Report - i9qe.peativerthera.ru/yHAr8r/

Report Overview

Visited public
2025-01-31 14:58:41
Tags
microsoft phishing outlook suspicious
URL
i9qe.peativerthera.ru/yHAr8r/
Finishing URL
i9qe.peativerthera.ru/yHAr8r/
IP / ASN
104.21.29.161
#13335 CLOUDFLARENET
Title
login for safety
Phishing - Microsoft
Phishing - Generic phishing
Phishing - Microsoft Outlook
Suspicious - Anti-debugging code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
objects.githubusercontent.com	134060	2014-02-06	2021-11-01	2025-01-29	893 B	11 kB	185.199.110.133
classify-client.services.mozilla.com	3824	1994-10-18	2019-01-09	2025-01-29	369 B	385 B	35.190.72.216
cdnjs.cloudflare.com	235	2009-02-17	2012-05-23	2025-01-29	1.4 kB	45 kB	104.17.24.14
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20	2025-01-29	468 B	406 B	104.18.95.41
code.jquery.com	634	2005-12-10	2012-05-21	2025-01-29	1.3 kB	94 kB	151.101.194.137
developers.cloudflare.com	592034	2009-02-17	2012-09-07	2025-01-28	450 B	1.7 kB	104.16.6.189
i9qe.peativerthera.ru	unknown	2025-01-14	2025-01-28	2025-01-28	31 kB	744 kB	172.67.149.115
ok4static.oktacdn.com	16592	2014-11-11	2018-06-15	2025-01-28	4.4 kB	134 kB	143.204.55.47
github.com	1423	2007-10-09	2016-07-13	2025-01-29	458 B	4.3 kB	140.82.121.3
py7kw.adlijari.ru	unknown	2025-01-15	2025-01-31	2025-01-31	453 B	1.4 kB	188.114.97.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (17)

	URL	From	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.6.0.min.js	ScriptElement	90 kB	2023-03-07	2025-05-03
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.194.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-03 04:27 Times Seen204267 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	i9qe.peativerthera.ru/34Ak2fk5jmThKj0oWoFkrBIUCcn4ijlWvsySgM4nt89102	ScriptElement	137 kB	2025-01-27	2025-02-05
Pretty URL i9qe.peativerthera.ru/34Ak2fk5jmThKj0oWoFkrBIUCcn4ijlWvsySgM4nt89102 IP 172.67.149.115 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-01-27 23:50 Last Seen2025-02-05 01:24 Times Seen2855 Hash 378be0bda52e0dc309ba19e0e8dc3af0 88de4b6325b9af80fcf458097f05ae8a10f6df0a 0eb68b87fd0c31cf0110c8688f47f26699bdc1483c3034a983396a3b4548324c Loading...

	i9qe.peativerthera.ru/yHAr8r/	ScriptElement	20 kB	2025-01-31	2025-01-31
Pretty URL i9qe.peativerthera.ru/yHAr8r/ IP 172.67.149.115 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash 3d839d493c22da3cda4383ed8abbc542 9e7018b122eb0f3bbbc2694fd1595b8399bf7053 b4ed0ca1554f027a9365b45809db6c1b48928e939033b78add13fead50ad292f Loading...

	unknown	ScriptElement	1.6 kB	2025-01-31	2025-01-31
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash c4e4e3027793da725cedef54b08149fc e81ae2ffdf6090a275de849399bb89044e152203 2c5422f555ead518902c909109807dbbfe2762649ac52917804ff70c1c58ddf1 Loading...

	cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	ScriptElement	48 kB	2023-03-07	2025-05-03
Pretty URL cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:31 Last Seen2025-05-03 04:27 Times Seen92082 Hash 2ca03ad87885ab983541092b87adb299 1a17f60bf776a8c468a185c1e8e985c41a50dc27 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762 Loading...

	unknown	ScriptElement	2.0 kB	2025-01-31	2025-01-31
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash 7521d28ae9c7eb560f87fa342361aa3e d0acbdaa11e0d7d4b94dacc2261ee20404abfa5a 34fd86d6738ddc0f8d249c29ce595973644125319260869ad5fc8873e3bdb8a5 Loading...

	unknown	ScriptElement	134 kB	2025-01-31	2025-01-31
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash 20fb67c0a4f1279fbc06db85af638e4d f3466a8232b50d3b13804354e817a0753a008bc4 338c89086fdf5b4f0728bbb2aba70c400eceb2976e44a1ea07e60765a4ffbc56 Loading...

	unknown	ScriptElement	2.2 kB	2025-01-31	2025-01-31
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash 6b921af8f76511c68f81001f0d843d7d 40b2ad0ee73ad1146056fcc312085176c2a624ad 48fac537956d3543b4cce990f01be03ccf27456925fb36a3216102b1f5f6c9a5 Loading...

	unknown	ScriptElement	659 B	2025-01-28	2025-02-11
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-01-28 07:57 Last Seen2025-02-11 00:06 Times Seen737 Hash 847930c9ac4f211a3e62a2a37e6e558d e08824d8ec5f536cd5f39d4ddab92d7b82ed25d9 ae81942197db418b474b9bd17af2cd59e8d1f53e1f8642baa2811381ed0e1a45 Loading...

	unknown	ScriptElement	14 kB	2025-01-31	2025-01-31
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash 51f9ce2246fefbbe2da81b1517756a03 aa009ec50a411b5f21fcb94fb3efe1f52135c214 ef083fa93136935b3eb348ce1627eec027df8a804c3102a6d0ac9f4aa1161ce5 Loading...

	unknown	ScriptElement	9.5 kB	2025-01-31	2025-01-31
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash 59489a6572d982cafa857df4eec90480 15fb765177912835bc1baafc771af5262c4a5781 1d6bb7860c71c60748d3fbbbfdc49c7cd9d3accb9acc2a8737681e9c06e81a15 Loading...

	github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js	ScriptElement	10 kB	2024-05-30	2025-05-03
Pretty URL github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js IP 140.82.121.3 ASN #36459 GITHUB Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-30 22:56 Last Seen2025-05-03 00:46 Times Seen18145 Hash 6c20a2be8ba900bc0a7118893a2b1072 ff7766fde1f33882c6e1c481ceed6f6588ea764c b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500 Loading...

		Size	First Seen	Last Seen
	#1 Eval - fe100082eaffc09f307851e81ea1242e	6.5 kB	2025-01-31 14:58	2025-01-31 14:58
Pretty Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash fe100082eaffc09f307851e81ea1242e e246828ceaf387d0cd98e861a61981d04bffad66 66adc82ed7d8c09d75bafb9f394140656cca7f592184ee78228ff8c339fd4435 Loading...

		Size	First Seen	Last Seen
	#1 Write - 3713fe98a0845c0ff9c5aacce3995ba6	129 kB	2025-01-31 14:58	2025-01-31 14:58
Pretty Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash 3713fe98a0845c0ff9c5aacce3995ba6 beb886e5ad544e5af70462c3a0a11ae4e187b9bb 208932c8cc5cb63d39807fc40c23f4b5fc39fc68795f4bf7560604dc63ef9bc4 Loading...

	#2 Write - b62216250cba30da7e3b252cd6062aea	11 kB	2025-01-31 14:58	2025-01-31 14:58
Pretty Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash b62216250cba30da7e3b252cd6062aea d69c2a62ebbe0450e55d22bd8e34f8e8fcee31fc 554f2e94614cc9ec0dea9ca78fd21f0c45e174cdab9f7a59584cce24d1c25919 Loading...

	#3 Write - 52d790ea07f1eef9e745d059f21d46fb	146 kB	2025-01-31 14:58	2025-01-31 14:58
Pretty Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash 52d790ea07f1eef9e745d059f21d46fb de894b454730a238e39874925359a15315129b06 1bbb6d7d061b417ed625b36dba573de3e076323bd9ec41b2867ef3c9b74ed0b6 Loading...

	#4 Write - f51f09f178684d54003df7783eb70901	99 kB	2025-01-31 14:58	2025-01-31 14:58
Pretty Observations First Seen2025-01-31 14:58 Last Seen2025-01-31 14:58 Times Seen1 Hash f51f09f178684d54003df7783eb70901 1ce0003e956d6cb5576b6fed3aa9923acfc48fdc 5caff4a5fd75a7eb63682c96233c9c630af35667ee46f01f6ae6b9d74931adb3 Loading...

