{"report_id":"021a2c85-0c90-43a3-82e0-d7e05aa31e61","version":6,"status":"done","tags":[],"date":"2026-05-20T20:23:51Z","url":{"schema":"https","addr":"slonz6cc.ru","fqdn":"slonz6cc.ru","domain":"slonz6cc.ru","tld":"ru"},"ip":{"addr":"209.141.42.45","port":0,"asn":53667,"as":"PONYNET","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"slonz6cc.ru/","fqdn":"slonz6cc.ru","domain":"slonz6cc.ru","tld":"ru"},"title":"Slon6 cc — электронные очереди для клиник, офисов и сервисных центров в Москве","dom":{"size":10091,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (510)","md5":"56e99fe982e6a2a7fbc77cad3ab83604","sha1":"8f7484fd0dc29d1c73b88b7bc9d9868bc4e547c6","sha256":"413cdda2bb1b04a774863b94e8e3cbaeb150c74fd51e7573132c65a1b0c302d9","sha512":"6360343551b3249c1b7aad90f69a13cbc6637fa1525079aee91de359de5282385d727d947347bddbde5ee9322b66e6e23bc434b0c380f40ee7426517dea58a4d","ssdeep":"192:3xXTg1YwrEXx/27EDu2vjciR+hWMdW4+bsqGdTTNCIKGb13ZfD:3xDg1YwrEXx/27EDu2vA2+hWMd4b8dTp","tlshash":"7d22017251d928c92140b01be900bf0c6ce980bfbf6a567624ac1c7f7fe61a0c66771e","dom_hash":"domhash07a36737f222b88c9f38e434f443a562","first_seen":"2026-05-20T20:23:54.179622Z","last_seen":"2026-05-20T20:23:54.179622Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"slonz6cc.ru","fqdn":"slonz6cc.ru","domain":"slonz6cc.ru","tld":"ru"},"ip":{"addr":"209.141.42.45","port":0,"asn":53667,"as":"PONYNET","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-24T20:23:51Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"slonz6cc.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null},"summary":[{"fqdn":"i.ibb.co","ip":{"addr":"45.43.142.6","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"domain_registered":"2010-07-20","domain_rank":21643,"first_seen":"2018-11-25T10:13:48Z","last_seen":"2026-05-14T10:20:16.267533Z","alert_count":0,"request_count":1,"received_data":35880,"sent_data":428,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"slonz6cc.ru","ip":{"addr":"209.141.42.45","port":443,"asn":53667,"as":"PONYNET","country":"United States","country_code":"US"},"domain_registered":"2026-05-08","domain_rank":0,"first_seen":"2026-05-20T20:23:51.102894Z","last_seen":"2026-05-20T20:23:51.102894Z","alert_count":1,"request_count":1,"received_data":10401,"sent_data":480,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"s3.firstvds.ru","ip":{"addr":"37.230.115.231","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"domain_registered":"2002-08-06","domain_rank":0,"first_seen":"2025-09-11T11:42:54.692973Z","last_seen":"2026-04-21T13:09:24.421968Z","alert_count":0,"request_count":1,"received_data":18103,"sent_data":457,"comment":"","tags":null,"fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"slonz6cc.ru/","fqdn":"slonz6cc.ru","domain":"slonz6cc.ru","tld":"ru"},"ip":{"addr":"209.141.42.45","port":443,"asn":53667,"as":"PONYNET","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-20T20:23:29.644Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"slonz6cc.ru","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Fri, 08 May 2026 14:26:42 GMT","end":"Thu, 06 Aug 2026 14:26:41 GMT"},"fingerprint":{"sha1":"A0:EB:A6:09:7B:5C:AA:94:42:16:FF:07:46:7E:AA:50:47:DE:80:7C","sha256":"76:86:07:E7:FC:17:AB:57:A4:4F:8F:68:D4:CC:43:6C:90:60:72:11:F4:BA:D3:BB:8E:98:3F:73:00:65:88:20"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: slonz6cc.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 20 May 2026 20:23:30 GMT\r\nContent-Type: text/html\r\nContent-Length: 3597\r\nConnection: keep-alive\r\nLast-Modified: Fri, 08 May 2026 16:05:00 GMT\r\nETag: \"277f-651508f1d8598-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10111,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (510)","md5":"f0c1ea4daa3749ad2157a145760a45c6","sha1":"dd7aac4bcbeeb8f5a4f692782aeaf5e785b42397","sha256":"50076ba361761c3a8403005d657a796411135a7ce372b14fb3a7328a8058551e","sha512":"cce5cece6b16014d62ba3550210320b92e2507232d0cfa3dd52564d3d9473c2c23bc4abf352f5b1c3590f7cb1cb8a0b9134b91456d3982a63336637c700577c4","ssdeep":"192:xxXTg1Y6Xx/27EDu2vjciRrhWMdW4+bsqGdTTNCIKGb13Zfx:xxDg1Y6Xx/27EDu2vA2rhWMd4b8dT0NE","tlshash":"3022017251d928c92140b01be900bf0c69e980bfbf6a567624ac1c7f7fe61a4c67771e","first_seen":"2026-05-20T20:23:54.184059Z","last_seen":"2026-05-20T20:23:54.184059Z","times_seen":1,"resource_available":false,"data":null}},"time_used":875,"timings":{"blocked":358,"dns":77,"connect":142,"send":0,"wait":145,"receive":1,"ssl":148},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-05-20","alert":"Sinkholed","trigger":"slonz6cc.