{"report_id":"393b175b-fe72-453c-b456-128a05a40893","version":0,"status":"done","tags":[],"date":"2026-08-25T20:59:48Z","url":{"schema":"http","addr":"formatf.ru/","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"formatf.ru/","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"title":"Format Factory — скачать бесплатный конвертер видео, аудио и фото для Windows","dom":{"size":17640,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (408)","md5":"6544f93001581ced06fa5f8fa614e839","sha1":"26c72e89d0115254ce8f7288207c26cd9482d108","sha256":"bb470f1c7b27fabfa351eb9915fa82f025cf44e8e09faf25aa092a3f9ff1ee70","sha512":"caba784d332074e9abde2e4a4664783be5b3308404962ac4d9366e9efbfb73f9d59c904d38bb87981dcd73a8bc5d1b5e38ff08021a39e5931a2080b1b5b216db","ssdeep":"192:zrJwqWVp/L0qBRbSz/XHTgM16V9PIIIAS10aYJPJNmigsWq3IO814oDOWpX0Pl7m:zrSz/LvBRbSzsMFIITuHPnL2dclYau","tlshash":"ad82512192f5187b121290cbda15771c3ea682bfea1e1201727c297d7fe3d499d3b60d","dom_hash":"domhash6bb9c609717c47ee1011507903e3b061","first_seen":"2026-08-25T20:58:56.610733Z","last_seen":"2026-08-25T20:59:50.384793Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"formatf.ru/","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T20:59:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"formatf.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-14","domain_rank":0,"first_seen":"2026-08-25T20:58:53.628848Z","last_seen":"2026-08-25T20:58:53.628848Z","alert_count":12,"request_count":6,"received_data":1771418,"sent_data":2860,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"formatf.ru/","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"3903a8c2eb867f38e866106073f5132d","sha1":"7f8bf6c4a31a41c85fe1244494456009f2677f25","sha256":"13820938aea6196b4a514a6d6c8dcd6fde289247fc090bb58bb712af46cf22a1","sha512":"f7867c29682a3220c47a3cfc2ca7e1b2b216c99c82db798ee10ca19e0498d92df9a30a65900e4f9fb739927782e8523ca72fa7b308ca14b179c7fdef9d1c3d9f","ssdeep":"","tlshash":"22f0e177b88492b5c6f62131532bb30c71271cb9308dad38870d8882397bc59102fd6d","size":576,"data":"","first_seen":"2026-08-25T20:58:56.626167Z","last_seen":"2026-08-25T20:59:50.390206Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"formatf.ru/assets/js/main.js","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"65f1a79300dec99b0b1c47287f2f766f","sha1":"08565450807a82374464b2a5586d4134c75e55cf","sha256":"bbf7023a2a9388ede3e6a5d7de35bf272322a4f0cee583670c317e61d457ce17","sha512":"c23d82b2bddfe6e13ab7a995a6743ae587648cb5b7e13b86a05e996b8da2f6e9b4fc0aca9af3002adc144c4af129ebbea9a424062de00ab521ec1fa112941592","ssdeep":"192:ZsHExUiZ/lYpnunOFkIRCC8KQlb7vJSVvGtH8ppF+hzU:ZskHZSuIkIU3KQhv4VvE8ppF+i","tlshash":"1d028669a459327684f733beaf2a554cffa005275102ca013decd9893f74d2046baedd","size":8504,"data":"","first_seen":"2026-08-25T20:58:56.620265Z","last_seen":"2026-08-25T20:59:50.387936Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"formatf.ru/","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T20:59:21.891Z","timestamp":1787691561891,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.formatf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:08:50 GMT","end":"Mon, 16 Nov 2026 20:08:49 GMT"},"fingerprint":{"sha1":"CE:72:67:49:19:5E:ED:B7:E1:E1:86:C9:AF:FD:2E:0A:4A:93:41:E6","sha256":"30:2E:F4:B0:73:02:D5:02:8A:AE:A2:8C:42:0B:65:D6:7C:82:3D:BD:A1:AB:52:9C:D1:22:84:06:F4:68:EC:63"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: formatf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:59:22 GMT\r\ncontent-type: text/html\r\ncontent-length: 4894\r\nlast-modified: Fri, 14 Aug 2026 08:54:05 GMT\r\netag: \"46a8-658fdf678b1e7-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18088,"size_decoded":5355,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (386), with CRLF line terminators","md5":"75f821b22a0d415c9fa0372d141034c6","sha1":"9734ca67cacee6babc11ae8d5527a9c826188185","sha256":"9dffa37c7556100d0ab2242d4b71d16f100d3c1ba8d8db2d37070b0a4c4733af","sha512":"0f206d8b3d50a108152850dd2d2dc10e6aba902e31523ce66d90efaea9afc6f95ff4b3bffa299a48bb73aad6b000c6c8a454d71f05ecb125761894deea9847a4","ssdeep":"192:UBqWVaxNP+A/+S3Z79PzIIiLv0WPJPJgMWE6sdnt3C0Ion4xx4oyhbU77hmN7lJe:qyNx+IHIIqcCPWG9Zrlf1y","tlshash":"2982403152c5187b1233908ada15771cfda682bfab1a570172bc267f3ff3d04992b609","first_seen":"2026-08-25T20:58:56.613581Z","last_seen":"2026-08-25T20:59:50.385615Z","times_seen":2,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":4,"connect":38,"send":0,"wait":51,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"formatf.ru/assets/css/style.css","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://formatf.ru/","date":"2026-08-25T20:59:22.221Z","timestamp":1787691562221,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.formatf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:08:50 GMT","end":"Mon, 16 Nov 2026 20:08:49 GMT"},"fingerprint":{"sha1":"CE:72:67:49:19:5E:ED:B7:E1:E1:86:C9:AF:FD:2E:0A:4A:93:41:E6","sha256":"30:2E:F4:B0:73:02:D5:02:8A:AE:A2:8C:42:0B:65:D6:7C:82:3D:BD:A1:AB:52:9C:D1:22:84:06:F4:68:EC:63"}}},"request":{"raw":"GET /assets/css/style.css HTTP/1.1\r\nHost: formatf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://formatf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:59:22 GMT\r\ncontent-type: text/css\r\ncontent-length: 3346\r\nlast-modified: Fri, 14 Aug 2026 08:54:06 GMT\r\netag: \"3327-658fdf690590c-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13095,"size_decoded":3807,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"065080aad160339103f1cf28d7a41c04","sha1":"135b5962b8274403b875a523c0eb9f8eb2a4b2da","sha256":"f89e6372120c86694328d90cc4ae114d95fa42e60dcdedd20a513dc33ee05add","sha512":"acdaafebe0ad6c058918fa8351827c99d75d8e8d9e03eda4c72092a2e5e6ae8db882c54a87cb6834707b6dbc9059928a6013442db30548caa836d408ad83e167","ssdeep":"192:xabhJSWrK6eHw5yW+lJDqmTnU0Py+q3U/5CvYDn2GKfVbNxeav:uB6U0PmU/5CvYDmt","tlshash":"4942529667286274f537b7a4fbd7d789a79c7213690103bdbde40008c28a6be9171f8c","first_seen":"2026-08-25T20:58:56.615893Z","last_seen":"2026-08-25T20:59:50.386265Z","times_seen":2,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"formatf.ru/assets/img/hero.png","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://formatf.ru/","date":"2026-08-25T20:59:22.222Z","timestamp":1787691562222,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.formatf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:08:50 GMT","end":"Mon, 16 Nov 2026 20:08:49 GMT"},"fingerprint":{"sha1":"CE:72:67:49:19:5E:ED:B7:E1:E1:86:C9:AF:FD:2E:0A:4A:93:41:E6","sha256":"30:2E:F4:B0:73:02:D5:02:8A:AE:A2:8C:42:0B:65:D6:7C:82:3D:BD:A1:AB:52:9C:D1:22:84:06:F4:68:EC:63"}}},"request":{"raw":"GET /assets/img/hero.png HTTP/1.1\r\nHost: formatf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://formatf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:59:22 GMT\r\ncontent-type: image/png\r\ncontent-length: 1708222\r\nlast-modified: Fri, 14 Aug 2026 08:54:08 GMT\r\netag: \"1a10be-658fdf6a909d7\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1708222,"size_decoded":1708637,"mime_type":"image/png","magic":"PNG image data, 1536 x 1024, 8-bit/color RGB, non-interlaced","md5":"7b008360a219cbec373dbac27a34f9ef","sha1":"4d89d3fe1a58c9f6b3953ed98467d1ea043ddb06","sha256":"0e943c2ac9e6454e2774568b0db8ce9d63410492316b96a900426672b2c6cfe7","sha512":"e95a033dd5f3ab685de0525927bd06930265c8d577acf15d5b485f1ad8912dd353439aef7af9f7437a777ab34a1e2d926f7816f5f7086e1594cc382ca31584a4","ssdeep":"12288:/0YXk8XoDYXopkcATjpxMrtTDYJ32tII0suZabYC0FRY2kNoc7sIPnpDV8QlIoh9:/JvRnf6CdKkFRSNLNDkohUKuDWyo7","tlshash":"7825127f4022d701c1a753f85b578e6c8f6cab04a7210a93a96bd29bc36bd7c053b746","first_seen":"2026-08-25T20:58:56.618001Z","last_seen":"2026-08-25T20:59:50.387131Z","times_seen":2,"resource_available":false,"data":null}},"time_used":318,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":283,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"formatf.ru/assets/js/main.js","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://formatf.ru/","date":"2026-08-25T20:59:22.223Z","timestamp":1787691562223,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.formatf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:08:50 GMT","end":"Mon, 16 Nov 2026 20:08:49 GMT"},"fingerprint":{"sha1":"CE:72:67:49:19:5E:ED:B7:E1:E1:86:C9:AF:FD:2E:0A:4A:93:41:E6","sha256":"30:2E:F4:B0:73:02:D5:02:8A:AE:A2:8C:42:0B:65:D6:7C:82:3D:BD:A1:AB:52:9C:D1:22:84:06:F4:68:EC:63"}}},"request":{"raw":"GET /assets/js/main.js HTTP/1.1\r\nHost: formatf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://formatf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:59:22 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:00:17 GMT\r\netag: W/\"2138-659a32c3efd61\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8504,"size_decoded":3207,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"65f1a79300dec99b0b1c47287f2f766f","sha1":"08565450807a82374464b2a5586d4134c75e55cf","sha256":"bbf7023a2a9388ede3e6a5d7de35bf272322a4f0cee583670c317e61d457ce17","sha512":"c23d82b2bddfe6e13ab7a995a6743ae587648cb5b7e13b86a05e996b8da2f6e9b4fc0aca9af3002adc144c4af129ebbea9a424062de00ab521ec1fa112941592","ssdeep":"192:ZsHExUiZ/lYpnunOFkIRCC8KQlb7vJSVvGtH8ppF+hzU:ZskHZSuIkIU3KQhv4VvE8ppF+i","tlshash":"1d028669a459327684f733beaf2a554cffa005275102ca013decd9893f74d2046baedd","first_seen":"2026-08-25T20:58:56.620265Z","last_seen":"2026-08-25T20:59:50.387936Z","times_seen":2,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":106,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"formatf.ru/assets/img/logo.png","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://formatf.ru/","date":"2026-08-25T20:59:22.227Z","timestamp":1787691562227,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.formatf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:08:50 