{"report_id":"21b6da48-0708-43c0-a453-db5fdb411203","version":6,"status":"done","tags":[],"date":"2025-10-23T12:53:41Z","url":{"schema":"https","addr":"webaccount.com.ru/","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":0,"asn":0,"as":"","country":"Israel","country_code":"IL"},"final":{"url":{"schema":"https","addr":"webaccount.com.ru/login","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"title":"Proton Account: Sign-in"},"submit":{"url":{"schema":"https","addr":"webaccount.com.ru/","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":0,"asn":0,"as":"","country":"Israel","country_code":"IL"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2026-11-27T12:53:41Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null},"summary":[{"fqdn":"webaccount.com.ru","ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"domain_registered":"2024-11-01","domain_rank":0,"first_seen":"2025-10-23T05:37:39.332813Z","last_seen":"2025-10-23T05:37:39.332813Z","alert_count":57,"request_count":19,"received_data":4811541,"sent_data":10291,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":[{"sensor_name":"suricata","description":"Suricata /w Emerging Threats Pro","alerts":null}],"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/pre.d37bce5a.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"introduction_type":"scriptElement","is_inline":false,"md5":"3ac83380b8c2e213f60db68515db6842","sha1":"0ae99d83653935d7f6bf45cbe8718e67538ee0bc","sha256":"cb95f82952a34257116019ca275895b0d5912a07e913c80061632e62ce1b8312","sha512":"995b48e298d45fce780c8dd29ffb0d1737e82c9d5cb4d3e72cd73701133e38b3cdcf042b4486bc0ce7031319fcc4e1c5507e610d01894eab3aa28ad5f03dab7e","ssdeep":"","tlshash":"3a01f170e030782565328ccbe23f4a9337492477928d46661511eff810b85caf43f8ea","size":799,"data":"","first_seen":"2025-10-23T12:46:24.36423Z","last_seen":"2025-10-23T12:53:47.677238Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/runtime.1d192064.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"introduction_type":"scriptElement","is_inline":false,"md5":"ad7a91752e25b10453e0a57b8d7523d1","sha1":"e7b95026e48b8ffbc0b5ea482ac16f99878928dc","sha256":"e69ccd6adbf4430be526355284002cce9d1c950a0c9ded6f282742fed888df85","sha512":"bf4840b6f3be958f94ccbd5d4ab4d0103dc25917d49cf105fb4b0326f5807b76a8b5c01c2dfc143ae24d61e4a961a84255a46501b885ce9a60788cfc3f1ac7f6","ssdeep":"768:quVwxXWQAbc0OP2EC57uWvl6L/pjdgu1+nroL0:quVWn0QCRuGl6djJMrj","tlshash":"3af295c81e12fd9b6df94ec8261142e9a0ac9339203995c5a0ad4ff871a5d5f0f7cdb2","size":35512,"data":"","first_seen":"2025-10-23T12:46:24.379172Z","last_seen":"2025-10-23T12:53:47.687142Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/unsupported.739efae3.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"introduction_type":"scriptElement","is_inline":false,"md5":"6f99f9353db067827b9744b77ee21b0c","sha1":"896d0361685ad2b93d2def1e58205e875e498369","sha256":"ea27ad0808469cedfa6ac5dc0d58b3bd9763702f97ce96f4ebc8a419fac8f859","sha512":"83a83d913ec816df45150a0e6c20cda9c0fa3c35e636817e1f6e037f494f885e4e4bc110dca37b1966fea6b0f86fe872fb7f171a052964dc462142ba51ac2679","ssdeep":"","tlshash":"a851427000f9252622a354d1e5391b437e01547f8b8be542f15d5be02be6d5de83f2e8","size":2694,"data":"","first_seen":"2025-10-23T12:46:24.362098Z","last_seen":"2025-10-23T12:53:47.680459Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/public-index.62ee47b0.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"introduction_type":"scriptElement","is_inline":false,"md5":"fa4bc90a3b5b5427caf66b189347c389","sha1":"1e90421e77a9df8aa6d84d926225b0b1ca130bf3","sha256":"dba832b9c3a6b63682149a087d94a70555f6bd67cf12753cd07086b63913a9ca","sha512":"f1b9379885c91769e19033aadb221a945fdeb0109d8c383a829db416c74dd26c5b5596c549d9d2dfc9787fb58378ab3c2020c28c410553f087923049b20ac032","ssdeep":"49152:1g8QDwenxC5lQS4hdEI67LXw1XJb8y1zSIy:6+C8wSz","tlshash":"3dd57dc5b363f5b9e3ab85e5d42f4008b23d2d44654d84a4fbd89d882499cc8f273fa9","size":2868428,"data":"","first_seen":"2025-10-23T12:46:24.394095Z","last_seen":"2025-10-23T12:53:47.696002Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/crypto-worker.5aeed0e1.chunk.