, with very long lines (471)
Hash c6116a3785ef3b1c544600ffe5e9e511
7aff43aa808e1094cdd0b8a3953095ab91d51a7f
f33c6695010d859eaa5e6c27f820cfd2a76cd33164bd4bc25177358136f23d1d
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
urlquery phishing Phishing - Tycoon Phishing Kit
GET /4pK163NVhm2T!J/ HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hsrdeai.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 02 Jul 2025 23:21:43 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=s8LkvmX5MdnsRFbN8TTXXG%2FFuPKFTxmEsGsYZhwNgvsVheS44GE1N9yTjD0fEVMAQd%2FXrZoALkJKVZg8szleop3iiExY5I8Wvnc%3D"}]}
cf-cache-status: DYNAMIC
content-encoding: br
set-cookie: XSRF-TOKEN=eyJpdiI6IlJtSjRSaWJZM0diZDl0OThvZExmUEE9PSIsInZhbHVlIjoiNFIza1lONEhrY3RFNmpiNjFrc0RKLzZrWmJ4RytrUmRiaWszVUdzL2duaFZENyszSGFIb2x5MnVnOFZPRXFIQ1ZOWFh6em5tY3UzRlV4U00zdC9abFZCQXdVdE04Z3pFZngrUDhwUkpMSEQ5dVpZMncwL0czRnR5WlJ5TTJMNWUiLCJtYWMiOiJlMWYwN2RlNjk2N2M2NTJhYTkwZDllNjExZWRjYWFkNGUwYTkwZTAyOWZhNGEwMTRiMDg4ZTMzNmYzY2U1MmM5IiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:21:42 GMT
laravel_session=eyJpdiI6IjJKaDFrRUhYRlI4S2dhUzlvaEJpamc9PSIsInZhbHVlIjoiZklsL2ZFUjgwVzFReG1CR3ZXRVUxeHpWTkNtbUJzMmdtUWRZdDZsUDhXYkRyMFU0UkVZVFBSYW5UaWp5UGtlVFRZbTRtNEJyWTgxT3VlZTZJeHZkQUJHWjM1d0kwUXBPcml2SWhzWGpaV0xoYmRibG9nWERBbTdGbVhwcitIQU4iLCJtYWMiOiJlZGZmMGY3NTFhOTM3MTIyZWU1ZWY2YmZhY2Y0NTMxYjVmMmJkNjkzZDhhZDUzZGVjN2QxMmU2MjQzOWE0NTk3IiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:21:42 GMT
cf-ray: 9591e187a834b518-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET a1hgm.yjpocjj.es/favicon.ico
404 Not Found 0 B URL GET a1hgm.yjpocjj.es/favicon.ico
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /favicon.ico HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Cookie: XSRF-TOKEN=eyJpdiI6IlJtSjRSaWJZM0diZDl0OThvZExmUEE9PSIsInZhbHVlIjoiNFIza1lONEhrY3RFNmpiNjFrc0RKLzZrWmJ4RytrUmRiaWszVUdzL2duaFZENyszSGFIb2x5MnVnOFZPRXFIQ1ZOWFh6em5tY3UzRlV4U00zdC9abFZCQXdVdE04Z3pFZngrUDhwUkpMSEQ5dVpZMncwL0czRnR5WlJ5TTJMNWUiLCJtYWMiOiJlMWYwN2RlNjk2N2M2NTJhYTkwZDllNjExZWRjYWFkNGUwYTkwZTAyOWZhNGEwMTRiMDg4ZTMzNmYzY2U1MmM5IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjJKaDFrRUhYRlI4S2dhUzlvaEJpamc9PSIsInZhbHVlIjoiZklsL2ZFUjgwVzFReG1CR3ZXRVUxeHpWTkNtbUJzMmdtUWRZdDZsUDhXYkRyMFU0UkVZVFBSYW5UaWp5UGtlVFRZbTRtNEJyWTgxT3VlZTZJeHZkQUJHWjM1d0kwUXBPcml2SWhzWGpaV0xoYmRibG9nWERBbTdGbVhwcitIQU4iLCJtYWMiOiJlZGZmMGY3NTFhOTM3MTIyZWU1ZWY2YmZhY2Y0NTMxYjVmMmJkNjkzZDhhZDUzZGVjN2QxMmU2MjQzOWE0NTk3IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Wed, 02 Jul 2025 23:21:44 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e18e78bc5685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rHPYQQnetmNBK%2BSK2EijB0pO%2FoQpGyukgtJYhp3pRNVOdnjr0MwDBCW8oc3Ti9mBzhV31E5yjNoNbgrFQAmkjqa8V0%2BVQc9NCv0%3D"}]}
cf-cache-status: EXPIRED
age: 15
vary: accept-encoding
cache-control: max-age=14400
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=4232&min_rtt=604&rtt_var=3537&sent=68&recv=90&lost=0&retrans=0&sent_bytes=8090&recv_bytes=6058&delivery_rate=527737&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=18056&unsent_bytes=0&cid=7f87c123822d7329&ts=873&inflight_dur=41&x=40"
GET cdn.jsdelivr.net/npm/lz-string@1.4.4/libs/lz-string.min.js
200 OK 4.7 kB URL GET cdn.jsdelivr.net/npm/lz-string@1.4.4/libs/lz-string.min.js
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGlobalSign nv-sa
Subjectjsdelivr.net
Fingerprint21:17:81:78:41:C6:8F:86:D6:CF:8D:98:CC:74:A8:F1:03:F8:C9:D4
ValidityMon, 02 Jun 2025 15:43:52 GMT - Sat, 04 Jul 2026 15:43:51 GMT
File type JavaScript source, ASCII text, with very long lines (4718)
Hash 109c13d75d0b6fc6440d3e98f803d396
b69e7073bc2c1bc9a57aada4c73799d182ef8368
9d1a0ef07a2ea5faa8cd4afb60a0518075e6771e341e5ff4e0e481cefedeecbf
GET /npm/lz-string@1.4.4/libs/lz-string.min.js HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
x-jsd-version: 1.4.4
x-jsd-version-type: version
etag: W/"126f-tp5wc7wsG8mleq2kxzeZ0YLvg2g"
content-encoding: br