HTTP Transactions (45)

URL IP Response Size

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.24.14

200 OK

14 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT

File type
JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Size
14 kB (13972 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 31 Jan 2025 14:58:10 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 768392
expires: Wed, 21 Jan 2026 14:58:10 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QqAnVRbogiBLOPOD0vTA39UOBylfLyNfWWzRgM%2F6QtCmTEYu1f1aZwd1HvAlmXVfCUOaxqaQOZ23PuvL2qG7gzSrRLxJr%2B%2FC88El4iBA6JZCpg%2BwD41KXn8g8iHmHufC1pIY%2BywY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 90aa8ef25a4f1bfe-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback

104.18.95.41

302 Found

0 B

URL
challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
IP
104.18.95.41:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Fri, 31 Jan 2025 14:58:10 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/b/6682e961b853/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 90aa8ef28ebd0b02-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.0.min.js

151.101.194.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.194.137:443
ASN
#54113 FASTLY

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 31 Jan 2025 14:58:11 GMT
age: 2089025
x-served-by: cache-lga21931-LGA, cache-hel1410033-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 543342
x-timer: S1738335491.018518,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

developers.cloudflare.com/favicon.png

104.16.6.189

200 OK

937 B

URL
developers.cloudflare.com/favicon.png
IP
104.16.6.189:0
ASN
#13335 CLOUDFLARENET

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
937 B (937 bytes)
Hash
fc3b7bbe7970f47579127561139060e2
3f7c5783fe1f4404cb16304a5a274778ea3abd25
85e6223afdbd5badf2c79bcfbaa6fe686acaa781eca52c196647ffabb3be2ffe

HTTP Headers

GET /favicon.png HTTP/1.1
Host: developers.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 31 Jan 2025 14:58:11 GMT
content-type: image/png
content-length: 937
cache-control: public, max-age=0, must-revalidate
etag: "6be7ff94b6151f8cfbf08b53a17e2ac1"
set-cookie: __cf_bm=7yBc31BT.n5AIMOt4QWfYZ_eD1NycGUTo.MY3Y4d484-1738335491-1.0.1.1-J4Pmnqbz.mrPeLT0vVxhixAwqfyU3bF7oH_7JSAyInELqAkCiGzQPTby7EU8YgHlKhrerwi_9sjrm01OL3euFw; path=/; expires=Fri, 31-Jan-25 15:28:11 GMT; domain=.developers.cloudflare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: cloudflare
cf-ray: 90aa8ef448db56b7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.24.14

200 OK

14 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT

File type
JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Size
14 kB (13972 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:19 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 768401
expires: Wed, 21 Jan 2026 14:58:19 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e9zZf%2BJuMkLPE33QDg%2B5DRvla%2FXITuHul74k2%2BIQTZE0fhzMAxnU1H1MJEUPYr1MxUErkX5z7MUIPcIJaZuYZ0g3VV6y8pbxugC1kQ1WeXlHTq1xXxqONKlrTFKjiFUhjHoqofku"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 90aa8f26bb55712d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

code.jquery.com/jquery-3.6.0.min.js

151.101.194.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.194.137:443
ASN
#54113 FASTLY

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 31 Jan 2025 14:58:19 GMT
age: 2089033
x-served-by: cache-lga21931-LGA, cache-hel1410033-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 543347
x-timer: S1738335499.334143,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.0.min.js

151.101.194.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.194.137:443
ASN
#54113 FASTLY

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5
ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 31 Jan 2025 14:58:20 GMT
age: 2089034
x-served-by: cache-lga21931-LGA, cache-hel1410033-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 543348
x-timer: S1738335500.175314,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.24.14

200 OK

14 kB

URL GET HTTP/3
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32
ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT

File type
JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Size
14 kB (13972 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 768402
expires: Wed, 21 Jan 2026 14:58:20 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E9dvQHC9SegW2NTK2pvnjz0IzXp5QBZrHDkILC919pUplkJYDDDB2rSwZjcel%2BuCWangt6A%2BUB2YXJr31g0R9Yf84npBuIXhKX%2BrNNReVyQCoY0%2FfeuL65CLtZDa%2Fc%2FBWX8KGS%2BT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 90aa8f2c2914712d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7

143.204.55.47

200 OK

11 kB

URL GET HTTP/2
ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
Size
11 kB (10796 bytes)
Hash
12bdacc832185d0367ecc23fd24c86ce
4422f316eb4d8c8d160312bb695fd1d944cbff12
877ae491d9aac5c6ef82a8430f9f652ace8a0dbc7294bd112aad49bd593769d0

HTTP Headers

GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: image/png
content-length: 10796
server: nginx
last-modified: Tue, 23 Feb 2021 04:20:08 GMT
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
date: Wed, 29 Jan 2025 00:59:17 GMT
expires: Thu, 29 Jan 2026 00:59:17 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: "12bdacc832185d0367ecc23fd24c86ce"
x-cache: Hit from cloudfront
via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: OF2QgTE9aI2PAFdNLF0wwrZ2nZ5agRssWDIB-_uN5yryB_NQ1COe0Q==
age: 223143
X-Firefox-Spdy: h2

i9qe.peativerthera.ru/uvi9jSSHmx6VLpbGEsGLcrU84opdw6CKaPeb4SWGDvaMWSI34130

172.67.149.115

200 OK

644 B

URL GET HTTP/3
i9qe.peativerthera.ru/uvi9jSSHmx6VLpbGEsGLcrU84opdw6CKaPeb4SWGDvaMWSI34130
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
RIFF (little-endian) data, Web/P image
Size
644 B (644 bytes)
Hash
541b83c2195088043337e4353b6fd60d
f09630596b6713217984785a64f6ea83e91b49c5
2658b8874f0d2a12e8726df78ac8954324c3bbe4695e66bdef89195fde64322f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /uvi9jSSHmx6VLpbGEsGLcrU84opdw6CKaPeb4SWGDvaMWSI34130 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: image/webp
content-length: 644
content-disposition: inline; filename="uvi9jSSHmx6VLpbGEsGLcrU84opdw6CKaPeb4SWGDvaMWSI34130"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SaxnpDEtorSJSapKQN40W4R%2FYvF6JwnDNQ2ysxmwtobdmTXU3cKVUeTkoucXqEcNSQ9P71EWwqosp4FGUCfZFZdJ0zsXqDBkYQo%2BFsJDsNqS6CAGLKVkA3h4dP3p4g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 90aa8f2c7f947130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=9163&min_rtt=8795&rtt_var=4034&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2153&delivery_rate=242589&cwnd=247&unsent_bytes=0&cid=3bed01f4fcd89b73&ts=119&x=0", cfL4;desc="?proto=QUIC&rtt=1883&min_rtt=944&rtt_var=940&sent=123&recv=59&lost=0&retrans=0&sent_bytes=99505&recv_bytes=24037&delivery_rate=2033602&cwnd=13200&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=9947&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/opF4x610SXhSrEXZXsJWNAefOLK16YJFaRg2Qsu1j845140

172.67.149.115

200 OK

892 B

URL GET HTTP/3
i9qe.peativerthera.ru/opF4x610SXhSrEXZXsJWNAefOLK16YJFaRg2Qsu1j845140
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
RIFF (little-endian) data, Web/P image
Size
892 B (892 bytes)
Hash
41d62ca205d54a78e4298367482b4e2b
839aae21ed8ecfc238fdc68b93ccb27431cd5393
20a4a780db0bcc047015a0d8037eb4eb58b3e5cb338673799c030a3e1b626b40

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /opF4x610SXhSrEXZXsJWNAefOLK16YJFaRg2Qsu1j845140 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: image/webp
content-length: 892
content-disposition: inline; filename="opF4x610SXhSrEXZXsJWNAefOLK16YJFaRg2Qsu1j845140"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RR3W9RyC9CLLioUZIYnY52uLKW28At5JiUDasPU1cxKbB%2B8OMGqW0tGeUqWhJmJ%2FPA8tMIIb8OYaSSAwXa27sJcrrbokLJSjgeeIpHU1RMUM%2BYU5KbayOzIjq%2BKZ%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 90aa8f2c7f977130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=9756&min_rtt=5544&rtt_var=8895&sent=6&recv=10&lost=0&retrans=1&sent_bytes=4222&recv_bytes=2148&delivery_rate=117788&cwnd=237&unsent_bytes=0&cid=81d7c2ab409f3c28&ts=121&x=0", cfL4;desc="?proto=QUIC&rtt=1802&min_rtt=944&rtt_var=867&sent=130&recv=60&lost=0&retrans=0&sent_bytes=105896&recv_bytes=24083&delivery_rate=708642&cwnd=13200&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=9951&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/qrzRj53kP2zyiLutkq27GaVRrvJyZcwODTckx2axKbF8duvRI9yFXWJrU2lkNml9ZQl6wgOKaanUbMnBcd240

172.67.149.115

200 OK

9.6 kB

URL GET HTTP/3
i9qe.peativerthera.ru/qrzRj53kP2zyiLutkq27GaVRrvJyZcwODTckx2axKbF8duvRI9yFXWJrU2lkNml9ZQl6wgOKaanUbMnBcd240
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
RIFF (little-endian) data, Web/P image
Size
9.6 kB (9648 bytes)
Hash
4946eb373b18d178c93d473489673bb6
16477acb73b63ca251d37401249e7e4515febd24
666bc574c9f3fb28a8ac626fa8105c187c2a313736494a06bd5a937473673c92

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /qrzRj53kP2zyiLutkq27GaVRrvJyZcwODTckx2axKbF8duvRI9yFXWJrU2lkNml9ZQl6wgOKaanUbMnBcd240 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: image/webp
content-length: 9648
server: cloudflare
content-disposition: inline; filename="qrzRj53kP2zyiLutkq27GaVRrvJyZcwODTckx2axKbF8duvRI9yFXWJrU2lkNml9ZQl6wgOKaanUbMnBcd240"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=laEIfmvpLX%2BjIdeVE%2B3bA0eEsRKstPtwCTVjPzp%2BZH9u%2Br8D6%2BG1DviZK2Dj47jlceKLlTxPN0fj0ZxgPduGhzk%2B3TvuAXZKt9biqoXDRnx0iSr2tnRAWZIcyiH6QA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
cf-ray: 90aa8f2c8fc17130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=7453&min_rtt=4087&rtt_var=7516&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2185&delivery_rate=143288&cwnd=238&unsent_bytes=0&cid=7c7004a5763dea57&ts=117&x=0", cfExtPri

i9qe.peativerthera.ru/uvLn8R2bvalouDZIsfJC2D675VU6q67INuUjjnNSWNC6RbcDybd9gh260

172.67.149.115

200 OK

18 kB

URL GET HTTP/3
i9qe.peativerthera.ru/uvLn8R2bvalouDZIsfJC2D675VU6q67INuUjjnNSWNC6RbcDybd9gh260
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
RIFF (little-endian) data, Web/P image
Size
18 kB (17842 bytes)
Hash
4b52ecdc33382c9dca874f551990e704
8f3bf8e41cd4cdddb17836b261e73f827b84341b
cce050cc3b150c0b370751021bb15018ee2b64ac369e230fe3b571a9b00d4342

