Report - click.convertkit-mail2.com/zluv0vvxr9fnhkkdxg4tphwrlp000s6/48hvhehro369mgix/aHR0cHM6Ly81eDkuZnhqcmxuempqLnJ1LzBrbTVDYi8=

Report Overview

Visited public
2025-02-22 10:44:39
Tags
microsoft phishing suspicious
URL
click.convertkit-mail2.com/zluv0vvxr9fnhkkdxg4tphwrlp000s6/48hvhehro369mgix/aHR0cHM6Ly81eDkuZnhqcmxuempqLnJ1LzBrbTVDYi8=
Finishing URL
5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
IP / ASN
3.141.222.179
#16509 AMAZON-02
Title
proceed to secure sign-in
Phishing - Microsoft
Phishing - Generic phishing
Suspicious - Anti-debugging code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
click.convertkit-mail2.com	173363	2016-11-19	2020-09-04	2025-02-18	586 B	478 B	3.18.56.123
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20	2025-02-19	924 B	31 kB	104.18.95.41
cdnjs.cloudflare.com	235	2009-02-17	2012-05-23	2025-02-19	914 B	30 kB	104.17.25.14
objects.githubusercontent.com	134060	2014-02-06	2021-11-01	2025-02-19	888 B	11 kB	185.199.109.133
code.jquery.com	634	2005-12-10	2012-05-21	2025-02-19	422 B	32 kB	151.101.66.137
developers.cloudflare.com	592034	2009-02-17	2012-09-07	2025-02-19	445 B	1.7 kB	104.16.3.189
5x9.fxjrlnzjj.ru	unknown	2025-02-12	2025-02-20	2025-02-20	30 kB	2.5 MB	104.21.75.230
ok4static.oktacdn.com	16592	2014-11-11	2018-06-15	2025-02-18	2.1 kB	268 kB	143.204.55.3
github.com	1423	2007-10-09	2016-07-13	2025-02-19	453 B	4.3 kB	140.82.121.4

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2025-02-20	medium	5x9.fxjrlnzjj.ru/0km5Cb/	Generic/Spear Phishing

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (13)

	URL	From	Size	First Seen	Last Seen
	unknown	ScriptElement	20 kB	2025-02-22	2025-02-22
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash 2221c5c24e6d78a6a021c4656dac775d cde13adaeacb3786aca19d8739a9727295ebcc78 d548e3b6b26f0b88d19059784b72b60b8b42a0a87fad26dd04150757a8481fb6 Loading...

	code.jquery.com/jquery-3.6.0.min.js	ScriptElement	90 kB	2023-03-07	2025-05-09
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.66.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 04:11 Times Seen205592 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js	ScriptElement	10 kB	2024-05-30	2025-05-08
Pretty URL github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js IP 140.82.121.4 ASN #36459 GITHUB Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-30 22:56 Last Seen2025-05-08 23:46 Times Seen18400 Hash 6c20a2be8ba900bc0a7118893a2b1072 ff7766fde1f33882c6e1c481ceed6f6588ea764c b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500 Loading...

	5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU	ScriptElement	44 kB	2025-02-22	2025-02-22
Pretty URL 5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU IP 104.21.75.230 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash 072e54a98ce820a823d3918736044377 1391cbfa362f9642c9870a9dbcde661093360c9d 231a9dd6dd5be581c605da416eb784c70037903495649694070cf79b8149731e Loading...

	cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	ScriptElement	48 kB	2023-03-07	2025-05-09
Pretty URL cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:31 Last Seen2025-05-09 03:30 Times Seen92689 Hash 2ca03ad87885ab983541092b87adb299 1a17f60bf776a8c468a185c1e8e985c41a50dc27 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762 Loading...

	unknown	ScriptElement	646 B	2025-02-22	2025-02-22
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash dd10a5238d6650ea4bb6ecbdb945f359 25945754799bcf88ade6229aa3684494582220d7 7ca44366d48b803dc5fa0ac82a501b99da187238da0cf10fdab9005e73e71e00 Loading...

	5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU	ScriptElement	234 kB	2025-02-22	2025-02-22
Pretty URL 5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU IP 104.21.75.230 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash db6e805a088951e0365f1ab67db7bbb5 d712dc9ce820447c3dcc2f991146723b579400a3 42cc6672eb764d4ab5f8a25275b45339c62412aa77384afac642a4e02364150c Loading...

		Size	First Seen	Last Seen
	#1 Eval - 47817e7958238effbd055d98acc95a99	1.7 kB	2025-02-22 10:44	2025-02-22 10:44
Pretty Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash 47817e7958238effbd055d98acc95a99 bdfdeef47e87a244a023a0525d6285db6b8ed165 60dc3f15804727642a9fe8f2ecba93795ba5e420905d2cc9e821ea9b134bcf9b Loading...

	#2 Eval - bd0414d84d1a0f930a90dba439125555	1.8 kB	2025-02-22 10:44	2025-02-22 10:44
Pretty Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash bd0414d84d1a0f930a90dba439125555 ea122841c12a13fdd8f517f0818c25bbaf81faa8 8ef4701123f1851116118e2751845b77f7e8b1c2fa39c1825593b15997cd4b8e Loading...

	#3 Eval - 98bb985503ccda4064f500ffcdbbbe86	13 kB	2025-02-22 10:44	2025-02-22 10:44
Pretty Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash 98bb985503ccda4064f500ffcdbbbe86 4f693a7a93b2000b6cc4aa8347d7dddf9d227dc1 fc746bce64f965d9ec41241dd836bd258408b9f7220930a83049faff41964a75 Loading...

		Size	First Seen	Last Seen
	#1 Write - 745b1693a7df3b273788d809bb008cee	56 kB	2025-02-22 10:44	2025-02-22 10:44
Pretty Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash 745b1693a7df3b273788d809bb008cee 948129aad02365ae6b860dea5d44a668702e9103 ae7593a5086003fde1f1da6570d794898814acadbd9f7c2672c4467437178f72 Loading...

	#2 Write - 31538c075814ff263e3fe2d8eac06ab4	8.3 kB	2025-02-22 10:44	2025-02-22 10:44
Pretty Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash 31538c075814ff263e3fe2d8eac06ab4 00ea96a34fadec78d143b01cc74697477b7e9f82 df0831b3b6dc420b2855e660c72f2b24df9efe36b40c1552243a52626d500b2d Loading...

	#3 Write - f2b324fa53342c86013ebcc8ffbcac9e	143 kB	2025-02-22 10:44	2025-02-22 10:44
Pretty Observations First Seen2025-02-22 10:44 Last Seen2025-02-22 10:44 Times Seen1 Hash f2b324fa53342c86013ebcc8ffbcac9e 0a111437517f6e13408e8af1dc4d2898f87a2792 d89e530ed5b8d135dc038d389e4d1dcca6e7fee150f863a3200da31c4c2923aa Loading...

HTTP Transactions (37)

URL IP Response Size

click.convertkit-mail2.com/zluv0vvxr9fnhkkdxg4tphwrlp000s6/48hvhehro369mgix/aHR0cHM6Ly81eDkuZnhqcmxuempqLnJ1LzBrbTVDYi8=

3.18.56.123

302 Found

0 B

URL
click.convertkit-mail2.com/zluv0vvxr9fnhkkdxg4tphwrlp000s6/48hvhehro369mgix/aHR0cHM6Ly81eDkuZnhqcmxuempqLnJ1LzBrbTVDYi8=
IP
3.18.56.123:0
ASN
#16509 AMAZON-02

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /zluv0vvxr9fnhkkdxg4tphwrlp000s6/48hvhehro369mgix/aHR0cHM6Ly81eDkuZnhqcmxuempqLnJ1LzBrbTVDYi8= HTTP/1.1
Host: click.convertkit-mail2.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: nginx/1.18.0
Date: Sat, 22 Feb 2025 10:44:06 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
x-frame-options: SAMEORIGIN
x-xss-protection: 0
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
location: https://5x9.fxjrlnzjj.ru/0km5Cb/
cache-control: no-cache
x-request-id: c60f375f-b362-4b27-b2ab-6eae7305763a
x-runtime: 0.012521

challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

104.18.95.41

302 Found

0 B

URL
challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
IP
104.18.95.41:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Sat, 22 Feb 2025 10:44:08 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/b/b0e4a89976ce/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 915e610ea9150b49-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.25.14