accept-ranges: bytes
date: Wed, 02 Jul 2025 23:22:04 GMT
age: 1906810
x-served-by: cache-fra-etou8220041-FRA, cache-hel1410025-HEL
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1425
X-Firefox-Spdy: h2
GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
200 OK 86 B URL GET challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
IP
Requested by https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type PNG image data, 2 x 2, 8-bit/color RGBA, non-interlaced
Hash 70c202196187ab3c11b4e094c20c6de1
9c52b959e74aee9d79cbc9f35d1f9f65a3b8c863
6255b9231d09ebe6aa1ac19ba46bdd81f3df58989c9ef2e11d6cd6e2e7b21643
GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/mcnpu/0x4AAAAAABgOLeQS9CXuCqY0/auto/fbE/new/normal/auto/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:21:43 GMT
content-type: image/png
content-length: 86
priority: u=4,i=?0
server: cloudflare
cf-ray: 9591e18febaa56b7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET a1hgm.yjpocjj.es/op2pP1GYGxl9WmZHjfSgE0YghBpAg8BgdEguCbODzBX6EJs3kYffbref198
200 OK 268 B URL GET a1hgm.yjpocjj.es/op2pP1GYGxl9WmZHjfSgE0YghBpAg8BgdEguCbODzBX6EJs3kYffbref198
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type SVG Scalable Vector Graphics image
Hash 59759b80e24a89c8cd029b14700e646d
651b1921c99e143d3c242de3faacfb9ad51dbb53
b02b5df3ecd59d6cd90c60878683477532cbfc24660028657f290bdc7bc774b5
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /op2pP1GYGxl9WmZHjfSgE0YghBpAg8BgdEguCbODzBX6EJs3kYffbref198 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: image/svg+xml
cf-ray: 9591e21feea35685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="op2pP1GYGxl9WmZHjfSgE0YghBpAg8BgdEguCbODzBX6EJs3kYffbref198"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1poDYnMVf4EU4WkigoME9PjlRRFYCGysrzePNjZGDSZUXkUBSxr3au3XQa7yWdxNIyGkimgjQAUI0MhS22bZLcMx%2BpFBbpKSN2k%3D"}]}
vary: accept-encoding
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=984&min_rtt=0&rtt_var=380&sent=270&recv=166&lost=5&retrans=6&sent_bytes=228186&recv_bytes=35588&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24313&inflight_dur=194&x=40"
GET bp6b7.onkttyhqjycn.es/taata@2l10f
200 OK 1 B URL GET bp6b7.onkttyhqjycn.es/taata@2l10f
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectonkttyhqjycn.es
Fingerprint07:F2:FA:DC:C1:F6:F0:9C:15:60:E4:65:57:05:DC:B0:0B:91:E5:AD
ValidityTue, 03 Jun 2025 23:28:03 GMT - Tue, 02 Sep 2025 00:24:30 GMT
File type very short file (no magic)
Hash cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
Quad9 DNS malicious Sinkholed
GET /taata@2l10f HTTP/1.1
Host: bp6b7.onkttyhqjycn.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/
Origin: https://a1hgm.yjpocjj.es
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 02 Jul 2025 23:22:03 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
access-control-allow-origin: *
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=fBhlS6UWNIFpHnxVxpvKchNoDgRq7zjAgfHXK2pgqRHgtgWHV2mBpRCtru6XMympoj2goI9NfwfRVVgbZ3FYMaEZHmg9pKuIAJksTs3HRmBZ8wM%3D"}]}
content-encoding: br
cf-ray: 9591e203797256b1-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
IP
Requested by https://hsrdeai.net/cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (47992), with no line terminators
Hash cf3402d7483b127ded4069d651ea4a22
bde186152457cacf9c35477b5bdda5bcb56b1f45
eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc
GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hsrdeai.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 02 Jul 2025 23:21:42 GMT
content-type: application/javascript; charset=utf-8
content-length: 14107
cf-ray: 9591e1860cc456aa-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e2d-bb78"
last-modified: Mon, 04 May 2020 16:09:17 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 525929
expires: Mon, 22 Jun 2026 23:21:42 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mcC4XvlU%2B6%2BY6qqHN2fV24pvYZWaRnfS8fiTDbNBovMDMsD87sX4%2FVB4lcQn9HLeNPTaz9HU0hbZjF%2FTO8a%2FbZlABcBbcpSFOaIMx64%2FbOk4XU6EBzqoilc0sonsYye5X%2BgqOjKk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET a1hgm.yjpocjj.es/favicon.ico
