{"report_id":"074a28b2-fa92-4159-be88-28c4a1b42d0b","version":0,"status":"done","tags":[],"date":"2026-08-25T21:16:26Z","url":{"schema":"http","addr":"tf2play.ru/","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"tf2play.ru/","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"title":"Скачать Team Fortress 2 бесплатно на русском — TF2PLAY.RU","dom":{"size":23540,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (482)","md5":"879498233ba08a35a3160c17a18389f7","sha1":"1401c5876924cc1d2f489cae5dffc3dd41dab83f","sha256":"c7c1831e3c7e7ac84ff6ddbe16ed86c4bf0d9b6418a6c3259aa3db9ed646aceb","sha512":"561f98955c9bc41fd8984c8fae9f1cb01ac9c384ee1ba0d86b2ea42f52647afc6a4ae3ce1fe4f7ba1e91aca3fcdc507eb36a8f7cd1a2e35532d43941adb22a2a","ssdeep":"384:zRR/mLEoaE7SnpHumaO+PhQFrtJhnF7H6742hhP+v01M39T:Dow+PhCrtJhnFf2hhPM39T","tlshash":"45b2852296f8286f1202918bee1477193daa41bfbb0e561175bc2e7d7fd2d058d3b20d","dom_hash":"domhash6622482289348fbf22481f091d44d217","first_seen":"2026-08-25T20:54:23.761419Z","last_seen":"2026-08-25T21:16:27.745306Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"tf2play.ru/","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:16:26Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"tf2play.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-10","domain_rank":0,"first_seen":"2026-08-25T20:54:19.810072Z","last_seen":"2026-08-25T20:54:19.810072Z","alert_count":18,"request_count":9,"received_data":506514,"sent_data":4427,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tf2play.ru/","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"3345561e0d0b557f5af2fb8cab095dda","sha1":"de28a1da478ec5fe758d42d31d97886de6ceee98","sha256":"b2529716934d8ab2893e09e041c54791551c5e23b27c9dc1e509cc75685d4014","sha512":"e36fdda4f7818f2514a71ee5cc50bd3ce07295bb9598adc78c8cf833f309e4d2decf7775da835d07c2521d66f4c61a963ef2024ea9890994257db1060f352679","ssdeep":"","tlshash":"c7f041e73c8a5038c3a302e13b73a24c303a243f340eac12b45c68523fa0e6514ab50c","size":615,"data":"","first_seen":"2026-08-25T20:54:23.810549Z","last_seen":"2026-08-25T21:16:27.754743Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tf2play.ru/assets/js/main.js","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"e8713b42238ecd8ebcc1406f7278f59a","sha1":"470a04574470ce3847cd7bb0fcd053b21772c699","sha256":"9ca4a0504e6993c54130ecdd633f278088635458bf35b2277781afe5bf66f614","sha512":"0eaf3fc6d3d7e91d69f8733dd76e990158fccd7f93bc571db82ee1dcc8d6783a1f1dbb283e2f63e161e8ff64bdcdee5dfb31c66dbcdf324afdf6d8d85320d0d4","ssdeep":"192:jo/tV2Yc/51lstk/gmoHcuLs333Uy3M33+ZlfYkhoO363QY:ZjlsG/gmo7A333J3M3elf7L363F","tlshash":"ef32a424a45921bb917363baea4a2a0cfbf1017f9502c3113dac86053ff5b651679ee8","size":10953,"data":"","first_seen":"2026-08-25T20:54:23.799698Z","last_seen":"2026-08-25T21:16:27.747245Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tf2play.ru/assets/js/main.js","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tf2play.ru/","date":"2026-08-25T21:15:59.446Z","timestamp":1787692559446,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tf2play.