200 OK

14 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT

File type
JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Size
14 kB (13972 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 22 Feb 2025 10:44:08 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 626006
expires: Thu, 12 Feb 2026 10:44:08 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LJ4tNzKJQDtUVwdp6Ks4MkViS4N1cHZ%2B25YQiyhsj6y5HBA4tNEOWXwmkz9MVpn8xD4Gs30ll23j7PARsEW%2Fyfi7eVGJa5rCL%2FlWGOPpkPa0iIFrvKjmJNBrl0mVwii5TbL1QHJw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 915e610ebc850b02-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.0.min.js

151.101.66.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.66.137:443
ASN
#54113 FASTLY

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Sat, 22 Feb 2025 10:44:08 GMT
age: 3974583
x-served-by: cache-lga21931-LGA, cache-hel1410030-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 1272727
x-timer: S1740221048.203985,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

developers.cloudflare.com/favicon.png

104.16.3.189

200 OK

937 B

URL
developers.cloudflare.com/favicon.png
IP
104.16.3.189:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
937 B (937 bytes)
Hash
fc3b7bbe7970f47579127561139060e2
3f7c5783fe1f4404cb16304a5a274778ea3abd25
85e6223afdbd5badf2c79bcfbaa6fe686acaa781eca52c196647ffabb3be2ffe

HTTP Headers

GET /favicon.png HTTP/1.1
Host: developers.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 22 Feb 2025 10:44:08 GMT
content-type: image/png
content-length: 937
cache-control: public, max-age=0, must-revalidate
etag: "6be7ff94b6151f8cfbf08b53a17e2ac1"
set-cookie: __cf_bm=YBcq6eqqD11Lg.H2cjjyJZjh5fkQYwlLQj2Doe3YC_g-1740221048-1.0.1.1-1sH2Xgp3fsHGNmt__YfA5iiabVr.tG6XbcSjHfmStbM544HDKgsRPa5PZQapkC_bdLvKany1cuolmtuJIRlpkg; path=/; expires=Sat, 22-Feb-25 11:14:08 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: cloudflare
cf-ray: 915e6110dd12569f-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

5x9.fxjrlnzjj.ru/0km5Cb/

104.21.75.230

200 OK

40 kB

URL
5x9.fxjrlnzjj.ru/0km5Cb/
IP
104.21.75.230:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with very long lines (11129), with CRLF line terminators
Size
40 kB (39902 bytes)
Hash
dbef072c8f586127b011e4feebf38369
04edd79248e795aea19bdc6ff03063654ba119e3
9eba5590ecf3aecd6861eb1254919566ef9af0d58129e0effee71879ba66710b

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Generic/Spear Phishing

HTTP Headers

GET /0km5Cb/ HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IlQvMk4rM2x3NDZzR0F6OGdOVS9VWVE9PSIsInZhbHVlIjoiZ1h2QXNqV3g3N3dZMFE4Ymx1ZFNVczVoaW9pQmY0ZTZyWm44QVlCcVVLU3lvUWk2RFFzR3ptQmV0RU0rM1VkMnVsT0JjVHFNbTVVQW10Z3UrVzRPWVRaR0dHbVdrK2IwamtkK3RNdDllZ0k0VDJFQ0FNaktmZS9TNEU0WVF5dDkiLCJtYWMiOiI5NWJiODk3ZDEzODk4NTNmMmYyNjVjOTQzYTM4NzFmM2Y1MWMyYWI2OTE2NmZmMjZmYTEwYTcyMzgyZDIxMTUxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Iko2a1dPRTVmd1MyeW1xMXJMSVFaZWc9PSIsInZhbHVlIjoiK1k1K210RnlCQ0pacUhOYzN4UG5XMlNMaUczK3grSEpLWjczU0o4YXJVcGRtNDNRWGdzTGxzS3lGd1JMa0dDMG9KOFVWV1lMb3Z5RHpHcTFRbmNEM3RUU1ZYMmtBa2g1WVFIVkJqQUdpSjNab3pobzhEL2FETXlJaU0vc25aeHYiLCJtYWMiOiJjY2RiNmRhMzQ1OTk5MjgzMzlkMWM0OWVlZTQ5ZjkxYjQ4YTU2MDI1M2U0N2M3NzRmNGEzMGU2OWIxNTZiOTZkIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:18 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
vary: accept-encoding
cf-cache-status: DYNAMIC
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImFIc3VQMmJWUS9CeS9WY1RyUTBVNmc9PSIsInZhbHVlIjoiLzd0SWhucFdxNlZIZzd0eGgrSVpmeitRUi92VHRtT2E4ZnpLaE9UTjRVOXRXNkw3T3ZlY0s3TFRnSGRMZW5NcTFpcGNSSUZlbExnZm82YndYWnhQcElkOVNOT0RYUit5WDZYNmVIUHZ4UWJ0Z0FTT3pCWElXeFVnU1BIYktIU2ciLCJtYWMiOiI1ODE5YjM5ZGExYTAyNGYwMWZmOTRjN2U4YTA3YzBhYzhmNTJmOGIwYzU1OTNmODk5NTY1N2U1MTM3YmYzZjNlIiwidGFnIjoiIn0%3D; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Sat, 22 Feb 2025 12:44:18 GMT
laravel_session=eyJpdiI6IjUzZFMvYUgxcnJPL2ZYaW0zL2lsMVE9PSIsInZhbHVlIjoiclVaRU95UWhNbW16ZHdBUXNsUlJSbVVka2pnVnpJc2gyWVJnTThoUjgzNS9mZjUwSTRqQm1OdS9nb2RLTGh5eEUwOHlkcmFac2lIY2NSTGREaU44N2FITSthQVJwNGVJKyt6U0FKcEl0Q080QnZCbzJXWnRSZlFDQmNhWVdtM24iLCJtYWMiOiJmYmU3MDQ0MDdkZjYxZTkwOGRkOTkwM2EzZTZhMWYyMTIzZTU2N2Q0M2FiZDE3MDdjODNhODI3ZjgzNGEyYWZiIiwidGFnIjoiIn0%3D; HttpOnly; SameSite=None; Secure; Path=/; Max-Age=7200; Expires=Sat, 22 Feb 2025 12:44:18 GMT
priority: u=1,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4hoZDRFR%2FTcq24DUskugNU%2F1aYdABxASFm4M03iXc0lyJRSzzJJaAAemOdz8jQqkLgxROqmVjxuDmRY6in7NhdwrSeUjz1ib%2FHm27dVIjXTrbIMMLzV1KtBHPIHijzzle3eH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 915e614e4a100b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=QUIC&rtt=5492&min_rtt=3533&rtt_var=2664&sent=17&recv=13&lost=0&retrans=0&sent_bytes=5820&recv_bytes=3897&delivery_rate=155&cwnd=12000&unsent_bytes=0&cid=585eaac8ab5f6506&ts=11069&x=1", cfExtPri, cfHdrFlush;dur=0

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.25.14

200 OK

14 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT

File type
JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Size
14 kB (13972 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:18 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 626016
expires: Thu, 12 Feb 2026 10:44:18 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KV%2F5V73qTt2rtD2Q4NR3FQw3xoxYl5YuALn%2FbW6jM5DBtn1n1wjg3Ni0pZXgCCBj5j1mcef5pRMruCbT8Dhy%2BSRaBoj%2BmAB%2BqHA%2F384JUtwwJZ92znT4wjF4%2Fi3WmTr4w2l2UauY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 915e61515ac356bf-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU

104.21.75.230

200 OK

104 kB

URL User Request GET HTTP/3
5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (14352), with CRLF line terminators
Size
104 kB (103925 bytes)
Hash
109604246111d87767cdcd9289c1417c
2ce089d1d561e67c46521d4b9f2c6cb81adf7d26
49fadcb3345035b43a76b56ee4f563f8c8b9583c50a0d47275a548034fc8ded4

