| cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js | 104.17.25.14 | 200 OK | 14 kB |
URL GET HTTP/3cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js IP 104.17.25.14:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32 ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File typeJavaScript source, ASCII text, with very long lines (48316), with no line terminators Hash2ca03ad87885ab983541092b87adb299 1a17f60bf776a8c468a185c1e8e985c41a50dc27 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 17:26:25 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 158456
expires: Wed, 04 Feb 2026 17:26:25 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DfETxItnognvOzz0V53NEPjLZGsavb7aVqDHgroMjkTLSKJXeZ0AcAuoV4RGOElLwifd1VkQr6rOzmJ0jkM7n0VLYU66wkPlNxN0xCK%2FWlCwG%2BxnBjV%2BFAESai%2FKL3S2hPdL1PPn"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911ec357f9feb4fa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback | 104.18.95.41 | 302 Found | 0 B |
URL challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback IP 104.18.95.41:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
date: Fri, 14 Feb 2025 17:26:25 GMT
content-length: 0
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
cross-origin-resource-policy: cross-origin
location: /turnstile/v0/b/324d0dcf743c/api.js
vary: Accept-Encoding
server: cloudflare
cf-ray: 911ec357fb8256c0-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| code.jquery.com/jquery-3.6.0.min.js | 151.101.130.137 | 200 OK | 31 kB |
URL GET HTTP/2code.jquery.com/jquery-3.6.0.min.js IP 151.101.130.137:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5 ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 14 Feb 2025 17:26:25 GMT
age: 3307519
x-served-by: cache-lga21931-LGA, cache-hel1410025-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 1218092
x-timer: S1739553985.340073,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
|
|
| challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js | 104.18.95.41 | 200 OK | 17 kB |
URL challenges.cloudflare.com/turnstile/v0/b/324d0dcf743c/api.js IP 104.18.95.41:0
File typeJavaScript source, ASCII text, with very long lines (48138) Hash59306e15eb43de76a56231e5e426ec80 7606b8e4aeace12b393ad6dcebdf6d64bc7240e9 69865fe9be4f6cdced3ca8c047a486db063f1179846f5edff395c39a7494fa34
GET /turnstile/v0/b/324d0dcf743c/api.js HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Fri, 14 Feb 2025 17:26:25 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 11 Feb 2025 23:52:12 GMT
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 911ec3586c1e56c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js | 104.17.25.14 | 200 OK | 14 kB |
URL GET HTTP/3cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js IP 104.17.25.14:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32 ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File typeJavaScript source, ASCII text, with very long lines (48316), with no line terminators Hash2ca03ad87885ab983541092b87adb299 1a17f60bf776a8c468a185c1e8e985c41a50dc27 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 158467
expires: Wed, 04 Feb 2026 17:26:36 GMT
accept-ranges: bytes
priority: u=2,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XOibMKnwCuwydls5b6WStoA5n%2BS9wViJkaMjjip2L6EljxWH%2Bt7n%2Bd%2BnmHZMXJLqWwre58m%2BOyCUMB7XGq7B8%2BEJRlq%2Flqt%2FcoWXkRqvwGeeYntiFB8pJQOrkxKAPReuAi2Xfl%2F0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911ec39cac471bfe-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| code.jquery.com/jquery-3.6.0.min.js | 151.101.130.137 | 200 OK | 31 kB |
URL GET HTTP/2code.jquery.com/jquery-3.6.0.min.js IP 151.101.130.137:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5 ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 14 Feb 2025 17:26:36 GMT
age: 3307530
x-served-by: cache-lga21931-LGA, cache-hel1410025-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 1218101
x-timer: S1739553996.272277,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
|
|
| f6mdk.revishbos.ru/bhanchod!jkq3x2 | 104.21.2.8 | 200 OK | 16 kB |
URL f6mdk.revishbos.ru/bhanchod!jkq3x2 IP 104.21.2.8:0
File typevery short file (no magic) Hashcfcd208495d565ef66e7dff9f98764da b6589fc6ab0dc82cf12099d1c2d40ab994e8410c 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /bhanchod!jkq3x2 HTTP/1.1
Host: f6mdk.revishbos.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Origin: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 17:26:35 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JMCCEYwSWC%2FjCdhvNEOgG%2Bq3YRAk4NvMVqmVfwCB62Er%2FpamtMxTsYyhxgohP2W4Lm%2BfIYEctM1Nm03vLr6D7M4gfYUewYWOde3%2FqjPcmztZLYHsMZuE4rgV99%2BQNXvq%2BFMw4CE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 911ec3979906712e-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6069&min_rtt=522&rtt_var=11107&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3202&recv_bytes=1173&delivery_rate=7144736&cwnd=254&unsent_bytes=0&cid=cee4d9a775bdcba1&ts=408&x=0"
X-Firefox-Spdy: h2
|
|
| cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js | 104.17.25.14 | 200 OK | 14 kB |
URL GET HTTP/3cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js IP 104.17.25.14:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectcdnjs.cloudflare.com Fingerprint00:0E:39:59:53:CF:68:07:90:75:EB:68:26:B9:04:22:44:7D:9A:32 ValidityFri, 24 Jan 2025 09:16:22 GMT - Thu, 24 Apr 2025 10:16:21 GMT
File typeJavaScript source, ASCII text, with very long lines (48316), with no line terminators Hash2ca03ad87885ab983541092b87adb299 1a17f60bf776a8c468a185c1e8e985c41a50dc27 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 158468
expires: Wed, 04 Feb 2026 17:26:37 GMT
accept-ranges: bytes
priority: u=3,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eYJSoo9NmG4PZ55TKx4IY5gjzTr9SsA7SeAHZY5bElTbIm9dUPfs2zv%2Fenbv1UcBvBd5RSXmFMYk9u61qHpWChlXIbzFMT5TMzk9DgxRVjJcUzbqVzrhG5cewQYioJA0kENLtY3r"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 911ec3a18a671bfe-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
|
|
| code.jquery.com/jquery-3.6.0.min.js | 151.101.130.137 | 200 OK | 31 kB |
URL GET HTTP/2code.jquery.com/jquery-3.6.0.min.js IP 151.101.130.137:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerSectigo Limited Subject*.jquery.com FingerprintCD:B5:6E:05:85:0C:5A:AE:47:12:80:2A:5B:C6:E5:8F:11:72:E2:B5 ValidityTue, 25 Jun 2024 00:00:00 GMT - Wed, 25 Jun 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (65447) Hash8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Fri, 14 Feb 2025 17:26:37 GMT
age: 3307531
x-served-by: cache-lga21931-LGA, cache-hel1410025-HEL
x-cache: HIT, HIT
x-cache-hits: 71, 1218104