404 Not Found 0 B URL GET a1hgm.yjpocjj.es/favicon.ico
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /favicon.ico HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Cookie: XSRF-TOKEN=eyJpdiI6InNNUGNDRVhuVkZzS01EWTNrTmNDdkE9PSIsInZhbHVlIjoiRTZ5TnVST08vQ2VrdXZiZ0s3MFFadkl6bGxTUGhqbXdVY0hXcTZxbjZoUEZrb1hqS0ZVbFNXR3c1ZjN2OU9VRHQ5QmZ2TmVLNXRXZ2l3UjY4bHJWQ2lhYisrc3hnSG93RmxsRjV3SGQvSkNGOEVjSG8zQitabm1xUnYxZWZrZG8iLCJtYWMiOiIxMWUwZDY0M2U5ZWU0OTI4MDQ2OTZmYTViMDI5OGNjNjBlMzk1NTJmOTk1ZDBjZTE1YTc4OWI2NjIxY2IwNzdiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjJnbngyQlY5WlhrYmJvNXJYVWVnT3c9PSIsInZhbHVlIjoiUDRzWU5peCtOOUc3Q0JQTHRNU3ZvZ1dFem05Qy9DQU9XbmhTekhDWE8vMzB6TjZGK05wREs1Y1pkeC9DS1hoQXBRL2lGQ1Y0aUx2TlV3TjBZUGpGOEoxOEl3Z2d1QmdocUFrUGxRbmJ2ck5weWJsSW9jaFArcWhBUi9YT3J1T2YiLCJtYWMiOiJhNWM5OTEzNWUyNjE2ZDI1ZGU2YzI1MjgzZGRmZDViNTBlYmNhYjE5NDk2Y2NhNWViOWYwMTY0YTEwYzNlYTkwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Wed, 02 Jul 2025 23:22:04 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e212ade45685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rHPYQQnetmNBK%2BSK2EijB0pO%2FoQpGyukgtJYhp3pRNVOdnjr0MwDBCW8oc3Ti9mBzhV31E5yjNoNbgrFQAmkjqa8V0%2BVQc9NCv0%3D"}]}
cf-cache-status: HIT
age: 20
vary: accept-encoding
cache-control: max-age=14400
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1770&min_rtt=339&rtt_var=1755&sent=103&recv=108&lost=0&retrans=0&sent_bytes=38670&recv_bytes=14419&delivery_rate=6017726&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=29037&unsent_bytes=0&cid=7f87c123822d7329&ts=21471&inflight_dur=98&x=40"
GET a1hgm.yjpocjj.es/ab2d9k1eUopqEyef30
200 OK 36 kB URL GET a1hgm.yjpocjj.es/ab2d9k1eUopqEyef30
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type ASCII text, with CRLF line terminators
Hash 38501e3fbbbd89b56aa5ba35de1a32fe
d9b31981b6f834e8480ba28fbc1cff1be772f589
a1ca6b381cb01968851c98512c6e7f6c5309a49f7a16b864813135cbff82a85b
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /ab2d9k1eUopqEyef30 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: text/css;charset=UTF-8
cf-ray: 9591e21fbe935685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="ab2d9k1eUopqEyef30"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=aqA33u%2BiN6HY6RbdhBVXs4gjhl7GHjNjHHTERIq%2B1uXNQiU0hBktGwUH7e%2FdnH482MBH0UAqwaT%2BOZu7dSwi0cnafYHyPauyXFE%3D"}]}
vary: accept-encoding
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1231&min_rtt=0&rtt_var=423&sent=300&recv=170&lost=5&retrans=6&sent_bytes=263643&recv_bytes=35772&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24447&inflight_dur=206&x=40"
GET a1hgm.yjpocjj.es/opxExAGLfxHDfLwmDue7Cgh4MgxPAylIjUMWuSU45140
200 OK 892 B URL GET a1hgm.yjpocjj.es/opxExAGLfxHDfLwmDue7Cgh4MgxPAylIjUMWuSU45140
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type RIFF (little-endian) data, Web/P image
Hash 41d62ca205d54a78e4298367482b4e2b
839aae21ed8ecfc238fdc68b93ccb27431cd5393
20a4a780db0bcc047015a0d8037eb4eb58b3e5cb338673799c030a3e1b626b40
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /opxExAGLfxHDfLwmDue7Cgh4MgxPAylIjUMWuSU45140 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: image/webp
content-length: 892
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="opxExAGLfxHDfLwmDue7Cgh4MgxPAylIjUMWuSU45140"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bHJLAClaAiCyj3OLGQLLW10SQ9HZ390dkpsGmJOxK5ES7FSaVTjNQOS2F08Yky97sn7kGaqsaB0avPDpi3BM%2Fus8FTHsRkJkJLs%3D"}]}
cf-ray: 9591e21fde9f5685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1123&min_rtt=0&rtt_var=439&sent=280&recv=168&lost=5&retrans=6&sent_bytes=240371&recv_bytes=35679&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24318&inflight_dur=197&x=40"
GET a1hgm.yjpocjj.es/ijaUzzxFyFJqL3I5i0wPRHaDPDsDqIJ94uwxj5SOfDDDD1QpzQQhI78170