HTTP Headers

GET /haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/0km5Cb/
Cookie: XSRF-TOKEN=eyJpdiI6ImY4S0hoYW5qMHFOdmc2UWlwekhUNXc9PSIsInZhbHVlIjoiL1BwNHFtTUs2VElqd0h2dGRqcFROdGloN1lKcVQ3Y29vNjVZVGlGbnhqNnp4eHU3YzZzaEdhQ3VCRm1XZW1TaVRabWR5WmxtcTFDL3dXdmtQVGpyemUvUGRZeGdBVVJrOXprWHFoRVlTdENoUFNTVktPbExidHZ4bmkyMnQrTFEiLCJtYWMiOiIwNDJmMmU0NTJkNzI3MWY4Mjg0MjgxNzJhYzkxMGQxYmEzMTM1ZGUxM2E5MTE5Mjg0NzU2OTQ4NGMzMmRkY2YyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjIyK2tRM1pnU29xcG5lbEN4TDlEcHc9PSIsInZhbHVlIjoic2ZqMk1SYmdjZjUwSXV4YXV3bEFSU216eGROR0NmL3VpNi9kUzJQUlZVUHIwT2pnTU5UcHJwOFFuZTJaekhMdWYza3pmQitGblFSNzAwSU1vUU44SStWZEFBeTlGOXN5M2VTR0s2VEQvMEZReXZMSVVGY0M5QUI4ZXhJbFVGcFgiLCJtYWMiOiI5ZGQzNTJmZDFiODI0ZDNhYTg3ZDRiOWY1YTcxYTY3MzY3ZTdhNTE2ZTE5M2VlNmI1ZTI4NDczZTgzOWJhNzBhIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:20 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yAFPWfiK41LgBrSxhzQ6YwAQUudRdUP0STj85kMADliVRCUR2wXNAl8sCK9zURz%2FBUdvS8FPxRS%2FftLV3VkwDXLj0pMSQ%2BY4V9%2FgQ%2BXCUxJyq1HW8L%2FspvObclLkK8WYPcfrHA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; expires=Sat, 22-Feb-2025 12:44:20 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D; expires=Sat, 22-Feb-2025 12:44:20 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 915e615739740b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1335&min_rtt=1276&rtt_var=521&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2239&delivery_rate=2231974&cwnd=250&unsent_bytes=0&cid=ab986f2edf9297bc&ts=444&x=0", cfL4;desc="?proto=QUIC&rtt=5248&min_rtt=2265&rtt_var=3259&sent=35&recv=21&lost=0&retrans=0&sent_bytes=18435&recv_bytes=6911&delivery_rate=1485&cwnd=12000&unsent_bytes=0&cid=585eaac8ab5f6506&ts=12706&x=1", cfExtPri, cfHdrFlush;dur=0

challenges.cloudflare.com/turnstile/v0/b/b0e4a89976ce/api.js

104.18.95.41

200 OK

30 kB

URL
challenges.cloudflare.com/turnstile/v0/b/b0e4a89976ce/api.js
IP
104.18.95.41:0
ASN
#13335 CLOUDFLARENET

File type
JavaScript source, ASCII text, with very long lines (48238)
Size
30 kB (30001 bytes)
Hash
781e3d70ad7285932b560af603ae0cf5
05dcf1fbcd9be56dc5fc3c2816ef3c0283c59c1b
f3c3760a932b9639cc554025300c8917e00f4f62e261086f5606c9e3a30d4836

HTTP Headers

GET /turnstile/v0/b/b0e4a89976ce/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://5x9.fxjrlnzjj.ru/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sat, 22 Feb 2025 10:44:08 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Wed, 19 Feb 2025 14:53:05 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 915e610f39d70b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7

143.204.55.3

200 OK

11 kB

URL GET HTTP/2
ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
IP
143.204.55.3:443
ASN
#16509 AMAZON-02

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
Size
11 kB (10796 bytes)
Hash
12bdacc832185d0367ecc23fd24c86ce
4422f316eb4d8c8d160312bb695fd1d944cbff12
877ae491d9aac5c6ef82a8430f9f652ace8a0dbc7294bd112aad49bd593769d0

HTTP Headers

GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: image/png
content-length: 10796
server: nginx
last-modified: Tue, 23 Feb 2021 04:20:08 GMT
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
date: Thu, 20 Feb 2025 19:53:24 GMT
expires: Fri, 20 Feb 2026 19:53:24 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: "12bdacc832185d0367ecc23fd24c86ce"
x-cache: Hit from cloudfront
via: 1.1 a9120cc3ff449047c990e82a4d5566ba.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: uQzKKxiDNV3_QvYtlSi1opBmo61CprqjLlphcppMI_1LQRI_5_lOhA==
age: 139855
X-Firefox-Spdy: h2

github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js

140.82.121.4

302 Found

0 B

URL GET HTTP/2
github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
IP
140.82.121.4:443
ASN
#36459 GITHUB

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerSectigo Limited
Subjectgithub.com
FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A
ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: GitHub.com
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250222T104421Z&X-Amz-Expires=300&X-Amz-Signature=3628d1186bc67ff9ac608568fa594ba1ea736d847352359712f105b36a6384d6&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-length: 0
x-github-request-id: 13F5:374B11:244C222:25ED42B:67B9AA84
X-Firefox-Spdy: h2

5x9.fxjrlnzjj.ru/qrGeB77g4EN8gcRbnmef4NQzqSNOCBey45140

104.21.75.230

200 OK

892 B

URL GET HTTP/3
5x9.fxjrlnzjj.ru/qrGeB77g4EN8gcRbnmef4NQzqSNOCBey45140
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
RIFF (little-endian) data, Web/P image
Size
892 B (892 bytes)
Hash
41d62ca205d54a78e4298367482b4e2b
839aae21ed8ecfc238fdc68b93ccb27431cd5393
20a4a780db0bcc047015a0d8037eb4eb58b3e5cb338673799c030a3e1b626b40

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /qrGeB77g4EN8gcRbnmef4NQzqSNOCBey45140 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: image/webp
content-length: 892
content-disposition: inline; filename="qrGeB77g4EN8gcRbnmef4NQzqSNOCBey45140"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZJN4ecnWuFS%2FPOADJuGxN0USnhly%2FC9HFK1yzO0Nsn3P5plJ7tdHAm76U7bHWhriu9y7TmS2Bz4soX5b7cYayj034yjVR6Gn7Sbfo%2BkHSQPN789NCAtY2fAvM40FLLK%2BY2E2hA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915e615e3e510b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1353&min_rtt=1297&rtt_var=463&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2175&delivery_rate=1844559&cwnd=250&unsent_bytes=0&cid=ebd4567d0ab99322&ts=208&x=0", cfL4;desc="?proto=QUIC&rtt=2933&min_rtt=1114&rtt_var=1676&sent=116&recv=49&lost=0&retrans=0&sent_bytes=99583&recv_bytes=25097&delivery_rate=10229&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=13772&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/uvX4AOs8B0YhAsrdKqryylzM8ie2qGmaixolTnq34126

104.21.75.230

200 OK

644 B

URL GET HTTP/3
5x9.fxjrlnzjj.ru/uvX4AOs8B0YhAsrdKqryylzM8ie2qGmaixolTnq34126
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
RIFF (little-endian) data, Web/P image
Size
644 B (644 bytes)
Hash
541b83c2195088043337e4353b6fd60d
f09630596b6713217984785a64f6ea83e91b49c5
2658b8874f0d2a12e8726df78ac8954324c3bbe4695e66bdef89195fde64322f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /uvX4AOs8B0YhAsrdKqryylzM8ie2qGmaixolTnq34126 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: image/webp
content-length: 644
content-disposition: inline; filename="uvX4AOs8B0YhAsrdKqryylzM8ie2qGmaixolTnq34126"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MbmbTxQ97sqXd%2FvfB3BE8djJdoHEDQzbAzUqeYetny%2FqO7dnPTcHcCqOjihXbWOK6yN51GdUR4kSmGIl6GqyNqURVhNvc23H9Fy3SMwwEArqY27apZ7OT%2Ft5Oc1SVeCDnzo9qw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915e615e3e4e0b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1349&min_rtt=1172&rtt_var=463&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2182&delivery_rate=2296774&cwnd=251&unsent_bytes=0&cid=a2d5e70ae034c792&ts=225&x=0", cfL4;desc="?proto=QUIC&rtt=2596&min_rtt=1114&rtt_var=1550&sent=122&recv=51&lost=0&retrans=0&sent_bytes=105214&recv_bytes=25188&delivery_rate=230090&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=13799&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/uvNWAUrZKqTM47bPoK8er5StQ6U6B45VfaB9QN0TdrOpI73i9IpJmzcExwMUkgh256