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /uvLn8R2bvalouDZIsfJC2D675VU6q67INuUjjnNSWNC6RbcDybd9gh260 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: image/webp
content-length: 17842
content-disposition: inline; filename="uvLn8R2bvalouDZIsfJC2D675VU6q67INuUjjnNSWNC6RbcDybd9gh260"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=izVWajAaBqSsS%2FFGnC5%2BJ2POZ%2FxRyiSW8F0lKx45zOZLMKB6btMdXb0XUicnoaa3qV5N5vdpmdgVPtYu3U%2Fh1CMEVcq3wzSfZH8pN5ZQpU8%2FBe7SOuQCXua%2FIaBC1w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 90aa8f2c8fc27130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=7815&min_rtt=4020&rtt_var=7765&sent=6&recv=10&lost=0&retrans=1&sent_bytes=4224&recv_bytes=2158&delivery_rate=139171&cwnd=251&unsent_bytes=0&cid=53a212e3433229f9&ts=124&x=0", cfL4;desc="?proto=QUIC&rtt=1802&min_rtt=944&rtt_var=867&sent=126&recv=60&lost=0&retrans=0&sent_bytes=101734&recv_bytes=24083&delivery_rate=708642&cwnd=13200&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=9950&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/ghoIhInwdkUznTpXyTENYVAmnNldtYQWs34Jt0Ie7XKqKJhE6bWOef210

172.67.149.115

200 OK

25 kB

URL GET HTTP/3
i9qe.peativerthera.ru/ghoIhInwdkUznTpXyTENYVAmnNldtYQWs34Jt0Ie7XKqKJhE6bWOef210
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
RIFF (little-endian) data, Web/P image
Size
25 kB (25216 bytes)
Hash
f9a795e2270664a7a169c73b6d84a575
0fbb60ab27ab88c064eb347d0722c8ed4cf5e8b8
d00203b2eea6e418c31baafa949ada5349a9f9b7e99fa003aec7406822693740

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /ghoIhInwdkUznTpXyTENYVAmnNldtYQWs34Jt0Ie7XKqKJhE6bWOef210 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: image/webp
content-length: 25216
server: cloudflare
content-disposition: inline; filename="ghoIhInwdkUznTpXyTENYVAmnNldtYQWs34Jt0Ie7XKqKJhE6bWOef210"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0A5QHcHjE8mnb4w8S7tKCUXCrKGXcBVDUdcRbq1PkAk97Y5GnHdahUsOdGPUBTeQDqR6XS0YlWVKAEFMU3DrwSBbPO151j1qNZaJaUvRtmfRbCkWedfHhPpxtOS%2F4A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
cf-ray: 90aa8f2c8fbe7130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=8661&min_rtt=4504&rtt_var=8956&sent=6&recv=9&lost=0&retrans=1&sent_bytes=4224&recv_bytes=2157&delivery_rate=98762&cwnd=172&unsent_bytes=0&cid=4886fdb6aaa00bb5&ts=115&x=0", cfExtPri

github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js

140.82.121.3

302 Found

0 B

URL GET HTTP/2
github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js
IP
140.82.121.3:443
ASN
#36459 GITHUB

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerSectigo Limited
Subjectgithub.com
FingerprintE7:03:5B:CC:1C:18:77:1F:79:2F:90:86:6B:6C:1D:F8:DF:AA:BD:C0
ValidityThu, 07 Mar 2024 00:00:00 GMT - Fri, 07 Mar 2025 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: GitHub.com
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250131%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250131T145820Z&X-Amz-Expires=300&X-Amz-Signature=db8c13b23acf5fde7a86888ca9d02702bebc48b6005d8a2ee977f454fe7fb5fe&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-length: 0
x-github-request-id: 3F53:39AD07:2ABD8F7:2BE8D46:679CE50C
X-Firefox-Spdy: h2

i9qe.peativerthera.ru/GDSherpa-bold.woff2

172.67.149.115

200 OK

28 kB

URL GET HTTP/3
i9qe.peativerthera.ru/GDSherpa-bold.woff2
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Size
28 kB (28000 bytes)
Hash
a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-bold.woff2 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://i9qe.peativerthera.ru/yHAr8r/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: font/woff2
content-length: 28000
server: cloudflare
content-disposition: inline; filename="GDSherpa-bold.woff2"
cache-control: max-age=14400
last-modified: Fri, 31 Jan 2025 14:58:20 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E%2BqtfxBcIxk3e7LuDuAAD697jT85qndzUZFjsOyZY06Rx78gjD6DcQWiy7%2BB0Usnc%2BWY%2FdDViK%2BTYaCcaZIUmq2Zu9c1Wzq9q97cQ%2F95TvC%2Fp%2ButC%2FctK2UddnUD0w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
priority: u=3,i=?0
accept-ranges: bytes
cf-ray: 90aa8f2c4f4b7130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=7528&min_rtt=6460&rtt_var=3707&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2141&delivery_rate=246345&cwnd=251&unsent_bytes=0&cid=11d460fa89340781&ts=227&x=0", cfExtPri

i9qe.peativerthera.ru/GDSherpa-bold.woff

172.67.149.115

200 OK

36 kB

URL GET HTTP/3
i9qe.peativerthera.ru/GDSherpa-bold.woff
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
Web Open Font Format, TrueType, length 35970, version 1.0
Size
36 kB (35970 bytes)
Hash
496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-bold.woff HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://i9qe.peativerthera.ru/yHAr8r/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: font/woff
content-length: 35970
content-disposition: inline; filename="GDSherpa-bold.woff"
cache-control: max-age=14400
last-modified: Fri, 31 Jan 2025 14:58:20 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WNc4X2bNEBWo%2Fiid1MPmgrPKls8L2s3fIlTGGO0ZzGoUOAHQGQ6he1u2xA%2FMFJ3IwlIRFP9xSlTUog84R4kgpuF41tmQyXPmFri99c3W9whpWZlZKSvAuytSkG6yGg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 90aa8f2c7f8b7130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=5908&min_rtt=4140&rtt_var=2326&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2190&delivery_rate=535741&cwnd=233&unsent_bytes=0&cid=c395a4f024a7b697&ts=205&x=0", cfL4;desc="?proto=QUIC&rtt=1402&min_rtt=791&rtt_var=524&sent=237&recv=89&lost=0&retrans=0&sent_bytes=207795&recv_bytes=25400&delivery_rate=143062&cwnd=26400&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=10182&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/GDSherpa-regular.woff

172.67.149.115

200 OK

37 kB

URL GET HTTP/3
i9qe.peativerthera.ru/GDSherpa-regular.woff
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
Web Open Font Format, TrueType, length 36696, version 1.0
Size
37 kB (36696 bytes)
Hash
a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-regular.woff HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://i9qe.peativerthera.ru/yHAr8r/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: font/woff
content-length: 36696
content-disposition: inline; filename="GDSherpa-regular.woff"
cache-control: max-age=14400
last-modified: Fri, 31 Jan 2025 14:58:20 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bF%2FF9ZZZDJ%2B5j8zHkoSBO%2FBxqAqVZCy5w%2Bd1tHFMK8bwtJyEscml%2FRNajWUVmdoPVGlfddJEoGtqYdk%2FrlE%2FrNeZcrXasdu0Ykx2KNtk735gMIVx3gGH1jPU%2F6ZjFA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 90aa8f2c7f8d7130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=10154&min_rtt=6572&rtt_var=4658&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2143&delivery_rate=370110&cwnd=158&unsent_bytes=0&cid=532d531a7081dcda&ts=214&x=0", cfL4;desc="?proto=QUIC&rtt=1726&min_rtt=791&rtt_var=774&sent=274&recv=93&lost=0&retrans=0&sent_bytes=250217&recv_bytes=25581&delivery_rate=984251&cwnd=52800&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=10201&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/GDSherpa-regular.woff2

172.67.149.115

200 OK

29 kB

URL GET HTTP/3
i9qe.peativerthera.ru/GDSherpa-regular.woff2
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Size
29 kB (28584 bytes)
Hash
17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-regular.woff2 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://i9qe.peativerthera.ru/yHAr8r/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: font/woff2
content-length: 28584
content-disposition: inline; filename="GDSherpa-regular.woff2"
cache-control: max-age=14400
last-modified: Fri, 31 Jan 2025 14:58:20 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t0PufWmzssqDW3xf%2FQ05tWfE77vNzzrI58A7dXqaufGeYRWX6LLdb5rbgglG4JICbEeOhbj1bBBBdaRdQR78gEhRgPOg1cW5cwqOZGjWIdou9ytJBPTMhkPkZfF7ug%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 90aa8f2c7f8c7130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=6937&min_rtt=4513&rtt_var=6065&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2145&delivery_rate=265325&cwnd=252&unsent_bytes=0&cid=9c8328a56fcc3da7&ts=234&x=0", cfL4;desc="?proto=QUIC&rtt=1726&min_rtt=791&rtt_var=797&sent=314&recv=95&lost=0&retrans=0&sent_bytes=293588&recv_bytes=25672&delivery_rate=1106938&cwnd=52800&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=10212&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/GDSherpa-vf.woff2

172.67.149.115

200 OK

44 kB

URL GET HTTP/3
i9qe.peativerthera.ru/GDSherpa-vf.woff2
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Size
44 kB (43596 bytes)
Hash
2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-vf.woff2 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://i9qe.peativerthera.ru/yHAr8r/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: font/woff2
content-length: 43596
content-disposition: inline; filename="GDSherpa-vf.woff2"
cache-control: max-age=14400
last-modified: Fri, 31 Jan 2025 14:58:20 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jqqBp%2BN9iL8H%2FjY9hbdHwGqu4wmuJfQL%2FW3DxfWu6HjZXJQ3V7WpWBaB7HJto5bRsW3LBqo1SWAm8J2NM9VdbPpHATz9cJoOipqdr%2FsP4IS8TdDvV%2F%2Fd1Ql%2Fo%2FrHRA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: EXPIRED
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 90aa8f2c7f907130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=7537&min_rtt=4604&rtt_var=6902&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2189&delivery_rate=162557&cwnd=238&unsent_bytes=0&cid=72a103bb3ac7cb24&ts=283&x=0", cfL4;desc="?proto=QUIC&rtt=1518&min_rtt=791&rtt_var=652&sent=342&recv=98&lost=0&retrans=0&sent_bytes=325440&recv_bytes=25808&delivery_rate=1808320&cwnd=52800&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=10256&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/GDSherpa-vf2.woff2

