sat.acc.nqsourcing.com
47.79.149.239  Malicious Activity! Public Scan Open in urlscan Pro

URL:
https://sat.acc.nqsourcing.com/costa/auth/facture.php 6mo old
Submission: On April 17 via manual (April 17th 2026, 6:07:00 pm UTC) from CR — Scanned from JP

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 20 HTTP transactions. The main IP is 47.79.149.239, located in Tokyo, Japan and belongs to ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN. The main domain is sat.acc.nqsourcing.com. 6mo old
TLS certificate: Issued by R12 on February 25th 2026. Valid for: 3mo.
This is the only time sat.acc.nqsourcing.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
11 47.79.149.239 47.79.149.239 45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1 2606:4700::68... 2606:4700::6810:aee2 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 104.18.10.207 104.18.10.207 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2a04:4e42:400... 2a04:4e42:400::649 54113 (FASTLY) (FASTLY - Fastly)
4 2404:6800:400... 2404:6800:400b:c006::5f 15169 (GOOGLE) (GOOGLE - Google LLC)
2 172.217.24.35 172.217.24.35 15169 (GOOGLE) (GOOGLE - Google LLC)
20 6
Apex Domain
Subdomains
Transfer
11 nqsourcing.com
sat.acc.nqsourcing.com 6mo old
213 KB
4 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 42 10yr old
4 KB
2 gstatic.com
fonts.gstatic.com — Cisco Umbrella Rank: 23 10yr old
202 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 784 13yr old
31 KB
1 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3437 8yr old
7 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 267 13yr old
9 KB
20 6
Domain Requested by
11 sat.acc.nqsourcing.com sat.acc.nqsourcing.com
4 fonts.googleapis.com sat.acc.nqsourcing.com
2 fonts.gstatic.com fonts.googleapis.com
1 code.jquery.com sat.acc.nqsourcing.com
1 stackpath.bootstrapcdn.com sat.acc.nqsourcing.com
1 cdn.jsdelivr.net sat.acc.nqsourcing.com
20 6

This site contains no links.

Subject Issuer Validity Valid
sat.acc.nqsourcing.com
R12
2026-02-25 -
2026-05-26
3mo crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA
2025-04-25 -
2026-05-04
1yr crt.sh
bootstrapcdn.com
WE1
2026-03-05 -
2026-06-03
3mo crt.sh
*.jquery.com
Sectigo Public Server Authentication CA DV E36
2025-06-12 -
2026-06-26
1yr crt.sh
upload.video.google.com
WR2
2026-03-30 -
2026-06-22
3mo crt.sh
*.gstatic.com
WR2
2026-03-30 -
2026-06-22
3mo crt.sh

This page contains 1 frames:

Primary Page: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Frame ID: 7AD63451562A1D6DA8DBD4D0FD15AFFF
Requests: 20 HTTP requests in this frame

Screenshot

Page Title

Ministerio de Hacienda - Administración Tributaria Virtual (ATV)

Detected technologies

(Programming languages)
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

(UI frameworks)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>-]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

(UI frameworks)
Overall confidence: 100%
Detected patterns
  • <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

(Font scripts)
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

(JavaScript libraries)
Overall confidence: 100%
Detected patterns
  • jquery
  • /jquery(?:-(\d+\.\d+\.\d+))[/.-]

