Report - secure.adnxs.com/clktrb?id=704169&redir=https://fechfactory.com/8e93ke93j/0op4irki94uj/twd5wz/bmVpbEBrb3J0ZWNoZ3JvdXAuY29t

Report Overview

Visited public
2023-10-17 21:03:06
Tags
phishing microsoft outlook
URL
secure.adnxs.com/clktrb?id=704169&redir=https://fechfactory.com/8e93ke93j/0op4irki94uj/twd5wz/bmVpbEBrb3J0ZWNoZ3JvdXAuY29t
Finishing URL
lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
IP / ASN
185.89.210.212
#29990 ASN-APPNEX
Title
Sign in to your Microsoft account
Phishing - Microsoft Outlook

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
lajg05z8w9s48y1.glfbreak.ru	unknown	2023-09-07	2023-09-16 14:11:04	2023-10-13 18:05:03	27 kB	789 kB	172.67.196.133
ocsp.r2m02.amazontrust.com	unknown	2007-05-11	2022-10-12 16:01:39	2023-10-17 18:12:13	340 B	942 B	54.230.80.227
challenges.cloudflare.com	unknown	2009-02-17	2021-10-20 07:02:03	2023-10-17 18:05:31	3.0 kB	163 kB	104.17.2.184
httpbin.org	352975	2011-06-12	2013-07-23 00:01:27	2023-10-17 17:58:15	488 B	288 B	44.194.147.17
adfs.heart.org	unknown	1995-01-12	2016-10-10 20:42:57	2023-10-17 15:22:19	449 B	6.9 kB	69.152.183.140
secure.adnxs.com	396	2008-05-27	2012-05-22 18:37:37	2023-10-17 18:12:30	1.2 kB	2.1 kB	37.252.171.21
fechfactory.com	unknown	2021-07-25	2021-07-25 17:16:50	2023-08-04 11:23:57	530 B	233 B	162.241.85.82
code.jquery.com	634	2005-12-10	2012-05-21 19:28:02	2023-10-17 18:06:53	423 B	32 kB	151.101.194.137
aadcdn.msftauth.net	1455	2018-10-25	2018-11-19 11:50:32	2023-10-17 18:12:21	1.5 kB	6.1 kB	152.199.23.37
logincdn.msauth.net	2330	2018-10-25	2019-04-23 03:13:28	2023-10-17 18:11:54	511 B	992 B	192.229.221.185
aadcdn.msauth.net	1421	2018-10-25	2018-11-19 11:50:03	2023-10-17 18:12:21	503 B	1.6 kB	13.107.246.53

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (11)

	URL	From	Size	First Seen	Last Seen
	code.jquery.com/jquery-3.6.0.min.js	ScriptElement	90 kB	2023-03-07	2025-05-02
Pretty URL code.jquery.com/jquery-3.6.0.min.js IP 151.101.194.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-02 02:57 Times Seen204078 Hash 8fb8fee4fcc3cc86ff6c724154c49c42 b82d238d4e31fdf618bae8ac11a6c812c03dd0d4 ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Loading...

	unknown	ScriptElement	378 B	2023-10-17	2024-08-21
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-17 18:55 Last Seen2024-08-21 04:21 Times Seen105 Hash e6a9034a724ac91061f0c4f1cbb70387 30c9de812761aed22eb0d4a9951eb873ce0294de 3813fba33e2b366e5ab7f761e225dbd3599f93471a3d323618eb4f2d99a57224 Loading...

	lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages-head-web.min.js?cb=1697576570277	ScriptElement	9.9 kB	2023-10-14	2024-08-21
Pretty URL lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages-head-web.min.js?cb=1697576570277 IP 172.67.196.133 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-14 19:21 Last Seen2024-08-21 04:43 Times Seen485 Hash bbe2872e144a916979cda3aa448ab9f8 4572afa8a6e6196ae14329dca115aa086ecd9791 48de0701a108bf94f6dde5457172a675c7462a310889c99cd38aaceb6961a335 Loading...

	lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages.js?cb=1697576570277	ScriptElement	81 kB	2023-09-27	2024-08-21
Pretty URL lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages.js?cb=1697576570277 IP 172.67.196.133 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-27 21:42 Last Seen2024-08-21 05:39 Times Seen3172 Hash 218f006287340a5c13cc18e43123292c e29a4767c1731f4f3ec266abe1ce800a48605894 72a12d7ce5530539f1f3d2b6865bc856d9b8853871ea165beec2acbd92e71ab6 Loading...

	lajg05z8w9s48y1.glfbreak.ru/myscr185725.js	ScriptElement	28 kB	2023-10-17	2023-10-23
Pretty URL lajg05z8w9s48y1.glfbreak.ru/myscr185725.js IP 172.67.196.133 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-17 18:55 Last Seen2023-10-23 01:36 Times Seen105 Hash 9d43fe357b2d89a7333ba2bc0a4c8e83 9c519b82f3bcd30f3c3ce60388a43dc4573f3cf1 67761952aeeb0249976f552d3a5809df787f47cf81a88dac35c7b46fcf941c7c Loading...

	lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages-head-top-web.min.js?cb=1697576569497	ScriptElement	2.2 kB	2023-09-28	2023-10-20
Pretty URL lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages-head-top-web.min.js?cb=1697576569497 IP 172.67.196.133 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-28 13:43 Last Seen2023-10-20 16:08 Times Seen619 Hash e42b0b9254061811676a22578e4d055d fd459de096e2b18300811fd1f8fda9019497ea31 dc271387f5db4616829bfa389052d86f8b6a04ac2059cca774c434535a66f9e5 Loading...

	challenges.cloudflare.com/turnstile/v0/api.js?render=explicit	ScriptElement	34 kB	2023-10-12	2023-10-24
Pretty URL challenges.cloudflare.com/turnstile/v0/api.js?render=explicit IP 104.17.2.184 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-12 19:01 Last Seen2023-10-24 16:16 Times Seen7437 Hash a65b6a0168a66b4f0db4dd65c60d8e3a fe403c2a8c9ce0f11185940892ad3479c3355c93 7e0b26f08c9a0d0a70e887541e8165472579233b92950835dd2bdde9963d1b8a Loading...

		Size	First Seen	Last Seen
	#1 Eval - 9e925e9341b490bfd3b4c4ca3b0c1ef2	4 B	2023-03-07 01:03	2025-05-02 02:57
Pretty Observations First Seen2023-03-07 01:03 Last Seen2025-05-02 02:57 Times Seen367694 Hash 9e925e9341b490bfd3b4c4ca3b0c1ef2 c2543fff3bfa6f144c2f06a7de6cd10c0b650cae 1eb79602411ef02cf6fe117897015fff89f80face4eccd50425c45149b148408 Loading...

		Size	First Seen	Last Seen
	#1 Write - e81199c8f011ea55bd1993f56d057ecf	3.6 kB	2023-10-12 19:01	2024-08-21 04:58
Pretty Observations First Seen2023-10-12 19:01 Last Seen2024-08-21 04:58 Times Seen14250 Hash e81199c8f011ea55bd1993f56d057ecf 94d8d4eca02b39294321ccb082fcd9a3e8c6a3c5 be3ce6b53b4c0030ff52fe4528fc2df52ca66931b5282b24b9b3a4823c0455c2 Loading...

	#2 Write - 14bba03df5e35366257685bc76e37c0a	4.8 kB	2023-10-17 18:55	2024-08-21 04:21
Pretty Observations First Seen2023-10-17 18:55 Last Seen2024-08-21 04:21 Times Seen105 Hash 14bba03df5e35366257685bc76e37c0a edee64eeee3f6b1297e846ac6c4475e82915a661 d2e7e5ad987a36659ae1afa7b62b0b59bba7c22b5656b631e267ae510d530faf Loading...

	#3 Write - 086707e4369f60afedcafb16050a7618	39 B	2023-03-07 01:03	2025-05-02 02:57
Pretty Observations First Seen2023-03-07 01:03 Last Seen2025-05-02 02:57 Times Seen56400 Hash 086707e4369f60afedcafb16050a7618 8216b0cc6876cbd44f01c158e7dff3833ceccd41 a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e Loading...

HTTP Transactions (49)

URL IP Response Size

secure.adnxs.com/clktrb?id=704169&redir=https://fechfactory.com/8e93ke93j/0op4irki94uj/twd5wz/bmVpbEBrb3J0ZWNoZ3JvdXAuY29t

37.252.171.21

0 B

URL
secure.adnxs.com/clktrb?id=704169&redir=https://fechfactory.com/8e93ke93j/0op4irki94uj/twd5wz/bmVpbEBrb3J0ZWNoZ3JvdXAuY29t
IP
37.252.171.21:0
ASN
#29990 ASN-APPNEX

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /clktrb?id=704169&redir=https://fechfactory.com/8e93ke93j/0op4irki94uj/twd5wz/bmVpbEBrb3J0ZWNoZ3JvdXAuY29t HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 307 Temporary Redirect
server: nginx/1.23.4
date: Tue, 17 Oct 2023 21:02:47 GMT
content-type: text/html; charset=utf-8
content-length: 0
cache-control: no-store, no-cache, private
pragma: no-cache
expires: Sat, 15 Nov 2008 16:00:00 GMT
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
x-xss-protection: 0
access-control-allow-credentials: true
access-control-allow-origin: *
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
location: https://secure.adnxs.com/bounce?%2Fclktrb%3Fid%3D704169%26redir%3Dhttps%3A%2F%2Ffechfactory.com%2F8e93ke93j%2F0op4irki94uj%2Ftwd5wz%2FbmVpbEBrb3J0ZWNoZ3JvdXAuY29t
an-x-request-uuid: 5a2e1172-6e59-4085-ac0e-97e7906e2786
set-cookie: uuid2=6038531786067213645; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 15-Jan-2024 21:02:47 GMT; Domain=.adnxs.com; Secure; HttpOnly
x-proxy-origin: 91.90.42.154; 91.90.42.154; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-Firefox-Spdy: h2

secure.adnxs.com/bounce?%2Fclktrb%3Fid%3D704169%26redir%3Dhttps%3A%2F%2Ffechfactory.com%2F8e93ke93j%2F0op4irki94uj%2Ftwd5wz%2FbmVpbEBrb3J0ZWNoZ3JvdXAuY29t

37.252.171.21

0 B

URL
secure.adnxs.com/bounce?%2Fclktrb%3Fid%3D704169%26redir%3Dhttps%3A%2F%2Ffechfactory.com%2F8e93ke93j%2F0op4irki94uj%2Ftwd5wz%2FbmVpbEBrb3J0ZWNoZ3JvdXAuY29t
IP
37.252.171.21:0
ASN
#29990 ASN-APPNEX

