Overview

URL g2.doshimotai.ru/baldr.exe
IP81.177.140.55
ASNAS8342 OJSC RTComm.RU
Location Russian Federation
Report completed2019-06-05 22:14:31 CEST
StatusLoading report..
urlquery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Pool
Access Level


Intrusion Detection Systems

Suricata /w Emerging Threats Pro  No alerts detected


Blacklists

MDL  No alerts detected
OpenPhish  No alerts detected
PhishTank  No alerts detected
Fortinet's Web Filter
Added / Verified Severity Host Comment
2019-06-05 2 g2.doshimotai.ru/baldr.exe Malware
2019-06-05 2 g2.doshimotai.ru/baldr.exe Malware
DNS-BH  No alerts detected
mnemonic secure dns  No alerts detected


Recent reports on same IP/ASN/Domain

Last 10 reports on IP: 81.177.140.55

Date UQ / IDS / BL URL IP
2019-06-06 04:58:07 +0200
0 - 0 - 2 ito3.doshimotai.ru/kryptexmon.exe 81.177.140.55
2019-06-06 04:57:25 +0200
0 - 0 - 2 ju8.doshimotai.ru/mkvdcbjalcygjtqrpmlrj.exe 81.177.140.55
2019-06-06 03:04:59 +0200
0 - 0 - 2 g2.doshimotai.ru/2/eXGEmrRsi-2_2019-03-21_19- (...) 81.177.140.55
2019-06-05 23:44:53 +0200
0 - 0 - 2 h13.doshimotai.ru/OX5d.exe 81.177.140.55
2019-06-05 23:43:15 +0200
0 - 0 - 2 jj7.doshimotai.ru/evidar2.exe 81.177.140.55
2019-06-05 23:42:36 +0200
0 - 0 - 2 jj7.doshimotai.ru/killeryuga.exe 81.177.140.55
2019-06-05 23:41:21 +0200
0 - 0 - 2 ii.doshimotai.ru/OneDrive.exe 81.177.140.55
2019-06-05 22:09:56 +0200
0 - 0 - 2 ju8.doshimotai.ru/MKvdCbjaLCYGJTQrPMLrj.exe 81.177.140.55
2019-06-05 20:02:03 +0200
0 - 0 - 2 g2.doshimotai.ru/1oj5d.exe 81.177.140.55
2019-06-05 20:01:59 +0200
0 - 0 - 2 b5.doshimotai.ru/2003/qwe2003_AU3_EXE_1cr36.exe 81.177.140.55

Last 10 reports on ASN: AS8342 OJSC RTComm.RU

Date UQ / IDS / BL URL IP
2019-06-27 09:58:45 +0200
0 - 0 - 0 radikal.ru 81.176.238.240
2019-06-26 19:02:54 +0200
0 - 0 - 5 coinspottechrem.com 81.177.141.30
2019-06-18 20:46:35 +0200
0 - 2 - 1 pasta.hurd.club/ 81.177.180.138
2019-06-18 20:37:32 +0200
0 - 1 - 1 aruna.migel.club/ 81.177.180.138
2019-06-18 20:26:57 +0200
0 - 0 - 1 escap.migel.club/ 81.177.180.138
2019-06-18 16:41:34 +0200
0 - 0 - 0 igra.tovsl.ru/cw-pl30/ 81.177.139.41
2019-06-17 21:38:04 +0200
0 - 0 - 1 linera.ru 81.177.140.222
2019-06-17 11:49:32 +0200
0 - 0 - 0 znak-a.ru 81.177.49.68
2019-06-13 17:28:39 +0200
0 - 0 - 0 idntfy.ru 195.161.34.118
2019-06-11 00:49:55 +0200
1 - 0 - 1 learning2live.ru/docs/config/cluster.html 81.177.32.12

No other reports on domain: doshimotai.ru



JavaScript

Executed Scripts (4)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (24)


Request Response
                                        
                                            GET /baldr.exe HTTP/1.1 
Host: g2.doshimotai.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         81.177.140.55
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
                                        