x-timer: S1739553997.046886,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2
|
|
| ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 | 143.204.55.47 | 200 OK | 11 kB |
URL GET HTTP/2ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 IP 143.204.55.47:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerDigiCert Inc Subject*.oktacdn.com Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5 ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File typePNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced Hash12bdacc832185d0367ecc23fd24c86ce 4422f316eb4d8c8d160312bb695fd1d944cbff12 877ae491d9aac5c6ef82a8430f9f652ace8a0dbc7294bd112aad49bd593769d0
GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: image/png
content-length: 10796
server: nginx
last-modified: Tue, 23 Feb 2021 04:20:08 GMT
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
date: Wed, 29 Jan 2025 00:59:17 GMT
expires: Thu, 29 Jan 2026 00:59:17 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: "12bdacc832185d0367ecc23fd24c86ce"
x-cache: Hit from cloudfront
via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: cWOFbNxkVkSUZcXks5J0J1Nr51yyFy4VnXtZb--CHuqKGLpTCKMv9A==
age: 1441640
X-Firefox-Spdy: h2
|
|
| github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js | 140.82.121.4 | 302 Found | 0 B |
URL GET HTTP/2github.com/fent/randexp.js/releases/download/v0.4.3/randexp.min.js IP 140.82.121.4:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerSectigo Limited Subjectgithub.com FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1
Host: github.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
server: GitHub.com
date: Fri, 14 Feb 2025 17:26:27 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T172627Z&X-Amz-Expires=300&X-Amz-Signature=def35df7449a3a3a89e101c204cc2a150c6015e49a7421731b543b8bd59bbcf5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: no-referrer-when-downgrade
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
content-length: 0
x-github-request-id: F127:188A48:2CF1141:2DFC29A:67AF7CCD
X-Firefox-Spdy: h2
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/qrhDU8hsCIk2A8C5UG6VQmnWUd3luoutel67140 | 188.114.97.1 | 200 OK | 892 B |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/qrhDU8hsCIk2A8C5UG6VQmnWUd3luoutel67140 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeRIFF (little-endian) data, Web/P image Hash41d62ca205d54a78e4298367482b4e2b 839aae21ed8ecfc238fdc68b93ccb27431cd5393 20a4a780db0bcc047015a0d8037eb4eb58b3e5cb338673799c030a3e1b626b40
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /qrhDU8hsCIk2A8C5UG6VQmnWUd3luoutel67140 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: image/webp
content-length: 892
content-disposition: inline; filename="qrhDU8hsCIk2A8C5UG6VQmnWUd3luoutel67140"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JDaU13WPfMXxDWdxLh2IOX5Z%2FSgbU3O2oKjktWFWAk7R85M%2FveHTxXYJGCfOo2tRPkN0S%2FwadOnaBsV4kNOEMs25ftLDNGxbAVf8tU9BvcEztXp9HWzT4%2FbPdLNLSg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a1bb20b4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1125&min_rtt=1112&rtt_var=338&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2271&delivery_rate=2431570&cwnd=251&unsent_bytes=0&cid=98b3d98a3efb2c61&ts=81&x=0", cfL4;desc="?proto=QUIC&rtt=1700&min_rtt=986&rtt_var=862&sent=117&recv=49&lost=0&retrans=0&sent_bytes=99376&recv_bytes=26088&delivery_rate=950514&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12283&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/opl04wMDKERJB6OWkHnEWALvg9st0Mw7so0y0S9xI054Kg79b8LVLgrlMF8ef240 | 188.114.97.1 | 200 OK | 9.6 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/opl04wMDKERJB6OWkHnEWALvg9st0Mw7so0y0S9xI054Kg79b8LVLgrlMF8ef240 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeRIFF (little-endian) data, Web/P image Hash4946eb373b18d178c93d473489673bb6 16477acb73b63ca251d37401249e7e4515febd24 666bc574c9f3fb28a8ac626fa8105c187c2a313736494a06bd5a937473673c92
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /opl04wMDKERJB6OWkHnEWALvg9st0Mw7so0y0S9xI054Kg79b8LVLgrlMF8ef240 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: image/webp
content-length: 9648
content-disposition: inline; filename="opl04wMDKERJB6OWkHnEWALvg9st0Mw7so0y0S9xI054Kg79b8LVLgrlMF8ef240"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mABowzdmgug6DQNeOdAeliu33vIUjZlpavnrhVELjty2vTktIyLFxb6nUBPBxIUmkwH80AIcbM9Owz2K29gUKqkBuNqS0ywOQY%2FIrRNdmWDPKb12EGcej0O%2BfgHFUg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a1db63b4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1069&min_rtt=1045&rtt_var=307&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2296&delivery_rate=2709073&cwnd=251&unsent_bytes=0&cid=937861bf19638ab3&ts=81&x=0", cfL4;desc="?proto=QUIC&rtt=1639&min_rtt=986&rtt_var=583&sent=123&recv=51&lost=0&retrans=0&sent_bytes=105518&recv_bytes=26178&delivery_rate=1723379&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12298&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-bold.woff2 | 188.114.97.1 | 200 OK | 28 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-bold.woff2 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 28000, version 1.66 Hasha4bca6c95fed0d0c5cc46cf07710dcec 73b56e33b82b42921db8702a33efd0f2b2ec9794 5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-bold.woff2 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: font/woff2
content-length: 28000
content-disposition: inline; filename="GDSherpa-bold.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 17:26:37 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bzTecgqQy5BpWI8ak%2FCmmFDNpU%2B%2BsbAzgjmBvpVud6lNQPo4%2B4Qa9EC9u8V32onwHM1bEnQ5ZVgS4uGrWdJ6c4%2BBgBuVwVLZ1LTqJlrjey9U9bApujBKSoYUDPif%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911ec3a1aaddb4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1123&min_rtt=1120&rtt_var=321&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2273&delivery_rate=2533683&cwnd=251&unsent_bytes=0&cid=3f8453fdb5413cf0&ts=90&x=0", cfL4;desc="?proto=QUIC&rtt=1620&min_rtt=869&rtt_var=632&sent=164&recv=55&lost=0&retrans=0&sent_bytes=151514&recv_bytes=26360&delivery_rate=4448449&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12316&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/uvTf39zkQrpCSPS1qrCPU0smm0MyJeszzIA34127 | 188.114.97.1 | 200 OK | 644 B |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/uvTf39zkQrpCSPS1qrCPU0smm0MyJeszzIA34127 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeRIFF (little-endian) data, Web/P image Hash541b83c2195088043337e4353b6fd60d f09630596b6713217984785a64f6ea83e91b49c5 2658b8874f0d2a12e8726df78ac8954324c3bbe4695e66bdef89195fde64322f