104.21.75.230

200 OK

18 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/uvNWAUrZKqTM47bPoK8er5StQ6U6B45VfaB9QN0TdrOpI73i9IpJmzcExwMUkgh256
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
RIFF (little-endian) data, Web/P image
Size
18 kB (17842 bytes)
Hash
4b52ecdc33382c9dca874f551990e704
8f3bf8e41cd4cdddb17836b261e73f827b84341b
cce050cc3b150c0b370751021bb15018ee2b64ac369e230fe3b571a9b00d4342

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /uvNWAUrZKqTM47bPoK8er5StQ6U6B45VfaB9QN0TdrOpI73i9IpJmzcExwMUkgh256 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: image/webp
content-length: 17842
content-disposition: inline; filename="uvNWAUrZKqTM47bPoK8er5StQ6U6B45VfaB9QN0TdrOpI73i9IpJmzcExwMUkgh256"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=esHzCfAAwglO8ML4Z7IUHuLuThbaGTFFm4kodyPk7pEXIz%2FdeA36d05HGFD9wghsHoIHMiNhxIY0yCI8EhH3Q%2Bhleoa4Ua3b8FtOnov6aA%2BgYxDXZ6g5PdT91fmXdtE%2BkY5DBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915e615edf6f0b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1251&min_rtt=1133&rtt_var=509&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2204&delivery_rate=2513680&cwnd=251&unsent_bytes=0&cid=176bc40853d3df9e&ts=217&x=0", cfL4;desc="?proto=QUIC&rtt=2394&min_rtt=1114&rtt_var=1003&sent=128&recv=54&lost=0&retrans=0&sent_bytes=110966&recv_bytes=25326&delivery_rate=1888281&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=13877&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/qrNbd7FZI71osV4orsQ7ehS5SmuvPHKG6jXTALeHApro4p5oS0flIjcd240

104.21.75.230

200 OK

9.6 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/qrNbd7FZI71osV4orsQ7ehS5SmuvPHKG6jXTALeHApro4p5oS0flIjcd240
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
RIFF (little-endian) data, Web/P image
Size
9.6 kB (9648 bytes)
Hash
4946eb373b18d178c93d473489673bb6
16477acb73b63ca251d37401249e7e4515febd24
666bc574c9f3fb28a8ac626fa8105c187c2a313736494a06bd5a937473673c92

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /qrNbd7FZI71osV4orsQ7ehS5SmuvPHKG6jXTALeHApro4p5oS0flIjcd240 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: image/webp
content-length: 9648
content-disposition: inline; filename="qrNbd7FZI71osV4orsQ7ehS5SmuvPHKG6jXTALeHApro4p5oS0flIjcd240"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=umqeNdsBIFN4O%2BpLm3BeiKa9yhBbP%2B5CynISqN4oH9AH27KhpFXklH8LY54tupxiRUgS75Ne6HXpwyNXi6pIojl%2FU79Kp4dWHKW9KNVyR3%2FvuvHKoHpISNf2p9rujMb7wNSPMA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915e615edf690b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1312&min_rtt=1198&rtt_var=531&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2197&delivery_rate=2377295&cwnd=251&unsent_bytes=0&cid=0d8fd0bf7bbd9082&ts=408&x=0", cfL4;desc="?proto=QUIC&rtt=2774&min_rtt=1114&rtt_var=967&sent=164&recv=59&lost=0&retrans=0&sent_bytes=150546&recv_bytes=25555&delivery_rate=868452&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14071&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/GDSherpa-bold.woff

104.21.75.230

200 OK

36 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/GDSherpa-bold.woff
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
Web Open Font Format, TrueType, length 35970, version 1.0
Size
36 kB (35970 bytes)
Hash
496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-bold.woff HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: font/woff
content-length: 35970
content-disposition: inline; filename="GDSherpa-bold.woff"
last-modified: Sat, 22 Feb 2025 10:44:21 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8mpFgjEHUgdj6DW9STf4P%2Fs%2B%2F%2Bz%2FHwp%2BjZiFaGpj6YA1EsOU5UKGr%2FVCJJVPxWx39nB0INyRSNHRusMH6kFlfXDb6Ay2uNpaO8c2BeaaZ3nrZj7wUwIQ5uWrw1%2B2wZUlRm6KiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915e615e2e120b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1352&min_rtt=1349&rtt_var=513&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2228&delivery_rate=2065264&cwnd=251&unsent_bytes=0&cid=2e435a80d4af5ef0&ts=416&x=0", cfL4;desc="?proto=QUIC&rtt=3103&min_rtt=1114&rtt_var=852&sent=179&recv=62&lost=0&retrans=0&sent_bytes=166265&recv_bytes=25692&delivery_rate=1240147&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14153&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/ghni8mM8J961LApOltdFqSPD64qWrGRNz58wYAqsCklZgSeYZdydpSxN0WEBOrZEkPThef208

104.21.75.230

200 OK

25 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/ghni8mM8J961LApOltdFqSPD64qWrGRNz58wYAqsCklZgSeYZdydpSxN0WEBOrZEkPThef208
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
RIFF (little-endian) data, Web/P image
Size
25 kB (25216 bytes)
Hash
f9a795e2270664a7a169c73b6d84a575
0fbb60ab27ab88c064eb347d0722c8ed4cf5e8b8
d00203b2eea6e418c31baafa949ada5349a9f9b7e99fa003aec7406822693740

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ghni8mM8J961LApOltdFqSPD64qWrGRNz58wYAqsCklZgSeYZdydpSxN0WEBOrZEkPThef208 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: image/webp
content-length: 25216
content-disposition: inline; filename="ghni8mM8J961LApOltdFqSPD64qWrGRNz58wYAqsCklZgSeYZdydpSxN0WEBOrZEkPThef208"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TgwGZ7ANaEiq93J92CDrZx5%2BI3d4ij3OKN9aS6nzPJj9KSLQvm6vdQrJZCBjnKSCkPS9o2YopQ2Ro751F7Y1Zp6Bcdl56Nw%2B7Ql1r68cQfWbSfOq7pmUvR91Xdh5zDLrEP93UA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915e615edf630b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1353&min_rtt=1348&rtt_var=516&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2211&delivery_rate=2045977&cwnd=234&unsent_bytes=0&cid=7c496def11cd6775&ts=386&x=0", cfL4;desc="?proto=QUIC&rtt=2410&min_rtt=1114&rtt_var=624&sent=152&recv=57&lost=0&retrans=0&sent_bytes=136234&recv_bytes=25463&delivery_rate=636948&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14055&x=1", cfExtPri, cfHdrFlush;dur=0

objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250222T104421Z&X-Amz-Expires=300&X-Amz-Signature=3628d1186bc67ff9ac608568fa594ba1ea736d847352359712f105b36a6384d6&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream

185.199.109.133

200 OK

10 kB

URL GET HTTP/2
objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250222T104421Z&X-Amz-Expires=300&X-Amz-Signature=3628d1186bc67ff9ac608568fa594ba1ea736d847352359712f105b36a6384d6&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
IP
185.199.109.133:443
ASN
#54113 FASTLY

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerDigiCert Inc
Subject*.github.io
Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28
ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (10017)
Size
10 kB (10245 bytes)
Hash
6c20a2be8ba900bc0a7118893a2b1072
ff7766fde1f33882c6e1c481ceed6f6588ea764c
b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500