GMT","end":"Mon, 16 Nov 2026 20:08:49 GMT"},"fingerprint":{"sha1":"CE:72:67:49:19:5E:ED:B7:E1:E1:86:C9:AF:FD:2E:0A:4A:93:41:E6","sha256":"30:2E:F4:B0:73:02:D5:02:8A:AE:A2:8C:42:0B:65:D6:7C:82:3D:BD:A1:AB:52:9C:D1:22:84:06:F4:68:EC:63"}}},"request":{"raw":"GET /assets/img/logo.png HTTP/1.1\r\nHost: formatf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://formatf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:59:22 GMT\r\ncontent-type: image/png\r\ncontent-length: 19654\r\nlast-modified: Fri, 14 Aug 2026 08:54:08 GMT\r\netag: \"4cc6-658fdf6ad112b\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":19654,"size_decoded":20065,"mime_type":"image/png","magic":"PNG image data, 111 x 102, 8-bit/color RGBA, non-interlaced","md5":"f6713b57e344bcb9dbe71526ee673fb9","sha1":"94ec6e7c020b725cc7dacab32b86aa893ec2cf2c","sha256":"2452012e6d022d2c8f9dd43379c4863cc1f826b2bbc1d9531166818cdd32bd1d","sha512":"05c05de999306854e95c978f30fb2275ced189b98001e5f0f8a8c2c0ddfd4e7c17f2bd2c4d7874e15c1c2fe3a626835c0d52cd46732991e8c783d30f711dd4bd","ssdeep":"384:Zuot3E2jnGLKC9eIZSInXGefB++WIXmmlLG/lMqvmxEMjlFQpWJuhlpUh5:Zuot5nC9eI5XtZ++7mMLmMqv2EMjlFQ0","tlshash":"e992d0947c65bc052b10d0b6a07f498ba03b6d197920caa3fe6fc2ffd95400ada641ed","first_seen":"2025-08-01T04:03:10.068977Z","last_seen":"2026-08-25T20:59:50.38855Z","times_seen":3,"resource_available":false,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":103,"receive":35,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"formatf.ru/favicon.ico","fqdn":"formatf.ru","domain":"formatf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://formatf.ru/","date":"2026-08-25T20:59:22.557Z","timestamp":1787691562557,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.formatf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:08:50 GMT","end":"Mon, 16 Nov 2026 20:08:49 GMT"},"fingerprint":{"sha1":"CE:72:67:49:19:5E:ED:B7:E1:E1:86:C9:AF:FD:2E:0A:4A:93:41:E6","sha256":"30:2E:F4:B0:73:02:D5:02:8A:AE:A2:8C:42:0B:65:D6:7C:82:3D:BD:A1:AB:52:9C:D1:22:84:06:F4:68:EC:63"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: formatf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://formatf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:59:22 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 1274\r\nlast-modified: Fri, 14 Aug 2026 08:54:05 GMT\r\netag: \"4fa-658fdf675622f\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1274,"size_decoded":1686,"mime_type":"image/x-icon","magic":"GIF image data, version 89a, 16 x 16","md5":"e5f76d665240ef67682a4357e6d6333e","sha1":"e2f842bfa402dcee4f0f06763147d3dda04ab380","sha256":"78e7852dec6f1862cb82f882d676be98b1dbb150985fa58dd776a9498fdddac4","sha512":"89c14655f5f0f3ada895f453c8a6462a7540dfbfa32fbccfeaba6b604caaa9d25ae226ee2a485a94d345c5be79b5b61728444286fe1e0bc11424d702ad9fc210","ssdeep":"","tlshash":"f521620ee9a07c029058e5d639fb5f6756a28c0089e0e4a9b9cdd40fab305b1ad1a5df","first_seen":"2025-08-01T04:03:10.053868Z","last_seen":"2026-08-25T20:59:50.389196Z","times_seen":3,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":30,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"formatf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}