172.67.149.115

200 OK

93 kB

URL GET HTTP/3
i9qe.peativerthera.ru/GDSherpa-vf2.woff2
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Size
93 kB (93276 bytes)
Hash
bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /GDSherpa-vf2.woff2 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://i9qe.peativerthera.ru/yHAr8r/
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: font/woff2
content-length: 93276
content-disposition: inline; filename="GDSherpa-vf2.woff2"
cache-control: max-age=14400
last-modified: Fri, 31 Jan 2025 14:58:20 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PExYcbiuQ54gbGnwgW0DmQQwqfUlmM7lMoIIy3co%2BH%2FvjEKObOr0gMIiUiaAYwSGoDGuiqO2E1a%2FYMeqeBvhTF%2BQRl%2BasyCpazMboag1o6oqjOddN0V%2BWtV0VcVM4A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 90aa8f2c7f927130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=9625&min_rtt=7219&rtt_var=6240&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2141&delivery_rate=157880&cwnd=210&unsent_bytes=0&cid=a9cc6d3f22cb9d81&ts=285&x=0", cfL4;desc="?proto=QUIC&rtt=1546&min_rtt=791&rtt_var=546&sent=380&recv=99&lost=0&retrans=0&sent_bytes=370984&recv_bytes=25854&delivery_rate=10464010&cwnd=52800&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=10277&x=1", cfExtPri, cfHdrFlush;dur=0

objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250131%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250131T145820Z&X-Amz-Expires=300&X-Amz-Signature=db8c13b23acf5fde7a86888ca9d02702bebc48b6005d8a2ee977f454fe7fb5fe&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream

185.199.110.133

200 OK

10 kB

URL GET HTTP/2
objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250131%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250131T145820Z&X-Amz-Expires=300&X-Amz-Signature=db8c13b23acf5fde7a86888ca9d02702bebc48b6005d8a2ee977f454fe7fb5fe&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
IP
185.199.110.133:443
ASN
#54113 FASTLY

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerDigiCert Inc
Subject*.github.io
Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28
ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (10017)
Size
10 kB (10245 bytes)
Hash
6c20a2be8ba900bc0a7118893a2b1072
ff7766fde1f33882c6e1c481ceed6f6588ea764c
b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500

HTTP Headers

GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250131%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250131T145820Z&X-Amz-Expires=300&X-Amz-Signature=db8c13b23acf5fde7a86888ca9d02702bebc48b6005d8a2ee977f454fe7fb5fe&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Tue, 07 Dec 2021 16:38:45 GMT
etag: "0x8D9B9A009499A1E"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d91f6eaf-e01e-0032-2f18-13e122000000
x-ms-version: 2023-11-03
x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT
x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=randexp.min.js
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
date: Fri, 31 Jan 2025 14:58:21 GMT
age: 4508
x-served-by: cache-iad-kiad7000045-IAD, cache-hel1410021-HEL
x-cache: HIT, HIT
x-cache-hits: 11369, 3
x-timer: S1738335501.749268,VS0,VE0
content-length: 10245
X-Firefox-Spdy: h2

ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/img/security/default.png

143.204.55.47

200 OK

1.8 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/img/security/default.png
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
Size
1.8 kB (1800 bytes)
Hash
04eeeba5b3538c4524d8e6828ba2c405
8db73b75bc7547a90aebd1377852ea3bf7cbc5ea
da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434

HTTP Headers

GET /assets/js/sdk/okta-signin-widget/7.18.0/img/security/default.png HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: image/png
content-length: 1800
date: Mon, 20 Jan 2025 09:26:31 GMT
server: nginx
last-modified: Tue, 14 May 2024 21:49:26 GMT
etag: "04eeeba5b3538c4524d8e6828ba2c405"
x-amz-meta-sha1sum: 8db73b75bc7547a90aebd1377852ea3bf7cbc5ea
expires: Tue, 20 Jan 2026 09:26:31 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: 4g3Br7ZVjTjiT3KS_lOW9m9DPIdeSE7Cd32iIVqYY9sdeinacxGwCA==
age: 970310
X-Firefox-Spdy: h2

ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css

143.204.55.47

200 OK

41 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
gzip compressed data, from Unix
Size
41 kB (40743 bytes)
Hash
614e101b27111428b6e1dd8a0301aa18
997d1bdb945efda85964c04c965186822cacccdc
be0a01d8627c61831080bf34ea5749fa46fe12327c42dcffeb992129d142e747

HTTP Headers

GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Tue, 14 May 2024 21:48:24 GMT
x-amz-meta-sha1sum: 7b5499b46660a0348cc2b22cae927dcc3fda8b20
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Wed, 29 Jan 2025 17:13:28 GMT
expires: Thu, 29 Jan 2026 17:13:28 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"0329c939fca7c78756b94fbcd95e322b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: TcdV9mZCVntjMwEpvt0HKljWZtH8eddguIwrkY4hu7LZUanNkguluA==
age: 164692
X-Firefox-Spdy: h2

ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2

143.204.55.47

200 OK

20 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 20416, version 2.197
Size
20 kB (20416 bytes)
Hash
d99a7377dabb55772ca9f986b0a04b57
2b5fcd8431953c44e410d0489899e74f6d2cfecc
affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149

HTTP Headers

GET /assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://i9qe.peativerthera.ru
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20416
date: Mon, 27 Jan 2025 07:42:18 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:56:28 GMT
etag: "d99a7377dabb55772ca9f986b0a04b57"
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
expires: Tue, 27 Jan 2026 07:42:18 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: -6TvzUDGDkSuG477TnRgJP0himvn6VqPmyx4o5FbjA8lBuWQ4Qw7Nw==
age: 371763
X-Firefox-Spdy: h2

ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-sbold-webfont.41acb8650115f83780fc.woff2

143.204.55.47

200 OK

20 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-sbold-webfont.41acb8650115f83780fc.woff2
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 20328, version 2.197
Size
20 kB (20328 bytes)
Hash
27429b092c0595aa8803b611bd7508f3
dd4beda27e8057403b27d1276ca9d68902692615
9b5d2290b34cd718e1e97e894d6790f92387ee50de0b3364da291e7112f412be

HTTP Headers

GET /assets/loginpage/font/assets/proximanova-sbold-webfont.41acb8650115f83780fc.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://i9qe.peativerthera.ru
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20328
date: Mon, 27 Jan 2025 06:31:17 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:54:23 GMT
etag: "27429b092c0595aa8803b611bd7508f3"
x-amz-meta-sha1sum: dd4beda27e8057403b27d1276ca9d68902692615
expires: Tue, 27 Jan 2026 06:31:17 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: Go3wArxn_utvXfwXnfGg1ekz0KBNoIdCB4wOaeGYN5jPDyAtPTmvDw==
age: 376024
X-Firefox-Spdy: h2

ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-light-webfont.aba797dabec6686294a9.woff2

143.204.55.47

200 OK

20 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-light-webfont.aba797dabec6686294a9.woff2
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
Web Open Font Format (Version 2), TrueType, length 20052, version 2.197
Size
20 kB (20052 bytes)
Hash
3bf194f33d52c87ea38f13e04fd41950
28b8b4bd234dde07b7ee63a6d32c6f275f03eca1
018930498a4b01e598099a6e45d7316d54c7b1411ce2b741a3b1f1b0ed4e578b

HTTP Headers

GET /assets/loginpage/font/assets/proximanova-light-webfont.aba797dabec6686294a9.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://i9qe.peativerthera.ru
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20052
date: Mon, 27 Jan 2025 06:31:17 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:58:19 GMT
etag: "3bf194f33d52c87ea38f13e04fd41950"
x-amz-meta-sha1sum: 28b8b4bd234dde07b7ee63a6d32c6f275f03eca1
expires: Tue, 27 Jan 2026 06:31:17 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: RosPOqfEqmJ8RIKaYtpWLAxYOz1rogAVkLP0t_jViZwwUETT0WtMdA==
age: 376024
X-Firefox-Spdy: h2

i9qe.peativerthera.ru/klRiGIunRIlmWDy4XNHkLCd9QMHvMoW895jMdSjLAZIB0oQFclwOKeg98aab230

172.67.149.115

200 OK

1.3 kB

URL GET HTTP/3
i9qe.peativerthera.ru/klRiGIunRIlmWDy4XNHkLCd9QMHvMoW895jMdSjLAZIB0oQFclwOKeg98aab230
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
RIFF (little-endian) data, Web/P image
Size
1.3 kB (1298 bytes)
Hash
32ca2081553e969f9fdd4374134521ad
7b09924c4c3d8b6e41fe38363e342da098be4173
216fc342a469aa6a005b2eacc24622095e5282d3e9f1ae99ce54c27b92ec3587

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /klRiGIunRIlmWDy4XNHkLCd9QMHvMoW895jMdSjLAZIB0oQFclwOKeg98aab230 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:21 GMT
content-type: image/webp
content-length: 1298
content-disposition: inline; filename="klRiGIunRIlmWDy4XNHkLCd9QMHvMoW895jMdSjLAZIB0oQFclwOKeg98aab230"
cf-cache-status: DYNAMIC
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2csMU56i86ID71sDBqEdYKJ24MTbK%2Fhg6FPYabAN3Uadc5YOS5LezdmnUkyR9C3ms%2BQa3ksVqMvlpxG3Bdz%2FI4BCrs8FolqXu8txF%2F2xAOxMT8A1VCrn4cyClJbMKiIIJonpy8SSVA4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 90aa8f346b2b7130-OSL
server-timing: cfL4;desc="?proto=QUIC&rtt=1642&min_rtt=791&rtt_var=526&sent=480&recv=109&lost=0&retrans=0&sent_bytes=478286&recv_bytes=29028&delivery_rate=467632&cwnd=105600&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=11143&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/rnc73igbxFwIX6JOMGSDvtSyTon3EnxwGu20qyqeSrti

