{"report_id":"2b13f614-23ee-44ca-88ea-04b79efe8b16","version":0,"status":"done","tags":[],"date":"2026-09-25T02:50:05Z","url":{"schema":"https","addr":"slon3ccticket.ru/","fqdn":"slon3ccticket.ru","domain":"slon3ccticket.ru","tld":"ru"},"ip":{"addr":"104.194.143.10","port":0,"asn":198983,"as":"'Tornado Datacenter GmbH \u0026 Co. KG'","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"slon3ccticket.ru/","fqdn":"slon3ccticket.ru","domain":"slon3ccticket.ru","tld":"ru"},"title":"kraken","dom":{"size":4195,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"56f52ba9bd0dc32506cb1351064dddc8","sha1":"2682ddabdc09f03ea61c89652e593e7ad6f84794","sha256":"c8ef336bfe6cb040a8106a14df9ef79dee320baf4f8332468235a7fa5b945cd0","sha512":"95226849a00715bdfd3eeb7f71de4382fafc56593a1574e18207741da8e7ee3e0af3999d9105dfd3fe274b05bf60f9b6d05619c31a3f208112284dc0073d2579","ssdeep":"48:nKpNvNzqnXpyp3r/dcjOThMRoF/8aZ9HVw/WJlQAqFsejt:nNyJlcjOThfZZdyu7qFsejt","tlshash":"a681559745a704553902c8783fdb9a5626498023c209dca87fdc229ccfcbad59af3bcc","dom_hash":"domhash7daee4acee8fd89d07cbd3cc302156bc","first_seen":"2026-09-25T02:50:06.822614Z","last_seen":"2026-09-25T02:50:06.822614Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"slon3ccticket.ru/","fqdn":"slon3ccticket.ru","domain":"slon3ccticket.ru","tld":"ru"},"ip":{"addr":"104.194.143.10","port":0,"asn":198983,"as":"'Tornado Datacenter GmbH \u0026 Co. KG'","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-30T02:50:05Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"slon3ccticket.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"slon3ccticket.ru","ip":{"addr":"104.194.143.10","port":443,"asn":198983,"as":"'Tornado Datacenter GmbH \u0026 Co. KG'","country":"United Kingdom","country_code":"GB"},"domain_registered":"2026-03-15","domain_rank":0,"first_seen":"2026-09-25T02:44:34.303151Z","last_seen":"2026-09-25T02:44:34.303151Z","alert_count":4,"request_count":4,"received_data":22851,"sent_data":2182,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"slon3ccticket.ru/","fqdn":"slon3ccticket.ru","domain":"slon3ccticket.ru","tld":"ru"},"ip":{"addr":"104.194.143.10","port":443,"asn":198983,"as":"'Tornado Datacenter GmbH \u0026 Co. KG'","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-25T02:49:36.688Z","timestamp":1790304576688,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"slon3ccticket.ru","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 00:32:30 GMT","end":"Wed, 16 Dec 2026 00:32:29 GMT"},"fingerprint":{"sha1":"FE:A7:A1:2D:5B:61:24:E9:3F:F9:99:A9:E4:A9:39:63:B2:70:F4:E3","sha256":"9A:CC:9E:B2:66:BB:B2:4C:31:55:34:B7:58:DA:DF:BC:CA:09:70:41:75:A1:23:42:5C:49:2C:CB:62:1D:A7:41"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: slon3ccticket.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 25 Sep 2026 02:49:35 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nSet-Cookie: antibot=9611a17c-6d15-4b42-9d80-977aa8dc4a55; Path=/; HttpOnly; Secure; SameSite=Strict\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":[{"name":"antibot","value":"9611a17c-6d15-4b42-9d80-977aa8dc4a55","quoted":false,"path":"/","secure":true,"http_only":true,"same_site":"Strict","partitioned":false,"raw":"antibot=9611a17c-6d15-4b42-9d80-977aa8dc4a55; Path=/; HttpOnly; Secure; SameSite=Strict"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4382,"size_decoded":1710,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"2f61beba978fad625ed92a2461e02bb8","sha1":"ac86eac434dd89062267bfb99610b7c3d94cd85d","sha256":"dcc7639164ec4acd483d38d2675af142cb5650c6d0b66f4779684d664f7af12b","sha512":"ed9836ad876e3355856ca9b0ec889cd0fa78defa448e76869435fb24caf388540f8d033e974e425c38871c91f9da5105dfbad1b23a08495e7dd53bdbf0dcbe20","ssdeep":"48:tfJNeNuTXpQpxhHEddijPaKow5KX8zXtiXttPIv4WBf36:BQ7uLijPaKRPXMC4WBP6","tlshash":"2d91312585451445313286b87fd25aaafb8a0123c30650a87fdc33968ffba5897b3fcc","first_seen":"2026-09-25T02:50:06.825009Z","last_seen":"2026-09-25T02:50:06.825009Z","times_seen":1,"resource_available":true,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":43,"connect":19,"send":0,"wait":199,"receive":0,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"slon3ccticket.