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.872Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/crypto-worker.5aeed0e1.chunk.js HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default; Domain=proton.me\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:18 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 376905\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 10:58:24 GMT\r\netag: \"4296c650fe40159e32ac440502d68273\"\r\ncache-control: max-age=1209600, public\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":376905,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (37362)","md5":"4296c650fe40159e32ac440502d68273","sha1":"5d803b20a57732db76496e747a20f1ca1e3038e1","sha256":"bf79992f69b128aea41d14d66f02fa7a83312cf37313ef6dca988a28844ed45f","sha512":"1c3f7091c9091c57bcb7f675797ac8f2427abfff18b32c27629f2fa1345bcbb4f9fd27b935ddf11fc08cc63f6371a3b5a4d4676cd0c78519da7dcdee61adc954","ssdeep":"6144:uCbkHE2UAer9bS9bzy9IQXwD3Wo39aSQoEUdt8H8hgBdGNCP4Tm3dHlrWWz:AHRp0z","tlshash":"d9840a997b72b062c3d671b2807b4102f37b599c186d0a18f355ed8f38a898993b7f35","first_seen":"2025-10-17T03:39:46.909925Z","last_seen":"2025-10-23T12:53:47.66586Z","times_seen":4,"resource_available":false,"data":null}},"time_used":276,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":163,"receive":113,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/InterVariable.c504db5c06caaf7cdfba.woff2","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:16.231Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/InterVariable.c504db5c06caaf7cdfba.woff2 HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nReferer: https://webaccount.com.ru/assets/static/public-index.0fae0813.css\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:16 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 352240\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 12:47:24 GMT\r\netag: \"2bf3d951bf9d6109437ea0874bbf12fb\"\r\ncache-control: max-age=600, s-maxage=3600, must-revalidate\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":352240,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 352240, version 4.66","md5":"2bf3d951bf9d6109437ea0874bbf12fb","sha1":"f55b18fdf5a4fbca23e23010fbe89df27d70d1ff","sha256":"693b77d4f32ee9b8bfc995589b5fad5e99adf2832738661f5402f9978429a8e3","sha512":"9c34339e338bc88488195216a834004c3cc2934896df8a5849c26801a88c7a4c4d84563d9cdae449d81bb379549f69f57c5fb9b199826adb8a88c3eb7d22bac1","ssdeep":"6144:NXxnNQ1mzp/C4K2K9y0deanlT3TPkHW644MVz66Z2YS78Eq/H493abRLF/VBoGuB:RxnNXpq4XF0tTPk2jzRkYS8/GabjC+a","tlshash":"fc742337370464501452c3aca8a70a57e6302de69fda07ecc7ae84e8899ca797f1f74d","first_seen":"2024-11-16T09:12:47.72962Z","last_seen":"2026-08-06T13:51:30.413909Z","times_seen":15404,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":201,"receive":117,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/favicon.ico","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.171Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/favicon.ico HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:17 GMT\r\ncontent-type: image/vnd.microsoft.icon\r\ncontent-length: 33310\r\naccept-ranges: bytes\r\netag: \"821e-641d14ad97700\"\r\nlast-modified: Thu, 23 Oct 2025 10:57:00 GMT\r\nset-cookie: Domain=proton.me; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=7776000\nTag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":33310,"size_decoded":0,"mime_type":"image/vnd.microsoft.icon","magic":"MS Windows icon resource - 5 icons, 16x16, 32 bits/pixel, 24x24, 32 bits/pixel","md5":"81245fb430265f55ddc12892b0d708c5","sha1":"aa3418fbe91fb9b1f7ce230e2e6d970ec02445d8","sha256":"b14b9633f3e695331dd486d257ba034ae6b807c950ea52c37ac37432982ec853","sha512":"8f0f9c2d0ec8a9c2b9c563d709f3069af09db5897c76715c4db4645ad16fc3ff8fca9ce78666a698812dff02d6d8f79c89b4593f4305409b03661f5657232c8a","ssdeep":"192:H8IAdhqQG1GsJjMQnf1tK5j4fP+/tHgLnnxhlUOLxWJwCs3w3e3d3idb3fN:cIAKQcJtnfysotALnxh3omfgONSBP","tlshash":"d7e254e2e49d815dec4704f88cf9f4f6b5e89685a8c6b6e722005433cab1627b137727","first_seen":"2023-11-11T19:57:42Z","last_seen":"2026-07-28T08:03:11.431722Z","times_seen":60,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/file-icons.513b6cf6e3f2d0fb7e72.svg","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.180Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/file-icons.513b6cf6e3f2d0fb7e72.svg HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:17 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 61659\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 12:47:22 GMT\r\netag: \"9bdc5dce2a96eb0fcf48dd58af300259\"\r\ncache-control: max-age=600, s-maxage=3600, must-revalidate\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61659,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"9bdc5dce2a96eb0fcf48dd58af300259","sha1":"403ba2db621df34d580d8c38b18c55dd56736912","sha256":"2c5923ea987c0d14e1e773ec114b58c6cf6880fc429ea6732540dda66d355281","sha512":"37dc86b98091418a3fb98d9ccf994fa61271e1af5e1ac9d9d5cbde516314c935aeb3133fd98003f69c5f293ee546f9b935ba24b22e43c5847ec113386a9b270c","ssdeep":"768:EFtMrxdrnjaRrR+eOC0aZzDv1nDXAFRHOGG2+D851+jDc2bHOi6N6UDa2Ss:sgrneD+7CjZXqMY8cks","tlshash":"4353d8d0d398a0f4d802d7f8ca6a7471717a24fe2f5b918cb1a4a560a2742ed4df9dc3","first_seen":"2025-06-14T13:34:21.55285Z","last_seen":"2026-08-05T07:58:14.285642Z","times_seen":110,"resource_available":false,"data":null}},"time_used":186,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":125,"receive":61,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/%61%73%73%65%74%73/%68%6f%73%74%2e%70%6e%67","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.223Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /%61%73%73%65%74%73/%68%6f%73%74%2e%70%6e%67 HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/assets/static/public-index.0fae0813.css\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 42\r\naccept-ranges: bytes\r\netag: \"2a-641d14ad97700\"\r\nlast-modified: Thu, 23 Oct 2025 10:57:00 GMT\r\nset-cookie: Domain=proton.me; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=7776000\nTag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":42,"size_decoded":0,"mime_type":"image/png","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-08-06T13:48:25.297237Z","times_seen":1022336,"resource_available":true,"data":null}},"time_used":163,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":163,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/api/auth/v4/sessions","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.546Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"POST /api/auth/v4/sessions HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/vnd.protonmail.v1+json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/login\r\nx-pm-appversion: web-account@5.0.302.1\r\nx-enforce-unauthsession: true\r\nx-pm-locale: en_US\r\nOrigin: https://webaccount.com.ru\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default; Domain=proton.me\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nContent-Length: 0\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:17 GMT\r\ncontent-type: application/json\r\ncontent-length: 184\r\naccess: application/vnd.protonmail.api+json;apiversion=4\r\ncache-control: max-age=0, must-revalidate, no-cache, no-store, private\r\ncontent-encoding: gzip\r\nexpires: Fri, 04 May 1984 22:15:00 GMT\r\nset-cookie: Session-Id=aPolPYUCXvJVuBF4yEGNpgAAA8Y; Domain=proton.me; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=7776000\nTag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nvary: Accept-Encoding\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":198,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"c7d22dd752ddbba6a327ad318d9e141b","sha1":"d54bda49f5f2662298794c8248e1725720cfecb8","sha256":"e94fedbe337c5b55cd3c766c8a75a7e11a681bdefa98c05d4802d0992fd5922a","sha512":"cd78cd1b0be1b0574889b62b1469f281a14356e8cb0e49b25d14ee4288625d1f506f8fea8b7f98760cd310fe3044336714b2fb10089918c167b9b8ee58ecba89","ssdeep":"","tlshash":"b4d022ce9e8b8db00270088070e74d936a091008a00c9304bd4a36f88a16c73332b535","first_seen":"2025-10-23T12:53:47.671849Z","last_seen":"2025-10-23T12:53:47.671849Z","times_seen":1,"resource_available":false,"data":null}},"time_used":194,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":194,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/api/core/v4/auth/cookies","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.750Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"POST /api/core/v4/auth/cookies HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/vnd.protonmail.v1+json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/login\r\nx-pm-appversion: web-account@5.0.302.1\r\nx-pm-uid: zqdcjj67h3us6g4tnmfvrmqxifkug3sk\r\nAuthorization: Bearer rzgqingjwnbi5f3ytnq7cn4zax7x3wrk\r\nx-pm-locale: en_US\r\ncontent-type: application/json\r\nContent-Length: 232\r\nOrigin: https://webaccount.com.ru\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default; Domain=proton.me\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:18 GMT\r\ncontent-type: application/json\r\ncontent-length: 101\r\naccess: application/vnd.protonmail.api+json;apiversion=4\r\ncache-control: max-age=0, must-revalidate, no-cache, no-store, private\r\ncontent-encoding: gzip\r\nexpires: Fri, 04 May 1984 22:15:00 GMT\r\nset-cookie: REFRESH-zqdcjj67h3us6g4tnmfvrmqxifkug3sk=%7B%22ResponseType%22%3A%22token%22%2C%22ClientID%22%3A%22WebAccount%22%2C%22GrantType%22%3A%22refresh_token%22%2C%22RefreshToken%22%3A%22uxgg6gpxrgm655f2et3iod5xleesoog6%22%2C%22UID%22%3A%22zqdcjj67h3us6g4tnmfvrmqxifkug3sk%22%7D; path=/api/auth/refresh; secure; httponly; samesite=strict\nAUTH-zqdcjj67h3us6g4tnmfvrmqxifkug3sk=ygxt4ey3xtwtxe7enhelng7xmoj53jav; path=/api/; secure; httponly; samesite=strict\nSession-Id=aPolPePMA4IiGiiFjNArEQAAAAE; Domain=proton.me; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=7776000\nTag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nvary: Accept-Encoding\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":85,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"b147973ef13a6306b6e265a318dd2370","sha1":"555df65287eb3f2ad544ad1956bea13085f47094","sha256":"98ce5799828918a6b175564bd7d256a8e86f0caa0034a0319dda15f498644f43","sha512":"8677fd81b5460e69693d1aa7585bb68bf63b3f0f34f33931b5dbe65359eee9b57d95d58f5f03f2d821853f6602f299391273368c3ff8bdabe5bac0be081fa773","ssdeep":"","tlshash":"2aa011808c0b8880003a00abb0a30020a08c202caa00a288e00c22b0ce8bcf80b03b30","first_seen":"2025-10-23T12:53:47.673923Z","last_seen":"2025-10-23T12:53:47.673923Z","times_seen":1,"resource_available":false,"data":null}},"time_used":546,"timings":{"blocked":6,"dns":0,"connect":0,"send":0,"wait":540,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-10-23T12:53:15.478Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:15 GMT\r\ncontent-type: text/html; charset=UTF-8\r\ncontent-length: 1730\r\naccept-ranges: bytes\r\ncache-control: max-age=0, no-cache, no-store, must-revalidate\r\ncontent-encoding: gzip\r\nexpires: Wed, 11 Jan 1984 05:00:00 GMT\r\nlast-modified: Thu, 23 Oct 2025 10:57:00 GMT\r\npragma: no-cache\r\nset-cookie: Session-Id=aPolO1pB2L1tVKxvIdUgjQAAABI; Domain=proton.me; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=7776000\nTag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nvary: Accept-Encoding\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nonion-location: https://account.protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7163,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (7163), with no line terminators","md5":"fd679e1849f56446cc5764b5203f1185","sha1":"d8a1dd99c31f507d48c46e9deeba4f7b169b2089","sha256":"b48ab8c6b5d93de9134828127be5b868534f36413435c028533d4d8fe3c3bc28","sha512":"900f79d4a67b8d863d5cc738af2d34806d29353977eab4382c0e649e23c25ebe1a3972affd699d7d40d2c961a90d9a0a8f83f957a87a5fc9bc2907b39ef72fdf","ssdeep":"96:vT9oDp56YR9G9ouPdzrRy//rNOiaFFb9Rv/a:vT9oDR9JuPlrRu/ROiqpLS","tlshash":"46e1aab39420988e6771a68ee90375dcc113252fc5e5ec6cb3d99b9715e1fe00a63837","first_seen":"2025-10-23T12:46:24.377114Z","last_seen":"2025-10-23T12:53:47.675727Z","times_seen":2,"resource_available":false,"data":null}},"time_used":343,"timings":{"blocked":80,"dns":54,"connect":9,"send":0,"wait":175,"receive":1,"ssl":20},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/pre.d37bce5a.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:15.921Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/pre.d37bce5a.js HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:16 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 799\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 10:58:50 GMT\r\netag: \"3ac83380b8c2e213f60db68515db6842\"\r\ncache-control: max-age=1209600, public\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":799,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (758)","md5":"3ac83380b8c2e213f60db68515db6842","sha1":"0ae99d83653935d7f6bf45cbe8718e67538ee0bc","sha256":"cb95f82952a34257116019ca275895b0d5912a07e913c80061632e62ce1b8312","sha512":"995b48e298d45fce780c8dd29ffb0d1737e82c9d5cb4d3e72cd73701133e38b3cdcf042b4486bc0ce7031319fcc4e1c5507e610d01894eab3aa28ad5f03dab7e","ssdeep":"","tlshash":"3a01f170e030782565328ccbe23f4a9337492477928d46661511eff810b85caf43f8ea","first_seen":"2025-10-23T12:46:24.36423Z","last_seen":"2025-10-23T12:53:47.677238Z","times_seen":2,"resource_available":true,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":196,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/public-index.62ee47b0.