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /bounce?%2Fclktrb%3Fid%3D704169%26redir%3Dhttps%3A%2F%2Ffechfactory.com%2F8e93ke93j%2F0op4irki94uj%2Ftwd5wz%2FbmVpbEBrb3J0ZWNoZ3JvdXAuY29t HTTP/1.1
Host: secure.adnxs.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: uuid2=6038531786067213645
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
server: nginx/1.23.4
date: Tue, 17 Oct 2023 21:02:47 GMT
content-type: text/html; charset=utf-8
content-length: 0
cache-control: no-store, no-cache, private
pragma: no-cache
expires: Sat, 15 Nov 2008 16:00:00 GMT
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
x-xss-protection: 0
access-control-allow-credentials: true
access-control-allow-origin: *
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
location: https://fechfactory.com/8e93ke93j/0op4irki94uj/twd5wz/bmVpbEBrb3J0ZWNoZ3JvdXAuY29t
an-x-request-uuid: 93c3d6ce-bcef-4578-b0fe-47dcade76673
set-cookie: uuid2=6038531786067213645; SameSite=None; Path=/; Max-Age=7776000; Expires=Mon, 15-Jan-2024 21:02:47 GMT; Domain=.adnxs.com; Secure; HttpOnly
x-proxy-origin: 91.90.42.154; 91.90.42.154; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-Firefox-Spdy: h2

fechfactory.com/8e93ke93j/0op4irki94uj/twd5wz/bmVpbEBrb3J0ZWNoZ3JvdXAuY29t

162.241.85.82

0 B

URL
fechfactory.com/8e93ke93j/0op4irki94uj/twd5wz/bmVpbEBrb3J0ZWNoZ3JvdXAuY29t
IP
162.241.85.82:0
ASN
#46606 UNIFIEDLAYER-AS-1

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /8e93ke93j/0op4irki94uj/twd5wz/bmVpbEBrb3J0ZWNoZ3JvdXAuY29t HTTP/1.1
Host: fechfactory.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
refresh: 0;url=https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 17 Oct 2023 21:02:47 GMT
server: Apache
X-Firefox-Spdy: h2

code.jquery.com/jquery-3.6.0.min.js

151.101.194.137

200 OK

31 kB

URL GET HTTP/2
code.jquery.com/jquery-3.6.0.min.js
IP
151.101.194.137:443
ASN
#54113 FASTLY

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (65447)
Size
31 kB (30875 bytes)
Hash
8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

HTTP Headers

GET /jquery-3.6.0.min.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-15d9d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Tue, 17 Oct 2023 21:02:48 GMT
age: 2338469
x-served-by: cache-lga21931-LGA, cache-bma1624-BMA
x-cache: HIT, HIT
x-cache-hits: 30, 490466
x-timer: S1697576569.711680,VS0,VE0
vary: Accept-Encoding
content-length: 30875
X-Firefox-Spdy: h2

lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-bold.woff2

172.67.196.133

200 OK

28 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-bold.woff2
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28000, version 1.66\012- data
Size
28 kB (28000 bytes)
Hash
a4bca6c95fed0d0c5cc46cf07710dcec
73b56e33b82b42921db8702a33efd0f2b2ec9794
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f

HTTP Headers

GET /web1/assets/fonts/GDSherpa-bold.woff2 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:49 GMT
content-type: font/woff2
content-length: 28000
last-modified: Fri, 25 Aug 2023 04:00:16 GMT
etag: "6d60-603b761e42cdb"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 194
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6WYDiT5G9jFLbVnJO9CSq%2BxP8SRDMup35WET24MsraUCjEG5aKtZ60pISSZMlKHd%2B0bVY3XveFKTZYnZyGAnC8LsTn8ag4kQMmxbZL4OULwovUF3nMlfP9xO6uVblyVJOuoxprs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c1848c1b509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-bold.woff

172.67.196.133

200 OK

36 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-bold.woff
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
Web Open Font Format, TrueType, length 35970, version 1.0\012- data
Size
36 kB (35970 bytes)
Hash
496b7bbde91c7dc7cf9bbabbb3921da8
2bd3c406a715ab52dad84c803c55bf4a6e66a924
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

HTTP Headers

GET /web1/assets/fonts/GDSherpa-bold.woff HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:49 GMT
content-type: font/woff
content-length: 35970
last-modified: Fri, 25 Aug 2023 04:00:22 GMT
etag: "8c82-603b7623b006b"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KKaN06VopW1H2y6KN0swoWsZZb70LDKDujlBLyasMC108U54bDepw0AL91kGvvxzQevAb%2FtbxiyWBk4MbJeWZwFjmZMFKdD6e6ZP%2FnolTk1roTzQLSXRuUDWgC4uacQNhjAo%2FY0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 194
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c1848c6b509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-regular.woff2

172.67.196.133

200 OK

29 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-regular.woff2
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
Web Open Font Format (Version 2), TrueType, length 28584, version 1.66\012- data
Size
29 kB (28584 bytes)
Hash
17081510f3a6f2f619ec8c6f244523c7
87f34b2a1532c50f2a424c345d03fe028db35635
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

HTTP Headers

GET /web1/assets/fonts/GDSherpa-regular.woff2 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:49 GMT
content-type: font/woff2
content-length: 28584
last-modified: Fri, 25 Aug 2023 04:00:25 GMT
etag: "6fa8-603b76269b664"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TQ1z3NroNA9qbxvBMzq9rkh6d9R0siEqpDNqWBbi52G1S8sbPh0YwZFh4yQ26QrZEAd6Nv4%2BA4ooxPHoV6LMS9s8g5py2VcaDf0bPvaqEbkol9rmMteuj%2FzXyr%2BDJWJWL0xPE5Y%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 194
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c1848c8b509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-regular.woff

172.67.196.133

200 OK

37 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-regular.woff
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
Web Open Font Format, TrueType, length 36696, version 1.0\012- data
Size
37 kB (36696 bytes)
Hash
a69e9ab8afdd7486ec0749c551051ff2
c34e6aa327b536fb48d1fe03577a47c7ee2231b8
fd78a1913db912221b8ead1e62fad47d1ff0a9fa6cd88d3b128a721ad91d2faf

HTTP Headers

GET /web1/assets/fonts/GDSherpa-regular.woff HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:49 GMT
content-type: font/woff
content-length: 36696
last-modified: Fri, 25 Aug 2023 04:00:28 GMT
etag: "8f58-603b762947b93"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tQRGgd5puH6RKUtkf%2FLr0wCpRTk4ASruhACIRMnRou2uOnE0iTbkP6RNYB8w6A92OvsrobEfnOEaOEoEvY9lrDbIWr3r5n%2FZ6DO9CeZksE%2BeLk6%2BIL9SbMt643t7bUlIYdGr%2Bws%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 194
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c1858cdb509-OSL

lajg05z8w9s48y1.glfbreak.ru/updonp4w44n

172.67.196.133

44 kB

URL
lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
IP
172.67.196.133:0
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
HTML document text\012- HTML document, ASCII text
Size
44 kB (43673 bytes)
Hash
b36797f85cf1cc9155d90a5cd3660a6c
e6e597713d4512a4b21068e1738594fb2becb35a
b58e747c6e303ad30de9fd0558f0464fc7a2d91e5502d883e4d71d1b43b272ce

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /updonp4w44n HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 17 Oct 2023 21:02:48 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TeaHWZkncuA4iqcALWCt5rjb2UnP2%2BumMuG7UnY%2BYflpu019Jjfrsg5Bb4o8KXjHYn2d0f8KaCm2n8nAs3cBQfQJE%2BWY0gFAy8mY3ea%2FJsM1dliGNWNl9H0WBZ8FEFPmlG9xl1QH%2FIqSvx6L3wQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 817b7c0faa450b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-vf2.woff2

172.67.196.133

200 OK

93 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-vf2.woff2
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
Web Open Font Format (Version 2), TrueType, length 93276, version 1.0\012- data
Size
93 kB (93276 bytes)
Hash
bcd7983ea5aa57c55f6758b4977983cb
ef3a009e205229e07fb0ec8569e669b11c378ef1
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

HTTP Headers

GET /web1/assets/fonts/GDSherpa-vf2.woff2 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:49 GMT
content-type: font/woff2
content-length: 93276
last-modified: Fri, 25 Aug 2023 04:00:32 GMT
etag: "16c5c-603b762dd727e"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9aYJLY4SUwx1Ibd8Wc52eDRqHznpiEi2u8lWsi%2FebqjLPlNRj1uxH%2BdkUzWYaQTCedXLVVxbJyBnXuFc8EtnHS%2BhWpqrK6mf7A0x1MmcWWcab2iJnkIuSBX6MEZq1nZzW76w67s%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 194
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c1858d1b509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/css/pages-okta.css?cb=1697576570277

172.67.196.133

200 OK

0 B

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/css/pages-okta.css?cb=1697576570277
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /web1/assets/css/pages-okta.css?cb=1697576570277 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:50 GMT
content-type: text/css
content-length: 0
last-modified: Thu, 24 Aug 2023 12:07:13 GMT
etag: "0-603aa11867866"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O2V1ToI2FKeTZNhb0FB5lUNMEgQV5vfZIz7bjTMBumNHsBuXPrvypQ1DjEbyqWb43IjoYCyeUQ0%2F1Rob4ZDxLeSf%2Fj5pph8cSbcfIhtIieMIJs5Khy5t9WzeyvFKm4edsB4USo4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c1818a3b509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/back.png

172.67.196.133

200 OK

231 B

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/back.png
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size
231 B (231 bytes)
Hash
547988bac5584b4608466d761e16f370
c11bb71049702528402a31027f200184910a7e23
70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4

HTTP Headers

GET /web1/assets/back.png HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6IlB4NkhMT29kSG5MZjFxMTdzOGgzN2c9PSIsInZhbHVlIjoiZkZkRWplcnZ4cVZ3Tzc3VWNFM2V3Ny80YWZOUkFERGhYY2xZelIraktMWGg2Sno2R2Y1bjVLQUl3YVA0Rmg4eGt6Tzl2eTlUU3pRb05iVHl3T1drNENrMGpBZnlObXU4eHRnOTJ4VjBHd24wOVNaNERjcDFMQXhmUGxMNzgwZkQiLCJtYWMiOiI2YThiNWJkMGViMDQ5ODM1ZmRjYTI5MDZhNzZhMmFhNTliZDY0MGVlMjdiNzk5NjZkNTZhZDZjM2Y5NDNiNzE0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlBRUTZidU9zNzBwVjAwaTJKZjFEQ2c9PSIsInZhbHVlIjoiT29RS3d3VGZBc3hteGVwVGhFSnVoMENBakpXazFFWjMyUnNaNWpMcE1LTGoyMXRqcDcrVWhhL2t1NVFDOEhyOW9PMVAwektvYnp3Z0NadU0wK2Rwdis3YStMU1FxSFg0UDE5RmhKODJVTzdvZ0Jvb1lIaXo4dkd6ajdQUFNjMHciLCJtYWMiOiI4N2VhZDU2NDA3YjQ5ODE2OGQzZDkwZjc5OWFiNmI2NDgyY2YzM2QzYWE0MjM0NDk2NGM4NzlmZGZmZjQwZjUwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:54 GMT
content-type: image/png
content-length: 231
last-modified: Sun, 19 Mar 2023 15:20:17 GMT
etag: "e7-5f7425905ae40"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZYNmy0T5ZLyDMNjiEXFIwP7XDBZmcvPMIuGd2Q3JcHX%2BmmOZbZ8jTIDIL0G0aTiu5olHtzf9Rwkm3tpcF93oC4hYlDXMiRrRa9J3mAkY5b%2BsEdKRmmuGXc6moQEAAlfHJW588%2FQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 194
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c38d9e0b509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/key.png

172.67.196.133

200 OK

727 B

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/key.png
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced\012- data
Size
727 B (727 bytes)
Hash
839cb0f55c3d2d5c2f740bda95cb2878
93f6fa3a2da8b7184d4b5c5f2065872793370c2e
40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652