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon3ccticket.ru/antibot_assets/kraken.css","fqdn":"slon3ccticket.ru","domain":"slon3ccticket.ru","tld":"ru"},"ip":{"addr":"104.194.143.10","port":443,"asn":198983,"as":"'Tornado Datacenter GmbH \u0026 Co. KG'","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://slon3ccticket.ru/","date":"2026-09-25T02:49:37.224Z","timestamp":1790304577224,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"slon3ccticket.ru","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 00:32:30 GMT","end":"Wed, 16 Dec 2026 00:32:29 GMT"},"fingerprint":{"sha1":"FE:A7:A1:2D:5B:61:24:E9:3F:F9:99:A9:E4:A9:39:63:B2:70:F4:E3","sha256":"9A:CC:9E:B2:66:BB:B2:4C:31:55:34:B7:58:DA:DF:BC:CA:09:70:41:75:A1:23:42:5C:49:2C:CB:62:1D:A7:41"}}},"request":{"raw":"GET /antibot_assets/kraken.css HTTP/1.1\r\nHost: slon3ccticket.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://slon3ccticket.ru/\r\nCookie: antibot=9611a17c-6d15-4b42-9d80-977aa8dc4a55\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 25 Sep 2026 02:49:36 GMT\r\nContent-Type: text/css; charset=utf-8\r\nContent-Length: 4768\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nLast-Modified: Tue, 06 Jan 2026 17:09:55 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4768,"size_decoded":4992,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with CRLF line terminators","md5":"75fd64fc8e99dc317f41914081a03352","sha1":"97c20a567cf31b997322b3228838ae44b1394233","sha256":"db6ad8d74f75b4ec10be88cbf8dcf0134d1f63f7126accf2b375a0833aba0028","sha512":"9b8c26c9e7b3ca6fbdd5337dbbe2a6bfa06cb476355406f010cf4ea09438a406c804f5c56577e7b68b11870ee8fedb397ffd11a72ab2036c5485175779aafc99","ssdeep":"48:W3AtE0JlzWvwIpQnStqoemMHmGmRm6iRtmQmHxa9uuuma86cPBmJz9K+N3z+0hCK:/zGwIU2jMxALy63zD2s5","tlshash":"78a1df9e16022b5083324f3463979b15b72402768e4530edb8d04ab9eb96be686d0fcf","first_seen":"2024-09-22T02:59:45Z","last_seen":"2026-09-25T04:11:15.615544Z","times_seen":246,"resource_available":true,"data":null}},"time_used":149,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":149,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"slon3ccticket.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon3ccticket.ru/antibot_generatecaptcha?IdlC6JiGaf","fqdn":"slon3ccticket.ru","domain":"slon3ccticket.ru","tld":"ru"},"ip":{"addr":"104.194.143.10","port":443,"asn":198983,"as":"'Tornado Datacenter GmbH \u0026 Co. KG'","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://slon3ccticket.ru/","date":"2026-09-25T02:49:37.229Z","timestamp":1790304577229,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"slon3ccticket.ru","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 00:32:30 GMT","end":"Wed, 16 Dec 2026 00:32:29 GMT"},"fingerprint":{"sha1":"FE:A7:A1:2D:5B:61:24:E9:3F:F9:99:A9:E4:A9:39:63:B2:70:F4:E3","sha256":"9A:CC:9E:B2:66:BB:B2:4C:31:55:34:B7:58:DA:DF:BC:CA:09:70:41:75:A1:23:42:5C:49:2C:CB:62:1D:A7:41"}}},"request":{"raw":"GET /antibot_generatecaptcha?IdlC6JiGaf HTTP/1.1\r\nHost: slon3ccticket.