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:13:01 GMT","end":"Sun, 08 Nov 2026 19:13:00 GMT"},"fingerprint":{"sha1":"D1:3F:E7:59:53:6D:71:94:61:67:43:BB:BB:FA:ED:9D:E8:7C:2C:01","sha256":"F0:BD:23:6D:AD:B3:B3:3A:47:DA:4B:A3:83:1A:3E:EC:BD:D5:B4:D0:34:2E:14:D2:35:B2:03:46:E6:25:A5:F3"}}},"request":{"raw":"GET /assets/js/main.js HTTP/1.1\r\nHost: tf2play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tf2play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:15:59 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:02:13 GMT\r\netag: W/\"2bdd-659a33331995a\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11229,"size_decoded":4113,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"e8713b42238ecd8ebcc1406f7278f59a","sha1":"470a04574470ce3847cd7bb0fcd053b21772c699","sha256":"9ca4a0504e6993c54130ecdd633f278088635458bf35b2277781afe5bf66f614","sha512":"0eaf3fc6d3d7e91d69f8733dd76e990158fccd7f93bc571db82ee1dcc8d6783a1f1dbb283e2f63e161e8ff64bdcdee5dfb31c66dbcdf324afdf6d8d85320d0d4","ssdeep":"192:jo/tV2Yc/51lstk/gmoHcuLs333Uy3M33+ZlfYkhoO363QY:ZjlsG/gmo7A333J3M3elf7L363F","tlshash":"ef32a424a45921bb917363baea4a2a0cfbf1017f9502c3113dac86053ff5b651679ee8","first_seen":"2026-08-25T20:54:23.799698Z","last_seen":"2026-08-25T21:16:27.747245Z","times_seen":2,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tf2play.ru/assets/img/img-engineer.webp","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tf2play.ru/","date":"2026-08-25T21:15:59.735Z","timestamp":1787692559735,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tf2play.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:13:01 GMT","end":"Sun, 08 Nov 2026 19:13:00 GMT"},"fingerprint":{"sha1":"D1:3F:E7:59:53:6D:71:94:61:67:43:BB:BB:FA:ED:9D:E8:7C:2C:01","sha256":"F0:BD:23:6D:AD:B3:B3:3A:47:DA:4B:A3:83:1A:3E:EC:BD:D5:B4:D0:34:2E:14:D2:35:B2:03:46:E6:25:A5:F3"}}},"request":{"raw":"GET /assets/img/img-engineer.webp HTTP/1.1\r\nHost: tf2play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tf2play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:15:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 74030\r\nlast-modified: Tue, 11 Aug 2026 15:30:09 GMT\r\netag: \"1212e-658c7256e1ce8\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":74030,"size_decoded":74443,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 960x640, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"5394894eca86da74d05280fc5c285850","sha1":"932e25a2e91f74ea3350fd44e77c32c1f5fa80b6","sha256":"01d95f0898192fb4f971ba28f18751b8d4a2f0c55b004d3bf58c991ce4570b88","sha512":"7b77be0dbc2c7419a1d5af3fd0063d9fffef47fea3efb4e1d42c2688da58c0ca73e37e61bc0f91dc0b4731df848e3290298e6252b1617f7e05537dbac8703ccd","ssdeep":"1536:6KHIG1GzljrLFp8ouLDje1K/r6HvUk3qwAImPc4vR4JsRTBA:6c3GzljvFGVfje1xX3qnU4vRooBA","tlshash":"c2730255c62ef76a0688f3e4287d88bc49c6555022ee8f77b88dda8538f40546fb418b","first_seen":"2026-08-25T20:54:23.804824Z","last_seen":"2026-08-25T21:16:27.748036Z","times_seen":2,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tf2play.ru/assets/img/favicon.ico","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tf2play.ru/","date":"2026-08-25T21:15:59.793Z","timestamp":1787692559793,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tf2play.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:13:01 GMT","end":"Sun, 08 Nov 2026 19:13:00 GMT"},"fingerprint":{"sha1":"D1:3F:E7:59:53:6D:71:94:61:67:43:BB:BB:FA:ED:9D:E8:7C:2C:01","sha256":"F0:BD:23:6D:AD:B3:B3:3A:47:DA:4B:A3:83:1A:3E:EC:BD:D5:B4:D0:34:2E:14:D2:35:B2:03:46:E6:25:A5:F3"}}},"request":{"raw":"GET /assets/img/favicon.ico HTTP/1.1\r\nHost: tf2play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tf2play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:15:59 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 9598\r\nlast-modified: Tue, 11 Aug 2026 15:30:08 GMT\r\netag: \"257e-658c7255b2512\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9598,"size_decoded":10011,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 32x32 with \n- PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"05dba0b9e9165eee8d41d573bc48d78a","sha1":"2277df8fc0f573c08dc7b4982a15bf1a4e34fdf1","sha256":"2f113feedeb5f734e80bbf106c2f3cd4c47d24a3cd035d30840a8a2e5a652919","sha512":"0bd9c22e8a0c2dbe293df1e747e56c0ba3f79f21bee86b74e2851ccb9cf3c7fbbe140c958b736771d60b2cfc7323d55e122007d534268d7cfee492cc761c85e5","ssdeep":"192:o8c0romLw0eHyDh/ozOU/vzydfTCJvOYcEJWRANUnKyQAGsA2eMM:ob0romLr6Eo3/rbJv249evvzr5M","tlshash":"3812bfdbdb4d1e56d0b63554f2c24357f66bc0acda039a87e3fe49224b7c142861ae18","first_seen":"2026-08-25T20:54:23.807305Z","last_seen":"2026-08-25T21:16:27.749063Z","times_seen":2,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tf2play.ru/assets/img/hero-main.webp","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tf2play.ru/","date":"2026-08-25T21:15:59.450Z","timestamp":1787692559450,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tf2play.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:13:01 GMT","end":"Sun, 08 Nov 2026 19:13:00 GMT"},"fingerprint":{"sha1":"D1:3F:E7:59:53:6D:71:94:61:67:43:BB:BB:FA:ED:9D:E8:7C:2C:01","sha256":"F0:BD:23:6D:AD:B3:B3:3A:47:DA:4B:A3:83:1A:3E:EC:BD:D5:B4:D0:34:2E:14:D2:35:B2:03:46:E6:25:A5:F3"}}},"request":{"raw":"GET /assets/img/hero-main.webp HTTP/1.1\r\nHost: tf2play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tf2play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:15:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 163108\r\nlast-modified: Tue, 11 Aug 2026 15:30:08 GMT\r\netag: \"27d24-658c7255e74ca\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":163108,"size_decoded":163522,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"dbf10fceb85760edfc049c43d31685e2","sha1":"244b081658ca809dc9b9a9b97064ffbac405aef0","sha256":"8403d49b14a110fd4995b90fb3eb119ff2206b15c7b0a092b00a4e0206dbb120","sha512":"ba81b52992b24d976bb038d60afa500ce9b011e6ad47f8d5f5c659f1873297b3e78c1b64f174e43214c59baec66de2c54fd453fa1e7ba5ad96427cf94373de08","ssdeep":"3072:sNDm3VVqDOB/vGx4T5010i0RxUebApB1N6PYkyo4Wh8C4SO+H0loKod:sYlV47xwi0LugmsO+NK4","tlshash":"aef3221e95287951fdf8fd19070585287b865790a3cbe7ab0d36b7ad8ad803caa470f0","first_seen":"2026-08-25T20:54:23.802607Z","last_seen":"2026-08-25T21:16:27.749818Z","times_seen":2,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":120,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tf2play.ru/assets/img/logo-mark.webp","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tf2play.ru/","date":"2026-08-25T21:15:59.451Z","timestamp":1787692559451,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tf2play.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:13:01 GMT","end":"Sun, 08 Nov 2026 19:13:00 GMT"},"fingerprint":{"sha1":"D1:3F:E7:59:53:6D:71:94:61:67:43:BB:BB:FA:ED:9D:E8:7C:2C:01","sha256":"F0:BD:23:6D:AD:B3:B3:3A:47:DA:4B:A3:83:1A:3E:EC:BD:D5:B4:D0:34:2E:14:D2:35:B2:03:46:E6:25:A5:F3"}}},"request":{"raw":"GET /assets/img/logo-mark.webp HTTP/1.1\r\nHost: tf2play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tf2play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:15:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 54776\r\nlast-modified: Tue, 11 Aug 2026 15:30:10 GMT\r\netag: \"d5f8-658c7257b8e93\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":54776,"size_decoded":55188,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 