HTTP Headers

GET /web1/assets/key.png HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6IlB4NkhMT29kSG5MZjFxMTdzOGgzN2c9PSIsInZhbHVlIjoiZkZkRWplcnZ4cVZ3Tzc3VWNFM2V3Ny80YWZOUkFERGhYY2xZelIraktMWGg2Sno2R2Y1bjVLQUl3YVA0Rmg4eGt6Tzl2eTlUU3pRb05iVHl3T1drNENrMGpBZnlObXU4eHRnOTJ4VjBHd24wOVNaNERjcDFMQXhmUGxMNzgwZkQiLCJtYWMiOiI2YThiNWJkMGViMDQ5ODM1ZmRjYTI5MDZhNzZhMmFhNTliZDY0MGVlMjdiNzk5NjZkNTZhZDZjM2Y5NDNiNzE0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlBRUTZidU9zNzBwVjAwaTJKZjFEQ2c9PSIsInZhbHVlIjoiT29RS3d3VGZBc3hteGVwVGhFSnVoMENBakpXazFFWjMyUnNaNWpMcE1LTGoyMXRqcDcrVWhhL2t1NVFDOEhyOW9PMVAwektvYnp3Z0NadU0wK2Rwdis3YStMU1FxSFg0UDE5RmhKODJVTzdvZ0Jvb1lIaXo4dkd6ajdQUFNjMHciLCJtYWMiOiI4N2VhZDU2NDA3YjQ5ODE2OGQzZDkwZjc5OWFiNmI2NDgyY2YzM2QzYWE0MjM0NDk2NGM4NzlmZGZmZjQwZjUwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:54 GMT
content-type: image/png
content-length: 727
last-modified: Sun, 19 Mar 2023 15:20:17 GMT
etag: "2d7-5f7425905ae40"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
age: 194
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wIdw1BZbvb%2BGSE9QU8%2Fs2kE4xhZHezq0QRZsIt%2BJOAt31zLqG%2BB1kT5TkttDE%2Fx0iPJdFWj6HhKZ3EM0jRjLe0FszqKbyWwG6cDJyXWzvu4GLV4G%2FrRSldTKzFf62mwE3myMqto%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c38e9e6b509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/godaddy-logo.png

172.67.196.133

200 OK

50 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/godaddy-logo.png
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced\012- data
Size
50 kB (49602 bytes)
Hash
db783743cd246ff4d77f4a3694285989
b9466716904457641b7831868b47162d8d378d41
5913b1ec0fc58ab2bec576804b9e9b566a584ea3d21a1bf74a7b40051a447fdc

HTTP Headers

GET /web1/assets/godaddy-logo.png HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6IlB4NkhMT29kSG5MZjFxMTdzOGgzN2c9PSIsInZhbHVlIjoiZkZkRWplcnZ4cVZ3Tzc3VWNFM2V3Ny80YWZOUkFERGhYY2xZelIraktMWGg2Sno2R2Y1bjVLQUl3YVA0Rmg4eGt6Tzl2eTlUU3pRb05iVHl3T1drNENrMGpBZnlObXU4eHRnOTJ4VjBHd24wOVNaNERjcDFMQXhmUGxMNzgwZkQiLCJtYWMiOiI2YThiNWJkMGViMDQ5ODM1ZmRjYTI5MDZhNzZhMmFhNTliZDY0MGVlMjdiNzk5NjZkNTZhZDZjM2Y5NDNiNzE0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlBRUTZidU9zNzBwVjAwaTJKZjFEQ2c9PSIsInZhbHVlIjoiT29RS3d3VGZBc3hteGVwVGhFSnVoMENBakpXazFFWjMyUnNaNWpMcE1LTGoyMXRqcDcrVWhhL2t1NVFDOEhyOW9PMVAwektvYnp3Z0NadU0wK2Rwdis3YStMU1FxSFg0UDE5RmhKODJVTzdvZ0Jvb1lIaXo4dkd6ajdQUFNjMHciLCJtYWMiOiI4N2VhZDU2NDA3YjQ5ODE2OGQzZDkwZjc5OWFiNmI2NDgyY2YzM2QzYWE0MjM0NDk2NGM4NzlmZGZmZjQwZjUwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:54 GMT
content-type: image/png
content-length: 49602
last-modified: Thu, 24 Aug 2023 13:40:53 GMT
etag: "c1c2-603ab607e0f57"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ob1h3ijHMCiJ0xbyGtUtkR7CA5gBr4IH0yF3ySkQY%2F1ZDSCTcKOD5GgJfY0RbRPGFaRZv0VwA3p7X073dBaVTF59RNDw9My0DmMstv3Q7zfiHG%2BzGVIrRGAZPH20ipk8yHKGX3M%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 194
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c38f9f5b509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/godaddy-left.png

172.67.196.133

200 OK

30 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/godaddy-left.png
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced\012- data
Size
30 kB (29796 bytes)
Hash
210433a8774859368f3a7b86d125a2a7
408bacddc39f12cad285579c102fe4a629862d88
9c6addfc339ce1c1d262290ab4cc2de8d38d4b54b11a8e85afd44fbb0acc2561

HTTP Headers

GET /web1/assets/godaddy-left.png HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6IlB4NkhMT29kSG5MZjFxMTdzOGgzN2c9PSIsInZhbHVlIjoiZkZkRWplcnZ4cVZ3Tzc3VWNFM2V3Ny80YWZOUkFERGhYY2xZelIraktMWGg2Sno2R2Y1bjVLQUl3YVA0Rmg4eGt6Tzl2eTlUU3pRb05iVHl3T1drNENrMGpBZnlObXU4eHRnOTJ4VjBHd24wOVNaNERjcDFMQXhmUGxMNzgwZkQiLCJtYWMiOiI2YThiNWJkMGViMDQ5ODM1ZmRjYTI5MDZhNzZhMmFhNTliZDY0MGVlMjdiNzk5NjZkNTZhZDZjM2Y5NDNiNzE0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlBRUTZidU9zNzBwVjAwaTJKZjFEQ2c9PSIsInZhbHVlIjoiT29RS3d3VGZBc3hteGVwVGhFSnVoMENBakpXazFFWjMyUnNaNWpMcE1LTGoyMXRqcDcrVWhhL2t1NVFDOEhyOW9PMVAwektvYnp3Z0NadU0wK2Rwdis3YStMU1FxSFg0UDE5RmhKODJVTzdvZ0Jvb1lIaXo4dkd6ajdQUFNjMHciLCJtYWMiOiI4N2VhZDU2NDA3YjQ5ODE2OGQzZDkwZjc5OWFiNmI2NDgyY2YzM2QzYWE0MjM0NDk2NGM4NzlmZGZmZjQwZjUwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:54 GMT
content-type: image/png
content-length: 29796
last-modified: Thu, 24 Aug 2023 14:10:07 GMT
etag: "7464-603abc9079d32"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pTfdrLLxWCTSZIk8z%2FDvEpQeIPlmmrR7lFXpSxFJVQbgN3u1tG1lkTR0PrbEvCOK%2BQuVuEFlSaS%2Bs21evEPP%2BWlDeqKlXwZiGot1Qalc6%2FnLCVy8I%2FkflLuQyussFOJlLiPcLvI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 194
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c38f9f7b509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/godaddy-microsoftlogo.png

172.67.196.133

200 OK

71 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/godaddy-microsoftlogo.png
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced\012- data
Size
71 kB (70712 bytes)
Hash
f70ff06d19498d80b130ec78176fd3ff
9d8a3b74c5164ff7ae2c7930b6d7b14707b404fc
df6dbab5251e56b405e48aaf57d3cd4188f073ffba71131fa6cd26e6742923ae

HTTP Headers

GET /web1/assets/godaddy-microsoftlogo.png HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6IlB4NkhMT29kSG5MZjFxMTdzOGgzN2c9PSIsInZhbHVlIjoiZkZkRWplcnZ4cVZ3Tzc3VWNFM2V3Ny80YWZOUkFERGhYY2xZelIraktMWGg2Sno2R2Y1bjVLQUl3YVA0Rmg4eGt6Tzl2eTlUU3pRb05iVHl3T1drNENrMGpBZnlObXU4eHRnOTJ4VjBHd24wOVNaNERjcDFMQXhmUGxMNzgwZkQiLCJtYWMiOiI2YThiNWJkMGViMDQ5ODM1ZmRjYTI5MDZhNzZhMmFhNTliZDY0MGVlMjdiNzk5NjZkNTZhZDZjM2Y5NDNiNzE0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlBRUTZidU9zNzBwVjAwaTJKZjFEQ2c9PSIsInZhbHVlIjoiT29RS3d3VGZBc3hteGVwVGhFSnVoMENBakpXazFFWjMyUnNaNWpMcE1LTGoyMXRqcDcrVWhhL2t1NVFDOEhyOW9PMVAwektvYnp3Z0NadU0wK2Rwdis3YStMU1FxSFg0UDE5RmhKODJVTzdvZ0Jvb1lIaXo4dkd6ajdQUFNjMHciLCJtYWMiOiI4N2VhZDU2NDA3YjQ5ODE2OGQzZDkwZjc5OWFiNmI2NDgyY2YzM2QzYWE0MjM0NDk2NGM4NzlmZGZmZjQwZjUwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:54 GMT
content-type: image/png
content-length: 70712
last-modified: Thu, 24 Aug 2023 12:58:17 GMT
etag: "11438-603aac821e121"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5jGWJpUAKNH7g5RDktrni%2B4l6RJXxnrQaxoEiqygHcKkfDFLioGm7idULWcvooE8SQuPjNcaSCjSiezIooalPe7sgxuACpmsl23sfFDZBVf72qKHOHU1Q%2B6SiIMBrtfUuikhPE4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 194
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c394a48b509-OSL

aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg

152.199.23.37

200 OK

2.4 kB

URL GET HTTP/2
aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (4714), with CRLF line terminators
Size
2.4 kB (2407 bytes)
Hash
b59c16ca9bf156438a8a96d45e33db64
4e51b7d3477414b220f688adabd76d3ae6472ee3
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8

HTTP Headers

GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 11977271
cache-control: public, max-age=31536000
content-md5: nTculR1Fom7eLci0F6rk+A==
content-type: image/svg+xml
date: Tue, 17 Oct 2023 21:02:54 GMT
etag: 0x8DB5C3F4ADC079A
last-modified: Wed, 24 May 2023 10:11:51 GMT
server: ECAcc (ska/F7B6)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 9d35d246-701e-009b-604e-944da7000000
x-ms-version: 2009-09-19
content-length: 2407
X-Firefox-Spdy: h2

aadcdn.msftauth.net/shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg

152.199.23.37

200 OK

190 B

URL GET HTTP/2
aadcdn.msftauth.net/shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with no line terminators
Size
190 B (190 bytes)
Hash
40eb39126300b56bf66c20ee75b54093
83678d94097257eb474713dec49e8094f49d2e2a
765709425a5b9209e875dccf2217d3161429d2d48159fc1df7b253b77c1574f4

HTTP Headers

GET /shared/1.0/content/images/close_790189870c9543725dc3f5a15fb25e46.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 11970807
cache-control: public, max-age=31536000
content-md5: rp+/fadJKxLUo+jgFmYTeQ==
content-type: image/svg+xml
date: Tue, 17 Oct 2023 21:02:54 GMT
etag: 0x8DB5C3F4721247A
last-modified: Wed, 24 May 2023 10:11:44 GMT
server: ECAcc (ska/F697)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: cf4cbdca-101e-0042-0c5d-942f4a000000
x-ms-version: 2009-09-19
content-length: 190
X-Firefox-Spdy: h2

aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg

152.199.23.37

200 OK

1.2 kB

URL GET HTTP/2
aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint99:06:D8:1E:EC:BF:DB:78:DF:F4:89:A3:ED:23:07:3D:79:F1:16:D6
ValidityTue, 31 Jan 2023 00:00:00 GMT - Wed, 31 Jan 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with very long lines (2905), with no line terminators
Size
1.2 kB (1173 bytes)
Hash
fe87496cc7a44412f7893a72099c120a
a0c1458c08a815df63d3cb0406d60be6607ca699
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1