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:15.923Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/public-index.62ee47b0.js HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:16 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 2868428\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 10:58:27 GMT\r\netag: \"fa4bc90a3b5b5427caf66b189347c389\"\r\ncache-control: max-age=1209600, public\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2868428,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (64132), with no line terminators","md5":"852048c2082db6b8ebdfae9af81abaa4","sha1":"2427c7e5b408c63b54008ca36902820fb43306d8","sha256":"be3fbc4dd2339fcacec06473444348803ebe06502e7d00b746804f155c2836c8","sha512":"11ca5e78cf46598c7913cf1f269c12383be1d13c56d5ba2c1525ffa5589a7d0d81e1cd61281509ebd53b1d73fe4a465fe429060800a3868767bd643130e7c37e","ssdeep":"12288:1vo+6WpIM3XiwbSb0/XYpRuFCc60wwbdErD:1gtHGQpJ3wg","tlshash":"d5253dc5f362faace56bc8d5942b800c723d6e48d72d44b4fae89d4411898c8f653fad","first_seen":"2025-10-23T12:53:47.678601Z","last_seen":"2025-10-23T12:53:47.678601Z","times_seen":1,"resource_available":false,"data":null}},"time_used":516,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":234,"receive":282,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/unsupported.739efae3.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:15.925Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/unsupported.739efae3.js HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:16 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 2694\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 10:58:29 GMT\r\netag: \"6f99f9353db067827b9744b77ee21b0c\"\r\ncache-control: max-age=1209600, public\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2694,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (842)","md5":"6f99f9353db067827b9744b77ee21b0c","sha1":"896d0361685ad2b93d2def1e58205e875e498369","sha256":"ea27ad0808469cedfa6ac5dc0d58b3bd9763702f97ce96f4ebc8a419fac8f859","sha512":"83a83d913ec816df45150a0e6c20cda9c0fa3c35e636817e1f6e037f494f885e4e4bc110dca37b1966fea6b0f86fe872fb7f171a052964dc462142ba51ac2679","ssdeep":"","tlshash":"a851427000f9252622a354d1e5391b437e01547f8b8be542f15d5be02be6d5de83f2e8","first_seen":"2025-10-23T12:46:24.362098Z","last_seen":"2025-10-23T12:53:47.680459Z","times_seen":2,"resource_available":true,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":181,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/sprite-icons.089121a9ce6713559016.svg","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/sprite-icons.089121a9ce6713559016.svg HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:17 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 330402\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 12:47:22 GMT\r\netag: \"93b0e8b4f1655a9c16eb9ac4d6ecd3de\"\r\ncache-control: max-age=600, s-maxage=3600, must-revalidate\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":330402,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"93b0e8b4f1655a9c16eb9ac4d6ecd3de","sha1":"0d0603de58990dfdbc21c13692c676e8626fc407","sha256":"3b40a2186115efa8ac2d388a808fad191197a56fc016dbbaf79a4c267c39739c","sha512":"6bc0ae0a3cb25a4d2a3768c3271c8ea49c2de7f87def25c5dc9ead6983385eace05f9f54bdb9f7901b6d80ce87f7a71be710908f01771139184cb88ecb72cd51","ssdeep":"1536:FlkWdTJy5zgk/P+OGsPAHQXFtDykI4yOp6/TNm2rO6dKmUYO0ijWt/PhUx/3Y+M/:8QoPAwya6YoO0ijWtSOPUr54p","tlshash":"a164a4f9076c52cca547dbbcfb2b90a1a31f78bd7e9ac5e4189ec6b42423154d94bc80","first_seen":"2025-10-17T03:39:46.876968Z","last_seen":"2025-10-30T16:06:07.045538Z","times_seen":6,"resource_available":false,"data":null}},"time_used":385,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":219,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/crypto-worker.5aeed0e1.chunk.