Server: nginx
Date: Wed, 05 Jun 2019 20:13:59 GMT
Content-Length: 154
Connection: keep-alive
Location: https://g2.doshimotai.ru/baldr.exe


--- Additional Info ---
Magic:  HTML document text
Size:   154
Md5:    cfbeaf604823f038b8b46f0ac862b98c
Sha1:   7b9eb1dac48e74fa5f418bc456cb410f88b81d98
Sha256: 20c1ab602462b7fc0d5b4cbd555cacf127b69a07a737579598ebcbc0f5b21319

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            POST / HTTP/1.1 
Host: ocsp.int-x3.letsencrypt.org
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 117
Content-Type: application/ocsp-request

                                         
                                         91.135.34.19
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 527
Etag: "7B05A45DB72A2F3E7B021E4B9A817A0A327210EF33BA52549B521076BF8AA84C"
Last-Modified: Tue, 04 Jun 2019 10:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=28168
Expires: Thu, 06 Jun 2019 04:03:27 GMT
Date: Wed, 05 Jun 2019 20:13:59 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   527
Md5:    6f70c6a315ab24822e97f9b536fae3c7
Sha1:   4a90d11599a3e06e3f33f4e207dfb8c72377d6a2
Sha256: 7b05a45db72a2f3e7b021e4b9a817a0a327210ef33ba52549b521076bf8aa84c
                                        
                                            POST / HTTP/1.1 
Host: isrg.trustid.ocsp.identrust.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         91.135.34.26
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: Apache
Content-Transfer-Encoding: Binary
Last-Modified: Sun, 02 Jun 2019 08:49:41 GMT
Etag: "00c1126c6ad37ff1b1f9172ff079a010bc7b5381"
Content-Length: 1398
Cache-Control: public, no-transform, must-revalidate, max-age=6722
Expires: Wed, 05 Jun 2019 22:06:01 GMT
Date: Wed, 05 Jun 2019 20:13:59 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   1398
Md5:    6ebb611ef4cc608e04c68ad174868571
Sha1:   00c1126c6ad37ff1b1f9172ff079a010bc7b5381
Sha256: e260002812626e5adbf7aa1d38df33695ae46d67d921fff4bb497977f42971f4
                                        
                                            GET /baldr.exe HTTP/1.1 
Host: g2.doshimotai.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

                                         
                                         81.177.140.55
HTTP/1.1 403 Forbidden
Content-Type: text/html
                                        
Date: Wed, 05 Jun 2019 20:13:59 GMT
Content-Length: 570
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012 exported SGML document text
Size:   570
Md5:    3d3656895c9f32108760bd1ee31d66c3
Sha1:   f9f43d37b8adf49aee9b2f29ded2423e000bf7c4
Sha256: d02b1bab084581449a66d98a025b2bcd1f7eddd3481cae4e3b5bbe86ac42dd68

Alerts:
  Blacklists:
    - fortinet: Malware
                                        
                                            POST / HTTP/1.1 
Host: status.rapidssl.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Cache-Control: max-age=104191
Date: Wed, 05 Jun 2019 20:14:00 GMT
Etag: "5cf71687-1d7"
Expires: Fri, 07 Jun 2019 01:10:31 GMT
Last-Modified: Wed, 05 Jun 2019 01:10:31 GMT
Server: nginx
X-Cache: HIT
Content-Length: 471


--- Additional Info ---
Magic:  data
Size:   471
Md5:    b7f2965a5ee2bb0d5c75fbaebe74a5ff
Sha1:   16cbe91a126225cda926fad07cc3bb4380ea0c39
Sha256: 9cd54075c8fded52aee62e433c4c828a8f5033e5f5e0aec77315e8e741289933
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Cache-Control: max-age=170993
Date: Wed, 05 Jun 2019 20:14:00 GMT
Etag: "5cf807ec-1d7"
Expires: Fri, 07 Jun 2019 19:43:53 GMT
Last-Modified: Wed, 05 Jun 2019 18:20:28 GMT
Server: ECS (lcy/1D24)
X-Cache: HIT
Content-Length: 471