HTTP Headers

GET /shared/1.0/content/images/picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 11408466
cache-control: public, max-age=31536000
content-md5: XHrPYKKsqlxUvysuxtSE2A==
content-type: image/svg+xml
date: Tue, 17 Oct 2023 21:02:54 GMT
etag: 0x8DB5C3F4A98E9BB
last-modified: Wed, 24 May 2023 10:11:50 GMT
server: ECAcc (ska/F6F3)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 3afb7c4b-e01e-0039-1e7a-99c6de000000
x-ms-version: 2009-09-19
content-length: 1173
X-Firefox-Spdy: h2

logincdn.msauth.net/shared/1.0/content/images/picker_verify_email_958962caa7cf6b75cd412e9e3b687b22.svg

192.229.221.185

200 OK

212 B

URL GET HTTP/2
logincdn.msauth.net/shared/1.0/content/images/picker_verify_email_958962caa7cf6b75cd412e9e3b687b22.svg
IP
192.229.221.185:443
ASN
#15133 EDGECAST

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerMicrosoft Corporation
Subjectidentitycdn.msauth.net
Fingerprint7E:49:E0:7F:53:0A:55:E1:C7:51:9E:26:2E:16:15:30:F1:F6:FB:0A
ValidityThu, 10 Aug 2023 19:09:28 GMT - Thu, 27 Jun 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- HTML document, ASCII text, with no line terminators
Size
212 B (212 bytes)
Hash
59759b80e24a89c8cd029b14700e646d
651b1921c99e143d3c242de3faacfb9ad51dbb53
b02b5df3ecd59d6cd90c60878683477532cbfc24660028657f290bdc7bc774b5

HTTP Headers

GET /shared/1.0/content/images/picker_verify_email_958962caa7cf6b75cd412e9e3b687b22.svg HTTP/1.1
Host: logincdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 11412000
cache-control: public, max-age=31536000
content-md5: pFQUXilUkzYtIbvSwGgVBQ==
content-type: image/svg+xml
date: Tue, 17 Oct 2023 21:02:54 GMT
etag: 0x8DB5C409F549E50
last-modified: Wed, 24 May 2023 10:21:22 GMT
server: ECAcc (ska/F7AD)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: e6e3cc87-601e-0079-1c72-993a7c000000
x-ms-version: 2009-09-19
content-length: 212
X-Firefox-Spdy: h2

lajg05z8w9s48y1.glfbreak.ru/web1/assets/officelogo.png

172.67.196.133

200 OK

1.4 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/officelogo.png
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced\012- data
Size
1.4 kB (1400 bytes)
Hash
333ee830e5ab72c41dd9126a27b4d878
12d8d66ebb3076f3d6069e133c3212f97c8774e1
8702292cbc365e9f0488143e2b309b85efe09c61fd2e0a2e21c53735a309313c

HTTP Headers

GET /web1/assets/officelogo.png HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/web1/assets/pages/ul8ez297rtg.css?cb=1697576570277
Cookie: XSRF-TOKEN=eyJpdiI6IlB4NkhMT29kSG5MZjFxMTdzOGgzN2c9PSIsInZhbHVlIjoiZkZkRWplcnZ4cVZ3Tzc3VWNFM2V3Ny80YWZOUkFERGhYY2xZelIraktMWGg2Sno2R2Y1bjVLQUl3YVA0Rmg4eGt6Tzl2eTlUU3pRb05iVHl3T1drNENrMGpBZnlObXU4eHRnOTJ4VjBHd24wOVNaNERjcDFMQXhmUGxMNzgwZkQiLCJtYWMiOiI2YThiNWJkMGViMDQ5ODM1ZmRjYTI5MDZhNzZhMmFhNTliZDY0MGVlMjdiNzk5NjZkNTZhZDZjM2Y5NDNiNzE0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlBRUTZidU9zNzBwVjAwaTJKZjFEQ2c9PSIsInZhbHVlIjoiT29RS3d3VGZBc3hteGVwVGhFSnVoMENBakpXazFFWjMyUnNaNWpMcE1LTGoyMXRqcDcrVWhhL2t1NVFDOEhyOW9PMVAwektvYnp3Z0NadU0wK2Rwdis3YStMU1FxSFg0UDE5RmhKODJVTzdvZ0Jvb1lIaXo4dkd6ajdQUFNjMHciLCJtYWMiOiI4N2VhZDU2NDA3YjQ5ODE2OGQzZDkwZjc5OWFiNmI2NDgyY2YzM2QzYWE0MjM0NDk2NGM4NzlmZGZmZjQwZjUwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:55 GMT
content-type: image/png
content-length: 1400
last-modified: Sun, 19 Mar 2023 15:20:17 GMT
etag: "578-5f7425905ae40"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dIf%2FONIDMLjKcizxeRHr2T8%2FjWgSjzSuehypNBW1ErYUob7nA6Q97nbqF%2BW1y%2BX2rZpNyazNWyrhQ7o02l3WVf2GWWLqizZ9OfNrNoAz7nusydZ68mmGj7RFld20%2B%2Bx7XT6vq5U%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
age: 195
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c39cab2b509-OSL

aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg

13.107.246.53

200 OK

673 B

URL GET HTTP/2
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
IP
13.107.246.53:443
ASN
#8068 MICROSOFT-CORP-MSN-AS-BLOCK

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint44:5F:75:46:1C:BE:AF:E4:F2:BF:F3:04:1D:0B:56:0F:EE:DA:A0:96
ValiditySat, 29 Jul 2023 00:00:00 GMT - Mon, 29 Jul 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (1864), with no line terminators
Size
673 B (673 bytes)
Hash
bc3d32a696895f78c19df6c717586a5d
9191cb156a30a3ed79c44c0a16c95159e8ff689d
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

HTTP Headers

GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: public, max-age=31536000
content-length: 673
content-type: image/svg+xml
content-encoding: gzip
content-md5: DhdidjYrlCeaRJJRG/y9mA==
last-modified: Wed, 24 May 2023 10:11:46 GMT
etag: 0x8DB5C3F47E260FD
x-cache: TCP_HIT
x-ms-request-id: 1aa32f50-d01e-0006-6e24-fdcd7f000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref-originshield: 0SEktZQAAAAD/yIqRk5FhSZm4jWF7LoFvQU1TMDRFREdFMTgxNAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
x-azure-ref: 0f/YuZQAAAADZesSem0IeQK/CiP1N+jA9U1ZHMjBFREdFMDUyMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
date: Tue, 17 Oct 2023 21:02:54 GMT
X-Firefox-Spdy: h2

adfs.heart.org/adfs/portal/logo/logo.png

69.152.183.140

200 OK

6.4 kB

URL GET HTTP/1.1
adfs.heart.org/adfs/portal/logo/logo.png
IP
69.152.183.140:443
ASN
#7018 ATT-INTERNET4

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerSectigo Limited
Subjectadfs.heart.org
Fingerprint11:D1:74:EB:5A:DF:CB:58:DE:8A:EE:06:70:FD:78:6D:A5:F4:22:58
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
PNG image data, 260 x 32, 8-bit/color RGBA, non-interlaced\012- data
Size
6.4 kB (6428 bytes)
Hash
d3f69be16baf7acef2e7f4dd03729866
e11aa0084b93253a24dd3ed57ddde66d27c84d2b
3a5eeea11e1041db96b81498ab69c050dd045d9e56c69e19bd98430ba752165f

HTTP Headers

GET /adfs/portal/logo/logo.png HTTP/1.1
Host: adfs.heart.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 6428
Content-Type: image/png
Expires: Thu, 16 Nov 2023 22:02:55 GMT
ETag: 3A5EEEA11E1041DB96B81498AB69C050DD045D9E56C69E19BD98430BA752165F
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
Strict-Transport-Security: max-age = 31536000
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Date: Tue, 17 Oct 2023 21:02:55 GMT

ocsp.r2m02.amazontrust.com/

54.230.80.227

471 B

URL
ocsp.r2m02.amazontrust.com/
IP
54.230.80.227:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
122713a46c95f8bb4dec5675c8bc6370
931a76230505a44e6aa1f7daf3793e4402a3418f
ee9a270ddf93a16b524dcd910d1ba5854596dfd2aa44d8fd71a4f36eefbe151c

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m02.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Tue, 17 Oct 2023 21:02:57 GMT
Last-Modified: Tue, 17 Oct 2023 20:08:36 GMT
Server: ECAcc (ska/F757)
X-Cache: Miss from cloudfront
Via: 1.1 94eee494c19905cb6933ec8a32a577a0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: wn5H99BY0HnzbBQzpR6BYbA6zQTjvODO2sNqaANTuvp-ReSOCECfew==
Age: 3261

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/442076121:1697573250:-cPE4sb1gsOXi2jaJI0xLtLm8RHMG6vg9scEwFi7pGk/817b7c1d7f92b52d/7a15714fc77720b

104.17.2.184

20 kB

URL
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/442076121:1697573250:-cPE4sb1gsOXi2jaJI0xLtLm8RHMG6vg9scEwFi7pGk/817b7c1d7f92b52d/7a15714fc77720b
IP
104.17.2.184:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with very long lines (3440), with no line terminators
Size
20 kB (19748 bytes)
Hash
2955ebb4e1395a44a15058bccba7d7e7
1ae2b3e3aedfafbd7073989ec69a32095b394dbd
a92de2af3c4210b0073fdbba4aba686c5a86a180dbccffc509943e7e3036e745

HTTP Headers

POST /cdn-cgi/challenge-platform/h/b/flow/ov1/442076121:1697573250:-cPE4sb1gsOXi2jaJI0xLtLm8RHMG6vg9scEwFi7pGk/817b7c1d7f92b52d/7a15714fc77720b HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/tolj8/0x4AAAAAAAJ1zx-MJxCL7z8m/auto/normal
Content-type: application/x-www-form-urlencoded
CF-Challenge: 7a15714fc77720b
Content-Length: 25457
Origin: https://challenges.cloudflare.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:52 GMT
content-type: text/html; charset=UTF-8
cf-chl-out: ciwkZUS/UJoOp1QA2fQ5qx1jqJbQEtKOa6SLv1+OdzdbaKBmv9ebSpTY1mOGrEu8RVtPRWmc4M4dztd+zN6aTs3Hsp/I9PYjQDTGkcrhf8a7UrfvczPXb12ZtL6sZlrQ$rbikvyvP97/6srETMFxroQ==
cf-chl-out-s: SYV2xB54tGaTV8Fellgr79JdVNv+vWMyg5drbnUxAOi0EkFsRjbc5APGt2C4aWtBH3YJ15O9Kw5u7Jk3431fUVC7HLc2EvUw6eNheBVZwl22KX2AK/oSO3eXhLxQjSRVSie5N27jwsnX1W5WLIsI+ccjCoWRGMjgA0VBTY2kTUDE06TX5r1RrnOQ2wOwA4aPX0YbLNeiJ8lS4J4eqP1cjmMiW+upZeIXRUR6jeuqJIqWJXsbU0grVC+tXEEoU0mLhNXAJdA+xSmEn0++6LFoOA==$1hGv/Fv2X4xxGM8VWkINTQ==
server: cloudflare
cf-ray: 817b7c2cfdbfb52d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

lajg05z8w9s48y1.glfbreak.ru/web1/info

172.67.196.133

200 OK

33 kB

URL POST HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/info
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type