172.67.149.115

200 OK

12 kB

URL POST HTTP/3
i9qe.peativerthera.ru/rnc73igbxFwIX6JOMGSDvtSyTon3EnxwGu20qyqeSrti
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
JSON text data
Size
12 kB (12120 bytes)
Hash
38c4765be0aa862793309d65efda7bdd
8a148633cfee331daeb473ab2c46440a2c34c847
0d9c52a8b41e940f79918494a3e0274d18b877a256605454707fdf1c2e7c7f2e

HTTP Headers

POST /rnc73igbxFwIX6JOMGSDvtSyTon3EnxwGu20qyqeSrti HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 53
Origin: https://i9qe.peativerthera.ru
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:21 GMT
content-type: application/json
cache-control: no-cache, private
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=66gDFZHktONg%2Bl261GraUxRrNbNBblBd45vzHvwZFhIunF1h9DGufUk9ji9E%2FS%2Bu4UgxEMJGT90rjG0B6Qd%2BczwPQ%2FxI2Ud7TgobpB47sy2J010fEiHrY5507KyM7w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6InJlMXdkUzVIODNwTjZiamhJMk8vOHc9PSIsInZhbHVlIjoibHc2TitOZm5PcW5aYm4wT25kSit0b1hCYlhTem4yQ2tTdmJZQ0R1LzJYR0NzNDFtMTY0SmF5Z0tpeEhrMGUzeVQ0MkJzT0twckxYZ0NCczd0MGRSakJVOFdJeEJQL1UrS0RNUk5PWW5ZVWNyQmRYb1NLbTdHUUZCS24xUXlhS24iLCJtYWMiOiJkNmFkNjBjOGUxYjRjYTY5ZmVlYzJjMjQ5M2M0MTRkMTdkZjMxOGIzNDFiMjk0ODAwYTQ5NzQ3MjBiYTBkYmQ1IiwidGFnIjoiIn0%3D; expires=Fri, 31-Jan-2025 16:58:21 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IlUzbDhEajNTc2s1UHBYdmZmRVI4RlE9PSIsInZhbHVlIjoidGRRZXVVMzRQTUJhR296WXc1V2hIa1o3djV1VlEyNnFaK21ibExPVEFKU252eWw4VU1uVmdscko2Tk9FN0VNYkQrNmYyd2o5blkrNHRSS0VMMHNTU2dBQkZRK1E2TnZwa1RubVNrYmhrVmY5aWszUVlaZUpGUnZ0OFJqY2xqb0QiLCJtYWMiOiJhM2JkYmVjNzE2MjRhMzE1NWUzYjE5ODViNzE2NmZjY2VhNmE1NGE5ZDBlM2FiNWMwMDExMDNkNDE3NDc2OGI5IiwidGFnIjoiIn0%3D; expires=Fri, 31-Jan-2025 16:58:21 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 90aa8f33faae7130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=5226&min_rtt=4940&rtt_var=2057&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2316&delivery_rate=576518&cwnd=208&unsent_bytes=0&cid=c1c65d4e2cd6396c&ts=113&x=0", cfL4;desc="?proto=QUIC&rtt=1507&min_rtt=791&rtt_var=409&sent=468&recv=106&lost=0&retrans=0&sent_bytes=470869&recv_bytes=28891&delivery_rate=19298&cwnd=105600&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=11087&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/zcRRVIyeoGdUC4yBLRI0xCQvWdMkg3bKwquMdpiPw6OTMtrj88EDTfq

172.67.149.115

200 OK

4.8 kB

URL POST HTTP/3
i9qe.peativerthera.ru/zcRRVIyeoGdUC4yBLRI0xCQvWdMkg3bKwquMdpiPw6OTMtrj88EDTfq
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
JSON text data
Size
4.8 kB (4780 bytes)
Hash
67908ba125e779744eed6b585d15da21
6c383d28d9cfac60a17f85bb05e648e981f9aca0
955af99e20b51c8afd37e9657e365583b33bd3ee1836965ae0ee7118055a8b3f

HTTP Headers

POST /zcRRVIyeoGdUC4yBLRI0xCQvWdMkg3bKwquMdpiPw6OTMtrj88EDTfq HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 6
Origin: https://i9qe.peativerthera.ru
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkZYOXdEdlZVZk5VcDhzd3h5UzJRQXc9PSIsInZhbHVlIjoiWVIwUDJoKzgyd24vMDVRMEJXczJnRUlWeDd6NUNNb2IxOFozalBDN2dwR2M5NHg4TG9DUXNCZG5FUjIxa1FrNlV1cUZ4SHhXNEliSktjMTREOEY3YlluV2krMENzQWU3S1E0Qy9zUS9sK3BmdGxhZjY3ZnN3MG9qSEJKVHhDeFIiLCJtYWMiOiI0YTRhODMxN2MyMDBlOGNhNzhlMThkZjdhNTdmMzhiYzVkNDZkZjMwZjQ0NDJhOTc0NjkwY2RjNDcxNjYzZTg2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ii9aOHhwazR2Mm9KVzAvN3Y5M0ttNEE9PSIsInZhbHVlIjoiQUJjZkdpWEp4UEw1d1QwcVdidE5IS3NRQ2xnb2QwRTFPbmwzOWJSaFlXMExuZ2hKYTlnS1RNSmtzeFlOWkp4L3NEdjZOZkpOcDU1OTZqeWF1aDBLcVp2ZjJ2cE9SYXJSZzRrajZ0N2dNMExkVzR0YnppTExBb1hvaDBkOUpxa2EiLCJtYWMiOiJiZTEzMGE0NzYzOTdjN2Q0NjFmM2FiZDUxN2ViZGZkN2QzMmE5Y2RhMGEzMWNmMTgyNDgyMTk5ZTQxZDJkM2U5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:19 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=crg9Q%2F8PhFf%2FePIpy652%2B9VyypphDria4hnOwbV4av5vfqLOjpYSPh2tUpZQamJBmOHcpyb8qZ7ov%2FC4kG3yUdLTa%2BEMyjhNtUVcTR1eKuDppxqPv%2BFwBJK21XiT2w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImJZNnEzQ2M1TG9mcnhHcGlOeStvZUE9PSIsInZhbHVlIjoiK2h5Ty9LK1ZEMGxMYk1FUG9DSjk4RHUzbTJRc3BDVE12QzlaclpDVXp6VHlaN0VQTkkzbkVCelZmR3o2V3Y4RlB2YVFFNWN1RWpvUzU5S1FFSjFoNDl2NWJKVXduNnNrRGEwTHdkSGhVOGxSVDZpdjQ4b2tYLytUUG5xcExrQWYiLCJtYWMiOiJjNWI4NmExZGM3NjJiZWI3OTllMzlmMjRmMzY1ZmVjODg4Y2U1NjViNTc3MmZmZGU5NjE1YmE3Y2I0YjE3MjY2IiwidGFnIjoiIn0%3D; expires=Fri, 31-Jan-2025 16:58:19 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IklHa05nVGdQamF0Q0QyVi9VYTZyclE9PSIsInZhbHVlIjoicFZ3ejVmenNGbFpLNWdwVmJBZVh4MkNzb1VzZzRwY05rK3dIZlVGOE54UVZNeGRKc1ZwRmIreU1oVGZPYTh5c0FHeEhPMFNyQ1dWb3R2TU5EZnBQWUpYc0dVN1RDSmJPQ0lvTmNIRFFjaTZmZFVrbGRWQ0RDZi9FZWp2LzMyQ2UiLCJtYWMiOiI3NTk0YWMwYTY5ZjQ2YzA2YWEzZDI2NjllYmJlODFkYmUxODFhMWUwOThjNWViMzllNDMzMTAyOTM3YjBkMWQ4IiwidGFnIjoiIn0%3D; expires=Fri, 31-Jan-2025 16:58:19 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=3,i=?0
server: cloudflare
cf-ray: 90aa8f2768687130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=7569&min_rtt=6328&rtt_var=2842&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2279&delivery_rate=439913&cwnd=238&unsent_bytes=0&cid=28fb6c56e0d6f25c&ts=155&x=0", cfL4;desc="?proto=QUIC&rtt=8917&min_rtt=1793&rtt_var=6243&sent=32&recv=17&lost=0&retrans=0&sent_bytes=18698&recv_bytes=5830&delivery_rate=174735&cwnd=12000&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=9130&x=1", cfExtPri, cfHdrFlush;dur=0

py7kw.adlijari.ru/jp70t6ex

188.114.97.1

200 OK

603 B

URL
py7kw.adlijari.ru/jp70t6ex
IP
188.114.97.1:0
ASN
#13335 CLOUDFLARENET

File type
very short file (no magic)
Size
603 B (603 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /jp70t6ex HTTP/1.1
Host: py7kw.adlijari.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://i9qe.peativerthera.ru/
Origin: https://i9qe.peativerthera.ru
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 31 Jan 2025 14:58:18 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d4ahDM2gpr2M8PWHmZNPgX0a46x1lZ%2BHoDP4UZ09NF0IXS%2Bli9XHPJjsgmkgsBnmT4YzptVvOOJ%2BQckR3K%2FtckrF2%2FqrxfeAImhfVdZ0HP4nozAVTN4qIpwdJOUpxE03G%2Baa2A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 90aa8f20fb58568b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=629&min_rtt=503&rtt_var=292&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3253&recv_bytes=1228&delivery_rate=6304789&cwnd=253&unsent_bytes=0&cid=d4cef5a1a6a6df25&ts=398&x=0"
X-Firefox-Spdy: h2

classify-client.services.mozilla.com/api/v1/classify_client/

35.190.72.216

200 OK

64 B

URL
classify-client.services.mozilla.com/api/v1/classify_client/
IP
35.190.72.216:0
ASN
#15169 GOOGLE