200 OK 7.4 kB URL GET a1hgm.yjpocjj.es/ijaUzzxFyFJqL3I5i0wPRHaDPDsDqIJ94uwxj5SOfDDDD1QpzQQhI78170
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type SVG Scalable Vector Graphics image
Hash b59c16ca9bf156438a8a96d45e33db64
4e51b7d3477414b220f688adabd76d3ae6472ee3
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /ijaUzzxFyFJqL3I5i0wPRHaDPDsDqIJ94uwxj5SOfDDDD1QpzQQhI78170 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: image/svg+xml
cf-ray: 9591e21fdea15685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="ijaUzzxFyFJqL3I5i0wPRHaDPDsDqIJ94uwxj5SOfDDDD1QpzQQhI78170"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OgUeLGjaCosIHfQ91%2FRfASEfupFM84MNG8gZP6XQ0W%2BTuzYPTOGLQEkCH5ZZiN7c3BdSY0xHipAN3lFp4x1KjCchRssUZYWTTGk%3D"}]}
vary: accept-encoding
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=984&min_rtt=0&rtt_var=843&sent=263&recv=163&lost=5&retrans=6&sent_bytes=223196&recv_bytes=35455&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24306&inflight_dur=187&x=40"
GET challenges.cloudflare.com/turnstile/v0/g/5f8a20c0c87c/api.js
200 OK 49 kB URL GET challenges.cloudflare.com/turnstile/v0/g/5f8a20c0c87c/api.js
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectchallenges.cloudflare.com
FingerprintFC:98:AC:45:6F:F6:41:18:0B:96:F4:70:AB:D7:E3:D4:3D:B4:66:71
ValidityFri, 27 Jun 2025 18:18:48 GMT - Thu, 25 Sep 2025 19:18:44 GMT
File type JavaScript source, ASCII text, with very long lines (48827)
Hash 31ef18c7aa69a5a102364b7938216a12
a3398313b19b1b9c2c929b420c01df000f5d4c6a
e35158744fc010eb2219015a6171d7b955674a9f7e11a0d0013e803009454efe
GET /turnstile/v0/g/5f8a20c0c87c/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 02 Jul 2025 23:21:43 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Mon, 30 Jun 2025 17:30:47 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 9591e18da87e56ab-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET code.jquery.com/jquery-3.6.0.min.js
200 OK 90 kB URL GET code.jquery.com/jquery-3.6.0.min.js
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerSectigo Limited
Subject*.jquery.com
Fingerprint56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE
ValidityThu, 12 Jun 2025 00:00:00 GMT - Fri, 26 Jun 2026 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Wed, 02 Jul 2025 23:22:04 GMT
age: 3227525
x-served-by: cache-lga21931-LGA, cache-hel1410029-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 1055122
x-timer: S1751498524.410078,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
GET a1hgm.yjpocjj.es/GDSherpa-vf2.woff2
200 OK 93 kB URL GET a1hgm.yjpocjj.es/GDSherpa-vf2.woff2
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Hash bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-vf2.woff2 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: font/woff2
content-length: 93276
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-vf2.woff2"
cf-cache-status: MISS
last-modified: Wed, 02 Jul 2025 23:22:07 GMT
accept-ranges: bytes
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2qe9us4%2FISQoKxO8qx%2FL%2BrbXTcdOcCIrUotp%2BrxJ2chtf6p%2B3dLULlWjwxOIh5uDdQDBM4CajUCOiS92g1%2F6c1y4MQOdeLZDIL4%3D"}]}
cache-control: max-age=14400
cf-ray: 9591e21fde9d5685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2637&min_rtt=0&rtt_var=2045&sent=427&recv=184&lost=5&retrans=6&sent_bytes=428978&recv_bytes=36440&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24834&inflight_dur=287&x=40"
GET tinfoil.io/Home/Bounce/?url=https://hsrdeai.net/cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d
302 Found 3.8 kB URL User Request GET tinfoil.io/Home/Bounce/?url=https://hsrdeai.net/cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d
IP
Certificate IssuerGoogle Trust Services
Subjecttinfoil.io
FingerprintA9:19:C0:5B:8A:3D:86:02:23:0D:0E:0E:CC:B0:74:56:94:6A:A6:60
ValidityFri, 13 Jun 2025 00:26:21 GMT - Thu, 11 Sep 2025 01:24:47 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /Home/Bounce/?url=https://hsrdeai.net/cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d HTTP/1.1