Size
33 kB (33141 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /web1/info HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 28
Origin: https://lajg05z8w9s48y1.glfbreak.ru
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6IlkxbjdTaHRQaXBybVNhaDlzMWFyUnc9PSIsInZhbHVlIjoiZEVaa1h5ZXBYTVlyZGQyKzJNQ25ma2JJekV1VlpHWnpLcVZHSjMxZVdEUGVVa0R3SS9MUFpGMTlQZ1JKZ2NKMmlLVzBJZGo1eVMrZnU5TTFJSGZHcXZQN1FCWGp4ZEpxRng0MkdwcHQ3MU1zOGR3R0FHS1MycUZERCtRWEw5YjgiLCJtYWMiOiIyMmY3NmQxYTIzYmM2NDBiYjE0N2FlMDVjZjY1Y2NjMzIxNGM1ZTY4MDE2NGU0ODQ0NjRkZDY1OTAzOGVhNzNkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNDUmxTckZjam9DaTVPaEdtZ1pnNHc9PSIsInZhbHVlIjoiKzdPZDBnYlVEa1NGb3FTeDZ0L1R6TUNKMUNkejJHS2IrbWRRY0tBVXdpbXAyZnlaV2NDTThwbUJ6KzBTbktvSGZwamdkSk9CNXhmdDBEYTFrK1Z1UnhVTWVyRG16V0VaREgxNzRVNGhwZ3NHWDArUy93eVlsR0c0K1Z0Qk9vemUiLCJtYWMiOiJjOWFhMjEyZDc0MWJjMWE0NmYzNjg3Nzk5ZmNhM2I4ZDc3ZjQ4ODUxNzZkNjA0ZjZmOGI0ZDJlMTBjOTQ2MzIyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:54 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.1.10
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rgyp%2F4N7VmpWPBV2ofIyYlVGyqU5VFO1QZ7R5tNONH8IZaIicWWFOthvCV5JZ2DoNllaNxmPVLLlc4zgontwUMjZgxJAbH1KEV29LGWsFRniOPzVeg3UvnuY9PYAvlUD6k0Esqg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IlB4NkhMT29kSG5MZjFxMTdzOGgzN2c9PSIsInZhbHVlIjoiZkZkRWplcnZ4cVZ3Tzc3VWNFM2V3Ny80YWZOUkFERGhYY2xZelIraktMWGg2Sno2R2Y1bjVLQUl3YVA0Rmg4eGt6Tzl2eTlUU3pRb05iVHl3T1drNENrMGpBZnlObXU4eHRnOTJ4VjBHd24wOVNaNERjcDFMQXhmUGxMNzgwZkQiLCJtYWMiOiI2YThiNWJkMGViMDQ5ODM1ZmRjYTI5MDZhNzZhMmFhNTliZDY0MGVlMjdiNzk5NjZkNTZhZDZjM2Y5NDNiNzE0IiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:54 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6IlBRUTZidU9zNzBwVjAwaTJKZjFEQ2c9PSIsInZhbHVlIjoiT29RS3d3VGZBc3hteGVwVGhFSnVoMENBakpXazFFWjMyUnNaNWpMcE1LTGoyMXRqcDcrVWhhL2t1NVFDOEhyOW9PMVAwektvYnp3Z0NadU0wK2Rwdis3YStMU1FxSFg0UDE5RmhKODJVTzdvZ0Jvb1lIaXo4dkd6ajdQUFNjMHciLCJtYWMiOiI4N2VhZDU2NDA3YjQ5ODE2OGQzZDkwZjc5OWFiNmI2NDgyY2YzM2QzYWE0MjM0NDk2NGM4NzlmZGZmZjQwZjUwIiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:54 GMT; Max-Age=7200; path=/; httponly; samesite=lax
server: cloudflare
cf-ray: 817b7c344ee5b509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/web1/assets/css/pages.min.css?cb=1697576570277

172.67.196.133

200 OK

17 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/css/pages.min.css?cb=1697576570277
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
ASCII text, with very long lines (17002), with no line terminators
Size
17 kB (17002 bytes)
Hash
68dd1bcccde5656be56122a5370bbb98
18d1618561916e13668295570a157c32acd9e1f5
bd5a242e3cd9e703a92c7d2667e8f78a3ba2c97cbd04237665782034e4760ed3

HTTP Headers

GET /web1/assets/css/pages.min.css?cb=1697576570277 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:50 GMT
content-type: text/css
last-modified: Thu, 21 Sep 2023 16:09:25 GMT
etag: W/"426a-605e0b73dd2ad"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CEskFJm8yHmgZ92r9EkrAIVpMgKr5uC9slIhi%2FZ%2FGx%2FXnwSdhhADnTO%2Fy3a1y1oACu%2FTYa4TgDmpFD4IOCDWVW4H04xI1tFK6uCGbHRSWfNtT%2BpobDhr1a9JbJohvB0xI42vZiQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 817b7c181890b509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages-head-web.min.js?cb=1697576570277

172.67.196.133

200 OK

9.9 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages-head-web.min.js?cb=1697576570277
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
ASCII text, with very long lines (9951), with no line terminators
Size
9.9 kB (9908 bytes)
Hash
2692213b1e8a48f2a0ef0e803666c269
e35b6539454bc178d8ef1f3a7c60a051d123ba93
f34ad8a7113853157e2408d8a1b35e15daa6c5f49d9621e327339ed683e1a496

HTTP Headers

GET /web1/assets/js/pages-head-web.min.js?cb=1697576570277 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:50 GMT
content-type: application/javascript
last-modified: Sat, 14 Oct 2023 12:29:26 GMT
etag: W/"26b4-607ac52d9994f"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e0JvcNp%2Fp0stnTGn0UhRcU0V1ex5TOdTFNiR9BCD0L3Av6stFLbCQbZmfpPaczQXgHUZ2N7nLMRrEDFVRdoKOFeTqPLUyUJawr7FZowRoYmaCprhrOJiy2D9n68Ianzc3q6LgT4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 817b7c1848c0b509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/myscr185725.js

172.67.196.133

200 OK

28 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/myscr185725.js
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
ASCII text
Size
28 kB (27899 bytes)
Hash
9d43fe357b2d89a7333ba2bc0a4c8e83
9c519b82f3bcd30f3c3ce60388a43dc4573f3cf1
67761952aeeb0249976f552d3a5809df787f47cf81a88dac35c7b46fcf941c7c

HTTP Headers

GET /myscr185725.js HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:48 GMT
content-type: application/javascript
last-modified: Sun, 15 Oct 2023 09:42:39 GMT
cache-control: max-age=14400
cf-cache-status: HIT
age: 5838
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B2s7QNgy3VQW4Aach9EWYF56bv6pyPnpJxGRg5q2%2Bg2aJXFsKEQBVE0jGcHeZ%2FpMUslwh6cTtJoogxInWP1%2FKQ13nn0TCewljHJXOS2HZ8nN4qHje7VmbHYYkBPcjiDe%2F9%2BeYMeNIQV1vuFIDYQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 817b7c11ebe5b509-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages-head-top-web.min.js?cb=1697576569497

172.67.196.133

200 OK

2.2 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages-head-top-web.min.js?cb=1697576569497
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
ASCII text, with very long lines (2377), with no line terminators
Size
2.2 kB (2209 bytes)
Hash
0f2e26038b2d0d2114e7abc2290e680d
ddd6bcce2bfcebdd49a781316cb74f49c00da143
4f0ba78178d3349808ddb2fb8d4d775bd3914ac66557c8aeba189e7b49d72517

HTTP Headers

GET /web1/assets/js/pages-head-top-web.min.js?cb=1697576569497 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:49 GMT
content-type: application/javascript
last-modified: Sat, 14 Oct 2023 12:50:57 GMT
etag: W/"8a1-607ac9fcda55a"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nk1STlvuMMrYjiEuVFD18jZk4qOsTDH6FZaHetzBj6RNCEF7e4tbWHvhBAMMEsldOzds3CDamPybi4hkro%2FJQeLz8ctUDnBamD0XNtRYIPPxcYXb1N4iNKXhmsl0bE7PZ4Uf5xU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 817b7c133cc4b509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/web1/assets/css/pages-godaddy.css?cb=1697576570277

172.67.196.133

200 OK

38 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/css/pages-godaddy.css?cb=1697576570277
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
ASCII text, with very long lines (1437), with CRLF line terminators
Size
38 kB (38221 bytes)
Hash
5732ce20ba6fd490b9732cfd3cb8ba04
50d032727014bccd0f319138a2424d2e9bb17aeb
0abd0eb456f4f3d9ac24b04778f49a4405baa2ea161bfb744803aefeda7cac73

HTTP Headers

GET /web1/assets/css/pages-godaddy.css?cb=1697576570277 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:50 GMT
content-type: text/css
last-modified: Mon, 09 Oct 2023 21:28:17 GMT
etag: W/"954d-6074f44c310a2"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B6zj%2FTuufKa64PXhJXhd3Bf2tbCSoXXKyMLP63FtgBKA1WDZ1D2eyPL6wBL1Dr803QgH07bXn%2BVIX%2FlaPXKnNGJV3MznJoKvmuiuktfydKAlvyypwhz89QTiQXD%2FiPvuRKAoKLg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 817b7c1818a0b509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/web1/check

172.67.196.133

200 OK

0 B

URL POST HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/check
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /web1/check HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 20
Origin: https://lajg05z8w9s48y1.glfbreak.ru
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6IlkxbjdTaHRQaXBybVNhaDlzMWFyUnc9PSIsInZhbHVlIjoiZEVaa1h5ZXBYTVlyZGQyKzJNQ25ma2JJekV1VlpHWnpLcVZHSjMxZVdEUGVVa0R3SS9MUFpGMTlQZ1JKZ2NKMmlLVzBJZGo1eVMrZnU5TTFJSGZHcXZQN1FCWGp4ZEpxRng0MkdwcHQ3MU1zOGR3R0FHS1MycUZERCtRWEw5YjgiLCJtYWMiOiIyMmY3NmQxYTIzYmM2NDBiYjE0N2FlMDVjZjY1Y2NjMzIxNGM1ZTY4MDE2NGU0ODQ0NjRkZDY1OTAzOGVhNzNkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNDUmxTckZjam9DaTVPaEdtZ1pnNHc9PSIsInZhbHVlIjoiKzdPZDBnYlVEa1NGb3FTeDZ0L1R6TUNKMUNkejJHS2IrbWRRY0tBVXdpbXAyZnlaV2NDTThwbUJ6KzBTbktvSGZwamdkSk9CNXhmdDBEYTFrK1Z1UnhVTWVyRG16V0VaREgxNzRVNGhwZ3NHWDArUy93eVlsR0c0K1Z0Qk9vemUiLCJtYWMiOiJjOWFhMjEyZDc0MWJjMWE0NmYzNjg3Nzk5ZmNhM2I4ZDc3ZjQ4ODUxNzZkNjA0ZjZmOGI0ZDJlMTBjOTQ2MzIyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:55 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.1.10
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y%2BFGgjNAzlx4ss3peYoqT9%2FefGSzeeYe5ohMpEL%2BZZY9KORDtLf8NGKZfWGBOePDjwr%2BS0CN1zMfDU8j7FvnOBBr%2FyMnVkP3lnjeUQ5tTSzNgsSqcAJmHQK6eUkvXnWAngkDX%2Bw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6ImU3dEZvOGlMU0k4RnF0enVscmkyTXc9PSIsInZhbHVlIjoiVTRQd0tyUzhUV0E2c3JPM09maWlDVUxJRDlVdlhWdHNQSEMvQmZ4WkNqbUM5TzgyTnh5Y1NkYzJKUEYvckVPeTJuN1RLUkFUUlBvblVyUTh3WG5takM2ZTNXS2Q3a0hRWjgxdjI1WVpnR0o4ZXl3MGJSM3UzMDNMWG5xY05INGciLCJtYWMiOiIyZTcxNzY5YjRlOTcyZTMyMzEzMWEyYjdhZmQxZmQ0MmNiMGQ3NGNjOWY4ZTNkNDQwOWE3NThiM2U1OWYxYzNhIiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:55 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6Iml4d0JrcXJyWEhMOHFhYzVHVDJBYlE9PSIsInZhbHVlIjoiUDN6RTFrSTByS2ZmL3l4NTVGaTVrZEpiNUltRDhkNERZRWdLampqUWFsSHhRZ2N5bDVUR3E5eS8wc0I4bmZhS0d3M3B1NG5OYldBd2xrTGo5TjloVXlqbmJkVlhQK2VtSUxvTWtuS0pTOUlxZzNqTkdqZFh5azhieis0djBNckIiLCJtYWMiOiI2MzEzYjEwYzhhYWI2MWZkNzNmNTU2MjFkMjAxYWEyNGQyOTI0ZGE4NTNjZDg3Yjg3MWZjY2U4ZDQ0M2NjN2M2IiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:55 GMT; Max-Age=7200; path=/; httponly; samesite=lax
server: cloudflare
cf-ray: 817b7c343edfb509-OSL
content-encoding: br