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /uvTf39zkQrpCSPS1qrCPU0smm0MyJeszzIA34127 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: image/webp
content-length: 644
content-disposition: inline; filename="uvTf39zkQrpCSPS1qrCPU0smm0MyJeszzIA34127"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I8snehgLiuV9b%2BysYTObbBi7h0nTw7SnYf6ry%2B%2FmOJe004nYmZLji5FLp3wBB4HuAux0vVCV8lZRJ4pDPCL7NkrtrGwBeP4f7Heh91RfyOyfbQpIz7MI81ZHDh3MzA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a1bb1cb4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1246&min_rtt=1222&rtt_var=360&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2272&delivery_rate=2296590&cwnd=246&unsent_bytes=0&cid=a6b1893de774d76f&ts=133&x=0", cfL4;desc="?proto=QUIC&rtt=1549&min_rtt=869&rtt_var=579&sent=190&recv=57&lost=0&retrans=0&sent_bytes=182124&recv_bytes=26452&delivery_rate=1873421&cwnd=57600&unsent_bytes=0&cid=cb977f966ba689a3&ts=12333&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/uvrTSB9tguTRT3FiEnWGvF3FUqC5nMuYN7jdimfK608RE679maf2zE7qzGujfpSFW1LoA1SlaZIFj8lHqn9ef260 | 188.114.97.1 | 200 OK | 18 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/uvrTSB9tguTRT3FiEnWGvF3FUqC5nMuYN7jdimfK608RE679maf2zE7qzGujfpSFW1LoA1SlaZIFj8lHqn9ef260 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeRIFF (little-endian) data, Web/P image Hash4b52ecdc33382c9dca874f551990e704 8f3bf8e41cd4cdddb17836b261e73f827b84341b cce050cc3b150c0b370751021bb15018ee2b64ac369e230fe3b571a9b00d4342
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /uvrTSB9tguTRT3FiEnWGvF3FUqC5nMuYN7jdimfK608RE679maf2zE7qzGujfpSFW1LoA1SlaZIFj8lHqn9ef260 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: image/webp
content-length: 17842
content-disposition: inline; filename="uvrTSB9tguTRT3FiEnWGvF3FUqC5nMuYN7jdimfK608RE679maf2zE7qzGujfpSFW1LoA1SlaZIFj8lHqn9ef260"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ssbfi0alypa15cboZ7Qixl%2B9ADdiwPhIe1jxounYxo%2FDBU8BW%2F1MuBYTff7SUveEQchKjcStIJN8nhhZMJO5RTkJvd%2BFL7weABPryeW5Al4V6hwxLpjYV%2BqepSaXJg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a1db65b4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1193&min_rtt=1181&rtt_var=468&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2320&delivery_rate=2255451&cwnd=251&unsent_bytes=0&cid=06a12964670af352&ts=81&x=0", cfL4;desc="?proto=QUIC&rtt=1611&min_rtt=986&rtt_var=494&sent=132&recv=52&lost=0&retrans=0&sent_bytes=116261&recv_bytes=26224&delivery_rate=2314628&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12303&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/ijjSp3geu4012DTRLGRXChSNipNox4E6Kkl8OojKXGnC2Nm0omSzqGDX2x2ydef208 | 188.114.97.1 | 200 OK | 25 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/ijjSp3geu4012DTRLGRXChSNipNox4E6Kkl8OojKXGnC2Nm0omSzqGDX2x2ydef208 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeRIFF (little-endian) data, Web/P image Hashf9a795e2270664a7a169c73b6d84a575 0fbb60ab27ab88c064eb347d0722c8ed4cf5e8b8 d00203b2eea6e418c31baafa949ada5349a9f9b7e99fa003aec7406822693740
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /ijjSp3geu4012DTRLGRXChSNipNox4E6Kkl8OojKXGnC2Nm0omSzqGDX2x2ydef208 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: image/webp
content-length: 25216
content-disposition: inline; filename="ijjSp3geu4012DTRLGRXChSNipNox4E6Kkl8OojKXGnC2Nm0omSzqGDX2x2ydef208"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l6fUIXE0SwHi8jb9c9%2FcUdN2ruHswCiLWusf8jt%2F1ccZmIp5GbkVDWf9saZcH%2BrkcIodnH5qb8IiQNP%2FBuIbfFt63GRWsOH0BBzeCj6L1Ud19x4%2B5ceb4chWsbEN2g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a1db60b4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1272&min_rtt=1151&rtt_var=518&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2298&delivery_rate=2516072&cwnd=251&unsent_bytes=0&cid=219ab09f0049a482&ts=92&x=0", cfL4;desc="?proto=QUIC&rtt=1492&min_rtt=869&rtt_var=501&sent=146&recv=54&lost=0&retrans=0&sent_bytes=132381&recv_bytes=26315&delivery_rate=7193477&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12309&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-regular.woff2 | 188.114.97.1 | 200 OK | 29 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-regular.woff2 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 28584, version 1.66 Hash17081510f3a6f2f619ec8c6f244523c7 87f34b2a1532c50f2a424c345d03fe028db35635 2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-regular.woff2 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: font/woff2
content-length: 28584
content-disposition: inline; filename="GDSherpa-regular.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 17:26:37 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ArQvGv%2FpdjC4NMzke%2B8rp3R4Ak3FLfguYzbG%2BZami5DiMYPQiB%2FIGWdeE4zKQbQWHKDIhi3htVQh8mkmWGLtIrXPrEPr%2FI0tnjh%2BgCRkKAIOuRl0cNT6JPd2DgUOyw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911ec3a1bb12b4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1254&min_rtt=1235&rtt_var=361&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2276&delivery_rate=2278520&cwnd=251&unsent_bytes=0&cid=8933c72274c5e072&ts=137&x=0", cfL4;desc="?proto=QUIC&rtt=1416&min_rtt=774&rtt_var=740&sent=223&recv=63&lost=0&retrans=0&sent_bytes=216469&recv_bytes=26725&delivery_rate=3385394&cwnd=57600&unsent_bytes=0&cid=cb977f966ba689a3&ts=12371&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-regular.woff | 188.114.97.1 | 200 OK | 37 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-regular.woff IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeWeb Open Font Format, TrueType, length 36696, version 1.0 Hasha69e9ab8afdd7486ec0749c551051ff2 c34e6aa327b536fb48d1fe03577a47c7ee2231b8 fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-regular.woff HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: font/woff
content-length: 36696
content-disposition: inline; filename="GDSherpa-regular.woff"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 17:26:37 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VJRYH04wtIRyrP%2By7b%2B0hgA2sBxP4pLD2u5rWgVDgEfBpO0aGNFaxt%2BuK9DAQd6ulgPP8EOScQWNxc%2F5c3wgaxVG%2FuSC8wckjx7i59RPK6mqa0GWR2dhBrcShowwXg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911ec3a1bb14b4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1110&min_rtt=1105&rtt_var=425&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2275&delivery_rate=2522648&cwnd=243&unsent_bytes=0&cid=daa47fc2a7584847&ts=137&x=0", cfL4;desc="?proto=QUIC&rtt=1416&min_rtt=774&rtt_var=740&sent=213&recv=63&lost=0&retrans=0&sent_bytes=204469&recv_bytes=26725&delivery_rate=3385394&cwnd=57600&unsent_bytes=0&cid=cb977f966ba689a3&ts=12370&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-bold.woff | 188.114.97.1 | 200 OK | 36 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-bold.woff IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeWeb Open Font Format, TrueType, length 35970, version 1.0 Hash496b7bbde91c7dc7cf9bbabbb3921da8 2bd3c406a715ab52dad84c803c55bf4a6e66a924 ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-bold.woff HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: font/woff