(CDN)
Overall confidence: 100%
Detected patterns
  • cdn\.jsdelivr\.net

(CDN)
Overall confidence: 100%
Detected patterns
  • code\.jquery\.com/

Page Statistics

20
Requests

100 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

466 kB
Transfer

914 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H2
200
Primary Request facture.php Show response
sat.acc.nqsourcing.com/costa/auth/
9 KB
3 KB
699ms
30ms
Document
text/html
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
4e9fced89aeb80798f97b47a79e05fd088dab705f2290b757c9dbb004a0094b4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
2458
content-type
text/html; charset=UTF-8
date
Fri, 17 Apr 2026 18:07:01 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
Apache
vary
Accept-Encoding
GET
H2
200
bootstrap-icons.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/
64 KB
9 KB
38ms
12ms
Stylesheet
text/css
2606:4700::6810:aee2
Cloudflare
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.css
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:aee2 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"100a0-GGXd3Lt7Z9zvQlDlkMyalXSrpnM"
age
2497231
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ieciDH8KCzJJBaS0C73je5n3zH3rDJv%2FTAWjlarHkFOQRJnwn38OmSRyzirYO0xPybCjDFoS4xtjYfLf5jXl%2BXHVptcm2MjVE1UOKhlPh053POEXr4XQZkEyFIHZjhybFwRUkg0edOJy0LQ6mVc%3D"}]}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Fri, 17 Apr 2026 18:07:01 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-eddf8230116-FRA, cache-nrt-rjtt7900062-NRT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
timing-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy
cross-origin
cf-ray
9edd5df1cc66d3e6-KIX
accept-ranges
bytes
access-control-allow-origin
*
content-length
8220
server
cloudflare
x-jsd-version
1.5.0
GET
H3
200
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/
30 KB
7 KB
29ms
14ms
Stylesheet
text/css
104.18.10.207
Cloudflare
General
Full URL
https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"269550530cc127b6aa5a35925a7de6ce"
age
707952
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Fri, 17 Apr 2026 18:07:01 GMT
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat
09/26/2024 11:08:39
vary
Accept-Encoding
content-type
text/css; charset=utf-8
cdn-requestpullcode
200
priority
u=0,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
0
cdn-cache
HIT
cdn-requestid
f4cd4c3787373133d2ba7bbbc8463681
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.04
cf-ray
9edd5df1beba9883-KIX
access-control-allow-origin
*
cdn-edgestorageid
1109
server
cloudflare
cdn-requestcountrycode
US
GET
H2
200
bootstrap.css
sat.acc.nqsourcing.com/costa/auth/css/
188 KB
24 KB
48ms
47ms
Stylesheet
text/css
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/css/bootstrap.css
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
"2f1f7-64f6fcb6ac440-gzip"
accept-ranges
bytes
content-length
24828
date
Fri, 17 Apr 2026 18:07:01 GMT
last-modified
Tue, 14 Apr 2026 18:30:33 GMT
vary
Accept-Encoding
server
Apache
content-type
text/css
GET
H2
200
arnaba.css
sat.acc.nqsourcing.com/costa/auth/css/
6 KB
1 KB
53ms
52ms
Stylesheet
text/css
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/css/arnaba.css
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
f4733b064fc1726c35c0c50ed86bc29a113b9d972cd1d157089baaec946eabe7

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
"161b-64f6fcb6ac440-gzip"
accept-ranges
bytes
content-length
1293
date
Fri, 17 Apr 2026 18:07:01 GMT
last-modified
Tue, 14 Apr 2026 18:30:33 GMT
vary
Accept-Encoding
server
Apache
content-type
text/css
GET
H2
404
animate.css
sat.acc.nqsourcing.com/costa/auth/css/
0
0
53ms
52ms
Stylesheet
text/html
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/css/animate.css
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-length
269
date
Fri, 17 Apr 2026 18:07:01 GMT
content-type
text/html; charset=iso-8859-1
server
Apache
GET
H2
200
nosnos.png
sat.acc.nqsourcing.com/costa/auth/image/
132 KB
132 KB
54ms
53ms
Image
image/png
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/image/nosnos.png
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
ca82f589233cbd171ad92c429af721a8e25f16368fa5c47dae79f6f38af7e43a