challenges.cloudflare.com/turnstile/v0/api.js?render=explicit

104.17.2.184

302 Found

34 kB

URL GET HTTP/2
challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type

Size
34 kB (34170 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /turnstile/v0/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Tue, 17 Oct 2023 21:02:48 GMT
access-control-allow-origin: *
cache-control: max-age=300, public
location: /turnstile/v0/b/7ff8d35b/api.js?render=explicit
vary: accept-encoding
server: cloudflare
cf-ray: 817b7c125eb80b31-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/tolj8/0x4AAAAAAAJ1zx-MJxCL7z8m/auto/normal

104.17.2.184

200 OK

0 B

URL GET HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/tolj8/0x4AAAAAAAJ1zx-MJxCL7z8m/auto/normal
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/tolj8/0x4AAAAAAAJ1zx-MJxCL7z8m/auto/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:54 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 817b7c389fd0b52d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

lajg05z8w9s48y1.glfbreak.ru/web1/info

172.67.196.133

200 OK

94 B

URL POST HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/info
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
94 B (94 bytes)
Hash
bb0b366ff2438126ec64bd9ad72dfb7f
50fe035ec905f33eb090b9c154a771fd8429d108
939ca6e15779ee9ddcf99d93cac872ae98a44b76a7f67600493055c55be64e78

HTTP Headers

POST /web1/info HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 27
Origin: https://lajg05z8w9s48y1.glfbreak.ru
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6IlkxbjdTaHRQaXBybVNhaDlzMWFyUnc9PSIsInZhbHVlIjoiZEVaa1h5ZXBYTVlyZGQyKzJNQ25ma2JJekV1VlpHWnpLcVZHSjMxZVdEUGVVa0R3SS9MUFpGMTlQZ1JKZ2NKMmlLVzBJZGo1eVMrZnU5TTFJSGZHcXZQN1FCWGp4ZEpxRng0MkdwcHQ3MU1zOGR3R0FHS1MycUZERCtRWEw5YjgiLCJtYWMiOiIyMmY3NmQxYTIzYmM2NDBiYjE0N2FlMDVjZjY1Y2NjMzIxNGM1ZTY4MDE2NGU0ODQ0NjRkZDY1OTAzOGVhNzNkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlNDUmxTckZjam9DaTVPaEdtZ1pnNHc9PSIsInZhbHVlIjoiKzdPZDBnYlVEa1NGb3FTeDZ0L1R6TUNKMUNkejJHS2IrbWRRY0tBVXdpbXAyZnlaV2NDTThwbUJ6KzBTbktvSGZwamdkSk9CNXhmdDBEYTFrK1Z1UnhVTWVyRG16V0VaREgxNzRVNGhwZ3NHWDArUy93eVlsR0c0K1Z0Qk9vemUiLCJtYWMiOiJjOWFhMjEyZDc0MWJjMWE0NmYzNjg3Nzk5ZmNhM2I4ZDc3ZjQ4ODUxNzZkNjA0ZjZmOGI0ZDJlMTBjOTQ2MzIyIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:55 GMT
content-type: application/json
x-powered-by: PHP/8.1.10
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j%2FWc5JFOZACmoJgFuu7Mnjec1l4txGoZvLuasIRpoJzEnOZ8%2F0N2LCfcn1MW%2FAJn62Jv0Rxk378P0s0jTTrArniNskFevfYXYRIYgSwfuRPaIJfX1gWw6eaYRgHLcOY%2FuPqZ0UM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6Ijh0V1JDMnkwcUxIcm9XUXBCZmd6UWc9PSIsInZhbHVlIjoialdoK1pHekEybHB5K0xVbitBc0diYmwyZHVQbmhYbVpicU1RVFkyMVBzMlpKTlVjcXpwdC9ZNlNacVJOR2dEOHgyb1U3Q3Z4NVVTOC80VThPTFVLZmV2VnA0dHROWWxyb0tBWVc5N0NEMFEzN3pNU01tV3ducUhXK0ZUMUdZMTIiLCJtYWMiOiI2ZDY5Zjc1ZmJjNzljODE1MWNiZmM3NTFiMWM3YWVmNzYwMWI3YjFjODMxMzdmODg0NDJhMGM0YTdhOTMxYTcwIiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:54 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6IlZqcVN1bkRSbWE1SC9YdUl4ZThCZ3c9PSIsInZhbHVlIjoiZW9aKzMxemFJcEs3QWxpdklqS3lUOUxhN2xBaTlmRHRzNEVmbUY3YlZYU3ZDMGxvR1MyN0plZFdsaXpTUzREaFYvZ1pFRTlObmQ4WGg2YTU2WmxtT25SOVZzSC9MazRqTFlDVndFUHdRclNhSGc3NDJNWkxQQU1KZ1NtaS84MlYiLCJtYWMiOiI4YTViODgyZTQxYWIxY2NjNWI5OTVlMDU0NTkzNWNiNTZiZjBiOGVkYWM0MDcwMWM1YmE2ZThkZWI2MTUyOTYwIiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:54 GMT; Max-Age=7200; path=/; httponly; samesite=lax
server: cloudflare
cf-ray: 817b7c343ee2b509-OSL
content-encoding: br

challenges.cloudflare.com/turnstile/v0/b/7ff8d35b/api.js?render=explicit

104.17.2.184

200 OK

34 kB

URL GET HTTP/2
challenges.cloudflare.com/turnstile/v0/b/7ff8d35b/api.js?render=explicit
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
ASCII text, with very long lines (34169)
Size
34 kB (34170 bytes)
Hash
a65b6a0168a66b4f0db4dd65c60d8e3a
fe403c2a8c9ce0f11185940892ad3479c3355c93
7e0b26f08c9a0d0a70e887541e8165472579233b92950835dd2bdde9963d1b8a

HTTP Headers

GET /turnstile/v0/b/7ff8d35b/api.js?render=explicit HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 17 Oct 2023 21:02:48 GMT
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
vary: Accept-Encoding
server: cloudflare
cf-ray: 817b7c127ec80b31-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

lajg05z8w9s48y1.glfbreak.ru/web1/call

0.0.0.0

0 B

URL POST
lajg05z8w9s48y1.glfbreak.ru/web1/call
IP
0.0.0.0:0
ASN
#0

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /web1/call HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 107
Origin: https://lajg05z8w9s48y1.glfbreak.ru
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6Ik96K3BxSjR3cFMvVThwczkyZ3pwdXc9PSIsInZhbHVlIjoiaCtqMjRJazg4YWNyWFVEV0NtaXA1bmMrSFR3SzRtOXFxS2tMWkxJNTJKNmliOU9PTWtkcm5iOHNHQXVrSXVWcDlydXF4K1lscTdSZy94WDBtbjU3UFpTUzlwaFBsSDQxTDdsWFhFdm15R2prWlJ2M2t4OWZ5ZVY2NWo2amtqMjQiLCJtYWMiOiJiNzAyMTJkZTlkNWY5MDNiZGJjYjRiNzQ5Zjk3Mjg3YzUxNTIwNmYyMTljYzA2MGRlNDdjMDEyMTdhZDQ0YmU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImI0REROVXRTWVlqVjhRVUY5ODdJZ1E9PSIsInZhbHVlIjoiTVZnYUE5ekczK29kOSt5NDN2SW9NcWN0T25uVDllN1ZrN2pzVzRlVzJYT3pjQmo4ZWMwUUU4cXpXdmFLekt4cldjWkFxN3N3REY2c2t3MW5SYTdqZU9VcHFmZkZDK0ZPbDI2ODNxczJLL0t1MzVTQ1dOMkk1TEt0cmxSOHBGNmYiLCJtYWMiOiJiNGVmOTllZWEyMWM0ZTdiZDIwYzE5ZTYwNWNiNWE5MmNiYWNlMGQ3ZDNkODVhMmJlM2RkOGY0YjBiMTg0OTkzIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

lajg05z8w9s48y1.glfbreak.ru/web1/validatecaptcha

172.67.196.133

200 OK

20 B

URL POST HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/validatecaptcha
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
20 B (20 bytes)
Hash
0b35866f4a3aa4d34ce5dda2d14c2cd8
d2b80911f09c3106fdf0df9920f983945d644083
493851374626d927bfe1c7d084fa977a0e636c03f163fda258ab6b638edc2f0d

HTTP Headers

POST /web1/validatecaptcha HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 567
Origin: https://lajg05z8w9s48y1.glfbreak.ru
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:54 GMT
content-type: application/json
x-powered-by: PHP/8.1.10
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=365q%2BsKgGsH1dLtxdTZMB2HbE8cJc8UQ4fxm02vtHkNUCzEvFH0UWR6I20prybN7PPNRxNaRC2OxmKckHvWLiAuxLbo8pyNDPMfXANspsMsVw4lVj4ypWLhdbOJuRYcQQE7lqpQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6IlkxbjdTaHRQaXBybVNhaDlzMWFyUnc9PSIsInZhbHVlIjoiZEVaa1h5ZXBYTVlyZGQyKzJNQ25ma2JJekV1VlpHWnpLcVZHSjMxZVdEUGVVa0R3SS9MUFpGMTlQZ1JKZ2NKMmlLVzBJZGo1eVMrZnU5TTFJSGZHcXZQN1FCWGp4ZEpxRng0MkdwcHQ3MU1zOGR3R0FHS1MycUZERCtRWEw5YjgiLCJtYWMiOiIyMmY3NmQxYTIzYmM2NDBiYjE0N2FlMDVjZjY1Y2NjMzIxNGM1ZTY4MDE2NGU0ODQ0NjRkZDY1OTAzOGVhNzNkIiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:53 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6IlNDUmxTckZjam9DaTVPaEdtZ1pnNHc9PSIsInZhbHVlIjoiKzdPZDBnYlVEa1NGb3FTeDZ0L1R6TUNKMUNkejJHS2IrbWRRY0tBVXdpbXAyZnlaV2NDTThwbUJ6KzBTbktvSGZwamdkSk9CNXhmdDBEYTFrK1Z1UnhVTWVyRG16V0VaREgxNzRVNGhwZ3NHWDArUy93eVlsR0c0K1Z0Qk9vemUiLCJtYWMiOiJjOWFhMjEyZDc0MWJjMWE0NmYzNjg3Nzk5ZmNhM2I4ZDc3ZjQ4ODUxNzZkNjA0ZjZmOGI0ZDJlMTBjOTQ2MzIyIiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:53 GMT; Max-Age=7200; path=/; httponly; samesite=lax
server: cloudflare
cf-ray: 817b7c2d599bb509-OSL
content-encoding: br

httpbin.org/ip

44.194.147.17

200 OK

31 B

URL GET HTTP/2
httpbin.org/ip
IP
44.194.147.17:443
ASN
#14618 AMAZON-AES

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerAmazon
Subjecthttpbin.org
Fingerprint14:0C:C7:A8:EC:FA:7F:9C:9D:D2:B8:7E:C9:B8:93:3A:A1:11:F6:01
ValidityThu, 21 Sep 2023 00:00:00 GMT - Fri, 18 Oct 2024 23:59:59 GMT