content-length: 35970
content-disposition: inline; filename="GDSherpa-bold.woff"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 17:26:37 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vW1w%2FhhwCozBdl7y5Wr4CgQGz32YLIhKMwMQwzufObZcpWczkbKOvER6z0LrmUsfXJ38OhA2Y2TKHU6jmZKEnCr5DXO9BruuVGaXCGjmlI3YwaqoN8JXyKWn0ks05Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911ec3a1bb0fb4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1367&min_rtt=1331&rtt_var=571&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2273&delivery_rate=1786551&cwnd=251&unsent_bytes=0&cid=48f53167a1a8330f&ts=130&x=0", cfL4;desc="?proto=QUIC&rtt=1416&min_rtt=774&rtt_var=556&sent=273&recv=64&lost=0&retrans=0&sent_bytes=273173&recv_bytes=26771&delivery_rate=3203268&cwnd=115200&unsent_bytes=0&cid=cb977f966ba689a3&ts=12379&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-vf.woff2 | 188.114.97.1 | 200 OK | 44 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-vf.woff2 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 43596, version 1.0 Hash2a05e9e5572abc320b2b7ea38a70dcc1 d5fa2a856d5632c2469e42436159375117ef3c35 3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-vf.woff2 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: font/woff2
content-length: 43596
content-disposition: inline; filename="GDSherpa-vf.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 17:26:37 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=67Qzu4mNqcTDaFz2c1pcIMm9i9ENTSqOxQm3FuL8XMuD4LlL8TOiIRtXg6fvR2CndxQe7FlNUesJAEgCCHMZtdfhjtJ90kWuJnEIS2GDfyYV%2BmRJJrpkDbxkMGYSgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911ec3a1bb17b4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1398&min_rtt=1381&rtt_var=553&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2272&delivery_rate=1900262&cwnd=251&unsent_bytes=0&cid=6b5dd2c42951b783&ts=171&x=0", cfL4;desc="?proto=QUIC&rtt=1527&min_rtt=774&rtt_var=807&sent=310&recv=67&lost=0&retrans=0&sent_bytes=316758&recv_bytes=26908&delivery_rate=4821913&cwnd=115200&unsent_bytes=0&cid=cb977f966ba689a3&ts=12443&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-vf2.woff2 | 188.114.97.1 | 200 OK | 93 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/GDSherpa-vf2.woff2 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 93276, version 1.0 Hashbcd7983ea5aa57c55f6758b4977983cb ef3a009e205229e07fb0ec8569e669b11c378ef1 6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /GDSherpa-vf2.woff2 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
DNT: 1
Connection: keep-alive
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: font/woff2
content-length: 93276
content-disposition: inline; filename="GDSherpa-vf2.woff2"
cache-control: max-age=14400
last-modified: Fri, 14 Feb 2025 17:26:37 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OU5673o01GdebxW%2FxKmISsuo39fbshTMW6wGyOdPhOGxjN7NiTm9aWaI%2F7DwzLiCgrkDyH0Eo%2FXAgPBL5JJIqxfSg9rcBU2Hbg76glIySc%2B%2Be6dGTT5zb%2FN0AI46FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
priority: u=3,i=?0
server: cloudflare
cf-ray: 911ec3a1bb19b4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1069&min_rtt=1053&rtt_var=428&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2272&delivery_rate=2441821&cwnd=251&unsent_bytes=0&cid=58e0acb287e08772&ts=170&x=0", cfL4;desc="?proto=QUIC&rtt=1527&min_rtt=774&rtt_var=807&sent=358&recv=67&lost=0&retrans=0&sent_bytes=373957&recv_bytes=26908&delivery_rate=4821913&cwnd=115200&unsent_bytes=0&cid=cb977f966ba689a3&ts=12445&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T172627Z&X-Amz-Expires=300&X-Amz-Signature=def35df7449a3a3a89e101c204cc2a150c6015e49a7421731b543b8bd59bbcf5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream | 185.199.108.133 | 200 OK | 10 kB |
URL GET HTTP/2objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T172627Z&X-Amz-Expires=300&X-Amz-Signature=def35df7449a3a3a89e101c204cc2a150c6015e49a7421731b543b8bd59bbcf5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream IP 185.199.108.133:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerDigiCert Inc Subject*.github.io Fingerprint97:D8:C5:70:0F:12:24:6C:88:BC:FA:06:7E:8C:A7:4D:A8:62:67:28 ValidityFri, 15 Mar 2024 00:00:00 GMT - Fri, 14 Mar 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (10017) Hash6c20a2be8ba900bc0a7118893a2b1072 ff7766fde1f33882c6e1c481ceed6f6588ea764c b1c42acd0288c435e95e00332476781532ed002cac6f3dcee9110ced30b31500
GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250214%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250214T172627Z&X-Amz-Expires=300&X-Amz-Signature=def35df7449a3a3a89e101c204cc2a150c6015e49a7421731b543b8bd59bbcf5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1
Host: objects.githubusercontent.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/octet-stream
last-modified: Tue, 07 Dec 2021 16:38:45 GMT
etag: "0x8D9B9A009499A1E"
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: d91f6eaf-e01e-0032-2f18-13e122000000
x-ms-version: 2023-11-03
x-ms-creation-time: Tue, 17 Aug 2021 14:57:31 GMT
x-ms-blob-content-md5: bCCivoupALwKcRiJOisQcg==
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
content-disposition: attachment; filename=randexp.min.js
x-ms-server-encrypted: true
via: 1.1 varnish, 1.1 varnish
fastly-restarts: 1
accept-ranges: bytes
date: Fri, 14 Feb 2025 17:26:37 GMT
age: 2520
x-served-by: cache-iad-kiad7000045-IAD, cache-hel1410024-HEL
x-cache: HIT, HIT
x-cache-hits: 11369, 2
x-timer: S1739553997.322158,VS0,VE0
content-length: 10245
X-Firefox-Spdy: h2
|
|
| ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 | 143.204.55.47 | 200 OK | 20 kB |
URL GET HTTP/2ok4static.oktacdn.com/assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 IP 143.204.55.47:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerDigiCert Inc Subject*.oktacdn.com Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5 ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 20416, version 2.197 Hashd99a7377dabb55772ca9f986b0a04b57 2b5fcd8431953c44e410d0489899e74f6d2cfecc affdba1620552b12a1a8a04467136aeb408c03fa337d20e9c38374d682d4d149
GET /assets/loginpage/font/assets/proximanova-reg-webfont.353416ed0ff540352235.woff2 HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
DNT: 1
Connection: keep-alive