--- Additional Info ---
Magic:  data
Size:   471
Md5:    7142c4b6561e56091461fa25eff98a05
Sha1:   316f2513b9c00b0463da2d3f14104bb8ccb6994d
Sha256: a0222696944cafa0414756ee70a16c4b625b02ab42251d7f1a3cbb35d7396c27
                                        
                                            GET /static/main.js HTTP/1.1 
Host: parking-static.jino.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe

                                         
                                         195.161.41.160
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Wed, 05 Jun 2019 20:14:00 GMT
Last-Modified: Thu, 13 Sep 2018 09:13:19 GMT
Transfer-Encoding: chunked
Connection: close
Etag: W/"5b9a2a2f-1c0a6"
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   38902
Md5:    b312d355c73a693dcaac004676600eaf
Sha1:   e9b8b5a743ce701232974cfe4847feed35fedece
Sha256: 129c556311b237a3fd0e8297a92b18922099e363b2ef93ef8db0fe3d96cdffb2
                                        
                                            POST /gsorganizationvalsha2g2 HTTP/1.1 
Host: ocsp2.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 111
Content-Type: application/ocsp-request

                                         
                                         104.18.21.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 05 Jun 2019 20:14:00 GMT
Content-Length: 1574
Connection: keep-alive
Set-Cookie: __cfduid=d0cc3fb45f74dac3449a5e4037f32c6841559765640; expires=Thu, 04-Jun-20 20:14:00 GMT; path=/; domain=.globalsign.com; HttpOnly
Expires: Sun, 09 Jun 2019 19:33:03 GMT
X-Powered-By: Undertow/1
Etag: "9fe338782cef67ade0e29f51710014b4c84e98a1"
Last-Modified: Wed, 05 Jun 2019 19:33:03 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 4e24cf7609d94277-OSL


--- Additional Info ---
Magic:  data
Size:   1574
Md5:    e345c0b255ab4ad8c0d9ac415af401d6
Sha1:   9fe338782cef67ade0e29f51710014b4c84e98a1
Sha256: 9ca20905382798b405584f16bf7d4a4f6b1628a407d612c0c7ace70f4bd1ae95
                                        
                                            GET /static/components/page/logo.svg HTTP/1.1 
Host: parking-static.jino.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe

                                         
                                         195.161.41.160
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx
Date: Wed, 05 Jun 2019 20:14:00 GMT
Last-Modified: Thu, 13 Sep 2018 09:13:19 GMT
Transfer-Encoding: chunked
Connection: close
Etag: W/"5b9a2a2f-a26"
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   1228
Md5:    88684194e02fd159f43ae79a6f761338
Sha1:   09de0a3bc9f9305143ce036c89fb1d34317f850f
Sha256: 014471cfa9a3a4c053aca3bf8071bc6211e97de4dde23fae753d39e687fdbb15
                                        
                                            GET /static/components/page/icons/page_block.svg HTTP/1.1 
Host: parking-static.jino.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe

                                         
                                         195.161.41.160
HTTP/1.1 200 OK
Content-Type: image/svg+xml
                                        
Server: nginx
Date: Wed, 05 Jun 2019 20:14:00 GMT
Content-Length: 748
Last-Modified: Thu, 13 Sep 2018 09:13:19 GMT
Connection: close
Etag: "5b9a2a2f-2ec"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  ASCII text, with very long lines, with no line terminators
Size:   748
Md5:    784f48e0384e6963a1905f548e2156dc
Sha1:   16e2481ee2a764a0f2835c1c93c1c4d4dd3c3f80
Sha256: b87121b47c625af61af4e55b8aff909526e6e337a784f162ae6977df7c3e1950
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 116
Content-Type: application/ocsp-request