File type
ASCII text, with no line terminators
Size
31 B (31 bytes)
Hash
b90b7b460267d7067015fd46f3cd1a1e
3c164e9136c246dffb5fb4ef3927dda99d880121
885fd87e71d0651d917c1483aaf061a95e9c52371afb3970abf85c50caa8dfbf

HTTP Headers

GET /ip HTTP/1.1
Host: httpbin.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://lajg05z8w9s48y1.glfbreak.ru
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 17 Oct 2023 21:02:57 GMT
content-type: application/json
content-length: 31
server: gunicorn/19.9.0
access-control-allow-origin: https://lajg05z8w9s48y1.glfbreak.ru
access-control-allow-credentials: true
X-Firefox-Spdy: h2

lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-vf.woff2

172.67.196.133

200 OK

44 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/fonts/GDSherpa-vf.woff2
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
Web Open Font Format (Version 2), TrueType, length 43596, version 1.0\012- data
Size
44 kB (43596 bytes)
Hash
2a05e9e5572abc320b2b7ea38a70dcc1
d5fa2a856d5632c2469e42436159375117ef3c35
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

HTTP Headers

GET /web1/assets/fonts/GDSherpa-vf.woff2 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:49 GMT
content-type: font/woff2
content-length: 43596
last-modified: Fri, 25 Aug 2023 04:00:36 GMT
etag: "aa4c-603b7631474f7"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 194
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GvKc0mAYuC4JWIqRAl2dfquxxD9nTAx0e7LfUKB3fYouFAoxrOEb4SBiGMyF%2BbugPBB9nPp2LN4J2yoYXsLtjBtgMqilyIrAFkSxYaZoaJeAWbOj7nIe9a00hSmlmKuc2BDLwM0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
accept-ranges: bytes
server: cloudflare
cf-ray: 817b7c1858ceb509-OSL

lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages.js?cb=1697576570277

172.67.196.133

200 OK

81 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/js/pages.js?cb=1697576570277
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type

Size
81 kB (80770 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /web1/assets/js/pages.js?cb=1697576570277 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6IlB4NkhMT29kSG5MZjFxMTdzOGgzN2c9PSIsInZhbHVlIjoiZkZkRWplcnZ4cVZ3Tzc3VWNFM2V3Ny80YWZOUkFERGhYY2xZelIraktMWGg2Sno2R2Y1bjVLQUl3YVA0Rmg4eGt6Tzl2eTlUU3pRb05iVHl3T1drNENrMGpBZnlObXU4eHRnOTJ4VjBHd24wOVNaNERjcDFMQXhmUGxMNzgwZkQiLCJtYWMiOiI2YThiNWJkMGViMDQ5ODM1ZmRjYTI5MDZhNzZhMmFhNTliZDY0MGVlMjdiNzk5NjZkNTZhZDZjM2Y5NDNiNzE0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlBRUTZidU9zNzBwVjAwaTJKZjFEQ2c9PSIsInZhbHVlIjoiT29RS3d3VGZBc3hteGVwVGhFSnVoMENBakpXazFFWjMyUnNaNWpMcE1LTGoyMXRqcDcrVWhhL2t1NVFDOEhyOW9PMVAwektvYnp3Z0NadU0wK2Rwdis3YStMU1FxSFg0UDE5RmhKODJVTzdvZ0Jvb1lIaXo4dkd6ajdQUFNjMHciLCJtYWMiOiI4N2VhZDU2NDA3YjQ5ODE2OGQzZDkwZjc5OWFiNmI2NDgyY2YzM2QzYWE0MjM0NDk2NGM4NzlmZGZmZjQwZjUwIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:56 GMT
content-type: application/javascript
last-modified: Mon, 25 Sep 2023 20:22:34 GMT
etag: W/"13b82-60634b7f30722"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zseEME77zcp3aLUDBp3TzPAeQgjVXbFwlSmY%2FG4PnOTHfmmbes%2Fq4TECsEw5mbEUSjgopTxdSDki87i2fNy%2FUnYHizlUJnJwPWBVyzUTmFZ1fFaXT4gDhoo%2BNUuGTG60ERXLf3A%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 817b7c394a49b509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/updonp4w44n

172.67.196.133

200 OK

111 B

URL User Request GET HTTP/2
lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
HTML document text\012- HTML document, ASCII text, with no line terminators
Size
111 B (111 bytes)
Hash
101582db1e6308eb1f6053d4208191a7
43a6096dc780f98a5d3b9b7fb908e342e91b5133
da724a8ef3986a489698138b03a1e6bdc2e0b25196fcf558db46af0d8442d5c8

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft Outlook

HTTP Headers

GET /updonp4w44n HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 17 Oct 2023 21:02:48 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TeaHWZkncuA4iqcALWCt5rjb2UnP2%2BumMuG7UnY%2BYflpu019Jjfrsg5Bb4o8KXjHYn2d0f8KaCm2n8nAs3cBQfQJE%2BWY0gFAy8mY3ea%2FJsM1dliGNWNl9H0WBZ8FEFPmlG9xl1QH%2FIqSvx6L3wQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 817b7c0faa450b02-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

lajg05z8w9s48y1.glfbreak.ru/web1/assets/cloudfavicon.ico

172.67.196.133

200 OK

34 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/cloudfavicon.ico
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel\012- data
Size
34 kB (34494 bytes)
Hash
88415acda09a4cbd9d87543c3ba78180
2dec4705e9ab399efdc6eef36e079aa31d1df8d9
20cccc47c1bac9d2ef36b6a1c58af58c5c169ad5ca084080f0392b86f949641c

HTTP Headers

GET /web1/assets/cloudfavicon.ico HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:48 GMT
content-type: image/x-icon
last-modified: Wed, 16 Aug 2023 15:22:46 GMT
etag: W/"86be-6030bde212b57"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
age: 193
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DTGWaV0q%2FkEEcbVdyWD15%2BZeBdx3%2BsAdF5G6XhQJ8KABFB7pHl8Wqrso5%2FB%2Fbgj2ZuCIILpiTarHxV%2BBGZR5Zh%2BIGwTZOZZUmQE5IMNRl0ped%2BfKordfWM2APM4SpWWA6UMV0zw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 817b7c141d71b509-OSL
content-encoding: br

challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/tolj8/0x4AAAAAAAJ1zx-MJxCL7z8m/auto/normal

104.17.2.184

200 OK

72 kB

URL GET HTTP/3
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/tolj8/0x4AAAAAAAJ1zx-MJxCL7z8m/auto/normal
IP
104.17.2.184:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerCloudflare, Inc.
Subjectchallenges.cloudflare.com
Fingerprint5F:E4:AA:8C:2E:24:D2:B1:69:9D:13:28:31:5C:65:FA:97:2A:E9:6E
ValidityFri, 18 Aug 2023 00:00:00 GMT - Sat, 17 Aug 2024 23:59:59 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (39843)
Size
72 kB (71799 bytes)
Hash
96b9405e142157ce81d8ae2dd41de1ce
eabe73edba957948ac0689a9b50d8684b7722ee9
d8ac0b28d6b71906c24357677a457c611c8b40356a1573157e62b4fb819c0bb5

HTTP Headers

GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/tolj8/0x4AAAAAAAJ1zx-MJxCL7z8m/auto/normal HTTP/1.1
Host: challenges.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:50 GMT
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
cf-ray: 817b7c1d7f92b52d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

lajg05z8w9s48y1.glfbreak.ru/web1/assets/cloudfavicon.ico

172.67.196.133

200 OK

34 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/cloudfavicon.ico
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel\012- data
Size
34 kB (34494 bytes)
Hash
88415acda09a4cbd9d87543c3ba78180
2dec4705e9ab399efdc6eef36e079aa31d1df8d9
20cccc47c1bac9d2ef36b6a1c58af58c5c169ad5ca084080f0392b86f949641c

HTTP Headers

GET /web1/assets/cloudfavicon.ico HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:50 GMT
content-type: image/x-icon
last-modified: Wed, 16 Aug 2023 15:22:46 GMT
etag: W/"86be-6030bde212b57"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
age: 195
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DTGWaV0q%2FkEEcbVdyWD15%2BZeBdx3%2BsAdF5G6XhQJ8KABFB7pHl8Wqrso5%2FB%2Fbgj2ZuCIILpiTarHxV%2BBGZR5Zh%2BIGwTZOZZUmQE5IMNRl0ped%2BfKordfWM2APM4SpWWA6UMV0zw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 817b7c1ded17b509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/web1/assets/pages/ul8ez297rtg.css?cb=1697576570277

172.67.196.133

200 OK

1.1 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/pages/ul8ez297rtg.css?cb=1697576570277
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
ASCII text, with very long lines (1164), with no line terminators
Size
1.1 kB (1121 bytes)
Hash
1d425fb9c0a48323d58155b61ac338d8
755d9cf7e096cd1f590b408f1921f78dba97d5c9
da5bb4dcce3afee4e8b582d18c202dd7f2ec4e9485986f18f1c8ff9271235adf

HTTP Headers

GET /web1/assets/pages/ul8ez297rtg.css?cb=1697576570277 HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:50 GMT
content-type: text/css
last-modified: Tue, 17 Oct 2023 16:47:34 GMT
etag: W/"461-607ec478b4074"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cache-control: max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hYdFmJsh3EcEA9rEGGMiyH3uZ22LbNiSOFovGgLgentGOL0p7tEDeAuTxbsXC%2BxUTWJZywN7hSgprU6aJT5aMZApwtUdUddcH3GFVoPUTR5LqYEd67jSV0Z6He9RDEYm3QC1svs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: MISS
server: cloudflare
cf-ray: 817b7c18188fb509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/web1/assets/microsoftfavicon.ico

172.67.196.133

200 OK

17 kB

URL GET HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/assets/microsoftfavicon.ico
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors\012- data
Size
17 kB (17174 bytes)
Hash
12e3dac858061d088023b2bd48e2fa96
e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