File type
JSON text data
Size
64 B (64 bytes)
Hash
a608665e83750eadac1bf257718c52f1
699f0176aae564dbab2676cecaca2886762bfc29
1abd9d069927aa08826a3f0c28f730fdbb9ded5cc1d2ae8beb41f561360eda0e

HTTP Headers

GET /api/v1/classify_client/ HTTP/1.1
Host: classify-client.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

HTTP/2 200 OK
server: nginx
date: Fri, 31 Jan 2025 14:58:38 GMT
content-type: application/json
content-length: 64
cache-control: max-age=0, no-cache, no-store, must-revalidate
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css

143.204.55.47

200 OK

10 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
ASCII text, with very long lines (10450)
Size
10 kB (10498 bytes)
Hash
e0d37a504604ef874bad26435d62011f
4301f0d2b729ae22adece657d79eccaa25f429b1
c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179

HTTP Headers

GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Thu, 14 Mar 2024 00:03:58 GMT
x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Fri, 31 Jan 2025 02:19:39 GMT
expires: Sat, 31 Jan 2026 02:19:39 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: taUra2QXl7BAeUnQjcUkNRPw5p6jsnkls_Zo1y2f9ZAm6gaW-KsD2g==
age: 45521
X-Firefox-Spdy: h2

i9qe.peativerthera.ru/jktltanyzrvbtapnhodtzzbwah1a3yuqm0ebppo11y5jzq5zc?KDOXJBERSRKM

172.67.149.115

200 OK

146 kB

URL GET HTTP/3
i9qe.peativerthera.ru/jktltanyzrvbtapnhodtzzbwah1a3yuqm0ebppo11y5jzq5zc?KDOXJBERSRKM
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
HTML document, ASCII text, with very long lines (52491), with CRLF line terminators
Size
146 kB (145482 bytes)
Hash
52d790ea07f1eef9e745d059f21d46fb
de894b454730a238e39874925359a15315129b06
1bbb6d7d061b417ed625b36dba573de3e076323bd9ec41b2867ef3c9b74ed0b6

HTTP Headers

GET /jktltanyzrvbtapnhodtzzbwah1a3yuqm0ebppo11y5jzq5zc?KDOXJBERSRKM HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6ImJZNnEzQ2M1TG9mcnhHcGlOeStvZUE9PSIsInZhbHVlIjoiK2h5Ty9LK1ZEMGxMYk1FUG9DSjk4RHUzbTJRc3BDVE12QzlaclpDVXp6VHlaN0VQTkkzbkVCelZmR3o2V3Y4RlB2YVFFNWN1RWpvUzU5S1FFSjFoNDl2NWJKVXduNnNrRGEwTHdkSGhVOGxSVDZpdjQ4b2tYLytUUG5xcExrQWYiLCJtYWMiOiJjNWI4NmExZGM3NjJiZWI3OTllMzlmMjRmMzY1ZmVjODg4Y2U1NjViNTc3MmZmZGU5NjE1YmE3Y2I0YjE3MjY2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IklHa05nVGdQamF0Q0QyVi9VYTZyclE9PSIsInZhbHVlIjoicFZ3ejVmenNGbFpLNWdwVmJBZVh4MkNzb1VzZzRwY05rK3dIZlVGOE54UVZNeGRKc1ZwRmIreU1oVGZPYTh5c0FHeEhPMFNyQ1dWb3R2TU5EZnBQWUpYc0dVN1RDSmJPQ0lvTmNIRFFjaTZmZFVrbGRWQ0RDZi9FZWp2LzMyQ2UiLCJtYWMiOiI3NTk0YWMwYTY5ZjQ2YzA2YWEzZDI2NjllYmJlODFkYmUxODFhMWUwOThjNWViMzllNDMzMTAyOTM3YjBkMWQ4IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KvOGtR18JsZztT8CdfmRMAAW5thRxQXRnbfAbDGumivJHYw0Dki%2Bsk9nrGmXJaz1iAm%2F0Z1bcinKxNh0twCYTVbEUMtsZmuogurFSqaU2Ioyh8uNK97jwjLnqErbng%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; expires=Fri, 31-Jan-2025 16:58:19 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D; expires=Fri, 31-Jan-2025 16:58:19 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=3,i=?0
server: cloudflare
cf-ray: 90aa8f29ab717130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=5105&min_rtt=4976&rtt_var=1484&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2157&delivery_rate=549913&cwnd=230&unsent_bytes=0&cid=c8766b426d0a885c&ts=141&x=0", cfL4;desc="?proto=QUIC&rtt=7244&min_rtt=1636&rtt_var=6403&sent=37&recv=20&lost=0&retrans=0&sent_bytes=21393&recv_bytes=6829&delivery_rate=18984&cwnd=12000&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=9477&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/klj4Twc9yXga5i8mhnFd86MXLNEB9l5632nXsKhNmow1HaDIrOsgsdyOA4plUuv211

172.67.149.115

200 OK

1.9 kB

URL GET HTTP/3
i9qe.peativerthera.ru/klj4Twc9yXga5i8mhnFd86MXLNEB9l5632nXsKhNmow1HaDIrOsgsdyOA4plUuv211
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
SVG Scalable Vector Graphics image
Size
1.9 kB (1864 bytes)
Hash
4b5c228b4faba433d06ec569ed855b2d
a7d3882b93e332460e7c59510a6a811ef011983f
eb19d76cd1fad39abf0f2778991883a5cf9ff560117ce8f7c64124e71471b4ed

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /klj4Twc9yXga5i8mhnFd86MXLNEB9l5632nXsKhNmow1HaDIrOsgsdyOA4plUuv211 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:21 GMT
content-type: image/svg+xml
content-disposition: inline; filename="klj4Twc9yXga5i8mhnFd86MXLNEB9l5632nXsKhNmow1HaDIrOsgsdyOA4plUuv211"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LpdzC6BpSRaE%2FtT%2BqA7%2B7lxcpp7gfHODl7hptoKK2OP%2FnQKoeOluz7SxPY8ktgf05%2B68vra66VoM8eCgKxPMbiV%2FbVyT%2FWbbHNVmQs1HatQFcR%2BExVVJ7TOueDpUow%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 90aa8f346b2a7130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=4168&min_rtt=4012&rtt_var=1437&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2167&delivery_rate=546431&cwnd=247&unsent_bytes=0&cid=d052c2d0680e0aad&ts=154&x=0", cfL4;desc="?proto=QUIC&rtt=1572&min_rtt=791&rtt_var=535&sent=482&recv=110&lost=0&retrans=0&sent_bytes=480335&recv_bytes=29074&delivery_rate=1218939&cwnd=105600&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=11193&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/yHAr8r/

172.67.149.115

200 OK

20 kB

URL User Request GET HTTP/3
i9qe.peativerthera.ru/yHAr8r/
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
HTML document, ASCII text, with very long lines (15049), with CRLF line terminators
Size
20 kB (20437 bytes)
Hash
fc84a512e8643fb7dbc38557da8b4854
4c982ef1bc5b2c654eb362ad2bc0ad00b8259b00
460bfe74c351140d52863c67bedb8bd179d80cbc51203736ac7057f8038abff8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /yHAr8r/ HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6Ik54QmN2RFkyckNDdnA1S2tWQStTenc9PSIsInZhbHVlIjoiVFpmcTFkY1k1Z2VHckQvTnMvd0JXbjBrODdPdVhwV01rRmtPekpucmdTL0Q0MnRIUTU1RWV6SW93WHlDcUJ3bEFLemdTTERIbUIxelJUa0ZSc1FMNUtPSTM4WHVWc3JRVlp2L1pETUpENnhEc0FKMTIzSmhaLzJqZDA1Nkw3d2oiLCJtYWMiOiIwNjMzNDM3NDA1MGZlNWM4YWVkYWU3MzhjY2VkNjNiYjg0MTFiMjYyZDQ3ZDlhOGNkYjU3MGZmMjkyNWI2NmRjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik9Fb1l4Y20yQUNTM3RGcVlwN3pDYmc9PSIsInZhbHVlIjoiRmtheEVJK1FVbzZFalZwVFZ3Z0VtSVVmREtVY2w1RjZQbVA3OWVoeUJrLytaYmVBc2puV00xOVJjT2s0VlZXTGE1VVU3VU5wQUppcEQyRkRHcDcxaiszWE45WVhkaGpVTy9IaGRnaUhRM2x3TTcwOVV2YnJNZUl2aDlGRmEzMTgiLCJtYWMiOiI2MjNlYTAwZDkyNzc1MjhhMzYyMTgzNWI2MzQ2YTgxOGI3NGIxM2ZmNGNiYjgyYjJkMDYyZDQ4MmVmMGYzM2ZkIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:19 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YhlF4yUv%2F%2FbTuFVF1bo4FLYJz8BfVfkxNSz3MkD2RWoYEmaeO3K5MW11dMn9qho11x%2BfhT8I5kMRq7%2FC5o8oGuHklrKIIf0qHg72CdGnsRd0AQ3dsAkN6%2FmdlCNHQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IkZYOXdEdlZVZk5VcDhzd3h5UzJRQXc9PSIsInZhbHVlIjoiWVIwUDJoKzgyd24vMDVRMEJXczJnRUlWeDd6NUNNb2IxOFozalBDN2dwR2M5NHg4TG9DUXNCZG5FUjIxa1FrNlV1cUZ4SHhXNEliSktjMTREOEY3YlluV2krMENzQWU3S1E0Qy9zUS9sK3BmdGxhZjY3ZnN3MG9qSEJKVHhDeFIiLCJtYWMiOiI0YTRhODMxN2MyMDBlOGNhNzhlMThkZjdhNTdmMzhiYzVkNDZkZjMwZjQ0NDJhOTc0NjkwY2RjNDcxNjYzZTg2IiwidGFnIjoiIn0%3D; expires=Fri, 31-Jan-2025 16:58:19 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6Ii9aOHhwazR2Mm9KVzAvN3Y5M0ttNEE9PSIsInZhbHVlIjoiQUJjZkdpWEp4UEw1d1QwcVdidE5IS3NRQ2xnb2QwRTFPbmwzOWJSaFlXMExuZ2hKYTlnS1RNSmtzeFlOWkp4L3NEdjZOZkpOcDU1OTZqeWF1aDBLcVp2ZjJ2cE9SYXJSZzRrajZ0N2dNMExkVzR0YnppTExBb1hvaDBkOUpxa2EiLCJtYWMiOiJiZTEzMGE0NzYzOTdjN2Q0NjFmM2FiZDUxN2ViZGZkN2QzMmE5Y2RhMGEzMWNmMTgyNDgyMTk5ZTQxZDJkM2U5IiwidGFnIjoiIn0%3D; expires=Fri, 31-Jan-2025 16:58:19 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 90aa8f253d767130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=5569&min_rtt=5548&rtt_var=1600&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2159&delivery_rate=501850&cwnd=250&unsent_bytes=0&cid=e4cf37ec7438b273&ts=124&x=0", cfL4;desc="?proto=QUIC&rtt=12285&min_rtt=1870&rtt_var=7491&sent=16&recv=11&lost=0&retrans=0&sent_bytes=5770&recv_bytes=3797&delivery_rate=192&cwnd=12000&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=8735&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/favicon.ico