                                         
                                         151.139.128.14
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 05 Jun 2019 20:14:00 GMT
Accept-Ranges: bytes
Last-Modified: Fri, 31 May 2019 17:59:55 GMT
Server: Apache
Etag: 47125374B40FCCF81BD772CF4D8AD08A502AE2FF
Cache-Control: max-age=300564,public,no-transform,must-revalidate
X-OCSP-Responder-ID: mcdpcaocsp5
X-HW: 1559765640.cds052.sk1.h2,1559765640.cds033.sk1.c
Connection: keep-alive
Content-Length: 472


--- Additional Info ---
Magic:  data
Size:   472
Md5:    1aa9e9905113e013192efaa255d7eabe
Sha1:   47125374b40fccf81bd772cf4d8ad08a502ae2ff
Sha256: 943cd3857aaef53c7382d691fbe93cf74822063aef286b27029b63fefa52c859
                                        
                                            POST / HTTP/1.1 
Host: ocsp.comodoca.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         151.139.128.14
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 05 Jun 2019 20:14:00 GMT
Accept-Ranges: bytes
Last-Modified: Thu, 30 May 2019 12:14:19 GMT
Server: Apache
Etag: D3AF0AB597DC9286F8AD82AA778B894E3189FCEE
Cache-Control: max-age=302399,public,no-transform,must-revalidate
X-OCSP-Responder-ID: mcdpcaocsp8
X-HW: 1559765640.cds052.sk1.h2,1559765640.cds041.sk1.c
Connection: keep-alive
Content-Length: 727


--- Additional Info ---
Magic:  data
Size:   727
Md5:    159059e286cc4f827e5fe0721db08ec4
Sha1:   d3af0ab597dc9286f8ad82aa778b894e3189fcee
Sha256: 09e58fc5b8b2e2f4d2f24d5f200865d4adb41ff23e56bc385d581ae7a133416f
                                        
                                            POST / HTTP/1.1 
Host: ocsp.usertrust.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Length: 115
Content-Type: application/ocsp-request

                                         
                                         151.139.128.14
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Wed, 05 Jun 2019 20:14:00 GMT
Accept-Ranges: bytes
Last-Modified: Thu, 30 May 2019 12:14:19 GMT
Server: Apache
Etag: FEF99D733CFE3927ACADEC7D49FAAB404BAFA347
Cache-Control: max-age=302399,public,no-transform,must-revalidate
X-OCSP-Responder-ID: mcdpcaocsp13
X-HW: 1559765640.cds045.sk1.h2,1559765640.cds047.sk1.c
Connection: keep-alive
Content-Length: 471


--- Additional Info ---
Magic:  data
Size:   471
Md5:    904190cad3c7544f0877ed2de7e4db5f
Sha1:   fef99d733cfe3927acadec7d49faab404bafa347
Sha256: 59637ea8a2a7c2b377f70633e01225510ed448317bf28bde556bc6f3d8530f85
                                        
                                            GET /metrika/watch.js HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe

                                         
                                         77.88.21.119
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.12.2
Date: Wed, 05 Jun 2019 20:14:00 GMT
Content-Length: 44105
Last-Modified: Tue, 04 Jun 2019 07:46:17 GMT
Connection: keep-alive
Etag: "5cf621c9-ac49"
Content-Encoding: gzip
Expires: Wed, 05 Jun 2019 21:14:00 GMT
Cache-Control: max-age=3600
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  gzip compressed data, from Unix, max compression
Size:   44105
Md5:    3d599d99f3dbaea7e03af998bcac10f0
Sha1:   24a2b5d3711a89158221bef58c669e5f21b36073
Sha256: 0644bb7dd5e296ed7279f9e7f65243ed4eccf60b3e6579a5a5007b887a7e8371
                                        
                                            GET /metrika/advert.gif HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe

                                         
                                         77.88.21.119
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Server: nginx/1.12.2
Date: Wed, 05 Jun 2019 20:14:01 GMT
Content-Length: 61
Last-Modified: Mon, 12 Oct 2015 13:09:09 GMT
Connection: keep-alive
Etag: "561bb0f5-3d"
Content-Encoding: gzip
Expires: Wed, 05 Jun 2019 21:14:01 GMT
Cache-Control: max-age=3600
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  gzip compressed data, was "advert.gif", from Unix, last modified: Mon Oct 12 15:06:12 2015
Size:   61
Md5:    aad2d5e940637a676e25e6cc7a684a83
Sha1:   c77946775d4c1719c48eb691edfbcf873b0738f5
Sha256: d9d219b8ba39a549d43400945b848dde73269f25dab5b75b85439c451ca0a525
                                        