HTTP Headers

GET /web1/assets/microsoftfavicon.ico HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6ImU3dEZvOGlMU0k4RnF0enVscmkyTXc9PSIsInZhbHVlIjoiVTRQd0tyUzhUV0E2c3JPM09maWlDVUxJRDlVdlhWdHNQSEMvQmZ4WkNqbUM5TzgyTnh5Y1NkYzJKUEYvckVPeTJuN1RLUkFUUlBvblVyUTh3WG5takM2ZTNXS2Q3a0hRWjgxdjI1WVpnR0o4ZXl3MGJSM3UzMDNMWG5xY05INGciLCJtYWMiOiIyZTcxNzY5YjRlOTcyZTMyMzEzMWEyYjdhZmQxZmQ0MmNiMGQ3NGNjOWY4ZTNkNDQwOWE3NThiM2U1OWYxYzNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Iml4d0JrcXJyWEhMOHFhYzVHVDJBYlE9PSIsInZhbHVlIjoiUDN6RTFrSTByS2ZmL3l4NTVGaTVrZEpiNUltRDhkNERZRWdLampqUWFsSHhRZ2N5bDVUR3E5eS8wc0I4bmZhS0d3M3B1NG5OYldBd2xrTGo5TjloVXlqbmJkVlhQK2VtSUxvTWtuS0pTOUlxZzNqTkdqZFh5azhieis0djBNckIiLCJtYWMiOiI2MzEzYjEwYzhhYWI2MWZkNzNmNTU2MjFkMjAxYWEyNGQyOTI0ZGE4NTNjZDg3Yjg3MWZjY2U4ZDQ0M2NjN2M2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:55 GMT
content-type: image/x-icon
last-modified: Sun, 19 Mar 2023 15:20:17 GMT
etag: W/"4316-5f7425905ae40"
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
cache-control: max-age=14400
age: 194
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9QCG9nMhymMxQZEiOw2%2FfOg99wIsAD%2FqsTYuOUvg%2FBDsKqcaa2qvNFYcINyd3F1DBaQUdlHjqG6EocmkHXaVtXGhvGjQC%2BKJ2hsMbwK1LZ6NoR45vVvhJyMT3DtSlCcGYGazWQE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
server: cloudflare
cf-ray: 817b7c3cbdceb509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/web1/info

172.67.196.133

200 OK

16 B

URL POST HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/info
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
16 B (16 bytes)
Hash
8f4fc8aa38d0752f63b9dc6fc0f8c90c
5f1a3156476dbb8a087273f2e3b4382d83bd841f
fd779f88e0dcaaf0babd6b4917d0991f6597f13095c71241f140462dbbb4d687

HTTP Headers

POST /web1/info HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 27
Origin: https://lajg05z8w9s48y1.glfbreak.ru
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6ImU3dEZvOGlMU0k4RnF0enVscmkyTXc9PSIsInZhbHVlIjoiVTRQd0tyUzhUV0E2c3JPM09maWlDVUxJRDlVdlhWdHNQSEMvQmZ4WkNqbUM5TzgyTnh5Y1NkYzJKUEYvckVPeTJuN1RLUkFUUlBvblVyUTh3WG5takM2ZTNXS2Q3a0hRWjgxdjI1WVpnR0o4ZXl3MGJSM3UzMDNMWG5xY05INGciLCJtYWMiOiIyZTcxNzY5YjRlOTcyZTMyMzEzMWEyYjdhZmQxZmQ0MmNiMGQ3NGNjOWY4ZTNkNDQwOWE3NThiM2U1OWYxYzNhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Iml4d0JrcXJyWEhMOHFhYzVHVDJBYlE9PSIsInZhbHVlIjoiUDN6RTFrSTByS2ZmL3l4NTVGaTVrZEpiNUltRDhkNERZRWdLampqUWFsSHhRZ2N5bDVUR3E5eS8wc0I4bmZhS0d3M3B1NG5OYldBd2xrTGo5TjloVXlqbmJkVlhQK2VtSUxvTWtuS0pTOUlxZzNqTkdqZFh5azhieis0djBNckIiLCJtYWMiOiI2MzEzYjEwYzhhYWI2MWZkNzNmNTU2MjFkMjAxYWEyNGQyOTI0ZGE4NTNjZDg3Yjg3MWZjY2U4ZDQ0M2NjN2M2IiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:57 GMT
content-type: application/json
x-powered-by: PHP/8.1.10
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vf1YcX27DJIg91dAeU3BKWnJgOVY1Vt%2FXAU1w9CgzQX1QRF9Fjt6YWdDUIvgVn%2Bc6Zjjb%2B9WeZfYGruSlCfmWelx0B%2FjgBB%2FJdblJhSNr8XGLn76OJWsLvLEDHwjqlPUOffo7WI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6Ik96K3BxSjR3cFMvVThwczkyZ3pwdXc9PSIsInZhbHVlIjoiaCtqMjRJazg4YWNyWFVEV0NtaXA1bmMrSFR3SzRtOXFxS2tMWkxJNTJKNmliOU9PTWtkcm5iOHNHQXVrSXVWcDlydXF4K1lscTdSZy94WDBtbjU3UFpTUzlwaFBsSDQxTDdsWFhFdm15R2prWlJ2M2t4OWZ5ZVY2NWo2amtqMjQiLCJtYWMiOiJiNzAyMTJkZTlkNWY5MDNiZGJjYjRiNzQ5Zjk3Mjg3YzUxNTIwNmYyMTljYzA2MGRlNDdjMDEyMTdhZDQ0YmU3IiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:57 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6ImI0REROVXRTWVlqVjhRVUY5ODdJZ1E9PSIsInZhbHVlIjoiTVZnYUE5ekczK29kOSt5NDN2SW9NcWN0T25uVDllN1ZrN2pzVzRlVzJYT3pjQmo4ZWMwUUU4cXpXdmFLekt4cldjWkFxN3N3REY2c2t3MW5SYTdqZU9VcHFmZkZDK0ZPbDI2ODNxczJLL0t1MzVTQ1dOMkk1TEt0cmxSOHBGNmYiLCJtYWMiOiJiNGVmOTllZWEyMWM0ZTdiZDIwYzE5ZTYwNWNiNWE5MmNiYWNlMGQ3ZDNkODVhMmJlM2RkOGY0YjBiMTg0OTkzIiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:57 GMT; Max-Age=7200; path=/; httponly; samesite=lax
server: cloudflare
cf-ray: 817b7c451c5eb509-OSL
content-encoding: br

lajg05z8w9s48y1.glfbreak.ru/web1/info

172.67.196.133

200 OK

1 B

URL POST HTTP/3
lajg05z8w9s48y1.glfbreak.ru/web1/info
IP
172.67.196.133:443
ASN
#13335 CLOUDFLARENET

Requested by
https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n#neil@kortechgroup.com
Certificate
IssuerGoogle Trust Services LLC
Subject*.glfbreak.ru
FingerprintFE:09:67:09:64:85:14:9F:26:37:8F:9A:B6:BA:D0:EC:CA:3B:8D:C8
ValidityThu, 07 Sep 2023 12:26:20 GMT - Wed, 06 Dec 2023 12:26:19 GMT

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
c4ca4238a0b923820dcc509a6f75849b
356a192b7913b04c54574d18c28d46e6395428ab
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

HTTP Headers

POST /web1/info HTTP/1.1
Host: lajg05z8w9s48y1.glfbreak.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 136
Origin: https://lajg05z8w9s48y1.glfbreak.ru
DNT: 1
Connection: keep-alive
Referer: https://lajg05z8w9s48y1.glfbreak.ru/updonp4w44n
Cookie: XSRF-TOKEN=eyJpdiI6Ik96K3BxSjR3cFMvVThwczkyZ3pwdXc9PSIsInZhbHVlIjoiaCtqMjRJazg4YWNyWFVEV0NtaXA1bmMrSFR3SzRtOXFxS2tMWkxJNTJKNmliOU9PTWtkcm5iOHNHQXVrSXVWcDlydXF4K1lscTdSZy94WDBtbjU3UFpTUzlwaFBsSDQxTDdsWFhFdm15R2prWlJ2M2t4OWZ5ZVY2NWo2amtqMjQiLCJtYWMiOiJiNzAyMTJkZTlkNWY5MDNiZGJjYjRiNzQ5Zjk3Mjg3YzUxNTIwNmYyMTljYzA2MGRlNDdjMDEyMTdhZDQ0YmU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImI0REROVXRTWVlqVjhRVUY5ODdJZ1E9PSIsInZhbHVlIjoiTVZnYUE5ekczK29kOSt5NDN2SW9NcWN0T25uVDllN1ZrN2pzVzRlVzJYT3pjQmo4ZWMwUUU4cXpXdmFLekt4cldjWkFxN3N3REY2c2t3MW5SYTdqZU9VcHFmZkZDK0ZPbDI2ODNxczJLL0t1MzVTQ1dOMkk1TEt0cmxSOHBGNmYiLCJtYWMiOiJiNGVmOTllZWEyMWM0ZTdiZDIwYzE5ZTYwNWNiNWE5MmNiYWNlMGQ3ZDNkODVhMmJlM2RkOGY0YjBiMTg0OTkzIiwidGFnIjoiIn0%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 17 Oct 2023 21:02:58 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/8.1.10
cache-control: no-cache, private
access-control-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: DENY
content-security-policy: frame-ancestors 'none'
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lz5HZiIR7%2Fe6izDx04X57k6%2BobKEDy5DTtcKjxiIpPOV%2BPbKtudXHShfeBSg31%2Fbm1wtPkOVWcgYWLcdajs%2BlUOAhXSxCmmW8DKos9xEM0U%2BOhd9LfcjtbzjILq6E4ZvRBNGSMY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
set-cookie: XSRF-TOKEN=eyJpdiI6Ik1RVEFTNGZZYng0ek1vMEZ0b1FIRXc9PSIsInZhbHVlIjoicHQySnJMR2JoaEhwYlgzTmpFVVlGL3NLekppbklvcnRqUUU2Njc0b0N1eVVDRnJRekdxODVqemk5TnRESVNRaEZiWXFTVjBtTFZuRzkrWi91bXFBWkRNaTBCRUgzQkVmVWtRZUtPR2ozTW44NU5vQUpwNmlZdVVCbGJrMmY1cHgiLCJtYWMiOiIxNzRlMmZiZTIyY2EzMjU4ZmMyOTUzYWEyNzlmMTEyOTBhZDhmYmNkMmY0Y2VlOTQwZTQ2OTc3NWQ0NDRhYzVjIiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:58 GMT; Max-Age=7200; path=/; samesite=lax
laravel_session=eyJpdiI6IlFZRmY0Z3htL1B6SU1NNkxCRXcvTUE9PSIsInZhbHVlIjoiS1krd2tqU3lIOVBCRXZwekdOUmtVcW8rS1dKai80bVJpUHYxWFpiNHhhNytFSloySGwvcEc4dlRBYkZBUkNMMjhUaldPTitvbVJnSHhiRXQzUkVNTDhlMjZvZyt4clhlRGNzcTlCS0tvVDBFUldqMVQwSHhJcitCaTBPb3NoZ0IiLCJtYWMiOiJjMTFhMmNlMDdhYzc1Yjk0NDU5YTRiY2JkZmVlYzIyM2RmNmU4YjQ5ZTIxMzk4MjM1MjhkNmZiNzdhZThmMDcyIiwidGFnIjoiIn0%3D; expires=Tue, 17-Oct-2023 23:02:58 GMT; Max-Age=7200; path=/; httponly; samesite=lax
server: cloudflare
cf-ray: 817b7c4b79c1b509-OSL
content-encoding: br

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (11)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (49)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size