Host: tinfoil.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Wed, 02 Jul 2025 23:21:41 GMT
content-type: text/html; charset=utf-8
location: https://hsrdeai.net/cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d
cache-control: private
server: cloudflare
x-powered-by: ASP.NET
access-control-allow-origin: *
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=re6jwr40x2eYlhUBBgd5oE2GrZnU72NQBUoGCv3saGprRVmFOOZaIDBPkilNF0KKnL4G%2FYS320UfjMlYPhTiv03O34GVO6kW"}]}
cf-ray: 9591e17faaad56ba-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
200 OK 11 kB URL GET ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
Hash 12bdacc832185d0367ecc23fd24c86ce
4422f316eb4d8c8d160312bb695fd1d944cbff12
877ae491d9aac5c6ef82a8430f9f652ace8a0dbc7294bd112aad49bd593769d0
GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: image/png
content-length: 10796
date: Sun, 29 Jun 2025 16:32:58 GMT
accept-ranges: bytes
server: nginx
last-modified: Tue, 23 Feb 2021 04:20:08 GMT
etag: "12bdacc832185d0367ecc23fd24c86ce"
expires: Mon, 29 Jun 2026 16:32:58 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-security-policy: default-src 'none'; img-src 'self'; require-trusted-types-for 'script'; report-uri https://oktacsp.report-uri.com/r/t/csp/enforce
x-content-type-options: nosniff
x-cache: Hit from cloudfront
via: 1.1 0bc6ea800eda1e813056323cb53f8c70.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: kkxHUdjykVdcjkZ6uQhhDOhLDhgc-GCAoR0Bp1_2t0YYCV2Mxm7PNw==
age: 283748
X-Firefox-Spdy: h2
GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
200 OK 223 kB URL GET ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type ASCII text, with very long lines (51734)
Size 223 kB (222931 bytes)
Hash 0329c939fca7c78756b94fbcd95e322b
7b5499b46660a0348cc2b22cae927dcc3fda8b20
0e47f4d2af98bfe77921113c8aaf0c53614f88ff14ff819be6612538611ed3d1
GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Tue, 14 May 2024 21:48:24 GMT
x-amz-meta-sha1sum: 7b5499b46660a0348cc2b22cae927dcc3fda8b20
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Mon, 16 Jun 2025 04:25:19 GMT
expires: Tue, 16 Jun 2026 04:25:19 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"0329c939fca7c78756b94fbcd95e322b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0bc6ea800eda1e813056323cb53f8c70.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: Dbt0XdS3mutG-TIRK7H2aL4LrYxwkf0Noct8WFHDqx-e9bvV0Oz0UA==
age: 1450607
X-Firefox-Spdy: h2
GET ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
200 OK 10 kB URL GET ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File type ASCII text, with very long lines (10450)
Hash e0d37a504604ef874bad26435d62011f
4301f0d2b729ae22adece657d79eccaa25f429b1
c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179
GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Thu, 14 Mar 2024 00:03:58 GMT
x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Mon, 16 Jun 2025 04:25:19 GMT
expires: Tue, 16 Jun 2026 04:25:19 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0bc6ea800eda1e813056323cb53f8c70.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P2
x-amz-cf-id: _Xenysla7cXRnbkZAWcTCfPwLuUcsrF_f-oI-v6sRYy3PV-8FvaNpQ==
age: 1450607
X-Firefox-Spdy: h2
GET a1hgm.yjpocjj.es/34HQ60ccqLPvjvY5q0TCjjklLTrl7ZhmeJbv667110
200 OK 292 kB URL GET a1hgm.yjpocjj.es/34HQ60ccqLPvjvY5q0TCjjklLTrl7ZhmeJbv667110
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size 292 kB (292204 bytes)
Hash 04c1251bae5a4681ad29e5f0846a0ee2
6bd282d27792a21ab43f6210efffabce36c03b07
265d88c373a1f0711c817a8460c9a78512c040047f5ffcb22f380024a629f83a
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /34HQ60ccqLPvjvY5q0TCjjklLTrl7ZhmeJbv667110 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: application/javascript
cf-ray: 9591e21ffea55685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="34HQ60ccqLPvjvY5q0TCjjklLTrl7ZhmeJbv667110"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=itUxNRiMEm9uGloWW1Wyk8IzmvNiKGhFb%2FIOGsaY0kN6Brav8bsT5xxKlJcHXP0SGu7%2BF69cGqbg7mhJlipTYCeIFlhK4Y%2BVno0%3D"}]}