HTTP Headers

GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250222T104421Z&X-Amz-Expires=300&X-Amz-Signature=3628d1186bc67ff9ac608568fa594ba1ea736d847352359712f105b36a6384d6&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Tue, 07 Dec 2021 16:38:45 GMT
etag: "0x8D9B9A009499A1E"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d91f6eaf-e01e-0032-2f18-13e122000000
x-ms-version: 2023-11-03
x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT
x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=randexp.min.js
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
date: Sat, 22 Feb 2025 10:44:21 GMT
age: 1048
x-served-by: cache-iad-kiad7000045-IAD, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 18050, 330
x-timer: S1740221061.377169,VS0,VE107
content-length: 10245
X-Firefox-Spdy: h2

5x9.fxjrlnzjj.ru/GDSherpa-regular.woff

104.21.75.230

200 OK

37 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/GDSherpa-regular.woff
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
Web Open Font Format, TrueType, length 36696, version 1.0
Size
37 kB (36696 bytes)
Hash
a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-regular.woff HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: font/woff
content-length: 36696
content-disposition: inline; filename="GDSherpa-regular.woff"
last-modified: Sat, 22 Feb 2025 10:44:21 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yob5%2BcRgMYO9ewNR%2F8wN99JYd3lnGlUYMzrc9uCiUF9eVAQTYaBoc9D%2FamVUrIZO7pabgWXcvG8CY3nYLRAQluasObzWaxkUVWMrVF0y1k%2FxaO1WpY3f0ZFqkQXFgXc5RqE0bw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915e615e2e150b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1282&min_rtt=1270&rtt_var=500&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2231&delivery_rate=2084919&cwnd=252&unsent_bytes=0&cid=8f6bb23caa60a056&ts=596&x=0", cfL4;desc="?proto=QUIC&rtt=3158&min_rtt=1114&rtt_var=741&sent=227&recv=66&lost=0&retrans=0&sent_bytes=219365&recv_bytes=25875&delivery_rate=33977&cwnd=67200&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14342&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/GDSherpa-regular.woff2

104.21.75.230

200 OK

29 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/GDSherpa-regular.woff2
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Size
29 kB (28584 bytes)
Hash
17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-regular.woff2 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: font/woff2
content-length: 28584
content-disposition: inline; filename="GDSherpa-regular.woff2"
last-modified: Sat, 22 Feb 2025 10:44:21 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kET3mN6HFaCF2QU5txIbuU1ZJ8ZsWmPt5aeusmVahut4JcPA6zDmHKVgZlt80ag1PqQbkl37%2BZAG%2F9E49KXdfHgF6kmznImpXf0V2wOl5Tmu%2FHcp2MkT3Ye%2BuCwSYDYHXsSz3A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915e615e2e140b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1236&min_rtt=1235&rtt_var=466&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2233&delivery_rate=2280224&cwnd=251&unsent_bytes=0&cid=4d28f9d0a0d9c551&ts=619&x=0", cfL4;desc="?proto=QUIC&rtt=3295&min_rtt=1114&rtt_var=831&sent=260&recv=67&lost=0&retrans=0&sent_bytes=257865&recv_bytes=25921&delivery_rate=3101815&cwnd=67200&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14357&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/GDSherpa-bold.woff2

104.21.75.230

200 OK

28 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/GDSherpa-bold.woff2
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Size
28 kB (28000 bytes)
Hash
a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-bold.woff2 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: font/woff2
content-length: 28000
content-disposition: inline; filename="GDSherpa-bold.woff2"
last-modified: Sat, 22 Feb 2025 10:44:21 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j1CjxqZfcCD5VyHmpkb7x9JcZmx1AEoY5GYLsfLeDzaEm2mlzpXU9s348pWQwNkU3%2FqZqlVcm384p5JU0jlzSGJI6SvyT5Lzgdbv3%2B2HvlZRUAWTyL%2F7fsnJqY1Xu4n5x3dvtw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915e615e2e100b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1344&min_rtt=1339&rtt_var=512&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2230&delivery_rate=2062273&cwnd=252&unsent_bytes=0&cid=8a82ce71df5bf046&ts=614&x=0", cfL4;desc="?proto=QUIC&rtt=3295&min_rtt=1114&rtt_var=831&sent=286&recv=67&lost=0&retrans=0&sent_bytes=288048&recv_bytes=25921&delivery_rate=3101815&cwnd=67200&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14360&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/GDSherpa-vf2.woff2

104.21.75.230

200 OK

93 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/GDSherpa-vf2.woff2
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Size
93 kB (93276 bytes)
Hash
bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-vf2.woff2 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:22 GMT
content-type: font/woff2
content-length: 93276
content-disposition: inline; filename="GDSherpa-vf2.woff2"
last-modified: Sat, 22 Feb 2025 10:44:21 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tevJTo11kcIqCqZQpZ2xMSEW92%2FMmn9x47jPG%2FfA8iWWKmbb1yrasYQkEGhwyj3Tlrf2PsASvuhmze9pERUTBX%2BQ1YlDSeDYg88g8O7mJEFHDsxGLbgglk%2BRhQFtel2vZN3aZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915e615e3e490b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1290&min_rtt=1276&rtt_var=507&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2228&delivery_rate=2047447&cwnd=251&unsent_bytes=0&cid=2071ce38878d3eb9&ts=722&x=0", cfL4;desc="?proto=QUIC&rtt=3910&min_rtt=1114&rtt_var=2185&sent=319&recv=73&lost=0&retrans=0&sent_bytes=323690&recv_bytes=29013&delivery_rate=2924636&cwnd=67200&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14653&x=1", cfExtPri, cfHdrFlush;dur=0

ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2

143.204.55.3

200 OK

20 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
IP
143.204.55.3:443
ASN
#16509 AMAZON-02

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 20416, version 2.197
Size
20 kB (20416 bytes)
Hash
d99a7377dabb55772ca9f986b0a04b57
2b5fcd8431953c44e410d0489899e74f6d2cfecc
affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149

HTTP Headers

GET /assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://5x9.fxjrlnzjj.ru
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20416
date: Mon, 10 Feb 2025 01:49:35 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:56:28 GMT
etag: "d99a7377dabb55772ca9f986b0a04b57"
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
expires: Tue, 10 Feb 2026 01:49:35 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 a9120cc3ff449047c990e82a4d5566ba.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: lztXkChhgXid_qkpZgOjMvbAjYdpzjKSsZTmUpq_R2TjEHy9iM2QDQ==
age: 1068887
X-Firefox-Spdy: h2

5x9.fxjrlnzjj.ru/GDSherpa-vf.woff2

104.21.75.230

200 OK

44 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/GDSherpa-vf.woff2
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Size
44 kB (43596 bytes)
Hash
2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-vf.woff2 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:22 GMT
content-type: font/woff2
content-length: 43596
content-disposition: inline; filename="GDSherpa-vf.woff2"
last-modified: Sat, 22 Feb 2025 10:44:21 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f3m7k%2FGYVtabTkn7K8c%2BmTNRtbcp0XE6YVcVlVfYWcuqQKnBTEZ5olGzBopJzmnaTc5Z40tZ6snWEUPfefGDdMSfZZocOWoySEADYgyQDc7qF4PsiVqyA3GWIPPrSfDcCaGLAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 915e615e2e180b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1238&min_rtt=1219&rtt_var=495&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2228&delivery_rate=2074289&cwnd=252&unsent_bytes=0&cid=be72c08224ae757e&ts=780&x=0", cfL4;desc="?proto=QUIC&rtt=4570&min_rtt=1114&rtt_var=2545&sent=400&recv=75&lost=0&retrans=0&sent_bytes=420173&recv_bytes=29105&delivery_rate=2267400&cwnd=134400&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14693&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/klBmZxivXxWefPPrCbxwLkdH0o0EAqZpJeAkWjAOqrCOY7DzrWfjzW2y4iGxyz226

104.21.75.230

200 OK

1.3 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/klBmZxivXxWefPPrCbxwLkdH0o0EAqZpJeAkWjAOqrCOY7DzrWfjzW2y4iGxyz226
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
RIFF (little-endian) data, Web/P image
Size
1.3 kB (1298 bytes)
Hash
32ca2081553e969f9fdd4374134521ad
7b09924c4c3d8b6e41fe38363e342da098be4173
216fc342a469aa6a005b2eacc24622095e5282d3e9f1ae99ce54c27b92ec3587