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"s3.firstvds.ru/fotohosting/2026/03/09/1000008538.jpg","fqdn":"s3.firstvds.ru","domain":"firstvds.ru","tld":"ru"},"ip":{"addr":"37.230.115.231","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://slonz6cc.ru/","date":"2026-05-20T20:23:30.404Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.s3.firstvds.ru","organization":""},"issuer":{"commonName":"GlobalSign GCC R6 AlphaSSL CA 2025","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 14 Apr 2026 02:39:39 GMT","end":"Fri, 30 Oct 2026 02:39:39 GMT"},"fingerprint":{"sha1":"96:27:81:39:71:BD:C9:5E:4A:31:AD:74:34:B5:0E:D0:63:0A:C1:0E","sha256":"4D:98:9E:B0:09:64:69:C9:A2:D3:4D:8E:0C:B8:52:67:F8:72:33:FC:2B:BD:AF:7B:61:F3:A9:27:58:BB:0E:43"}}},"request":{"raw":"GET /fotohosting/2026/03/09/1000008538.jpg HTTP/1.1\r\nHost: s3.firstvds.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://slonz6cc.ru/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nContent-Length: 17684\r\nAccept-Ranges: bytes\r\nLast-Modified: Mon, 09 Mar 2026 07:34:29 GMT\r\nx-rgw-object-type: Normal\r\nETag: \"294c36bfed5fcb6cd967ab5421720952\"\r\nCache-Control: public, max-age=31536000\r\nx-amz-request-id: tx000008b1ec832775a1057-006a0e1842-126495479-default\r\nContent-Type: image/jpeg\r\nServer: Ceph Object Gateway (tentacle)\r\nDate: Wed, 20 May 2026 20:23:30 GMT\r\nConnection: Keep-Alive\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":17684,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4, height=0, orientation=[*0*], width=0], baseline, precision 8, 1104x384, components 1","md5":"294c36bfed5fcb6cd967ab5421720952","sha1":"71e0d47efcb9f358fb9a6dcbe88c13a95ac8d49d","sha256":"c17ee0ff5602c2084e1d2cc2d98ca71eb533d6e00ddd9e94e17805a93b47e74e","sha512":"0edb200aa59a7322293722253300a2c1d993f054c734c82b0fdfd47e50ac10a1d0526aa3604d09f11c25e3d69c35e95778da6044a6a20ddafb39e65152290206","ssdeep":"384:g2dL/BpuFqS0+m9/Uk5X6q8CVDxfAlypyKoFmGcjK3ZBo/kTxqz7mW7:NdL/BpuSCCwcE/FmGcjK3Z9VqOA","tlshash":"a182d0fd03467392f197f7b0a233a302d9983a0b5c986327157006b2b921e85bcd9add","first_seen":"2026-03-17T07:46:42.016159Z","last_seen":"2026-05-20T20:23:54.186487Z","times_seen":43,"resource_available":false,"data":null}},"time_used":376,"timings":{"blocked":160,"dns":15,"connect":29,"send":0,"wait":32,"receive":25,"ssl":112},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"i.ibb.co/dw6dpv9h/i.jpg","fqdn":"i.ibb.co","domain":"ibb.co","tld":"co"},"ip":{"addr":"45.43.142.6","port":443,"asn":215751,"as":"Mikhail Fedorov","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://slonz6cc.ru/","date":"2026-05-20T20:23:30.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ibb.co","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Wed, 15 Apr 2026 08:46:45 GMT","end":"Tue, 14 Jul 2026 08:46:44 GMT"},"fingerprint":{"sha1":"AB:FE:0C:54:E2:24:E0:D9:B7:F9:DC:18:02:C9:05:26:34:63:E8:65","sha256":"F0:A7:95:74:CF:C2:BC:7A:69:1D:6A:03:47:B4:D3:2A:76:24:DE:28:F8:31:95:41:B2:F8:86:C9:B3:F8:E3:01"}}},"request":{"raw":"GET /dw6dpv9h/i.jpg HTTP/1.1\r\nHost: i.ibb.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://slonz6cc.ru/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Wed, 20 May 2026 20:23:30 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 35512\r\nlast-modified: Tue, 24 Mar 2026 10:06:39 GMT\r\nexpires: Thu, 31 Dec 2037 23:55:55 GMT\r\ncache-control: max-age=315360000, public\r\naccess-control-allow-origin: *\r\naccess-control-allow-methods: GET, OPTIONS\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35512,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], progressive, precision 8, 640x640, components 3","md5":"5dd8a46af57400f02c7038aa4fdcbe5d","sha1":"f78b91cb43567aa86343ab572ee1eba57a52f997","sha256":"ab3714122a9755dadfbb6f2017372f7616eca90e6df5a14cd8d021bb6540e3bf","sha512":"2c33fc9dc304c5f18b57cd6fd19434cd28779817cf4a2236a8bf8cfbcfc3c0817c5a0b040ca737884817b16c29d8a57c74ffb97990a145cd3f9ea54c56a5af74","ssdeep":"768:G2igIr17ZqcdROdhKYAPQfWBIALb6fkRdL:uZqcdRQsYA9BD5","tlshash":"a9f2e01caed2dd85fcd503b22962f7a092e68309a5ff944f51920ba4c6807fd6e261d1","first_seen":"2026-05-19T23:05:30.391963Z","last_seen":"2026-07-14T02:49:57.581328Z","times_seen":7,"resource_available":false,"data":null}},"time_used":145,"timings":{"blocked":-1,"dns":3,"connect":23,"send":0,"wait":50,"receive":28,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}