vary: accept-encoding
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1123&min_rtt=0&rtt_var=439&sent=282&recv=168&lost=5&retrans=6&sent_bytes=241933&recv_bytes=35679&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24320&inflight_dur=197&x=40"
GET a1hgm.yjpocjj.es/favicon.ico
404 Not Found 0 B URL GET a1hgm.yjpocjj.es/favicon.ico
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
GET /favicon.ico HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IjFrSC9uZVREMUpNbDNrUG10UVBiOEE9PSIsInZhbHVlIjoiN1hRa1Yza3U0OVZLelg1UHZPRGUvZ1lvNHcxc1hhcHIvQks4bno2ckR4YmdaTjloSkdQQUdTZW9YdHFVbFBCcHMxd3NhdUFIWGc4alo5dGpqY2h6UGV2bzJvNW5ia0NaNTFwRUJOdXRzRzhDS1pYZWJyUXRPbzJrNWJ3Nm55c2MiLCJtYWMiOiI1OTE4ZjQ5MWZlNzFmMjY3MDkwYzNmZTdjNDc4ZDg5MGM2ZmM3NzdlOGRhYWU0ODQ1ODRlMjk0MzkyNTZkMTkxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlhmUHpiZFZBL0xraWlTVGRuaTV4YkE9PSIsInZhbHVlIjoiMFhlaWhuY0E2enIxNzhoNElDSVQ5V3hwZUNFcU05OUVHakwvQzFRVGxNMFRwa3FrcXI3bU9EdWFINVRoNW5pSG9lWmYwSXVmcERlbndKS01CWFY4c3QzNXl6cHJrdWdGWWdJNHZBOHJxbDRYc0FETGlBampoSy8vS1NtdklBWm0iLCJtYWMiOiI4YTVlMGRkMWE0MjE0NmI1ZTM2ZjM0ZWQ4ZmRkODVjNjVkYjgwMTAyNjVhNzZlZjcwODM5NzU1MzMyYzBkMWVmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Wed, 02 Jul 2025 23:22:08 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e22d6f4d5685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=rHPYQQnetmNBK%2BSK2EijB0pO%2FoQpGyukgtJYhp3pRNVOdnjr0MwDBCW8oc3Ti9mBzhV31E5yjNoNbgrFQAmkjqa8V0%2BVQc9NCv0%3D"}]}
cf-cache-status: HIT
age: 24
vary: accept-encoding
cache-control: max-age=14400
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1019&min_rtt=0&rtt_var=389&sent=710&recv=223&lost=5&retrans=6&sent_bytes=799345&recv_bytes=44063&delivery_rate=22269676&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=28136&unsent_bytes=0&cid=7f87c123822d7329&ts=25746&inflight_dur=337&x=40"
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 02 Jul 2025 23:22:01 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 9591e2006f7a712d-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 556959
expires: Mon, 22 Jun 2026 23:22:01 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j5ElCpMLoJ%2BEB1VEnXTXZ3y1QQS5%2B12240T8iwW2%2BfD%2FokIaOASKPautm%2BgJfGIRES0iS8kpJ8s2gw%2F5je%2Fg%2F6jTzV8w5VHoRAS%2BnY7p3b6%2FEQdz%2F5G0PFXDFGZTV7uGKdJCzy26"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET code.jquery.com/jquery-3.6.0.min.js
200 OK 90 kB URL GET code.jquery.com/jquery-3.6.0.min.js
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerSectigo Limited
Subject*.jquery.com
Fingerprint56:36:FB:D3:E0:9E:71:88:98:A4:C9:34:94:9B:43:3A:C4:C5:1E:BE
ValidityThu, 12 Jun 2025 00:00:00 GMT - Fri, 26 Jun 2026 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Wed, 02 Jul 2025 23:22:01 GMT
age: 3227522
x-served-by: cache-lga21931-LGA, cache-hel1410029-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 1055121
x-timer: S1751498522.786775,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
POST a1hgm.yjpocjj.es/xypfQsUlugEU6EYxyArtkaZsk9kM78eEUzwZKfq
200 OK 441 B URL POST a1hgm.yjpocjj.es/xypfQsUlugEU6EYxyArtkaZsk9kM78eEUzwZKfq
IP
Requested by https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
Hash ecb5c40bccebf13d6610028eb6bcb366
6d79f38a4f1906646f70122c9be9a83d52f7cc66
1813de801b4d36d5df39e6581f3a99873b85bcac4b600d0a76bf21efac4166aa
Analyzer Verdict Alert urlquery phishing Phishing - Tycoon Phishing Kit
POST /xypfQsUlugEU6EYxyArtkaZsk9kM78eEUzwZKfq HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 6
Origin: https://a1hgm.yjpocjj.es
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/4pK163NVhm2T!J/