Referer: https://ok4static.oktacdn.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-type: application/font-woff2
content-length: 20416
date: Mon, 27 Jan 2025 07:42:18 GMT
server: nginx
last-modified: Tue, 07 Nov 2023 18:56:28 GMT
etag: "d99a7377dabb55772ca9f986b0a04b57"
x-amz-meta-sha1sum: 2b5fcd8431953c44e410d0489899e74f6d2cfecc
expires: Tue, 27 Jan 2026 07:42:18 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
accept-ranges: bytes
x-cache: Hit from cloudfront
via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: UZ1yIFX74QZlEMCEMsL8dBH-1fNGllCh7OReOZxmleakcqfU6PFdTA==
age: 1590259
X-Firefox-Spdy: h2
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV | 188.114.97.1 | 200 OK | 73 kB |
URL User Request GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV IP 188.114.97.1:443
CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeHTML document, ASCII text, with very long lines (52489), with CRLF line terminators Hashe0430458cca2426c4350b0648eb6ccd7 c11409fab34843312d43eddc22367a4690f04dd7 71f6342bc555ddf66a85d35d6990fa0708ee1d8e30ea2842538fcebb929abe01
Analyzer | Verdict | Alert | urlquery | suspicious | Suspicious - Anti-debugging code |
GET /eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/vXsP8/
Cookie: XSRF-TOKEN=eyJpdiI6Ijcva3pmNzdxanJZVTVtRVBIbE81R0E9PSIsInZhbHVlIjoibmtHblFmV3EzU2FwWlNvc0xJWUdjMVFxYlhMNGI5aW1Dd2pSdk1QVzh3WVl5UlFTQSsrdldpTExMRXZneXEwczEzOTBzQjcrOXh0YituOUVhRVBGSWxMWVdmVVY1YWdnRVJ1SnRTcFAvNkZCS0RwUHRRbW96WmlEZ29TVFdFRnAiLCJtYWMiOiJkNjBmZjRiMTZjZDEwNzI0NmY3NzYyMzA4NDc1ZDE3ZjAxN2E2ZTY2NjY5MzE5OTY1NGFhNTQ0ZDgzMTg2MzlkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ims5Tk1GaHZXQklIYVlCVnFWa2Zmamc9PSIsInZhbHVlIjoiVlh3V094cmsyemVFYjlvc3U0YzArU0hPekZlamplT1FRM24rTEQyZ3N1elNIR0xZZXZhTnVXRS92SXJKcFBkOC8rNWkzTTBRWjZZSmR2TUtMNm15TGJtZXVQVS94cWVCM05wdWJzRENqM21QWjJMcGtDSXZacGhXZ2wzUHpCTDYiLCJtYWMiOiJiMTc4ZjQ5ZGU1YWFjMzdmZjEzOWFlZTBjODM5ZGM1NDg2NGQwNWJjNTYyMzU1Yzc0ODA0ZmRmOWFkYTk2YTgyIiwidGFnIjoiIn0%3D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:36 GMT
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-cache-status: DYNAMIC
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aaeuXT1QhOMnFqbvCXb%2BDX3p3VUpFzziHbl5HResTp9FuTLRFhIZJMcXUZ5B5VTPYhAoQeHDdTHuFZ6n8o%2FeazPc9afOd8YuNbhgxHShY96t%2FYGjgz1m3DkIx8fjLA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 19:26:36 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 19:26:36 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
priority: u=1,i=?0
server: cloudflare
cf-ray: 911ec39f3e91b4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1139&min_rtt=1126&rtt_var=449&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2332&delivery_rate=2343042&cwnd=251&unsent_bytes=0&cid=9d0118ffb2aae90d&ts=198&x=0", cfL4;desc="?proto=QUIC&rtt=3702&min_rtt=1916&rtt_var=1493&sent=34&recv=18&lost=0&retrans=0&sent_bytes=19031&recv_bytes=7248&delivery_rate=39970&cwnd=12000&unsent_bytes=0&cid=cb977f966ba689a3&ts=11960&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/klJpjmnYEYdyPvVo1kU9Qa4wxLhJAK3nl5Tcx1go9KjC78170 | 188.114.97.1 | 200 OK | 7.4 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/klJpjmnYEYdyPvVo1kU9Qa4wxLhJAK3nl5Tcx1go9KjC78170 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeSVG Scalable Vector Graphics image Hashbca9b46fee32162356ba5b4783e614dc cc09ee862df9bf86e545f9dfdf2fbd4facfa71f5 fb48e7087def752683bc9a9fe4035acf2419cebbe8b17a16e5c81699a06f6fec
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /klJpjmnYEYdyPvVo1kU9Qa4wxLhJAK3nl5Tcx1go9KjC78170 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: image/svg+xml
content-disposition: inline; filename="klJpjmnYEYdyPvVo1kU9Qa4wxLhJAK3nl5Tcx1go9KjC78170"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xZUVEhYFSkxLb%2FEaCJD3qiFuVe4IqbPEZVrZdWurx%2FSmVFFFt5%2BXOPMCOYDBGLomoYobv6DAaGvwTkZgfSG6eovSJGFJlSkwrU0JiBuI5T%2BYTs3D1xe3mkrtw4juAA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a1bb27b4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1429&min_rtt=1360&rtt_var=505&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2281&delivery_rate=1705535&cwnd=251&unsent_bytes=0&cid=ca8a9cfc9a7932b0&ts=83&x=0", cfL4;desc="?proto=QUIC&rtt=1655&min_rtt=986&rtt_var=735&sent=119&recv=50&lost=0&retrans=0&sent_bytes=101146&recv_bytes=26133&delivery_rate=1318338&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12293&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css | 143.204.55.47 | 200 OK | 223 kB |
URL GET HTTP/2ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css IP 143.204.55.47:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerDigiCert Inc Subject*.oktacdn.com Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5 ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
Size223 kB (222931 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Tue, 14 May 2024 21:48:24 GMT
x-amz-meta-sha1sum: 7b5499b46660a0348cc2b22cae927dcc3fda8b20
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Wed, 29 Jan 2025 17:13:28 GMT
expires: Thu, 29 Jan 2026 17:13:28 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"0329c939fca7c78756b94fbcd95e322b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: OWrTe-yH4ZRE0SpUwlvXIlBD4-K6ISQxBjecdTSkmEfyV4ltPfb6nw==
age: 1383189
X-Firefox-Spdy: h2
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/wxo56eo2GNoO2AH3siqXKopBy7iEAvR627xTfMZfQi5ab173 | 188.114.97.1 | 200 OK | 2.9 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/wxo56eo2GNoO2AH3siqXKopBy7iEAvR627xTfMZfQi5ab173 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeSVG Scalable Vector Graphics image Hashe924de0d471df54b6280f3dc8b187cb8 857f03226070b502a9e06b4249710ec10be4c9e9 24ce135a31ce83ac3d62471fcc0e1a82ce6f1533c993ee59ca4e110d5f2fae33
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /wxo56eo2GNoO2AH3siqXKopBy7iEAvR627xTfMZfQi5ab173 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: image/svg+xml
content-disposition: inline; filename="wxo56eo2GNoO2AH3siqXKopBy7iEAvR627xTfMZfQi5ab173"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XOzLZ0cnhz0yXpzBOZW5AJuFvcEDvQln%2BnseGqd%2F8YfkQqA%2Fr%2BEmKC3vbOc5TvgIuOwGGYeJxrZzmZoicPRWOZFHLIfIxz5q2no7BeRJMzEj5MCTkQa0YKZp6UyD6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a1bb2ab4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1165&min_rtt=1145&rtt_var=470&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2280&delivery_rate=2212375&cwnd=250&unsent_bytes=0&cid=2d7a6c64590fc8e9&ts=90&x=0", cfL4;desc="?proto=QUIC&rtt=1611&min_rtt=986&rtt_var=494&sent=142&recv=52&lost=0&retrans=0&sent_bytes=128261&recv_bytes=26224&delivery_rate=2314628&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12305&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| 4smjfu97yjrdx8pwtxzsf3rtpzapuzzizlvkissujrdu7cnoyn.nexthorizonz.ru/sadpKXoFlJmsQFgCvWWpHqGjZUsAgAYMMAFZIHYLLKKNYPUHOPSMPVVMGFKBRRCAYOPPNPJMFOrsRPfptQt8C2Dh234z2oLqA7uv32 | 172.67.200.132 | 200 OK | 536 B |