512x512, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"51182bfe99061b7ac4e1a2f1d0184945","sha1":"d3635c8d88c64e13c23ddf62acbb28b5a63b7a29","sha256":"1c5e5abc4be2582db089dd105de32faad9c4384871439ab8d4cfd6266a472646","sha512":"62df7e1ba986aa257b6de146f5271b90beb2c714bfce25b8c945cc34be3aabc983779890115dc069887bd1d64251a59bbc9ad22304ca5ce227a82708a241d309","ssdeep":"1536:DzwrBTcZVlyOk70aLflH7vXwd/XGee6QOVmwyuTD/Vt:DzAIVwOHapbvXfoNy4D/Vt","tlshash":"1233029ed2078ae4795b7714a052b799b27c4f2207a353e25d53c0686264f3bcbe821f","first_seen":"2026-08-25T20:54:23.78598Z","last_seen":"2026-08-25T21:16:27.750859Z","times_seen":2,"resource_available":false,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":117,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tf2play.ru/assets/img/img-soldier.webp","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://tf2play.ru/","date":"2026-08-25T21:15:59.733Z","timestamp":1787692559733,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tf2play.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:13:01 GMT","end":"Sun, 08 Nov 2026 19:13:00 GMT"},"fingerprint":{"sha1":"D1:3F:E7:59:53:6D:71:94:61:67:43:BB:BB:FA:ED:9D:E8:7C:2C:01","sha256":"F0:BD:23:6D:AD:B3:B3:3A:47:DA:4B:A3:83:1A:3E:EC:BD:D5:B4:D0:34:2E:14:D2:35:B2:03:46:E6:25:A5:F3"}}},"request":{"raw":"GET /assets/img/img-soldier.webp HTTP/1.1\r\nHost: tf2play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tf2play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:15:59 GMT\r\ncontent-type: image/webp\r\ncontent-length: 82458\r\nlast-modified: Tue, 11 Aug 2026 15:30:10 GMT\r\netag: \"1421a-658c72575fcaf\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":82458,"size_decoded":82871,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 960x640, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"24646f0f3cc7e32271f7460c10b44278","sha1":"3591e06b2f3b22579063ddc0d81d80eb2771e67f","sha256":"cb6da24f8a39a4e4bbc2d40a19ceb44f22c1fc98fb74dd1c3ecb4d97f2d57f47","sha512":"c47d6aeb340a292a3bd9f9e34c6220678fa2527004c4118493c854d52ea329693f0d02e47114ded004ac15e4146ee00967ef01e5ffaa9aa403c8840402051bc7","ssdeep":"1536:XSEy6IBNc8XV4QZfkPZrot2o4CuZ01tX489Yq2WesyyNABQiQMw+sN:C76IjNFJJkPZrofOi1t5ssy/Gcw+sN","tlshash":"cf83028a93f8519b5311c1fe62975bcddde9c8b28060b7624c13ae99c9d4984fdf41c3","first_seen":"2026-08-25T20:54:23.789769Z","last_seen":"2026-08-25T21:16:27.7518Z","times_seen":2,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":42,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tf2play.ru/assets/img/icon-180.png","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tf2play.ru/","date":"2026-08-25T21:15:59.790Z","timestamp":1787692559790,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tf2play.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:13:01 GMT","end":"Sun, 08 Nov 2026 19:13:00 GMT"},"fingerprint":{"sha1":"D1:3F:E7:59:53:6D:71:94:61:67:43:BB:BB:FA:ED:9D:E8:7C:2C:01","sha256":"F0:BD:23:6D:AD:B3:B3:3A:47:DA:4B:A3:83:1A:3E:EC:BD:D5:B4:D0:34:2E:14:D2:35:B2:03:46:E6:25:A5:F3"}}},"request":{"raw":"GET /assets/img/icon-180.png HTTP/1.1\r\nHost: tf2play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tf2play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:15:59 GMT\r\ncontent-type: image/png\r\ncontent-length: 62095\r\nlast-modified: Tue, 11 Aug 2026 15:30:08 GMT\r\netag: \"f28f-658c7255d9236\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":62095,"size_decoded":62506,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"066d41f3251e4eb13a878b90c5496166","sha1":"48ca16f4e77b8c8208e62bc2fecad498d11cdc13","sha256":"b6a9fb7c3fb0124aaa0daa8790feec4371870555e99a3b19c478c794e4e69ed8","sha512":"bf8f9b8a668397178c7149b404d87ccd1e22d35ecaab595973953e44ab5e31b638ce1471e78ae5ad186ec0e6443415a9fa92349f005042364f07c5d265ac9d12","ssdeep":"1536:7JEFHocYD5ntjvYsGGji4sG1uoVS8B9hP+KhNjq89arp1GiP:dEucK5ntLYdG+hq9wKhNmoarvr","tlshash":"225302aa919b82cecb346dda4e244d4eb6b819581f036fd1bc31d91dcd88bdd84e1c70","first_seen":"2026-08-25T20:54:23.794212Z","last_seen":"2026-08-25T21:16:27.752373Z","times_seen":2,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":58,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tf2play.ru/","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:15:59.118Z","timestamp":1787692559118,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tf2play.