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

accept-ranges
bytes
content-length
135345
etag
"210b1-64f6f9d0b6dc0"
date
Fri, 17 Apr 2026 18:07:01 GMT
last-modified
Tue, 14 Apr 2026 18:17:35 GMT
content-type
image/png
server
Apache
GET
H2
200
jquery-3.5.1.min.js Show response
sat.acc.nqsourcing.com/costa/auth/js/
87 KB
30 KB
54ms
53ms
Script
text/javascript
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/js/jquery-3.5.1.min.js
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
"15d84-64f6fcb6ac440-gzip"
accept-ranges
bytes
content-length
30910
date
Fri, 17 Apr 2026 18:07:01 GMT
last-modified
Tue, 14 Apr 2026 18:30:33 GMT
vary
Accept-Encoding
server
Apache
content-type
text/javascript
GET
H2
200
jquery.mask.js Show response
sat.acc.nqsourcing.com/costa/auth/js/
23 KB
6 KB
98ms
96ms
Script
text/javascript
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/js/jquery.mask.js
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
"5a88-64f6fcb6ac440-gzip"
accept-ranges
bytes
content-length
5877
date
Fri, 17 Apr 2026 18:07:01 GMT
last-modified
Tue, 14 Apr 2026 18:30:33 GMT
vary
Accept-Encoding
server
Apache
content-type
text/javascript
GET
H2
200
bootstrap.min.js Show response
sat.acc.nqsourcing.com/costa/auth/js/
61 KB
16 KB
98ms
97ms
Script
text/javascript
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/js/bootstrap.min.js
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
"f3cb-64f6fcb6ac440-gzip"
accept-ranges
bytes
content-length
16021
date
Fri, 17 Apr 2026 18:07:01 GMT
last-modified
Tue, 14 Apr 2026 18:30:33 GMT
vary
Accept-Encoding
server
Apache
content-type
text/javascript
GET
H2
404
test.js
sat.acc.nqsourcing.com/costa/auth/js/
0
0
99ms
98ms
Script
text/html
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/js/test.js
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-length
269
date
Fri, 17 Apr 2026 18:07:01 GMT
content-type
text/html; charset=iso-8859-1
server
Apache
GET
H2
200
jquery-3.6.0.min.js Show response
code.jquery.com/
87 KB
31 KB
33ms
10ms
Script
application/javascript
2a04:4e42:400::649
Fastly
General
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/facture.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
W/"28feccc0-15d9d"
age
1332393
x-cache
HIT, HIT
date
Fri, 17 Apr 2026 18:07:01 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
398809, 718771
x-served-by
cache-lga21931-LGA, cache-itm1220030-ITM
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1776449221.419654,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30875
server
nginx
GET
H2
200
css2
fonts.googleapis.com/
7 KB
962 B
94ms
52ms
Stylesheet
text/css
2404:6800:400b:c006::5f
Google LLC
General
Full URL
https://fonts.googleapis.com/css2?family=Outfit:wght@100;200;300;400;500;600;700;800;900&display=swap
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/css/arnaba.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2404:6800:400b:c006::5f , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
0d7a53a635d0c085cee6765d4c33228ffb27fda6c0a762d8d37b775260135dcc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 17 Apr 2026 18:07:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 17 Apr 2026 18:07:01 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Fri, 17 Apr 2026 18:07:01 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
css2
fonts.googleapis.com/
4 KB
723 B
128ms
86ms
Stylesheet
text/css
2404:6800:400b:c006::5f
Google LLC
General
Full URL
https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100..900;1,100..900&display=swap
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/css/arnaba.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2404:6800:400b:c006::5f , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
bad282626c803aeb80f4c964ec90aff8839cf1317f55aa8a8f7bf4fa07b8a44e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 17 Apr 2026 18:07:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 17 Apr 2026 18:07:01 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Fri, 17 Apr 2026 17:23:18 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
css2
fonts.googleapis.com/
7 KB
2 KB
131ms
90ms
Stylesheet
text/css
2404:6800:400b:c006::5f
Google LLC
General
Full URL
https://fonts.googleapis.com/css2?family=Google+Sans+Flex:opsz,wght@6..144,1..1000&display=swap
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/css/arnaba.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2404:6800:400b:c006::5f , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
4d1fdf9a91d682b7a3429ef349e41538905ba7a1474d0bd028a90edd251493a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 17 Apr 2026 18:07:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 17 Apr 2026 18:07:01 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Fri, 17 Apr 2026 17:48:59 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
css2
fonts.googleapis.com/
5 KB
791 B
95ms
54ms
Stylesheet
text/css
2404:6800:400b:c006::5f
Google LLC
General
Full URL
https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900&display=swap
Requested by
Host: sat.acc.nqsourcing.com
URL: https://sat.acc.nqsourcing.com/costa/auth/css/arnaba.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2404:6800:400b:c006::5f , Japan, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
bdf8fc0ca61a8c5e4157d07d465bda7d449894c313588e81c2e4a075279104c9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 17 Apr 2026 18:07:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 17 Apr 2026 18:07:01 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Fri, 17 Apr 2026 17:50:22 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H3
200
UcCo3FwrK3iLTcviYwY.woff2
fonts.gstatic.com/s/inter/v20/
71 KB
71 KB
43ms
23ms
Font
font/woff2
172.217.24.35
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCo3FwrK3iLTcviYwY.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.24.35 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
syd15s20-in-f3.1e100.net
Software
sffe /
Resource Hash
2c295d99e26dcf357d4d01bcf270fd6924b600c9a13dd8c363ef114f4c6976fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://sat.acc.nqsourcing.com
sec-ch-ua-platform
"Linux"
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
232620
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 15 Apr 2027 01:30:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 15 Apr 2026 01:30:01 GMT
last-modified
Tue, 09 Sep 2025 18:33:17 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
72920
x-xss-protection
0
server
sffe
GET
H3
200
UcCo3FwrK3iLTcvsYwYL8g.woff2
fonts.gstatic.com/s/inter/v20/
130 KB
130 KB
38ms
18ms
Font
font/woff2
172.217.24.35
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCo3FwrK3iLTcvsYwYL8g.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.24.35 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
syd15s20-in-f3.1e100.net
Software
sffe /
Resource Hash
5e6d4fe9d9f4bff8b2a2469d25ab19576bb85331e22c6ed51398e16f95d56a9c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://sat.acc.nqsourcing.com
sec-ch-ua-platform
"Linux"
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
30089
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sat, 17 Apr 2027 09:45:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 17 Apr 2026 09:45:32 GMT
last-modified
Tue, 09 Sep 2025 18:30:57 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
133336
x-xss-protection
0
server
sffe
GET
H2
200
favicon.ico
sat.acc.nqsourcing.com/costa/auth/image/
1 KB
1 KB
21ms
21ms
Other
image/x-icon
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/image/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
d20459f6eb92fdd1db736ac0274e1eff87fa04bb7e4c6f6a13f3ba49e37b5e7e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
"47e-64f6fcb6ac440-gzip"
accept-ranges
bytes
content-length
993
date
Fri, 17 Apr 2026 18:07:01 GMT
last-modified
Tue, 14 Apr 2026 18:30:33 GMT
vary
Accept-Encoding
server
Apache
content-type
image/x-icon
GET
H2
200
favicon.ico
sat.acc.nqsourcing.com/costa/auth/image/
1 KB
0
0ms
0ms
Other
image/x-icon
47.79.149.239
ALIBABA-CN-NET Al...
General
Full URL
https://sat.acc.nqsourcing.com/costa/auth/image/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
47.79.149.239 Tokyo, Japan, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
d20459f6eb92fdd1db736ac0274e1eff87fa04bb7e4c6f6a13f3ba49e37b5e7e

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://sat.acc.nqsourcing.com/costa/auth/facture.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
"47e-64f6fcb6ac440-gzip"
accept-ranges
bytes
content-length
993
date
Fri, 17 Apr 2026 18:07:01 GMT
last-modified
Tue, 14 Apr 2026 18:30:33 GMT
vary
Accept-Encoding
server
Apache
content-type
image/x-icon

Verdicts & Comments Add Verdict or Comment


Malicious page.url
Submitted on April 17th 2026, 6:07:46 pm UTC — From Costa Rica

Threats: Phishing
Brands: Costa Rica Government CR
Comment: Phishing - Website is trying to steal user credentials

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

4 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery number| uidEvent object| bootstrap

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
sat.acc.nqsourcing.com/ 1969-12-31
23:59:59
Name: PHPSESSID
Value: 3v3lhqv4jkn4rrtsn5v2vnttmb

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
network error URL: https://sat.acc.nqsourcing.com/costa/auth/css/animate.css
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://sat.acc.nqsourcing.com/costa/auth/js/test.js
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
sat.acc.nqsourcing.com
stackpath.bootstrapcdn.com
104.18.10.207
172.217.24.35
2404:6800:400b:c006::5f
2606:4700::6810:aee2
2a04:4e42:400::649
47.79.149.239
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334
0d7a53a635d0c085cee6765d4c33228ffb27fda6c0a762d8d37b775260135dcc
2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9
2c295d99e26dcf357d4d01bcf270fd6924b600c9a13dd8c363ef114f4c6976fa
3c325075337b768950583012228055ae392e384688d77ec5235e6ca88dcec6ef
4d1fdf9a91d682b7a3429ef349e41538905ba7a1474d0bd028a90edd251493a2
4e9fced89aeb80798f97b47a79e05fd088dab705f2290b757c9dbb004a0094b4
5e6d4fe9d9f4bff8b2a2469d25ab19576bb85331e22c6ed51398e16f95d56a9c
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
bad282626c803aeb80f4c964ec90aff8839cf1317f55aa8a8f7bf4fa07b8a44e
bdf8fc0ca61a8c5e4157d07d465bda7d449894c313588e81c2e4a075279104c9
ca82f589233cbd171ad92c429af721a8e25f16368fa5c47dae79f6f38af7e43a
d20459f6eb92fdd1db736ac0274e1eff87fa04bb7e4c6f6a13f3ba49e37b5e7e
f4733b064fc1726c35c0c50ed86bc29a113b9d972cd1d157089baaec946eabe7
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e