URL POST HTTP/24smjfu97yjrdx8pwtxzsf3rtpzapuzzizlvkissujrdu7cnoyn.nexthorizonz.ru/sadpKXoFlJmsQFgCvWWpHqGjZUsAgAYMMAFZIHYLLKKNYPUHOPSMPVVMGFKBRRCAYOPPNPJMFOrsRPfptQt8C2Dh234z2oLqA7uv32 IP 172.67.200.132:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectnexthorizonz.ru Fingerprint9C:B2:D1:14:A9:D9:8F:E7:CB:00:FF:4C:D0:E6:92:32:FC:4C:61:13 ValidityThu, 23 Jan 2025 22:26:54 GMT - Wed, 23 Apr 2025 23:24:21 GMT
File typeASCII text, with very long lines (536), with no line terminators Hashb700a2408fff4601b18b91dd7b1adf0f 294a42cbff29c06fe6bff0cc3d5d6b93f7fda3dc 23731d6f86bfade6b1fd1acf5985785e9e1cb0f155f662cf89464d7a6f2c04b6
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft | Quad9 DNS | malicious | Sinkholed |
POST /sadpKXoFlJmsQFgCvWWpHqGjZUsAgAYMMAFZIHYLLKKNYPUHOPSMPVVMGFKBRRCAYOPPNPJMFOrsRPfptQt8C2Dh234z2oLqA7uv32 HTTP/1.1
Host: 4smjfu97yjrdx8pwtxzsf3rtpzapuzzizlvkissujrdu7cnoyn.nexthorizonz.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 117
Origin: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 17:26:41 GMT
content-type: text/plain; charset=utf-8
vary: Origin
access-control-allow-origin: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zH5dvNtEwLVPAja3iWK%2FJl7U1zcVsLlKhOUbqY%2BjZ%2Fbvvvwi4V7BSZ5RKBLjSgMyyokDWoc0wSyb1Mu6qy%2BGc%2BAG1R6bGow3DDiYGTmjc172JVC7DksbXLE%2Bc%2FW0BbuqY3%2Bu%2BKoQ8IMy2F4EaCZFpsLa9l9iG9vaIBsnORVnVVQSJzE5nh%2FZHNziy3RjmWqlGTKoPIE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 911ec3b55e3856a3-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=811&min_rtt=458&rtt_var=737&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3260&recv_bytes=1649&delivery_rate=7144736&cwnd=253&unsent_bytes=0&cid=0e8579de936cd9a3&ts=1028&x=0"
X-Firefox-Spdy: h2
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/kl4ne6w1ln1Sx0R4ISoW1wuxFlgI9Te2vEDggTLYoN7hQh56HaxTKiyybVCdu5qTJVw50w8vzRvfX6sduv220 | 188.114.97.1 | 200 OK | 1.9 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/kl4ne6w1ln1Sx0R4ISoW1wuxFlgI9Te2vEDggTLYoN7hQh56HaxTKiyybVCdu5qTJVw50w8vzRvfX6sduv220 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeSVG Scalable Vector Graphics image Hash4b5c228b4faba433d06ec569ed855b2d a7d3882b93e332460e7c59510a6a811ef011983f eb19d76cd1fad39abf0f2778991883a5cf9ff560117ce8f7c64124e71471b4ed
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /kl4ne6w1ln1Sx0R4ISoW1wuxFlgI9Te2vEDggTLYoN7hQh56HaxTKiyybVCdu5qTJVw50w8vzRvfX6sduv220 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:38 GMT
content-type: image/svg+xml
content-disposition: inline; filename="kl4ne6w1ln1Sx0R4ISoW1wuxFlgI9Te2vEDggTLYoN7hQh56HaxTKiyybVCdu5qTJVw50w8vzRvfX6sduv220"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=in56b79kmVDSeMMM3ZmbhXiNNflSkVuKDyv98CXXDcJj4sEbC%2FF2ntJ4J%2F4JGboda2h7Gaknc9cXUZreLBglM0ChU8oYNcYhosCaUBXwAjbqdwUg%2Fr35wkzeP8yt4A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a75d07b4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1059&min_rtt=1026&rtt_var=309&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2317&delivery_rate=2698974&cwnd=251&unsent_bytes=0&cid=dda084b37d28c33e&ts=126&x=0", cfL4;desc="?proto=QUIC&rtt=928&min_rtt=571&rtt_var=414&sent=858&recv=142&lost=0&retrans=0&sent_bytes=930746&recv_bytes=33386&delivery_rate=1385216&cwnd=230400&unsent_bytes=0&cid=cb977f966ba689a3&ts=13191&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/34RtWPIChxmUBFNXgh0h4R7iXoXnpZP8M67110 | 188.114.97.1 | 200 OK | 4.8 MB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/34RtWPIChxmUBFNXgh0h4R7iXoXnpZP8M67110 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
Size4.8 MB (4756466 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /34RtWPIChxmUBFNXgh0h4R7iXoXnpZP8M67110 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: application/javascript
content-disposition: inline; filename="34RtWPIChxmUBFNXgh0h4R7iXoXnpZP8M67110"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OluFW6xbI8zrUm5wYSMTr1BIyweUoM2zwZ69WAnbEN27mAXg53c15dapHhBsnnLq8gANRU%2B4jSwkw9WWjxOqqvPab%2FIuP08ajoVeHFk%2BY8782WJnArGjPyYWRjKB1g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 911ec3a1eb77b4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1565&rtt_var=444&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2234&delivery_rate=1843411&cwnd=251&unsent_bytes=0&cid=49e787b980a0fda8&ts=87&x=0", cfL4;desc="?proto=QUIC&rtt=1620&min_rtt=869&rtt_var=632&sent=161&recv=55&lost=0&retrans=0&sent_bytes=148986&recv_bytes=26360&delivery_rate=4448449&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12315&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/cbzAc8vEGf4Mww5oKGDtYxhXGHkwgNsH98cTZ7xfCnFAwtf | 188.114.97.1 | 200 OK | 2.8 kB |
URL POST HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/cbzAc8vEGf4Mww5oKGDtYxhXGHkwgNsH98cTZ7xfCnFAwtf IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (2848), with no line terminators Hash30edd40408b51029c5cf835c32db1990 eb9b897447719b5e073c400839ae65153cb56ad4 1748c9c983c310b0e3f1f2e7df53ada32aef4867b015a7607c1f2a28506939ea
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
POST /cbzAc8vEGf4Mww5oKGDtYxhXGHkwgNsH98cTZ7xfCnFAwtf HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 53
Origin: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:38 GMT
content-type: application/json
cache-control: no-cache, private
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IUEoO936iwzY3iMZ2OQhFCmKF04fHTJQh6ae3USQ64OvJoNlnJq5U7LlF5g1cq8tsbeePO1O94yrRnIqn9eHsMdeIJ7HTiACy17beB6SPgBfbYIW0ML53rsB25fw0A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IktGZWhIQ3djVzRaNThtaEQvTFh3anc9PSIsInZhbHVlIjoiUk1jMUh3VU81Szc4SXBMQkEyV0FQN1ZnU1ltbkhES2o3TVlCVE44T1hoY1VPLzl1REUzZkpPRy93TEN5cmYwTWJUWCtQajJhSHIvdXhSMEpWTk9VZFh4SEx1M1l1TFVvb0piMW5idzZLVlRJdHZpZ3RaVEpTaW9MYzNXaGc0WkgiLCJtYWMiOiIzMTkyZTQ2Y2Q3OWMwNTk0OWMyOWYyNmQ3NDQ3NmQ0ZjkwOTRhM2FkMGRkYmE5NjVlMWM3ZDU1ZDM4M2IzMmZlIiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 19:26:38 GMT; Max-Age=7200; path=/; secure; samesite=none
laravel_session=eyJpdiI6IkRibGJxTEx3VWRyM2hrTUxyRWJNdnc9PSIsInZhbHVlIjoiNFMybGpRUkNPK3JYaDlHek5TZVdXVndtQTh6K1V4UXgzSklPSVFFci9rL3ZjRktIVm9hRERCUHg0RklSK1MvWGI3d2Y5Q2kraGhxM08vb0JFcHVKbWhQdU93cFlLbmtIc0tiUU1oMWdaRi8rZll1SXBETlZpTkZUZWJpOU5ySXEiLCJtYWMiOiI0MmE3Mjc0OTk0NTk3MjhkNjRkOGEwNDVkMDJiMzU4MzM0MGIzNDcxMzMwZmM4MzA0N2I4ODRhZjNjNDBhYTY0IiwidGFnIjoiIn0%3D; expires=Fri, 14-Feb-2025 19:26:38 GMT; Max-Age=7200; path=/; secure; httponly; samesite=none
vary: accept-encoding
priority: u=3,i=?0
server: cloudflare