Cookie: XSRF-TOKEN=eyJpdiI6InNNUGNDRVhuVkZzS01EWTNrTmNDdkE9PSIsInZhbHVlIjoiRTZ5TnVST08vQ2VrdXZiZ0s3MFFadkl6bGxTUGhqbXdVY0hXcTZxbjZoUEZrb1hqS0ZVbFNXR3c1ZjN2OU9VRHQ5QmZ2TmVLNXRXZ2l3UjY4bHJWQ2lhYisrc3hnSG93RmxsRjV3SGQvSkNGOEVjSG8zQitabm1xUnYxZWZrZG8iLCJtYWMiOiIxMWUwZDY0M2U5ZWU0OTI4MDQ2OTZmYTViMDI5OGNjNjBlMzk1NTJmOTk1ZDBjZTE1YTc4OWI2NjIxY2IwNzdiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjJnbngyQlY5WlhrYmJvNXJYVWVnT3c9PSIsInZhbHVlIjoiUDRzWU5peCtOOUc3Q0JQTHRNU3ZvZ1dFem05Qy9DQU9XbmhTekhDWE8vMzB6TjZGK05wREs1Y1pkeC9DS1hoQXBRL2lGQ1Y0aUx2TlV3TjBZUGpGOEoxOEl3Z2d1QmdocUFrUGxRbmJ2ck5weWJsSW9jaFArcWhBUi9YT3J1T2YiLCJtYWMiOiJhNWM5OTEzNWUyNjE2ZDI1ZGU2YzI1MjgzZGRmZDViNTBlYmNhYjE5NDk2Y2NhNWViOWYwMTY0YTEwYzNlYTkwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:04 GMT
content-type: text/html; charset=UTF-8
cf-ray: 9591e211fdde5685-OSL
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, private
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VX7idQze4HV0X8EtCVsneDdoh2GyQOFarWY6Y1HQ2KugGrahw60OR4xh5tw1EaYpMomx8EmRwwp9Kswv%2Fp8kQE1USkoTz24esqg%3D"}]}
cf-cache-status: DYNAMIC
set-cookie: XSRF-TOKEN=eyJpdiI6IkVRZnN4QmpIUUM4eTg0VTNnQ2VkYXc9PSIsInZhbHVlIjoiTVF4VGR2eUNDYW03d20vSGIxa1lGS2JHaFVxSzZEYlFoTVg4UG1CMTM0SGhCU2FsT0FxVXBXNVVOejZqTGpHam1meTM2ZC9wNXZlMVk4UGVENjBiOEZNSjR5ZG15di96SHFaZytaYmdLQk1YMXo4TnQrK3h5VkZ0YUpPWHEvVnAiLCJtYWMiOiJmNDI3MTM3MTEwMzgyNGUzYzU5ZWJhNzc0MmEwNmJiNTZkMjUzNzUzYTc3MWNlMDk2OTNkOGQwYThhODYyM2Y1IiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:04 GMT
laravel_session=eyJpdiI6IklGWER3djdzZUtScjRybVh6L3Y2OXc9PSIsInZhbHVlIjoiTkxnaENwMWhQM2JJRmJGc0tzMVVJaGVodExtY095NmkzNnc0K0xCUDJOVjAzaUpzN1VFTzkyQnE2QWxUeXZ5YTVxZ2JnRWoxb2d0RklMR3QrOElVd1JsT2lnQTdjL3JxeG1lUmZYaHlKeUVHQmF5Zko3VmNmb2ozOUNsNjZxSVgiLCJtYWMiOiJiNmEzNzQwZjZkMjY2NDZmOTBiMzAwZDQ3NmM0Y2NjOTI3NzhmOWYwMGU1YWI5YTllZGZkNzc4ZjkxOTAwNTY5IiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Thu, 03 Jul 2025 01:22:04 GMT
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1669&min_rtt=339&rtt_var=1517&sent=105&recv=109&lost=0&retrans=0&sent_bytes=39311&recv_bytes=14464&delivery_rate=6017726&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=29037&unsent_bytes=0&cid=7f87c123822d7329&ts=21765&inflight_dur=99&x=40"
GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
200 OK 48 kB URL GET cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Hash 2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
cf-ray: 9591e226adfa56a5-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 556965
expires: Mon, 22 Jun 2026 23:22:07 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VkEvmjwblhRnVQDCesqFCDeZCwFTdTbS%2BQOr%2FohnERM6anIkbLi247%2BfK%2F8nFFxj7jZQ6fXkhon341FdKz%2FonbCcFE3r%2BX%2BvXMY1zB8%2FnRY4A8NX5C1HE44MLKilaDqqNBYVOKrr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET a1hgm.yjpocjj.es/ij2lA2uROda2rsk6bf6FAVU2DtfaFh7TxGUqrPGpjM3RYbGrAyUsSztSD8qOzJO8Yxwayz230
200 OK 1.3 kB URL GET a1hgm.yjpocjj.es/ij2lA2uROda2rsk6bf6FAVU2DtfaFh7TxGUqrPGpjM3RYbGrAyUsSztSD8qOzJO8Yxwayz230
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type RIFF (little-endian) data, Web/P image
Hash 32ca2081553e969f9fdd4374134521ad
7b09924c4c3d8b6e41fe38363e342da098be4173
216fc342a469aa6a005b2eacc24622095e5282d3e9f1ae99ce54c27b92ec3587
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /ij2lA2uROda2rsk6bf6FAVU2DtfaFh7TxGUqrPGpjM3RYbGrAyUsSztSD8qOzJO8Yxwayz230 HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:08 GMT
content-type: image/webp
content-length: 1298
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="ij2lA2uROda2rsk6bf6FAVU2DtfaFh7TxGUqrPGpjM3RYbGrAyUsSztSD8qOzJO8Yxwayz230"
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=sKeIhtgwAFTWQvoLnWJnZC7KnAP8DZiwOQeTNBGmBnzpyIsLOMiiXuU9FxZRymG%2Buvrba5BlBAE8RsFKIlcifZFVHEtULNg%2FFwQ%3D"}]}
cf-ray: 9591e227ef0e5685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=907&min_rtt=0&rtt_var=488&sent=566&recv=207&lost=5&retrans=6&sent_bytes=612048&recv_bytes=42356&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=20380&unsent_bytes=0&cid=7f87c123822d7329&ts=25281&inflight_dur=312&x=40"
GET hsrdeai.net/favicon.ico
404 Not Found 315 B IP
ASN #48452 Traffic Broadband Communications Ltd.