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.424Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/crypto-worker.5aeed0e1.chunk.js HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/login\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default; Domain=proton.me\r\nSec-Fetch-Dest: worker\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:17 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 376905\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 10:58:24 GMT\r\netag: \"4296c650fe40159e32ac440502d68273\"\r\ncache-control: max-age=1209600, public\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":376905,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (37362)","md5":"4296c650fe40159e32ac440502d68273","sha1":"5d803b20a57732db76496e747a20f1ca1e3038e1","sha256":"bf79992f69b128aea41d14d66f02fa7a83312cf37313ef6dca988a28844ed45f","sha512":"1c3f7091c9091c57bcb7f675797ac8f2427abfff18b32c27629f2fa1345bcbb4f9fd27b935ddf11fc08cc63f6371a3b5a4d4676cd0c78519da7dcdee61adc954","ssdeep":"6144:uCbkHE2UAer9bS9bzy9IQXwD3Wo39aSQoEUdt8H8hgBdGNCP4Tm3dHlrWWz:AHRp0z","tlshash":"d9840a997b72b062c3d671b2807b4102f37b599c186d0a18f355ed8f38a898993b7f35","first_seen":"2025-10-17T03:39:46.909925Z","last_seen":"2025-10-23T12:53:47.66586Z","times_seen":4,"resource_available":false,"data":null}},"time_used":334,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":162,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/api/feature/v2/frontend?sessionId=239777790\u0026appName=-\u0026environment=default","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:18.310Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /api/feature/v2/frontend?sessionId=239777790\u0026appName=-\u0026environment=default HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/login\r\nx-pm-appversion: web-account@5.0.302.1\r\nauthorization: -\r\nunleash-sdk: unleash-client-js:3.7.8\r\nunleash-appname: -\r\nunleash-connection-id: 5c05cb54-3488-4b41-bf5b-d1154967f54b\r\nx-pm-uid: zqdcjj67h3us6g4tnmfvrmqxifkug3sk\r\nx-pm-locale: en_US\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: AUTH-zqdcjj67h3us6g4tnmfvrmqxifkug3sk=ygxt4ey3xtwtxe7enhelng7xmoj53jav; Tag=default; Domain=proton.me\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:18 GMT\r\ncontent-type: application/json\r\ncontent-length: 1336\r\naccess: application/vnd.protonmail.api+json;apiversion=2\r\ncache-control: max-age=0, must-revalidate, no-cache, no-store, private\r\ncontent-encoding: gzip\r\nexpires: Fri, 04 May 1984 22:15:00 GMT\r\nset-cookie: Session-Id=aPolPsC0XpQwkt0dGi5tkgAAA1k; Domain=proton.me; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=7776000\nTag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nvary: Accept-Encoding\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10954,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"5724435ea31899606f1636b35746ae84","sha1":"da3adf65cfdbc9fcf54e02e96c9f5f617c6eb0b8","sha256":"60b9931b956e843ceb0dca917cce002829882c7d65c6f6bc521a6ad4013e0a11","sha512":"f2c4c3b1d631af00128bd0d88cf8b185a3a706dd07c97d8039000e4e8d246151a93606d862051db18c6f45f725136b9d5de16c0de868baae99738a9deaa7f9e3","ssdeep":"48:Y9CxpqfeRjElkFjxTcBHpx22NrqP7dmlzm4IWuNP40xhxwxvLOxGv7urFN9NNWx8:AJyNqxTxmDIlz7TeP40xjwxvPv7+fgYR","tlshash":"3f3248ad49313cffad44ca40c72f566f6738c87f729a2ca890598d3c269f9a51b11c72","first_seen":"2025-10-23T12:53:47.683787Z","last_seen":"2025-10-23T12:53:47.683787Z","times_seen":1,"resource_available":false,"data":null}},"time_used":280,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":279,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/public-index.0fae0813.css","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:15.915Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/public-index.0fae0813.css HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:16 GMT\r\ncontent-type: text/css\r\ncontent-length: 320586\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 10:58:21 GMT\r\netag: \"a44901df33dac49140e7b2d2c46ae4c5\"\r\ncache-control: max-age=1209600, public\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":320586,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"a44901df33dac49140e7b2d2c46ae4c5","sha1":"d1adb5c470def01d57824c8085a4ad05bfb4c6c9","sha256":"9ea800475d9c8340f5a3c4288bbc8197ca97b34bebd2da9847a75085ea4896b5","sha512":"e9ddc548e1f1773d11423834d08060659b3a1ba23ec47f722103ec1a1d7df39085bf12ea9a7b119850747546fb665e1fb11e0589437dfe70e8f54ad69ff1ab23","ssdeep":"6144:NlrZAOzLErr3omu4rbPKN7kz49samB7QsNIoWS9Dg:NlrZAOzLErr3omu4rbyN7kz4BM9uog","tlshash":"5964a7cfde9271bd3967431453d9a3d8a3253c61cc006af9f163d2105bcb3b6292b66a","first_seen":"2025-10-23T12:46:24.385244Z","last_seen":"2025-10-23T12:53:47.685443Z","times_seen":2,"resource_available":false,"data":null}},"time_used":253,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":153,"receive":100,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/runtime.1d192064.js","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:15.919Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/runtime.1d192064.js HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:16 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 35512\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 10:58:23 GMT\r\netag: \"ad7a91752e25b10453e0a57b8d7523d1\"\r\ncache-control: max-age=1209600, public\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":35512,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (16547)","md5":"ad7a91752e25b10453e0a57b8d7523d1","sha1":"e7b95026e48b8ffbc0b5ea482ac16f99878928dc","sha256":"e69ccd6adbf4430be526355284002cce9d1c950a0c9ded6f282742fed888df85","sha512":"bf4840b6f3be958f94ccbd5d4ab4d0103dc25917d49cf105fb4b0326f5807b76a8b5c01c2dfc143ae24d61e4a961a84255a46501b885ce9a60788cfc3f1ac7f6","ssdeep":"768:quVwxXWQAbc0OP2EC57uWvl6L/pjdgu1+nroL0:quVWn0QCRuGl6djJMrj","tlshash":"3af295c81e12fd9b6df94ec8261142e9a0ac9339203995c5a0ad4ff871a5d5f0f7cdb2","first_seen":"2025-10-23T12:46:24.379172Z","last_seen":"2025-10-23T12:53:47.687142Z","times_seen":2,"resource_available":true,"data":null}},"time_used":202,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":173,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/host.png","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.219Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/host.png HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/assets/static/public-index.0fae0813.css\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:17 GMT\r\ncontent-type: image/png\r\ncontent-length: 42\r\naccept-ranges: bytes\r\netag: \"2a-641d14ad97700\"\r\nlast-modified: Thu, 23 Oct 2025 10:57:00 GMT\r\nset-cookie: Domain=proton.me; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=7776000\nTag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42,"size_decoded":0,"mime_type":"image/png","magic":"GIF image data, version 89a, 1 x 1","md5":"d89746888da2d9510b64a9f031eaecd5","sha1":"d5fceb6532643d0d84ffe09c40c481ecdf59e15a","sha256":"ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629","sha512":"d5da26b5d496edb0221df1a4057a8b0285d15592a8f8dc7016a294df37ed335f3fde6a2252962e0df38b62847f8b771463a0124ef3f84299f262ed9d9d3cee4c","ssdeep":"","tlshash":"c4900023fa808000c3a8c2300a0b238a2b8c80200a28030b80ae208cec3a3a22c03020","first_seen":"2023-04-05T02:54:03Z","last_seen":"2026-08-06T13:48:25.297237Z","times_seen":1022336,"resource_available":true,"data":null}},"time_used":150,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/api/domains/available?Type=login","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:18.305Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /api/domains/available?Type=login HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/vnd.protonmail.v1+json\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/login\r\nx-pm-appversion: web-account@5.0.302.1\r\nx-pm-uid: zqdcjj67h3us6g4tnmfvrmqxifkug3sk\r\nx-pm-locale: en_US\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: AUTH-zqdcjj67h3us6g4tnmfvrmqxifkug3sk=ygxt4ey3xtwtxe7enhelng7xmoj53jav; Tag=default; Domain=proton.me\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:18 GMT\r\ncontent-type: application/json\r\ncontent-length: 67\r\naccess: application/vnd.protonmail.api+json;apiversion=3\r\ncache-control: max-age=0, must-revalidate, no-cache, no-store, private\r\ncontent-encoding: gzip\r\nexpires: Fri, 04 May 1984 22:15:00 GMT\r\nset-cookie: Session-Id=aPolPpR5You6H9LTuDSLRQAAA9Q; Domain=proton.me; Path=/; HttpOnly; SameSite=None; Secure; Max-Age=7776000\nTag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nvary: Accept-Encoding\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":54,"size_decoded":0,"mime_type":"application/json","magic":"JSON text