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://slon3ccticket.ru/\r\nCookie: antibot=9611a17c-6d15-4b42-9d80-977aa8dc4a55\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 25 Sep 2026 02:49:36 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 11505\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nCache-Control: no-store, no-cache, must-revalidate, private\r\nExpires: 0\r\nLast-Modified: Wed, 14 Jan 2026 16:48:55 GMT\r\nPragma: no-cache\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11505,"size_decoded":11808,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"Blender:File:C:\\Projects\\captcha\\captcha-3.blend\", comment: \"Blender:Date:2023/02/14 21:37:18\", comment: \"Blender:Time:00:00:00:00\", comment: \"Blender:Frame:000\", comment: \"Blender:Camera:Camera\", comment: \"Blender:Scene:Scene\", comment: \"Blender:RenderTime:00:00.07\", baseline, precision 8, 380x120, components 3","md5":"d839cfc328027bfee062dc233f51703c","sha1":"a9a3878af07ebb46df4f335d87adce22f62c4158","sha256":"d3c5662ae17e9ff45bf0a248b6db9e1f469e107ab4f3fcf52469c321b4c6c7d7","sha512":"5621a45c6786b2c68bd430d563dd202842dcd051785b80208138544659ce184ba4eeae4b4caba3ad8ec9d58f9b4d58c6db85518d029c4ba3a3901986d4190bbb","ssdeep":"192:GdsyDSID9G4XZuwaswat92OxKvlY3pX8sWwdocQM8Sn6I8q9NbSVnvX:1yDXJrXZVyS3c9qPWo7FqX","tlshash":"2632b055cfe353bc1e7836be0114276de28d599fd22837c5f583a0d58f3861286dc84a","first_seen":"2026-03-28T03:26:27.174822Z","last_seen":"2026-09-25T02:50:06.827139Z","times_seen":3,"resource_available":false,"data":null}},"time_used":332,"timings":{"blocked":143,"dns":0,"connect":17,"send":0,"wait":189,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"slon3ccticket.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon3ccticket.ru/antibot_assets/kraken-favicon.svg","fqdn":"slon3ccticket.ru","domain":"slon3ccticket.ru","tld":"ru"},"ip":{"addr":"104.194.143.10","port":443,"asn":198983,"as":"'Tornado Datacenter GmbH \u0026 Co. KG'","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://slon3ccticket.ru/","date":"2026-09-25T02:49:37.481Z","timestamp":1790304577481,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"slon3ccticket.ru","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 17 Sep 2026 00:32:30 GMT","end":"Wed, 16 Dec 2026 00:32:29 GMT"},"fingerprint":{"sha1":"FE:A7:A1:2D:5B:61:24:E9:3F:F9:99:A9:E4:A9:39:63:B2:70:F4:E3","sha256":"9A:CC:9E:B2:66:BB:B2:4C:31:55:34:B7:58:DA:DF:BC:CA:09:70:41:75:A1:23:42:5C:49:2C:CB:62:1D:A7:41"}}},"request":{"raw":"GET /antibot_assets/kraken-favicon.svg HTTP/1.1\r\nHost: slon3ccticket.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://slon3ccticket.ru/\r\nCookie: antibot=9611a17c-6d15-4b42-9d80-977aa8dc4a55\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Fri, 25 Sep 2026 02:49:36 GMT\r\nContent-Type: image/svg+xml\r\nContent-Length: 1167\r\nConnection: keep-alive\r\nAccept-Ranges: bytes\r\nLast-Modified: Thu, 03 Sep 2026 15:26:58 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1167,"size_decoded":1381,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c43e17f11a86a2b716b8cd402dce5f43","sha1":"043e9c49d0e96f6fdb347344e07e64bff03a5237","sha256":"9136035acf15bcf4013e965b93c84abbfb6a2da3fa041b82e8659520787c9367","sha512":"83fe6e984640c4fe0348e5f673833b8ed308755f2a8e8ff53e07134b0efc6fd646d5b1d614448e722a33a79febb0d961be966c3b1ec9352c82d5657a1e6c98f1","ssdeep":"","tlshash":"4b21ce8c68455c75c7e087c08bb8f9c8023eb38f40e13979aead3a430d0acb949be701","first_seen":"2026-09-24T04:57:25.473877Z","last_seen":"2026-09-25T04:11:15.619855Z","times_seen":7,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-25","alert":"Sinkholed","trigger":"slon3ccticket.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}