                                            GET /sections/2/2497410.js HTTP/1.1 
Host: cache.betweendigital.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe

                                         
                                         151.236.81.151
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx
Date: Wed, 05 Jun 2019 20:14:01 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 05 Jul 2018 10:08:01 GMT
Etag: W/"5b3dee01-217f"
Content-Encoding: gzip


--- Additional Info ---
Magic:  gzip compressed data, from Unix
Size:   2737
Md5:    1d9769bd4355c05390e22a32288fffa7
Sha1:   fb689dc867f73166408a592987077acd33269c98
Sha256: 8ab5e732d4517e363db56cfdb09ef71acc7ab81b5f49311ab39a35fb60adf08a
                                        
                                            GET /code/1x1.gif HTTP/1.1 
Host: cache.betweendigital.com
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe

                                         
                                         151.236.81.151
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Server: nginx
Date: Wed, 05 Jun 2019 20:14:01 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Tue, 04 Jun 2019 08:31:23 GMT
Etag: "5cf62c5b-2b"
Accept-Ranges: bytes


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1
Size:   43
Md5:    df3e567d6f16d040326c7a0ea29a4f41
Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736
Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
                                        
                                            OPTIONS /watch/25328195?wmode=7&page-url=https%3A%2F%2Fg2.doshimotai.ru%2Fbaldr.exe&charset=utf-8&ut=noindex&site-info=%7B%22page%22%3A%22block%22%2C%22jsVersion%22%3A%221.30.0%22%2C%22htmlVersion%22%3Anull%7D&browser-info=ti%3A10%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Aw%3A1176x754%3Az%3A120%3Ai%3A20190605221400%3Aet%3A1559765642%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A972098429266%3Arqn%3A1%3Arn%3A101472247%3Ahid%3A326650104%3Agdpr%3A14%3Av%3A1545%3Arqnl%3A1%3Ast%3A1559765642%3Au%3A1559765641165703886%3At%3A%D0%A1%D0%B0%D0%B9%D1%82%20%D0%B7%D0%B0%D0%B1%D0%BB%D0%BE%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Origin: https://g2.doshimotai.ru
Access-Control-Request-Method: POST

                                         
                                         77.88.21.119
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
                                        
Server: nginx/1.12.2
Date: Wed, 05 Jun 2019 20:14:01 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Max-Age: 1728000
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
                                        
                                            GET /watch/25328195?wmode=5&callback=_ymjsp344426701&page-url=https%3A%2F%2Fg2.doshimotai.ru%2Fbaldr.exe&charset=utf-8&ut=noindex&site-info=%7B%22page%22%3A%22block%22%2C%22jsVersion%22%3A%221.30.0%22%2C%22htmlVersion%22%3Anull%7D&browser-info=ti%3A6%3Ati%3A10%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Aw%3A1176x754%3Az%3A120%3Ai%3A20190605221400%3Aet%3A1559765642%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A972098429266%3Arqn%3A1%3Arn%3A101472247%3Ahid%3A326650104%3Agdpr%3A14%3Av%3A1545%3Arqnl%3A1%3Ast%3A1559765642%3Au%3A1559765641165703886%3At%3A%D0%A1%D0%B0%D0%B9%D1%82%20%D0%B7%D0%B0%D0%B1%D0%BB%D0%BE%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe

                                         
                                         77.88.21.119
HTTP/1.1 302 Found
                                        
Server: nginx/1.12.2
Date: Wed, 05 Jun 2019 20:14:01 GMT
Content-Length: 0
Connection: keep-alive
Set-Cookie: yandexuid=8158028701559765641; Expires=Thu, 04-Jun-2020 20:14:01 GMT; Domain=.yandex.ru; Path=/ yabs-sid=1516518431559765641; Path=/ i=3ax2LQA/jhtPKX58bLMbhr0P3qgA0HTBhIyrNwZDLkqF9AripJ+Jl7b+Rfrxxmul3abbI0m2W2jLNTBnC+YfdfKmwmk=; Expires=Thu, 04-Jun-2020 20:14:01 GMT; Domain=.yandex.ru; Path=/; Secure; HttpOnly yp=1591301641.yrts.1559765641#1591301641.yrtsi.1559765641; Expires=Sat, 02-Jun-2029 20:14:01 GMT; Domain=.yandex.ru; Path=/
Last-Modified: Wed, 05-Jun-2019 20:14:01 GMT
Expires: Wed, 05-Jun-2019 20:14:01 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Pragma: no-cache
Location: /watch/25328195/1?wmode=5&callback=_ymjsp344426701&page-url=https%3A%2F%2Fg2.doshimotai.ru%2Fbaldr.exe&charset=utf-8&ut=noindex&site-info=%7B%22page%22%3A%22block%22%2C%22jsVersion%22%3A%221.30.0%22%2C%22htmlVersion%22%3Anull%7D&browser-info=ti%3A6%3Ati%3A10%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Aw%3A1176x754%3Az%3A120%3Ai%3A20190605221400%3Aet%3A1559765642%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A972098429266%3Arqn%3A1%3Arn%3A101472247%3Ahid%3A326650104%3Agdpr%3A14%3Av%3A1545%3Arqnl%3A1%3Ast%3A1559765642%3Au%3A1559765641165703886%3At%3A%D0%A1%D0%B0%D0%B9%D1%82%20%D0%B7%D0%B0%D0%B1%D0%BB%D0%BE%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
                                        
                                            GET /watch/25328195/1?wmode=5&callback=_ymjsp344426701&page-url=https%3A%2F%2Fg2.doshimotai.ru%2Fbaldr.exe&charset=utf-8&ut=noindex&site-info=%7B%22page%22%3A%22block%22%2C%22jsVersion%22%3A%221.30.0%22%2C%22htmlVersion%22%3Anull%7D&browser-info=ti%3A6%3Ati%3A10%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Aw%3A1176x754%3Az%3A120%3Ai%3A20190605221400%3Aet%3A1559765642%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A972098429266%3Arqn%3A1%3Arn%3A101472247%3Ahid%3A326650104%3Agdpr%3A14%3Av%3A1545%3Arqnl%3A1%3Ast%3A1559765642%3Au%3A1559765641165703886%3At%3A%D0%A1%D0%B0%D0%B9%D1%82%20%D0%B7%D0%B0%D0%B1%D0%BB%D0%BE%D0%BA%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe
Cookie: yandexuid=8158028701559765641; yabs-sid=1516518431559765641; i=3ax2LQA/jhtPKX58bLMbhr0P3qgA0HTBhIyrNwZDLkqF9AripJ+Jl7b+Rfrxxmul3abbI0m2W2jLNTBnC+YfdfKmwmk=; yp=1591301641.yrts.1559765641#1591301641.yrtsi.1559765641

                                         
                                         77.88.21.119
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Server: nginx/1.12.2
Date: Wed, 05 Jun 2019 20:14:01 GMT
Content-Length: 130
Connection: keep-alive
Last-Modified: Wed, 05-Jun-2019 20:14:01 GMT
Expires: Wed, 05-Jun-2019 20:14:01 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Pragma: no-cache
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  ASCII text, with no line terminators
Size:   130
Md5:    ebadd217b46d727763244342f59e212f
Sha1:   0ca5703a359a8ba00de456c6974117752d8eea0c
Sha256: 2069607a16e65c0f8f7b8bf48847b701a9e2fcef4352fdf10176452b5056cede
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: g2.doshimotai.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: _ym_uid=1559765641165703886; _ym_d=1559765641; _ym_isad=2

                                         
                                         81.177.140.55
HTTP/1.1 403 Forbidden
Content-Type: text/html
                                        
Date: Wed, 05 Jun 2019 20:14:01 GMT
Content-Length: 570
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012 exported SGML document text
Size:   570
Md5:    3d3656895c9f32108760bd1ee31d66c3
Sha1:   f9f43d37b8adf49aee9b2f29ded2423e000bf7c4
Sha256: d02b1bab084581449a66d98a025b2bcd1f7eddd3481cae4e3b5bbe86ac42dd68
                                        
                                            OPTIONS /watch/25328195/1?page-url=https%3A%2F%2Fg2.doshimotai.ru%2Fbaldr.exe&charset=utf-8&browser-info=ti%3A7%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Az%3A120%3Ai%3A20190605221401%3Aet%3A1559765642%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Apa%3A1%3Als%3A972098429266%3Arqn%3A2%3Arn%3A309187471%3Ahid%3A326650104%3Agdpr%3A14%3Av%3A1545%3Arqnl%3A1%3Ast%3A1559765642%3Au%3A1559765641165703886 HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Origin: https://g2.doshimotai.ru
Access-Control-Request-Method: POST

                                         
                                         77.88.21.119
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8
                                        
Server: nginx/1.12.2
Date: Wed, 05 Jun 2019 20:14:01 GMT
Content-Length: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Max-Age: 1728000
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
                                        
                                            GET /watch/25328195/1?page-url=https%3A%2F%2Fg2.doshimotai.ru%2Fbaldr.exe&charset=utf-8&site-info=%7B%22ads%22%3A%22between_inpagevideo%22%7D&browser-info=ti%3A4%3Aj%3A1%3As%3A1176x885x24%3Af%3A10.0.45.2%3Afpr%3A65694993101%3Acn%3A1%3Az%3A120%3Ai%3A20190605221401%3Aet%3A1559765642%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Aar%3A1%3Apa%3A1%3Als%3A972098429266%3Arqn%3A2%3Arn%3A309187471%3Ahid%3A326650104%3Agdpr%3A14%3Av%3A1545%3Arqnl%3A1%3Ast%3A1559765642%3Au%3A1559765641165703886 HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://g2.doshimotai.ru/baldr.exe
Cookie: yandexuid=8158028701559765641; yabs-sid=1516518431559765641; i=3ax2LQA/jhtPKX58bLMbhr0P3qgA0HTBhIyrNwZDLkqF9AripJ+Jl7b+Rfrxxmul3abbI0m2W2jLNTBnC+YfdfKmwmk=; yp=1591301641.yrts.1559765641#1591301641.yrtsi.1559765641

                                         
                                         77.88.21.119
HTTP/1.1 200 OK
Content-Type: image/gif
                                        
Server: nginx/1.12.2
Date: Wed, 05 Jun 2019 20:14:01 GMT
Content-Length: 43
Connection: keep-alive
Last-Modified: Wed, 05-Jun-2019 20:14:01 GMT
Expires: Wed, 05-Jun-2019 20:14:01 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Pragma: no-cache
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1
Size:   43
Md5:    df3e567d6f16d040326c7a0ea29a4f41
Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736
Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
                                        
                                            GET /favicon.ico HTTP/1.1 
Host: g2.doshimotai.ru
                                        
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: _ym_uid=1559765641165703886; _ym_d=1559765641; _ym_isad=2

                                         
                                         81.177.140.55
HTTP/1.1 403 Forbidden
Content-Type: text/html
                                        
Date: Wed, 05 Jun 2019 20:14:03 GMT
Content-Length: 570
Connection: keep-alive


--- Additional Info ---
Magic:  HTML document text\012 exported SGML document text
Size:   570
Md5:    3d3656895c9f32108760bd1ee31d66c3
Sha1:   f9f43d37b8adf49aee9b2f29ded2423e000bf7c4
Sha256: d02b1bab084581449a66d98a025b2bcd1f7eddd3481cae4e3b5bbe86ac42dd68