data","md5":"baa2f94be6cb0d6b13abaa4d52d3347a","sha1":"ef605ff78fd2457a30bc8e7fca451267830f0b7f","sha256":"3ba9fce180e0a7fe534adb72b6fc0240bbf47de8eebc5daaf4b66eeca712a434","sha512":"c4af39d0c432702053b045ca6ce3ea3ea88c52fc0165deebfbe983c6065e6faf804257d925582f8a41e4b6e62a16ad6d613d5e3295b7654ad87ee8425385fe87","ssdeep":"","tlshash":"ff900246804d5444c95510063346e885461c7007d594ed5c973ec0f1499181522100e8","first_seen":"2023-06-20T14:53:00Z","last_seen":"2026-08-03T18:41:44.926394Z","times_seen":51,"resource_available":false,"data":null}},"time_used":305,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":305,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"webaccount.com.ru/assets/static/favicon.85478299dafc69454be0.svg","fqdn":"webaccount.com.ru","domain":"webaccount.com.ru","tld":"com.ru"},"ip":{"addr":"93.93.205.215","port":443,"asn":0,"as":"","country":"Israel","country_code":"IL"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://webaccount.com.ru/","date":"2025-10-23T12:53:17.174Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"webaccount.com.ru","organization":""},"issuer":{"commonName":"E8","organization":"Let's Encrypt"},"validity":{"start":"Mon, 29 Sep 2025 19:24:45 GMT","end":"Sun, 28 Dec 2025 19:24:44 GMT"},"fingerprint":{"sha1":"35:91:A2:FB:2C:55:D1:E3:CF:28:A5:DD:27:1C:87:90:CF:B8:DC:02","sha256":"B3:9D:70:3A:F6:6B:40:0D:66:1A:11:C8:1B:93:D5:92:57:56:89:85:BB:10:6D:39:84:6A:FD:38:F1:65:77:87"}}},"request":{"raw":"GET /assets/static/favicon.85478299dafc69454be0.svg HTTP/1.1\r\nHost: webaccount.com.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://webaccount.com.ru/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: Tag=default\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: nginx/1.26.3\r\ndate: Thu, 23 Oct 2025 12:53:17 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1070\r\naccept-ranges: bytes\r\nlast-modified: Thu, 23 Oct 2025 10:58:34 GMT\r\netag: \"1a747858f9c6bc8ed5f1ac4060f1587b\"\r\ncache-control: max-age=600, s-maxage=3600, must-revalidate\r\ncontent-security-policy: default-src 'self'; connect-src 'self' blob: https://proton.me https://*.protonmail.com; script-src 'self' 'wasm-unsafe-eval' blob: 'sha256-eAhF1Kdccp0BTXM6nMW7SYBdV0c3fZwzcC177TQ692g='; style-src 'self' 'unsafe-inline'; img-src http: https: data: blob: cid:; frame-src 'self' blob: data: https://www.youtube-nocookie.com https://account-api.proton.me; object-src 'self' blob:; child-src 'self' data: blob:; report-uri https://reports.proton.me/reports/csp; frame-ancestors https://verify.proton.me https://mail.proton.me https://calendar.proton.me https://drive.proton.me https://account-api.proton.me https://docs.proton.me https://lumo.proton.me https://wallet.proton.me https://meet.proton.me ;\r\npublic-key-pins-report-only: pin-sha256=\"CT56BhOTmj5ZIPgb/xD5mH8rY3BLo/MlhP7oPyJUEDo=\"; pin-sha256=\"35Dx28/uzN3LeltkCBQ8RHK0tlNSa2kCpCRGNp34Gxc=\"; report-uri=\"https://reports.proton.me/reports/tls\"\r\nvary: Accept-Encoding\r\nset-cookie: Tag=default; Path=/; SameSite=None; Secure; Max-Age=7776000\r\nstrict-transport-security: max-age=31536000; includeSubDomains; preload\r\nexpect-ct: max-age=2592000, enforce, report-uri=\"https://reports.proton.me/reports/tls\"\r\nx-content-type-options: nosniff\r\nx-xss-protection: 0\r\nreferrer-policy: strict-origin-when-cross-origin\r\nx-permitted-cross-domain-policies: none\r\nalt-svc: h3=\":443\";ma=900;\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx:1.26.3","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1070,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"1a747858f9c6bc8ed5f1ac4060f1587b","sha1":"1d1c94b59dbbb90b53fcea06b0aa1f1295a8661c","sha256":"e599e9db5cb154d9e98f8205cf02bea37fdcf39cccfde17c87ef8fa183342838","sha512":"93a103e5f933d30225b7673ac48c8405328a891d36f7600a6f179124d973740fa1cc8219aefaf62c02d3592a7fb92791fa65a6aa6b39e602780fa79d7718738b","ssdeep":"","tlshash":"e011bdbc91be989ee01ec438d886585c2b0c42a7b4414448f89c8f0e4f659c18a8f7f4","first_seen":"2024-08-19T20:09:15.37608Z","last_seen":"2026-07-28T08:03:11.389158Z","times_seen":48,"resource_available":false,"data":null}},"time_used":127,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":127,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns0","sensor_type":"DNS","title":"DNS0 Zero","description":"DNS0 Zero","scan_date":"2025-10-23","alert":"Sinkholed","trigger":"webaccount.com.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS (SOA: negative-caching.dns0.eu)","link":"https://www.dns0.eu/zero","meta":null}],"urlquery":null}}]}