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /klBmZxivXxWefPPrCbxwLkdH0o0EAqZpJeAkWjAOqrCOY7DzrWfjzW2y4iGxyz226 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:22 GMT
content-type: image/webp
content-length: 1298
content-disposition: inline; filename="klBmZxivXxWefPPrCbxwLkdH0o0EAqZpJeAkWjAOqrCOY7DzrWfjzW2y4iGxyz226"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dIMvExXyjgEwGitbGPMLPpVCrwqSMbVkO5J4CdkXHDO09mCRti3UV2C6%2FE9qC2y4H88cXvYgYf4zvy03205e%2BWDiKZRtdekpQKDBwZCuU7Q6jODE0hXhvXFneXcycKOBxBUvjg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 915e61671da50b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1340&min_rtt=1324&rtt_var=528&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2203&delivery_rate=1960082&cwnd=250&unsent_bytes=0&cid=91a100aeba100b12&ts=394&x=0", cfL4;desc="?proto=QUIC&rtt=1597&min_rtt=746&rtt_var=763&sent=521&recv=92&lost=0&retrans=0&sent_bytes=544686&recv_bytes=29875&delivery_rate=537038&cwnd=134400&unsent_bytes=0&cid=585eaac8ab5f6506&ts=15200&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/12jVtmMSAqlbabUkv8919

104.21.75.230

200 OK

27 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/12jVtmMSAqlbabUkv8919
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
ASCII text, with very long lines (26765), with no line terminators
Size
27 kB (26765 bytes)
Hash
1a862a89d5633fac83d763886726740d
e5ce3aa454c992a13fd406a9647d7afbf831051f
5c22fd904edb792331a7307ddf4a790e0d1318924f6d8e7362fa6b55d5ab6fbb

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /12jVtmMSAqlbabUkv8919 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="12jVtmMSAqlbabUkv8919"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tlv6Q4vnNr8RNW54KHD6Z7R4O3aNmwD5xKW3MNTMzAk2%2F%2B%2FsSwazxx24mn7%2B63HDvkpBelmBUuvd7QsZqo1H8Yhm%2BiFcN8zEbErDhjKMUEPqIxUeAC6Ve9q0vg%2BK57R%2Bwfcy8w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 915e615e2e0b0b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1410&min_rtt=1298&rtt_var=567&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2152&delivery_rate=2194144&cwnd=251&unsent_bytes=0&cid=1070e9eacbd030df&ts=239&x=0", cfL4;desc="?proto=QUIC&rtt=3097&min_rtt=1114&rtt_var=1797&sent=112&recv=48&lost=0&retrans=0&sent_bytes=95220&recv_bytes=25051&delivery_rate=14464741&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=13614&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/abeGvmDRexrhEBpqcdWKgh30

104.21.75.230

200 OK

36 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/abeGvmDRexrhEBpqcdWKgh30
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
ASCII text, with CRLF line terminators
Size
36 kB (35786 bytes)
Hash
38501e3fbbbd89b56aa5ba35de1a32fe
d9b31981b6f834e8480ba28fbc1cff1be772f589
a1ca6b381cb01968851c98512c6e7f6c5309a49f7a16b864813135cbff82a85b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /abeGvmDRexrhEBpqcdWKgh30 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="abeGvmDRexrhEBpqcdWKgh30"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J4IGVHbTrQa0O2M%2BhFv6LT24NUtIHwBSNcjgd%2FQ0YnwvcrNlMKOV62UDZobPhTvwS1FHeUDtYfqGwy%2Fu%2FC2nuVy6dzIVaDXObjtHEmamyotByM85shfUokHTfg%2BJ4wzaGFjKuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 915e615e2e0d0b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1316&min_rtt=1284&rtt_var=504&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2155&delivery_rate=2218068&cwnd=252&unsent_bytes=0&cid=357c5fcc49942ba9&ts=403&x=0", cfL4;desc="?proto=QUIC&rtt=2337&min_rtt=1114&rtt_var=866&sent=141&recv=55&lost=0&retrans=0&sent_bytes=125542&recv_bytes=25372&delivery_rate=5926487&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=13979&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/favicon.ico

104.21.75.230

404 Not Found

0 B

URL GET HTTP/3
5x9.fxjrlnzjj.ru/favicon.ico
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6IjhmbXlvQnBSUlBlS01oZFFZbHU0RXc9PSIsInZhbHVlIjoibmNxdUJhY0Y1SmhIYUtjQjRBNDd6aW0vdUdmU1QzL3BvUXhPdWFYNUkzTjYrdkNnSXlMVkZVWlJhVlEyeUJJZG81R2VwbzF3SGtWSjlkRE9OOGJPaDkvUGFEZG1hNjNQMFVnWGZQMHpNcFpmb21WWkdWVHZIalNEUEtXekNOQzAiLCJtYWMiOiI3MWQ3MjQ4NTM2ZDQzMDM1MDhmYjQwYThlOWViZGFlM2Q3NzllN2NiNzM0NTE3NGQxZjYxODI3ZjhiZjlkNmFhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InlMUGQxV1Aya0dWVk9TZ3I2V2ppUEE9PSIsInZhbHVlIjoiS3k2NzZKc2hBUXI1N1JVb1JUU1hnN0tmeEptaFEwSDg5TEZjTG14RHZpNEVXblExemFhL2FkdXp4ODR6VWNidEhxcXdJRWV2TVRxMFJmcE1rR3BRSnlnY3RwOVhoblBTbmo2NThKN3oyaktnU1hXakRkd1lYbjM5eDhXNDhzTUMiLCJtYWMiOiIwNDMwNjE4NGVhNDczMDVmZDY1YWZjZmM2NmI2NjM3MjU4ZTVhYjVjMjYxNzBlNDQwYjMwNjEwMmZmNTNiMmNhIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Sat, 22 Feb 2025 10:44:23 GMT
content-type: text/html; charset=UTF-8
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bc%2FRn6Is4JkN8HCZmFZspDjN7TiYHiYWiWikPx8J4z5QWslBFvzLUHKs5ISxG5kxODL7Z4w%2BhK1ErD9EeANzVI0dVFaxhgdx4f%2FqtjjFMwBT7LhkOZkgOndlJcu5AahOyEda2w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
cache-control: max-age=14400
cf-cache-status: HIT
age: 4
priority: u=6,i=?0
server: cloudflare
cf-ray: 915e616cceff0b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1392&min_rtt=1149&rtt_var=604&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2102&delivery_rate=2478677&cwnd=251&unsent_bytes=0&cid=31d463f6a25c6456&ts=392&x=0", cfL4;desc="?proto=QUIC&rtt=1468&min_rtt=746&rtt_var=308&sent=638&recv=101&lost=0&retrans=0&sent_bytes=663290&recv_bytes=31151&delivery_rate=1296&cwnd=134400&unsent_bytes=0&cid=585eaac8ab5f6506&ts=15536&x=1", cfExtPri, cfHdrFlush;dur=0

ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css

143.204.55.3

200 OK

10 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
IP
143.204.55.3:443
ASN
#16509 AMAZON-02

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
ASCII text, with very long lines (10450)
Size
10 kB (10498 bytes)
Hash
e0d37a504604ef874bad26435d62011f
4301f0d2b729ae22adece657d79eccaa25f429b1
c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179

HTTP Headers

GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Thu, 14 Mar 2024 00:03:58 GMT
x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Sat, 22 Feb 2025 06:22:03 GMT
expires: Sun, 22 Feb 2026 06:22:03 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a9120cc3ff449047c990e82a4d5566ba.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: TNq24_W5vcUGfv1cCcV-k1sdiaPd_-WVfCyTFH8dG8S0UgXq2a6MCQ==
age: 15737
X-Firefox-Spdy: h2

5x9.fxjrlnzjj.ru/wbKgf8c3BB4YTetOlEyE1CGKYOk24I03jC105y2LDlYUjHWLs6f

104.21.75.230

200 OK

2.8 kB

URL POST HTTP/3
5x9.fxjrlnzjj.ru/wbKgf8c3BB4YTetOlEyE1CGKYOk24I03jC105y2LDlYUjHWLs6f
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
troff or preprocessor input, ASCII text, with very long lines (2846), with no line terminators
Size
2.8 kB (2831 bytes)
Hash
98a06dccf6014483c047195a79347512
3b0cb1b8d098d4fae206f25751a0b88be2814e77
4deaf681f1d671777ba6328d9a67782fc327672cb440d28ebb85cd4fea339592

HTTP Headers

POST /wbKgf8c3BB4YTetOlEyE1CGKYOk24I03jC105y2LDlYUjHWLs6f HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 53
Origin: https://5x9.fxjrlnzjj.ru
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:22 GMT
content-type: application/json
cache-control: no-cache, private
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wdLaWbeNbSqQzjjOg5WB4pbhi6h78NUp3qv1TsYL919tcTZsy9wgKGVHH7RrFZC%2FjyVwYYp5ZvT00kTDZACVz1ZSpA4a10Wpv3GvunCJXEAtz1620SzmSQtcSXHTbUecPrvB6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IjhmbXlvQnBSUlBlS01oZFFZbHU0RXc9PSIsInZhbHVlIjoibmNxdUJhY0Y1SmhIYUtjQjRBNDd6aW0vdUdmU1QzL3BvUXhPdWFYNUkzTjYrdkNnSXlMVkZVWlJhVlEyeUJJZG81R2VwbzF3SGtWSjlkRE9OOGJPaDkvUGFEZG1hNjNQMFVnWGZQMHpNcFpmb21WWkdWVHZIalNEUEtXekNOQzAiLCJtYWMiOiI3MWQ3MjQ4NTM2ZDQzMDM1MDhmYjQwYThlOWViZGFlM2Q3NzllN2NiNzM0NTE3NGQxZjYxODI3ZjhiZjlkNmFhIiwidGFnIjoiIn0%3D; expires=Sat, 22-Feb-2025 12:44:22 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6InlMUGQxV1Aya0dWVk9TZ3I2V2ppUEE9PSIsInZhbHVlIjoiS3k2NzZKc2hBUXI1N1JVb1JUU1hnN0tmeEptaFEwSDg5TEZjTG14RHZpNEVXblExemFhL2FkdXp4ODR6VWNidEhxcXdJRWV2TVRxMFJmcE1rR3BRSnlnY3RwOVhoblBTbmo2NThKN3oyaktnU1hXakRkd1lYbjM5eDhXNDhzTUMiLCJtYWMiOiIwNDMwNjE4NGVhNDczMDVmZDY1YWZjZmM2NmI2NjM3MjU4ZTVhYjVjMjYxNzBlNDQwYjMwNjEwMmZmNTNiMmNhIiwidGFnIjoiIn0%3D; expires=Sat, 22-Feb-2025 12:44:22 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 915e6166cd340b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=2008&min_rtt=1220&rtt_var=1020&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2355&delivery_rate=2334426&cwnd=251&unsent_bytes=0&cid=52b8abc5021cc0f3&ts=228&x=0", cfL4;desc="?proto=QUIC&rtt=2593&min_rtt=1114&rtt_var=1859&sent=473&recv=83&lost=0&retrans=0&sent_bytes=499493&recv_bytes=29467&delivery_rate=10831657&cwnd=134400&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14985&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/klCOQ4d02mrxLB7uT4UuKC5Zmu1MIkSof7SwxAUnlKD2v4SWeGJ9NNIFI8Y8N56170

104.21.75.230

200 OK

7.4 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/klCOQ4d02mrxLB7uT4UuKC5Zmu1MIkSof7SwxAUnlKD2v4SWeGJ9NNIFI8Y8N56170
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
SVG Scalable Vector Graphics image
Size
7.4 kB (7390 bytes)
Hash
bca9b46fee32162356ba5b4783e614dc
cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5
fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /klCOQ4d02mrxLB7uT4UuKC5Zmu1MIkSof7SwxAUnlKD2v4SWeGJ9NNIFI8Y8N56170 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: image/svg+xml
content-disposition: inline; filename="klCOQ4d02mrxLB7uT4UuKC5Zmu1MIkSof7SwxAUnlKD2v4SWeGJ9NNIFI8Y8N56170"
cf-cache-status: DYNAMIC
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P1lhRNfok4spPEyaU9J16Yyc2GUXR5Ukr2oKLwCwMoljiyvPCnHAtehTP38%2FRwSnpFdPrDAP6W3TjGss%2FplHFNbFOBHO6fRFd6i164xjmqFE%2Flhgmlaaci4IQjPjedzDjHeD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 915e615e9ee80b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=QUIC&rtt=2498&min_rtt=1114&rtt_var=1061&sent=125&recv=53&lost=0&retrans=0&sent_bytes=107818&recv_bytes=25280&delivery_rate=48878&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=13874&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/klu5JmSjD1OsCYKjHEFo1nqF2BV56ODtxgstQmM5P39o58d3wTpBDCL1RZuv220

104.21.75.230

200 OK

1.9 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/klu5JmSjD1OsCYKjHEFo1nqF2BV56ODtxgstQmM5P39o58d3wTpBDCL1RZuv220
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
SVG Scalable Vector Graphics image
Size
1.9 kB (1864 bytes)
Hash
4b5c228b4faba433d06ec569ed855b2d
a7d3882b93e332460e7c59510a6a811ef011983f
eb19d76cd1fad39abf0f2778991883a5cf9ff560117ce8f7c64124e71471b4ed

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /klu5JmSjD1OsCYKjHEFo1nqF2BV56ODtxgstQmM5P39o58d3wTpBDCL1RZuv220 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:22 GMT
content-type: image/svg+xml
server: cloudflare
content-disposition: inline; filename="klu5JmSjD1OsCYKjHEFo1nqF2BV56ODtxgstQmM5P39o58d3wTpBDCL1RZuv220"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MhS3pthZp0E3JobhoG6i%2FwUZtOiIqaVpYPrk0Vq6mt%2BLtRbrKovaX%2Fp%2F%2Bwz3C5hdD2W2O0k86gwmoBgioUXuSjRmKT5kXKId1vDaY02cBT3hcvAndi05PbwuZ4WoHv%2B%2BD59PqA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
vary: accept-encoding
cf-ray: 915e61671d960b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1359&min_rtt=1185&rtt_var=568&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2202&delivery_rate=2403375&cwnd=252&unsent_bytes=0&cid=069d4e3a78bd07a0&ts=210&x=0", cfExtPri

5x9.fxjrlnzjj.ru/wx3rWz2HxP6hqoQmlder9orhJOmnc4qlH1PdrO1Za5r4KVqNUH0z2ab180

104.21.75.230

200 OK

2.9 kB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/wx3rWz2HxP6hqoQmlder9orhJOmnc4qlH1PdrO1Za5r4KVqNUH0z2ab180
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
SVG Scalable Vector Graphics image
Size
2.9 kB (2905 bytes)
Hash
e924de0d471df54b6280f3dc8b187cb8
857f03226070b502a9e06b4249710ec10be4c9e9
24ce135a31ce83ac3d62471fcc0e1a82ce6f1533c993ee59ca4e110d5f2fae33

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /wx3rWz2HxP6hqoQmlder9orhJOmnc4qlH1PdrO1Za5r4KVqNUH0z2ab180 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: image/svg+xml
content-disposition: inline; filename="wx3rWz2HxP6hqoQmlder9orhJOmnc4qlH1PdrO1Za5r4KVqNUH0z2ab180"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S2H%2FoUU5cfrrgGGmzQ2nU9ZPSKyuXks619TsETn5wUh2DCVu6udk4GTBOr4qfUqKaHuqFdjtp2hWKPi8G5CdNdnwjqkXvJCDoA2idgya1cUPco14klNe%2FAmswtqab%2BGRUEznpA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 915e615e9eeb0b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=2345&min_rtt=1165&rtt_var=1259&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2196&delivery_rate=2444635&cwnd=251&unsent_bytes=0&cid=c80533d005b972d3&ts=410&x=0", cfL4;desc="?proto=QUIC&rtt=2356&min_rtt=1114&rtt_var=687&sent=145&recv=56&lost=0&retrans=0&sent_bytes=129539&recv_bytes=25418&delivery_rate=987196&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=14033&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/opkAOI6J3z0f6OKbKFIxvXgTCHKszkauEl9YijHNmMFA0HwtNJ9NUly0fM8b8cd194

104.21.75.230

200 OK

268 B

URL GET HTTP/3
5x9.fxjrlnzjj.ru/opkAOI6J3z0f6OKbKFIxvXgTCHKszkauEl9YijHNmMFA0HwtNJ9NUly0fM8b8cd194
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
SVG Scalable Vector Graphics image
Size
268 B (268 bytes)
Hash
1318aafc1fb9ded0c623e5b9a557e6df
0917cdd7633cd1642b02b2b785416ec7e5106dcc
d86660a84daa211b121ec9fe0df83d6b945f61b888384391eabc7d6b4e941dc4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /opkAOI6J3z0f6OKbKFIxvXgTCHKszkauEl9YijHNmMFA0HwtNJ9NUly0fM8b8cd194 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: image/svg+xml
content-disposition: inline; filename="opkAOI6J3z0f6OKbKFIxvXgTCHKszkauEl9YijHNmMFA0HwtNJ9NUly0fM8b8cd194"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nEsoNOpP8%2B8hzgskn69HvRBSFfPom4KPYrRyzPGURije5DyhmYF8HpyMhmt8x5QOmqmAcaefaFPxqxPt7TsV4KLozPKBzl0fObNpSuuQrmuTa1fjI%2Bduc2XbXebxlN5w5RAYXw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 915e615e9eee0b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1277&rtt_var=702&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2204&delivery_rate=2230227&cwnd=252&unsent_bytes=0&cid=31b2c3f34361135d&ts=226&x=0", cfL4;desc="?proto=QUIC&rtt=2582&min_rtt=1114&rtt_var=1191&sent=124&recv=52&lost=0&retrans=0&sent_bytes=106747&recv_bytes=25234&delivery_rate=496062&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=13848&x=1", cfExtPri, cfHdrFlush;dur=0

5x9.fxjrlnzjj.ru/efvnYDSf2blyX255j3ijPAZrHjjQb2YO5MedCrY78150

104.21.75.230

200 OK

270 B

URL GET HTTP/3
5x9.fxjrlnzjj.ru/efvnYDSf2blyX255j3ijPAZrHjjQb2YO5MedCrY78150
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type
SVG Scalable Vector Graphics image
Size
270 B (270 bytes)
Hash
0c09c5ea7c28d6feb4d124957dde0a0d
1b9efde2d8f0e2a3d9d5315117e597c2d622fc5e
b3c39d2c15327b7ae68940502a2d7bf457fe521e075e6e671d0340edc58bcb3a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /efvnYDSf2blyX255j3ijPAZrHjjQb2YO5MedCrY78150 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: image/svg+xml
content-disposition: inline; filename="efvnYDSf2blyX255j3ijPAZrHjjQb2YO5MedCrY78150"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ott9x2df%2FQinMn%2BL9%2B3NFEMDJ4tsRbn6Q9rjYEC%2BKUXVia56h5%2BXW4R3faSvqq6k4GtEJdHMHBnGN7DjLjJKi8CRm%2Fg4QUlkNl%2F%2BY%2BrJr8%2FSCflaaAHwodDIEfNBrwOEhTHtVg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 915e615e3e550b65-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1375&min_rtt=1206&rtt_var=573&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2182&delivery_rate=2361525&cwnd=250&unsent_bytes=0&cid=0fada48377ef7d88&ts=216&x=0", cfL4;desc="?proto=QUIC&rtt=2800&min_rtt=1114&rtt_var=1523&sent=118&recv=50&lost=0&retrans=0&sent_bytes=101359&recv_bytes=25143&delivery_rate=679528&cwnd=33600&unsent_bytes=0&cid=585eaac8ab5f6506&ts=13780&x=1", cfExtPri, cfHdrFlush;dur=0

ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css

143.204.55.3

200 OK

223 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
IP
143.204.55.3:443
ASN
#16509 AMAZON-02

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type

Size
223 kB (222931 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Tue, 14 May 2024 21:48:24 GMT
x-amz-meta-sha1sum: 7b5499b46660a0348cc2b22cae927dcc3fda8b20
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Fri, 21 Feb 2025 21:16:29 GMT
expires: Sat, 21 Feb 2026 21:16:29 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"0329c939fca7c78756b94fbcd95e322b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a9120cc3ff449047c990e82a4d5566ba.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: cX0fE5d2sXGEpTrovgZVUEUjVmg6eCE6ipEmYWK1qKuJwZ3Z0Rb7oA==
age: 48471
X-Firefox-Spdy: h2

5x9.fxjrlnzjj.ru/34YB5bMfrj8zDmGcCmfLdGMqFghoS8MAOXY2o3F67104

104.21.75.230

200 OK

2.0 MB

URL GET HTTP/3
5x9.fxjrlnzjj.ru/34YB5bMfrj8zDmGcCmfLdGMqFghoS8MAOXY2o3F67104
IP
104.21.75.230:443
ASN
#13335 CLOUDFLARENET

Requested by
https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Certificate
IssuerGoogle Trust Services
Subjectfxjrlnzjj.ru
FingerprintA1:24:00:69:48:6E:DE:65:7F:71:82:B4:49:69:C9:FD:A6:9C:13:C5
ValidityThu, 13 Feb 2025 10:22:50 GMT - Wed, 14 May 2025 11:21:20 GMT

File type

Size
2.0 MB (1970484 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /34YB5bMfrj8zDmGcCmfLdGMqFghoS8MAOXY2o3F67104 HTTP/1.1
Host: 5x9.fxjrlnzjj.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://5x9.fxjrlnzjj.ru/haaygjiaznvcqznsn02ralvuii384q6m?CHZQLSADWHFPNCCZWSSIU
Cookie: XSRF-TOKEN=eyJpdiI6ImlxblhLWVAzUm51NFA0SkpXNjFuaWc9PSIsInZhbHVlIjoiL1UxZWVuTUxmR2xaQW5nN1B6MjJIdE04SUVDcFlHcnhMdll2NjBYdE1abmd4cVJEU04rcEh5a2tCbmdDRk5qMm9jbnlMZ1dtRHZCeHRVY2pGTDREZjFwdnJtd0hYUmtLaGcyOE80Ymp5UXg2ckZGKzljc1dSM1hRNXFjWEE1b0kiLCJtYWMiOiI1NjhhNzBjODkxNTc2OTljNTU1MTRiNzg1NjhiNDgyMGZhMzNhMGM3NTlhZTA0MTkxNDJlNjY1OTQwMzBlYjNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InQzTTNHRVFxOVF3bmJGamZHWW93M1E9PSIsInZhbHVlIjoienFhd0ZwTWlLRTF2REFPSkI1andFVkFVbUZVZitkcytRMnhtSERUZ0RvN3k5WjhQaUNTenFuZTFOc1Rnb1hUcUlxRmxxcW9UN0lUZExaT0hwci9aMWhyVzRHOVRSZW5RT01lSDVNYjA5Wnc0Yi9IQkhTeFpENG5SWTNyQW41RDYiLCJtYWMiOiI1MmVhODQ2YzJhYWFkOGYxMjE5Y2M4NjdjNDEyM2UxM2Q4MzdmMzJmNjdkOGU1MjYxMzA2ZTM2ZmE0MTgxZWM0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 22 Feb 2025 10:44:21 GMT
content-type: application/javascript
server: cloudflare
content-disposition: inline; filename="34YB5bMfrj8zDmGcCmfLdGMqFghoS8MAOXY2o3F67104"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VXrBCd1ljwgMCwIR5CKb3w%2F6e2Lh3322D6TyEMc%2F7K2iWZSPV6t18dBkcOmDu1ZWTtR2a1m1V60jJ4%2FZ3AfjtjiPHfd21ie2gaLo0q8FZ38n9sHAdL8S4dG6WeGHxRtbUDAx8g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
priority: u=3,i=?0
vary: accept-encoding
cf-ray: 915e615edf740b65-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1275&min_rtt=1259&rtt_var=504&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2147&delivery_rate=2053352&cwnd=252&unsent_bytes=0&cid=216e88ab4454e362&ts=432&x=0", cfExtPri

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (13)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (37)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size