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:13:01 GMT","end":"Sun, 08 Nov 2026 19:13:00 GMT"},"fingerprint":{"sha1":"D1:3F:E7:59:53:6D:71:94:61:67:43:BB:BB:FA:ED:9D:E8:7C:2C:01","sha256":"F0:BD:23:6D:AD:B3:B3:3A:47:DA:4B:A3:83:1A:3E:EC:BD:D5:B4:D0:34:2E:14:D2:35:B2:03:46:E6:25:A5:F3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tf2play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:15:59 GMT\r\ncontent-type: text/html\r\ncontent-length: 6620\r\nlast-modified: Sat, 22 Aug 2026 13:54:17 GMT\r\netag: \"5c4b-659a316cfe199-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":23627,"size_decoded":7081,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (476)","md5":"8583e88be191cde22af3f32a2b387e19","sha1":"070d409c35f3a7011d6358cf8ceeab58fdab5b31","sha256":"79d88c4f1d3a7c9ca847572e213a57480925d5b72c832cdb1acaae69a38095e6","sha512":"16ce49f61dba577f4790cf77d2968649efe4d61980ce04a254a9253cc80817a340f40d3e6d920436e2d3a012179312150b25e669f606edfb13712038a6572a46","ssdeep":"384:RRR/mLEoaE7jnpVumHO+PhFAYrtJhnFUH67NphhP+v01X393:aaj+Ph5rtJhnFPphhPX393","tlshash":"1aa2752296f8186f52029187ee147b193eaa41bf7b0e561175bc2a7d3fd2d05cd3b20d","first_seen":"2026-08-25T20:54:23.797225Z","last_seen":"2026-08-25T21:16:27.752994Z","times_seen":2,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":0,"dns":3,"connect":40,"send":0,"wait":57,"receive":0,"ssl":46},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tf2play.ru/assets/css/style.css","fqdn":"tf2play.ru","domain":"tf2play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tf2play.ru/","date":"2026-08-25T21:15:59.444Z","timestamp":1787692559444,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tf2play.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:13:01 GMT","end":"Sun, 08 Nov 2026 19:13:00 GMT"},"fingerprint":{"sha1":"D1:3F:E7:59:53:6D:71:94:61:67:43:BB:BB:FA:ED:9D:E8:7C:2C:01","sha256":"F0:BD:23:6D:AD:B3:B3:3A:47:DA:4B:A3:83:1A:3E:EC:BD:D5:B4:D0:34:2E:14:D2:35:B2:03:46:E6:25:A5:F3"}}},"request":{"raw":"GET /assets/css/style.css HTTP/1.1\r\nHost: tf2play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tf2play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:15:59 GMT\r\ncontent-type: text/css\r\ncontent-length: 5579\r\nlast-modified: Tue, 11 Aug 2026 15:30:08 GMT\r\netag: \"550e-658c7255ab7b0-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":21774,"size_decoded":6040,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"2c4e8e93cbd0d948c704de77696ed5f2","sha1":"d6e16a988bac0bbdd401e7bb306fa18300d806e7","sha256":"775a6e291962c2f90e946ef6e2d14fe473e871d7586cdb1186f46a21484eb34f","sha512":"93fa9aedc1e752f8e078b4c37264e93e0c0f6ea2363bca24f281ec0016c280ae8f601378d9549d01915d052d0877d3e3b57f7ddef3781f9376fef8301e45d113","ssdeep":"384:2XznVVhgtF3jdB4wkWQPkXLZVkgx5qtw9wnE9G1/UoMnbNnQ:2TVVe73jdB4wkWQ8XLZVkg5b9wnEgdYa","tlshash":"48a296425f244138b827e6a9778b9b4ef32860128509d97d6fe5001cdece3fc91ae79d","first_seen":"2026-08-25T20:54:23.769845Z","last_seen":"2026-08-25T21:16:27.753841Z","times_seen":2,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tf2play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}