{"report_id":"21ce9a62-760b-473e-8db6-026fdd04b9d8","version":6,"status":"done","tags":[],"date":"2025-12-17T06:05:16Z","url":{"schema":"https","addr":"m19partisan.com/phishing","fqdn":"m19partisan.com","domain":"m19partisan.com","tld":"com"},"ip":{"addr":"91.206.71.116","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"m19partisan.com/phishing","fqdn":"m19partisan.com","domain":"m19partisan.com","tld":"com"},"title":"Вы не робот?","dom":{"size":1473,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1440), with no line terminators","md5":"5dd222b0c985bc9a28026b3446e00217","sha1":"87445d0776848cd46cafb508d5beee2fdd9e9c1e","sha256":"4fde07a6c81d4bd39682c8830cc4d4b49ffab3fe117db78876bb5ef243201270","sha512":"62b10837b0ef6c4b6496be3a2d33112d665affd632cb4b43f0b63514894abc77484d7ff6eb9f0e577b9765c3d6520229cbc61b9dc2ee714877154deaeec58fb2","ssdeep":"","tlshash":"553174332d4954204867db70b4d3eac8d156803af917b890986021744ffdad5cf72e5e","dom_hash":"domhashf17fc353fdf76acc303b34dfc54c6653","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"m19partisan.com/phishing","fqdn":"m19partisan.com","domain":"m19partisan.com","tld":"com"},"ip":{"addr":"91.206.71.116","port":0,"asn":0,"as":"","country":"United States","country_code":"US"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-21T06:05:16Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":0}},"detection":{"ids":null,"analyzer":null,"urlquery":null},"summary":[{"fqdn":"m19partisan.com","ip":{"addr":"91.206.71.116","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"domain_registered":"2025-06-06","domain_rank":3555870,"first_seen":"2025-12-17T06:05:16.53662Z","last_seen":"2025-12-17T06:05:16.53662Z","alert_count":0,"request_count":3,"received_data":10337,"sent_data":1456,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"m19partisan.com/phishing","fqdn":"m19partisan.com","domain":"m19partisan.com","tld":"com"},"ip":{"addr":"91.206.71.116","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"f745c22b8eb9b285d676b54de141f869","sha1":"3b380fe50a0e1157bfaa3b76ef04ca80c8ad2a4c","sha256":"0e3c46ef176a8c48db02ab9e446429608b74b8e4a5cd7db7ccb554850ab9e437","sha512":"b57f0a8e0efac9745add975681373d06475dc9b1a1bb46dceb314303c436b4c05bf7fb119da949692174072249652a07c0716f30212658bda677d04649c220e6","ssdeep":"","tlshash":"62c02b3b71092c74039bf936503fe3681b35300130011101d414084c4d96b8ce076c89","size":139,"data":"","first_seen":"2025-03-13T21:00:39.55932Z","last_seen":"2026-07-07T18:20:44.559935Z","times_seen":126,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"m19partisan.com/phishing","fqdn":"m19partisan.com","domain":"m19partisan.com","tld":"com"},"ip":{"addr":"91.206.71.116","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-17T06:04:55.227Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m19partisan.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 30 Nov 2025 20:41:15 GMT","end":"Sat, 28 Feb 2026 21:41:05 GMT"},"fingerprint":{"sha1":"1D:6A:16:BE:84:96:78:F8:47:F6:0F:EE:D0:DA:B8:10:97:50:4F:70","sha256":"C8:7E:07:3C:28:A6:D2:28:D2:46:2B:54:CC:8F:E9:BC:65:A1:9F:B7:23:7B:90:EA:DB:10:06:DF:58:A7:D5:0B"}}},"request":{"raw":"GET /phishing HTTP/1.1\r\nHost: m19partisan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 17 Dec 2025 06:04:55 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nexpires: Thu, 01 Jan 1970 00:00:01 GMT\r\ncache-control: no-cache\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: gzip\r\ncf-ray: 9af439cd5d1cb28a-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1473,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1440), with no line terminators","md5":"32527e6cd4c3c1b15e5903d404ae52d2","sha1":"2763c5ce9a1da6811a9837af392d76bbec42c15e","sha256":"a0c53615bef55e7077cb22bf4a57fc7938a2a335ab74d0a17ebfafdd4e9180a2","sha512":"d916d97e60b3e356d6c244c59427a5bed6a9ce02254757822e5ac2df7a119e522ebc395dafaa622e6685c431c2a9fc8a4d43910445690e4b3cab7540b9f3ed50","ssdeep":"","tlshash":"de3174331d5954205866db70b4d3eac8d556803af907b880985031784ffdad5cf72e5e","first_seen":"2023-11-10T02:27:09Z","last_seen":"2026-07-07T18:20:44.55418Z","times_seen":112,"resource_available":true,"data":null}},"time_used":137,"timings":{"blocked":30,"dns":21,"connect":1,"send":0,"wait":64,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m19partisan.com/captcha","fqdn":"m19partisan.com","domain":"m19partisan.com","tld":"com"},"ip":{"addr":"91.206.71.116","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m19partisan.com/phishing","date":"2025-12-17T06:04:55.562Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m19partisan.