Requested by https://hsrdeai.net/cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d
Certificate IssuerLet's Encrypt
Subjecthsrdeai.net
FingerprintBA:94:2D:6B:0A:72:74:92:62:11:4D:E3:09:29:0B:B3:49:ED:46:A9
ValiditySat, 14 Jun 2025 20:36:21 GMT - Fri, 12 Sep 2025 20:36:20 GMT
File type HTML document, ASCII text
Hash a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
GET /favicon.ico HTTP/1.1
Host: hsrdeai.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hsrdeai.net/cllascio.php?342d36383734373437303733336132663266363133313638363736643265373936613730366636333661366132653635373332663334373034623331333633333465353636383664333235343231346132662d
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Date: Wed, 02 Jul 2025 23:21:42 GMT
Server: Apache
Content-Length: 315
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
GET a1hgm.yjpocjj.es/GDSherpa-bold.woff
200 OK 36 kB URL GET a1hgm.yjpocjj.es/GDSherpa-bold.woff
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerGoogle Trust Services
Subjectyjpocjj.es
Fingerprint02:F3:24:7E:7F:8D:32:5F:4A:8A:9C:FE:29:BA:22:4D:24:5B:30:F1
ValidityWed, 04 Jun 2025 11:34:29 GMT - Tue, 02 Sep 2025 12:27:00 GMT
File type Web Open Font Format, TrueType, length 35970, version 1.0
Hash 496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798
Analyzer Verdict Alert urlquery phishing Phishing - Microsoft
urlquery phishing Phishing - Tycoon Phishing Kit
GET /GDSherpa-bold.woff HTTP/1.1
Host: a1hgm.yjpocjj.es
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlVSREk0VHNZZ21BT1RDMTlXQVdFVFE9PSIsInZhbHVlIjoibWRwR2RwSnhvTW5OQ3Z6U01sUUxqdVVWZ3FYMmxrN1NNbS9UUkhhakg5UFI5Qk9Lend6WVZmSDBMRHBrSk8yYzZjandpKzlWMXlETzdka3ZpOS9qMlU4Y0hIK01tUmtVYnl1MU91THMyTWVvYW12VVYyT1RvREpHU2NXMVJSbE8iLCJtYWMiOiJjYTVlZTdhNmE1Njc3NjJlZGFlOTQzZmQxOGY1YzNlY2FmZGFlNWY4ZDZhNDZiMjM5N2IyZjU3OGFiZmY5NWMyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkdHeVdxUlg0VTF5cnR0b2xpOXJ0ZkE9PSIsInZhbHVlIjoiY2IrM2dPMkd5d1hBNWVhV2haNGRlS2Jyb3hHL1FYNFRkcVQ2MHhRazlPVTNLWCtSMStQU21xakVFN2Qzb0laUmE1SWtDaXU5K3hDTTYwaDg2Zi85V1BTTFRUVHQyZUI1VFBvTE9YbExGdFVPN0J6TjV6d3IvNFdzTnpaR1YrdFEiLCJtYWMiOiI5NjNjZjUxZTVjZGIzMDllZmQ2OTdlOTQyZmJhMGEwOTYxZDYwOGQ1ZTgyODgzMDg1Y2RhYzhiMDg0ODE0YTlmIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Wed, 02 Jul 2025 23:22:07 GMT
content-type: font/woff
content-length: 35970
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-disposition: inline; filename="GDSherpa-bold.woff"
cf-cache-status: MISS
last-modified: Wed, 02 Jul 2025 23:22:07 GMT
accept-ranges: bytes
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=MjX%2FsDkuEQ9Qq2I8hGxn6T5QH8lvOZ8Nbkzys7Jvs4WwBJbyM7iF2c97FLjb9k9s512JvSc2IxMZwcx1hjWjcBVYaUbYld84OLw%3D"}]}
cache-control: max-age=14400
cf-ray: 9591e21fce965685-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=1231&min_rtt=0&rtt_var=423&sent=308&recv=170&lost=5&retrans=6&sent_bytes=274036&recv_bytes=35772&delivery_rate=20645978&ss_exit_cwnd=29037&ss_exit_reason=2&cwnd=24377&unsent_bytes=0&cid=7f87c123822d7329&ts=24470&inflight_dur=228&x=40"
GET objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250702%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250702T232207Z&X-Amz-Expires=1800&X-Amz-Signature=36517d3a704e60afb20fbc295fd0e76c6fe20551020237902c7bab57c893a003&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
200 OK 10 kB URL GET objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250702%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250702T232207Z&X-Amz-Expires=1800&X-Amz-Signature=36517d3a704e60afb20fbc295fd0e76c6fe20551020237902c7bab57c893a003&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
IP
Requested by https://a1hgm.yjpocjj.es/u7dkpzr7mmdav3w?common/oauth2/v2.0/authorize?client_id=a5eb1b8e337-97315170562d-c971c6fc217-1bfe761f5e787-fba8f4474-a054f7f7e97bb9f-e109322c5bd612-df7a2757f91d8&locales=en
Certificate IssuerSectigo Limited
Subject*.github.io
Fingerprint8C:FF:59:E5:8E:C4:FA:76:FE:AF:2D:C5:C0:D4:13:6A:77:2D:F9:91
ValidityFri, 07 Mar 2025 00:00:00 GMT - Sat, 07 Mar 2026 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (10017)
Hash 6c20a2be8ba900bc0a7118893a2b1072
ff7766fde1f33882c6e1c481ceed6f6588ea764c
b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500
GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250702%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250702T232207Z&X-Amz-Expires=1800&X-Amz-Signature=36517d3a704e60afb20fbc295fd0e76c6fe20551020237902c7bab57c893a003&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a1hgm.yjpocjj.es/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Tue, 07 Dec 2021 16:38:45 GMT
etag: "0x8D9B9A009499A1E"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d91f6eaf-e01e-0032-2f18-13e122000000
x-ms-version: 2023-11-03
x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT
x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=randexp.min.js
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
age: 5275
date: Wed, 02 Jul 2025 23:22:07 GMT
x-served-by: cache-iad-kiad7000045-IAD, cache-hel1410027-HEL
x-cache: HIT, HIT
x-cache-hits: 23045, 0
x-timer: S1751498527.184916,VS0,VE1
content-length: 10245
X-Firefox-Spdy: h2
172.67.219.89
13.107.246.53
94.26.90.17
140.82.121.3