172.67.149.115

404 Not Found

0 B

URL GET HTTP/3
i9qe.peativerthera.ru/favicon.ico
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkZYOXdEdlZVZk5VcDhzd3h5UzJRQXc9PSIsInZhbHVlIjoiWVIwUDJoKzgyd24vMDVRMEJXczJnRUlWeDd6NUNNb2IxOFozalBDN2dwR2M5NHg4TG9DUXNCZG5FUjIxa1FrNlV1cUZ4SHhXNEliSktjMTREOEY3YlluV2krMENzQWU3S1E0Qy9zUS9sK3BmdGxhZjY3ZnN3MG9qSEJKVHhDeFIiLCJtYWMiOiI0YTRhODMxN2MyMDBlOGNhNzhlMThkZjdhNTdmMzhiYzVkNDZkZjMwZjQ0NDJhOTc0NjkwY2RjNDcxNjYzZTg2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ii9aOHhwazR2Mm9KVzAvN3Y5M0ttNEE9PSIsInZhbHVlIjoiQUJjZkdpWEp4UEw1d1QwcVdidE5IS3NRQ2xnb2QwRTFPbmwzOWJSaFlXMExuZ2hKYTlnS1RNSmtzeFlOWkp4L3NEdjZOZkpOcDU1OTZqeWF1aDBLcVp2ZjJ2cE9SYXJSZzRrajZ0N2dNMExkVzR0YnppTExBb1hvaDBkOUpxa2EiLCJtYWMiOiJiZTEzMGE0NzYzOTdjN2Q0NjFmM2FiZDUxN2ViZGZkN2QzMmE5Y2RhMGEzMWNmMTgyNDgyMTk5ZTQxZDJkM2U5IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Fri, 31 Jan 2025 14:58:19 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=smFrhRNy52dDJqbPYM6nYnJJSVjHWZvWpsX4p0YT75LX%2FrlNAY5NDKagxLam3s%2FnI2SqZt%2FU667oVexe7TT9fJg692QTo1o%2BF7x%2FPDgtZ1YcWQ11HWoqJGCCDmCYvg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
priority: u=6,i=?0
server: cloudflare
cf-ray: 90aa8f28196a7130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=5065&min_rtt=4908&rtt_var=1953&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2112&delivery_rate=580277&cwnd=251&unsent_bytes=0&cid=d7813d22111daa72&ts=150&x=0", cfL4;desc="?proto=QUIC&rtt=8007&min_rtt=1636&rtt_var=6502&sent=36&recv=19&lost=0&retrans=0&sent_bytes=20554&recv_bytes=6785&delivery_rate=7625&cwnd=12000&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=9276&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/efKtcLhEJrylQKYhvqSaMtcOuvidAowKJsNtyW0L90142

172.67.149.115

200 OK

270 B

URL GET HTTP/3
i9qe.peativerthera.ru/efKtcLhEJrylQKYhvqSaMtcOuvidAowKJsNtyW0L90142
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
SVG Scalable Vector Graphics image
Size
270 B (270 bytes)
Hash
0c09c5ea7c28d6feb4d124957dde0a0d
1b9efde2d8f0e2a3d9d5315117e597c2d622fc5e
b3c39d2c15327b7ae68940502a2d7bf457fe521e075e6e671d0340edc58bcb3a

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /efKtcLhEJrylQKYhvqSaMtcOuvidAowKJsNtyW0L90142 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: image/svg+xml
content-disposition: inline; filename="efKtcLhEJrylQKYhvqSaMtcOuvidAowKJsNtyW0L90142"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ku%2BEXynwKthyYo7ARiPt7FNmOfu1mOsnGea0M0MkoOcSqLtXcStjjproca8rArMkzDBu1wFRotFPm4xR907lM0tYW548peUS9f7TOPfQp2qTn32bgddKMmJSS7j9PA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 90aa8f2c8fb57130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=6515&min_rtt=5000&rtt_var=4418&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2146&delivery_rate=269085&cwnd=239&unsent_bytes=0&cid=df3c43cfc8b1456f&ts=132&x=0", cfL4;desc="?proto=QUIC&rtt=1773&min_rtt=944&rtt_var=553&sent=138&recv=64&lost=0&retrans=0&sent_bytes=113980&recv_bytes=24265&delivery_rate=1584325&cwnd=13200&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=9961&x=1", cfExtPri, cfHdrFlush;dur=0

ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/img/ui/forms/checkbox-sign-in-widget.png

143.204.55.47

200 OK

3.1 kB

URL GET HTTP/2
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/img/ui/forms/checkbox-sign-in-widget.png
IP
143.204.55.47:443
ASN
#16509 AMAZON-02

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerDigiCert Inc
Subject*.oktacdn.com
Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5
ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT

File type
PNG image data, 50 x 1155, 8-bit/color RGBA, non-interlaced
Size
3.1 kB (3141 bytes)
Hash
7846b2f8c6d0a7ca69fdd3d3c294e92d
e0bb021ffdf93c68fef44de2a3b08f378b6fb50a
40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665

HTTP Headers

GET /assets/js/sdk/okta-signin-widget/7.18.0/img/ui/forms/checkbox-sign-in-widget.png HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/png
content-length: 3141
date: Mon, 20 Jan 2025 09:26:31 GMT
server: nginx
last-modified: Tue, 14 May 2024 21:49:26 GMT
etag: "7846b2f8c6d0a7ca69fdd3d3c294e92d"
x-amz-meta-sha1sum: e0bb021ffdf93c68fef44de2a3b08f378b6fb50a
expires: Tue, 20 Jan 2026 09:26:31 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 bcd5dadccb0831729969c938747ff79a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: UYQCr_TjGmwnnzPtvgyizXP-2anlhUjV-D7hVzhe9PSsIhtb6GYAPw==
age: 970310
X-Firefox-Spdy: h2

i9qe.peativerthera.ru/12q9dpV5jqab5XPWl8915

172.67.149.115

200 OK

24 kB

URL GET HTTP/3
i9qe.peativerthera.ru/12q9dpV5jqab5XPWl8915
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
ASCII text, with very long lines (23854), with no line terminators
Size
24 kB (23854 bytes)
Hash
8025ea2266871f7af97c89d4b43dc4a6
b80f1279a6438e2325d0ece6642ba34cebd9b4d8
bad46ff2d915998c6f922bfca9b0f01b805f3b548cf038da1bf6643fe371385e

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /12q9dpV5jqab5XPWl8915 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:21 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="12q9dpV5jqab5XPWl8915"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GmAjILcf1xRZ1ECejkn3wp3hSRF4iK2N1eRaF8dm2DdAs5BZE%2F%2Fr7UY%2F2J3px%2FE1m6UzP%2BNt4KTWxJGTcW9OIH1H7X7KLsPbTa0NJ37nzIexomDFiXhRqtSgpxdh5A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 90aa8f2c4f467130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=5625&min_rtt=5348&rtt_var=2027&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2115&delivery_rate=400056&cwnd=181&unsent_bytes=0&cid=719588a609b0bff5&ts=1281&x=0", cfL4;desc="?proto=QUIC&rtt=1581&min_rtt=791&rtt_var=348&sent=463&recv=105&lost=0&retrans=0&sent_bytes=467513&recv_bytes=28845&delivery_rate=2318544&cwnd=105600&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=11079&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/abSgereAjqYl3pqGbnef30

172.67.149.115

200 OK

36 kB

URL GET HTTP/3
i9qe.peativerthera.ru/abSgereAjqYl3pqGbnef30
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
ASCII text, with CRLF line terminators
Size
36 kB (35786 bytes)
Hash
38501e3fbbbd89b56aa5ba35de1a32fe
d9b31981b6f834e8480ba28fbc1cff1be772f589
a1ca6b381cb01968851c98512c6e7f6c5309a49f7a16b864813135cbff82a85b