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 30 Nov 2025 20:41:15 GMT","end":"Sat, 28 Feb 2026 21:41:05 GMT"},"fingerprint":{"sha1":"1D:6A:16:BE:84:96:78:F8:47:F6:0F:EE:D0:DA:B8:10:97:50:4F:70","sha256":"C8:7E:07:3C:28:A6:D2:28:D2:46:2B:54:CC:8F:E9:BC:65:A1:9F:B7:23:7B:90:EA:DB:10:06:DF:58:A7:D5:0B"}}},"request":{"raw":"GET /captcha HTTP/1.1\r\nHost: m19partisan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://m19partisan.com/phishing\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 17 Dec 2025 06:04:55 GMT\r\ncontent-type: text/plain; charset=UTF-8\r\nserver: cloudflare\r\nlast-modified: Fri, 08 Nov 2019 15:44:17 GMT\r\nset-cookie: CaptchaH=ad697f3b4c6ba27f31418972d6369eda; Path=/; Expires=Wed, 17-Dec-25 06:08:55 GMT\nCaptchaS=9604E616B2C395DE; Path=/; Expires=Wed, 17-Dec-25 06:08:55 GMT\r\npragma-directive: no-cache\r\ncache-directive: no-cache\r\ncache-control: no-cache, no-store, max-age=0, must-revalidate\r\npragma: no-cache\r\nexpires: 0\r\ncf-cache-status: DYNAMIC\r\netag: W/\"5dc58d51-1833\"\r\ncontent-encoding: gzip\r\ncf-ray: 9af439cf391fb28a-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6195,"size_decoded":0,"mime_type":"text/plain; charset=UTF-8","magic":"data","md5":"7def76eafface7123ed1ae68b17241ae","sha1":"12f06cdfa423111a9c822c3aa84c4a1f8410f26a","sha256":"aeb103870561f66e59f37625fa988f0f729faaff84c5dd587d378a8c26697418","sha512":"862a7170352f7139672bf68fa5c251c77580261635dcbf6b93e79862a31a0433ecc6a989a838daca756dc74e09458c8f32227be26461a4bae0f0065c43af7b18","ssdeep":"192:47mSavH7UfUBugancnOzOaOGRI1WzuNK5dz1cx9jpH6tDZo9:KmSavJBugQcnOzLOuIMzuNK5xAl7","tlshash":"ea128d43a6c39772e77ce9b332000dc4e61abe55a7f97da0d520d8461c93918d15fb26","first_seen":"2025-12-17T06:05:19.791492Z","last_seen":"2025-12-17T06:05:19.791492Z","times_seen":1,"resource_available":false,"data":null}},"time_used":33,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"m19partisan.com/favicon.ico","fqdn":"m19partisan.com","domain":"m19partisan.com","tld":"com"},"ip":{"addr":"91.206.71.116","port":443,"asn":0,"as":"","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://m19partisan.com/phishing","date":"2025-12-17T06:04:55.601Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"m19partisan.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 30 Nov 2025 20:41:15 GMT","end":"Sat, 28 Feb 2026 21:41:05 GMT"},"fingerprint":{"sha1":"1D:6A:16:BE:84:96:78:F8:47:F6:0F:EE:D0:DA:B8:10:97:50:4F:70","sha256":"C8:7E:07:3C:28:A6:D2:28:D2:46:2B:54:CC:8F:E9:BC:65:A1:9F:B7:23:7B:90:EA:DB:10:06:DF:58:A7:D5:0B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: m19partisan.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://m19partisan.com/phishing\r\nCookie: CaptchaH=ad697f3b4c6ba27f31418972d6369eda; CaptchaS=9604E616B2C395DE\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 17 Dec 2025 06:04:55 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nserver: cloudflare\r\nvary: accept-encoding\r\nexpires: Wed, 17 Dec 2025 10:04:55 GMT\r\ncache-control: public, max-age=14400\r\ncf-cache-status: MISS\r\ncontent-encoding: gzip\r\ncf-ray: 9af439cf79aeb28a-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1473,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1440), with no line terminators","md5":"32527e6cd4c3c1b15e5903d404ae52d2","sha1":"2763c5ce9a1da6811a9837af392d76bbec42c15e","sha256":"a0c53615bef55e7077cb22bf4a57fc7938a2a335ab74d0a17ebfafdd4e9180a2","sha512":"d916d97e60b3e356d6c244c59427a5bed6a9ce02254757822e5ac2df7a119e522ebc395dafaa622e6685c431c2a9fc8a4d43910445690e4b3cab7540b9f3ed50","ssdeep":"","tlshash":"de3174331d5954205866db70b4d3eac8d556803af907b880985031784ffdad5cf72e5e","first_seen":"2023-11-10T02:27:09Z","last_seen":"2026-07-07T18:20:44.55418Z","times_seen":112,"resource_available":true,"data":null}},"time_used":86,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":86,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}