cf-ray: 911ec3a73cd8b4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1279&min_rtt=1264&rtt_var=505&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2494&delivery_rate=2084953&cwnd=251&unsent_bytes=0&cid=c69a742a035187a9&ts=91&x=0", cfL4;desc="?proto=QUIC&rtt=782&min_rtt=571&rtt_var=216&sent=854&recv=140&lost=0&retrans=0&sent_bytes=927840&recv_bytes=33295&delivery_rate=14773123&cwnd=230400&unsent_bytes=0&cid=cb977f966ba689a3&ts=13135&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| get.geojs.io/v1/ip/geo.json | 172.67.70.233 | 200 OK | 336 B |
URL GET HTTP/2get.geojs.io/v1/ip/geo.json IP 172.67.70.233:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectgeojs.io Fingerprint55:74:AA:F3:7A:AF:02:8B:48:DB:6E:73:EB:A1:95:20:EC:13:2D:8E ValidityTue, 31 Dec 2024 05:30:37 GMT - Mon, 31 Mar 2025 06:30:13 GMT
File typetroff or preprocessor input, ASCII text, with very long lines (394), with no line terminators Hashfaefe736aa2fafe1932d03385ba7b34b feeb0e6085bae0febbfcd5374c3bc3e006cf1202 53a8e31409926d4b6c81891f139d29facbece16942c1e997f1c4407131431ad1
GET /v1/ip/geo.json HTTP/1.1
Host: get.geojs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Fri, 14 Feb 2025 17:26:40 GMT
content-type: application/json
x-request-id: 5ca1bf7881252dfb2ab98887aa3a9b2e-ASH
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-origin: *
access-control-allow-methods: GET
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
geojs-backend: ash-01
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fxvswS1LheYpsaUdqlOIdTBfw7lriq%2FWmXe%2FpZNvMZgs94TAejGzdtC61Io9JYHxT9%2FCKlVFvX2WrngXNXaLVlq9iu9kJNqqXIz%2FTyF0tiv%2F03c4SfZyQLUydEponA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
server: cloudflare
cf-ray: 911ec3b3feea56bf-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=550&min_rtt=478&rtt_var=196&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3266&recv_bytes=1322&delivery_rate=7451114&cwnd=251&unsent_bytes=0&cid=81f97f32922886f9&ts=138&x=0"
X-Firefox-Spdy: h2
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/klRsD3hLwpyUTNOvkTeONonm89k3qkVoVwUw4Qm366z2wab230 | 188.114.97.1 | 200 OK | 1.3 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/klRsD3hLwpyUTNOvkTeONonm89k3qkVoVwUw4Qm366z2wab230 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeRIFF (little-endian) data, Web/P image Hash32ca2081553e969f9fdd4374134521ad 7b09924c4c3d8b6e41fe38363e342da098be4173 216fc342a469aa6a005b2eacc24622095e5282d3e9f1ae99ce54c27b92ec3587
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /klRsD3hLwpyUTNOvkTeONonm89k3qkVoVwUw4Qm366z2wab230 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:38 GMT
content-type: image/webp
content-length: 1298
content-disposition: inline; filename="klRsD3hLwpyUTNOvkTeONonm89k3qkVoVwUw4Qm366z2wab230"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Tr3Ze10ydlf%2BpVqSW8QaLcU6moPx%2BBYTpz1xETgsDabgQcZdfulvgpXdZELRUn0FmkKWg3yyrhYbUFk0EIruGBMmRMLLmtN%2Bgwr6eI%2F0LbT9aOXe8JU%2BCi1LRraXA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a76d10b4fd-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1096&min_rtt=1062&rtt_var=358&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2282&delivery_rate=2393388&cwnd=251&unsent_bytes=0&cid=7f980b85e69a60f1&ts=129&x=0", cfL4;desc="?proto=QUIC&rtt=945&min_rtt=571&rtt_var=343&sent=860&recv=143&lost=0&retrans=0&sent_bytes=932342&recv_bytes=33432&delivery_rate=989058&cwnd=230400&unsent_bytes=0&cid=cb977f966ba689a3&ts=13199&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/abuTDYM3uWf0apq35ef30 | 188.114.97.1 | 200 OK | 36 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/abuTDYM3uWf0apq35ef30 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeASCII text, with CRLF line terminators Hash38501e3fbbbd89b56aa5ba35de1a32fe d9b31981b6f834e8480ba28fbc1cff1be772f589 a1ca6b381cb01968851c98512c6e7f6c5309a49f7a16b864813135cbff82a85b
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /abuTDYM3uWf0apq35ef30 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="abuTDYM3uWf0apq35ef30"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0haWZcRN%2B96wbjPyDq9vxVPNb32NOIvlDbhZSqU7CfGfazWn6FsoO9inESPS9Bt5MGc8I%2FsJW6aauqQpDoKXd33hWy%2Fy1d4tbBqJH%2FrsicfZiwvwSK7jcfr6ythdfg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 911ec3a19aceb4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1146&min_rtt=1117&rtt_var=334&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2246&delivery_rate=2485836&cwnd=251&unsent_bytes=0&cid=b99c6f8266ad27f0&ts=78&x=0", cfL4;desc="?proto=QUIC&rtt=1869&min_rtt=986&rtt_var=1025&sent=111&recv=47&lost=0&retrans=0&sent_bytes=94096&recv_bytes=25998&delivery_rate=44263&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12262&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/favicon.ico | 188.114.97.1 | 404 Not Found | 0 B |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/favicon.ico IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IktGZWhIQ3djVzRaNThtaEQvTFh3anc9PSIsInZhbHVlIjoiUk1jMUh3VU81Szc4SXBMQkEyV0FQN1ZnU1ltbkhES2o3TVlCVE44T1hoY1VPLzl1REUzZkpPRy93TEN5cmYwTWJUWCtQajJhSHIvdXhSMEpWTk9VZFh4SEx1M1l1TFVvb0piMW5idzZLVlRJdHZpZ3RaVEpTaW9MYzNXaGc0WkgiLCJtYWMiOiIzMTkyZTQ2Y2Q3OWMwNTk0OWMyOWYyNmQ3NDQ3NmQ0ZjkwOTRhM2FkMGRkYmE5NjVlMWM3ZDU1ZDM4M2IzMmZlIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkRibGJxTEx3VWRyM2hrTUxyRWJNdnc9PSIsInZhbHVlIjoiNFMybGpRUkNPK3JYaDlHek5TZVdXVndtQTh6K1V4UXgzSklPSVFFci9rL3ZjRktIVm9hRERCUHg0RklSK1MvWGI3d2Y5Q2kraGhxM08vb0JFcHVKbWhQdU93cFlLbmtIc0tiUU1oMWdaRi8rZll1SXBETlZpTkZUZWJpOU5ySXEiLCJtYWMiOiI0MmE3Mjc0OTk0NTk3MjhkNjRkOGEwNDVkMDJiMzU4MzM0MGIzNDcxMzMwZmM4MzA0N2I4ODRhZjNjNDBhYTY0IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 404 Not Found
date: Fri, 14 Feb 2025 17:26:38 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lq63i5yMWOooXhnCiQmhsBPWllSEnG2elUwyvtMc5TGGPgHqfbYgJ53rB24%2FPKMmBPzpKeL1wtMlJpwNe0UDVDd%2FNk8n17xcM6hf8DplA4wgXyCc%2BYaUtE1hrn4d1A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 2
priority: u=6,i=?0
server: cloudflare
cf-ray: 911ec3ac0bfbb4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1037&min_rtt=1024&rtt_var=312&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2824&recv_bytes=2192&delivery_rate=2642335&cwnd=249&unsent_bytes=0&cid=1893bf6b6c814709&ts=88&x=0", cfL4;desc="?proto=QUIC&rtt=1019&min_rtt=571&rtt_var=406&sent=863&recv=145&lost=0&retrans=0&sent_bytes=934563&recv_bytes=34466&delivery_rate=440354&cwnd=230400&unsent_bytes=0&cid=cb977f966ba689a3&ts=13776&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/56G1ebWyabxoK26718 | 188.114.97.1 | 200 OK | 27 kB |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/56G1ebWyabxoK26718 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeASCII text, with very long lines (26765), with no line terminators Hash1a862a89d5633fac83d763886726740d e5ce3aa454c992a13fd406a9647d7afbf831051f 5c22fd904edb792331a7307ddf4a790e0d1318924f6d8e7362fa6b55d5ab6fbb
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /56G1ebWyabxoK26718 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline; filename="56G1ebWyabxoK26718"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2nNCWnJC%2BazWPZA74Xdtggchq7Y6koGPzLU5JWMq1RQ0x1IjbKfPKOGRxmH%2FRJzeuGVihDVsc4elc1aAKcznQkj7SJ%2FjagC0x9sjEOjch23N3iiPRiUKcrbF5oLvPw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=2,i=?0
server: cloudflare
cf-ray: 911ec3a19ac0b4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1601&min_rtt=1512&rtt_var=478&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2243&delivery_rate=1782153&cwnd=251&unsent_bytes=0&cid=9f8023ac7c6bd4c5&ts=89&x=0", cfL4;desc="?proto=QUIC&rtt=1942&min_rtt=986&rtt_var=1172&sent=105&recv=46&lost=0&retrans=0&sent_bytes=88197&recv_bytes=25953&delivery_rate=11763402&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12229&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/mnikBWWeN9hECFQqwLe9bnBzuvbcb3W2gewU49TIWZbrJr90150 | 188.114.97.1 | 200 OK | 270 B |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/mnikBWWeN9hECFQqwLe9bnBzuvbcb3W2gewU49TIWZbrJr90150 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeSVG Scalable Vector Graphics image Hash0c09c5ea7c28d6feb4d124957dde0a0d 1b9efde2d8f0e2a3d9d5315117e597c2d622fc5e b3c39d2c15327b7ae68940502a2d7bf457fe521e075e6e671d0340edc58bcb3a
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /mnikBWWeN9hECFQqwLe9bnBzuvbcb3W2gewU49TIWZbrJr90150 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: image/svg+xml
content-disposition: inline; filename="mnikBWWeN9hECFQqwLe9bnBzuvbcb3W2gewU49TIWZbrJr90150"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7w9S%2B5yEc4tvIHSX5WHb%2BpW1zYj9wykPwnmm5Z7JtK1rwep3Y%2BDkK0pph28AkOfaiIUB0IFOp1hKAhesAUR2izknCtcGWGxgM4G82sdUy637X%2BSAqCMTxNh4OHALrA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a1bb24b4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1037&min_rtt=1026&rtt_var=304&sent=4&recv=8&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2283&delivery_rate=2669124&cwnd=251&unsent_bytes=0&cid=6e4fa5dfa0d9facd&ts=104&x=0", cfL4;desc="?proto=QUIC&rtt=1620&min_rtt=869&rtt_var=632&sent=186&recv=55&lost=0&retrans=0&sent_bytes=177786&recv_bytes=26360&delivery_rate=4448449&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12318&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/op7yx5mzcwCT5VcS7GCpVFemaKPMVNLXVvFij7j4El6KS8h9D8BNwomaldUuAWrmcd194 | 188.114.97.1 | 200 OK | 268 B |
URL GET HTTP/3adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/op7yx5mzcwCT5VcS7GCpVFemaKPMVNLXVvFij7j4El6KS8h9D8BNwomaldUuAWrmcd194 IP 188.114.97.1:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerGoogle Trust Services Subjectlumpnk.ru Fingerprint8A:5D:29:76:89:6D:FB:90:14:A3:2F:87:70:15:30:DE:66:1F:44:FB ValidityFri, 17 Jan 2025 17:08:07 GMT - Thu, 17 Apr 2025 18:06:38 GMT
File typeSVG Scalable Vector Graphics image Hash1318aafc1fb9ded0c623e5b9a557e6df 0917cdd7633cd1642b02b2b785416ec7e5106dcc d86660a84daa211b121ec9fe0df83d6b945f61b888384391eabc7d6b4e941dc4
Analyzer | Verdict | Alert | urlquery | phishing | Phishing - Microsoft |
GET /op7yx5mzcwCT5VcS7GCpVFemaKPMVNLXVvFij7j4El6KS8h9D8BNwomaldUuAWrmcd194 HTTP/1.1
Host: adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV
Cookie: XSRF-TOKEN=eyJpdiI6IjhTSXRCckNvam5NK29qS1R2K242bXc9PSIsInZhbHVlIjoiNWVKaEppWnllcnNya2hCV1ZmM21lV1NMWkpadnNYdElKcmV3OStNY2ZwTEFWeVVCQ1JWRktFY3ExNE9JakRteHB5UENSSFQzVkMzZ0dGTldqanJiQlZ3eWFCbk80aFFWVnN3TmlLUjR3NFRiVUZ0RmkvcFBBcDVvWnJnWW5sYnIiLCJtYWMiOiI3ZmY1MDVmOTI2MWIwOGM5N2U1OGFlYzUxNzZhOTY5NmExNzliNTk1ODAwOTY2ODc0NDhlNjMxNzgxYzI0OTdhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVWTlMycXFadHdMSURSdzRrTDVTanc9PSIsInZhbHVlIjoiOHlRNVFoekR4UjFkTEo0U0lCQnNoRkdScDVuZzFTenFOSkRoVjRDSkRGVmkyeWFmeDRUTnlZWUk0U2V3VlMvZk9ZcUJJQ2VIdHczUHR0SXpZWXVhYUMrUWlaREpsNERuVlovTjcwRkJWdDV5ajdubEVDRXMwR0R3dzZCT21XVzIiLCJtYWMiOiI0YTA4MjVjMDY2ZjYxOGZlODRkYTUwNzIyYTlhMTRkYTY2YzU2NGU0YmFiNDQyMTA0YWU5ZTUxNTU4Yzc1OGM2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Fri, 14 Feb 2025 17:26:37 GMT
content-type: image/svg+xml
content-disposition: inline; filename="op7yx5mzcwCT5VcS7GCpVFemaKPMVNLXVvFij7j4El6KS8h9D8BNwomaldUuAWrmcd194"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RLnkYNLLNp7v9JgMpCodY1AlYDmBF3om%2Fs2csdT3uMqQ%2FzTk%2F4KVPp2QVFCvh0Lw64yyLkNyAFskpxmIQX0Z%2F0D1wtnb1qgOp7nbiPp5fd%2BFmmT%2Fg7CTilhaYilMDg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
vary: accept-encoding
priority: u=4,i=?0
server: cloudflare
cf-ray: 911ec3a1cb46b4fd-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1222&min_rtt=1215&rtt_var=470&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=2301&delivery_rate=2276729&cwnd=251&unsent_bytes=0&cid=62ae673f7d815fd7&ts=84&x=0", cfL4;desc="?proto=QUIC&rtt=1655&min_rtt=986&rtt_var=735&sent=122&recv=50&lost=0&retrans=0&sent_bytes=104446&recv_bytes=26133&delivery_rate=1318338&cwnd=28800&unsent_bytes=0&cid=cb977f966ba689a3&ts=12295&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css | 143.204.55.47 | 200 OK | 10 kB |
URL GET HTTP/2ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css IP 143.204.55.47:443
Requested byhttps://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/eptxlofzryloctfhzvxmmserEMD9FU5LZ0OQBFAZCF42?YRMHJFLFWHZV CertificateIssuerDigiCert Inc Subject*.oktacdn.com Fingerprint3E:D7:C7:A6:35:70:74:E4:BF:45:2E:A1:D5:A3:25:88:24:76:B3:B5 ValidityMon, 02 Dec 2024 00:00:00 GMT - Fri, 02 Jan 2026 23:59:59 GMT
File typeASCII text, with very long lines (10450) Hashe0d37a504604ef874bad26435d62011f 4301f0d2b729ae22adece657d79eccaa25f429b1 c39ff65e2a102e644eb0bf2e31d2bad3d18f7afb25b3b9ba7a4d46263a711179
GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1
Host: ok4static.oktacdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://adfs-pm3nf0mwnkjlbo3qyuq8a3iq4rosjiivkunx8cgzvpcflzyenp.lumpnk.ru/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css
server: nginx
last-modified: Thu, 14 Mar 2024 00:03:58 GMT
x-amz-meta-sha1sum: 4301f0d2b729ae22adece657d79eccaa25f429b1
strict-transport-security: max-age=315360000; includeSubDomains
access-control-allow-origin: *
content-encoding: gzip
date: Fri, 31 Jan 2025 02:19:39 GMT
expires: Sat, 31 Jan 2026 02:19:39 GMT
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
etag: W/"e0d37a504604ef874bad26435d62011f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: yRUaZUpzhpIM8O8bbmremZXtiQ1bCYdXRgcHMAq9GNFJBF-M0n7Lbw==
age: 1264018
X-Firefox-Spdy: h2
|
|