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /abSgereAjqYl3pqGbnef30 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="abSgereAjqYl3pqGbnef30"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e8Ga%2B6ayCfq9VkF%2FMZWvcDytEQAgZWajLKds%2F9EeLwV75napsgJn1Hd%2FWWvlUefQx219mlxkeWEkxJWmBV7v4iMu4YVLddHCIeheB9agkZKf%2FUOf%2F7YQPQRx1moMNg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 90aa8f2c4f497130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=9417&min_rtt=5758&rtt_var=4875&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2116&delivery_rate=487504&cwnd=239&unsent_bytes=0&cid=cc4e49f2b701b3f8&ts=95&x=0", cfL4;desc="?proto=QUIC&rtt=2341&min_rtt=944&rtt_var=1415&sent=110&recv=54&lost=0&retrans=0&sent_bytes=87370&recv_bytes=23810&delivery_rate=1478&cwnd=13200&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=9861&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/opMoHauBFlKgiIKjQs6YGOuvPCoGwWqayCa0TeyPhHxzhoJef200

172.67.149.115

200 OK

268 B

URL GET HTTP/3
i9qe.peativerthera.ru/opMoHauBFlKgiIKjQs6YGOuvPCoGwWqayCa0TeyPhHxzhoJef200
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
SVG Scalable Vector Graphics image
Size
268 B (268 bytes)
Hash
1318aafc1fb9ded0c623e5b9a557e6df
0917cdd7633cd1642b02b2b785416ec7e5106dcc
d86660a84daa211b121ec9fe0df83d6b945f61b888384391eabc7d6b4e941dc4

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /opMoHauBFlKgiIKjQs6YGOuvPCoGwWqayCa0TeyPhHxzhoJef200 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: image/svg+xml
server: cloudflare
content-disposition: inline; filename="opMoHauBFlKgiIKjQs6YGOuvPCoGwWqayCa0TeyPhHxzhoJef200"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EH3ZOCEk9RsSTEffEj80aIVhfjuhkvBbRCVRQdrNWOqoeq0Wcv1Oe7%2BRPDlLcnwMJL992gLqkYtbGdFJY%2FQxc6C8Z84VxuXlQ%2BTU%2Fgn5%2BaJDPNF3JNBPjEVna%2B6fXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
vary: accept-encoding
cf-ray: 90aa8f2c8fbc7130-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=9603&min_rtt=4504&rtt_var=10659&sent=6&recv=9&lost=0&retrans=1&sent_bytes=4220&recv_bytes=2152&delivery_rate=83391&cwnd=220&unsent_bytes=0&cid=163146818b7b8ee0&ts=132&x=0", cfExtPri

i9qe.peativerthera.ru/34Ak2fk5jmThKj0oWoFkrBIUCcn4ijlWvsySgM4nt89102

172.67.149.115

200 OK

137 kB

URL GET HTTP/3
i9qe.peativerthera.ru/34Ak2fk5jmThKj0oWoFkrBIUCcn4ijlWvsySgM4nt89102
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type

Size
137 kB (136817 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /34Ak2fk5jmThKj0oWoFkrBIUCcn4ijlWvsySgM4nt89102 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: application/javascript
content-disposition: inline; filename="34Ak2fk5jmThKj0oWoFkrBIUCcn4ijlWvsySgM4nt89102"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=USEW2XqHrfbbvEJGKIetl7HuRC4WrVvTpMHqSz0dB1SoBJxE4elcpQ5nwixnNynWmYNd%2BPHAHKlDTRgByq6mCtBlVh768UUGB1uw9r7FtGL5%2BLwWPtdWMLZLFViBXw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 90aa8f2c8fc97130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=19394&min_rtt=7573&rtt_var=11504&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2111&delivery_rate=311767&cwnd=248&unsent_bytes=0&cid=672ad982f80f6b63&ts=166&x=0", cfL4;desc="?proto=QUIC&rtt=1415&min_rtt=791&rtt_var=384&sent=189&recv=78&lost=0&retrans=0&sent_bytes=161280&recv_bytes=24900&delivery_rate=1537581&cwnd=13200&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=10046&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/kluBd6FLVSYneForm3RX3p1Y1cdq2UQNIVVu8N6mobLiUltlGIejd78164

172.67.149.115

200 OK

7.4 kB

URL GET HTTP/3
i9qe.peativerthera.ru/kluBd6FLVSYneForm3RX3p1Y1cdq2UQNIVVu8N6mobLiUltlGIejd78164
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
SVG Scalable Vector Graphics image
Size
7.4 kB (7390 bytes)
Hash
bca9b46fee32162356ba5b4783e614dc
cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5
fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /kluBd6FLVSYneForm3RX3p1Y1cdq2UQNIVVu8N6mobLiUltlGIejd78164 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: image/svg+xml
content-disposition: inline; filename="kluBd6FLVSYneForm3RX3p1Y1cdq2UQNIVVu8N6mobLiUltlGIejd78164"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SyyVGha2tQ%2FK5xF0yHCSWszm3yuoYNCsbghW%2Fq%2FXKW9Aor8r63og1XP8iKSXT9LC%2BdOUjUKNTg3%2FZyd24E8ZHZyEvOP7A3iDYaEqUTbx9OO5CbW85AoHCoQ1YguW4w%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 90aa8f2c8fb77130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=7086&min_rtt=3999&rtt_var=7075&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2159&delivery_rate=187590&cwnd=251&unsent_bytes=0&cid=e5fb28bd90a70b74&ts=173&x=0", cfL4;desc="?proto=QUIC&rtt=1365&min_rtt=791&rtt_var=378&sent=184&recv=77&lost=0&retrans=0&sent_bytes=155930&recv_bytes=24855&delivery_rate=1017537&cwnd=13200&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=10010&x=1", cfExtPri, cfHdrFlush;dur=0

i9qe.peativerthera.ru/wxml6pd0XWs52NmgssIvpemnPjiFVS1AGxK5Paab177

172.67.149.115

200 OK

2.9 kB

URL GET HTTP/3
i9qe.peativerthera.ru/wxml6pd0XWs52NmgssIvpemnPjiFVS1AGxK5Paab177
IP
172.67.149.115:443
ASN
#13335 CLOUDFLARENET

Requested by
https://i9qe.peativerthera.ru/yHAr8r/
Certificate
IssuerGoogle Trust Services
Subjectpeativerthera.ru
Fingerprint71:32:E6:2A:92:9E:7B:13:FD:7B:A3:A5:A5:00:6F:06:11:BE:A4:3B
ValidityWed, 15 Jan 2025 00:23:11 GMT - Tue, 15 Apr 2025 01:21:50 GMT

File type
SVG Scalable Vector Graphics image
Size
2.9 kB (2905 bytes)
Hash
e924de0d471df54b6280f3dc8b187cb8
857f03226070b502a9e06b4249710ec10be4c9e9
24ce135a31ce83ac3d62471fcc0e1a82ce6f1533c993ee59ca4e110d5f2fae33

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /wxml6pd0XWs52NmgssIvpemnPjiFVS1AGxK5Paab177 HTTP/1.1
Host: i9qe.peativerthera.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i9qe.peativerthera.ru/yHAr8r/
Cookie: XSRF-TOKEN=eyJpdiI6IkNvRTdTcGxtSUtzSFR1bmFvUENHcmc9PSIsInZhbHVlIjoiNEE0NUgzd2I0Y0pJSDlsTVJUeUtWcE5Bc3MrTU1IZW42UVlXRCtGcXRlSm03b0FMUUsyb3hGTjNtRlpFQmFiOU1ETzdUdU9tV0c2R09lNWpxWUtwK2trS2ZKQWprZUljS2JjNitobUI3ZkQyS3hjU1lwNkVQVkEyZXJZcng1ME0iLCJtYWMiOiJhZjAyYjY2NWE0NWYzMGU3NGJjOWJlZDM5N2Q3NDU5MWY0ZTZjYWYzMjFkM2FlODRkOTFjNDNiYjE1ZDI3MTM0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ilhkbk9GZDRybTZkb1ViYi90ODU4SXc9PSIsInZhbHVlIjoiUHJmbnZGL3QwMFY1UW04YUhoNUppTVFGMFdhME1xYzF5SXg0NVJXSTl2cytvU05JaTVHcytIYWs2Q2drWE1yV2ZodExobk9XSEdCdEVRcXZwREdUa1lnWkdvN0dGVEREYk4vOGlaZDJhS0tFeXJGL1hYdnJXN2orNWdheWdIdXEiLCJtYWMiOiI4NDQ1ZDY1MjQyMTBkZjJmNTJhYjU0NWJhYWNlNjI5NmJkZmU0N2Q3YmYzZjc1NmY5ZjI2N2Y3ZWJiNzlhMjVlIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 31 Jan 2025 14:58:20 GMT
content-type: image/svg+xml
content-disposition: inline; filename="wxml6pd0XWs52NmgssIvpemnPjiFVS1AGxK5Paab177"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0lFx1SVOrVCQP42dyQcS%2ByS%2FXUeWPh3jRGD1gOD2dax%2BY0PdQU1JRL2VLZ6sHCFQFajQWmd3q5O7EKhfYM8tI9Mtrtd53nHF2gJSg%2FK07oLRKuti3DCZhRdQJrQzPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 90aa8f2c8fb97130-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=5555&min_rtt=5500&rtt_var=1650&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2144&delivery_rate=487838&cwnd=249&unsent_bytes=0&cid=b539ec916beccd21&ts=108&x=0", cfL4;desc="?proto=QUIC&rtt=1415&min_rtt=791&rtt_var=384&sent=187&recv=78&lost=0&retrans=0&sent_bytes=159238&recv_bytes=24900&delivery_rate=1537581&cwnd=13200&unsent_bytes=0&cid=bcd9d82f566b81cf&ts=10046&x=1", cfExtPri, cfHdrFlush;dur=0

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (17)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations