{"report_id":"3a482d24-f936-411f-a32c-6f79888b7883","version":0,"status":"done","tags":[],"date":"2026-09-05T19:11:10Z","url":{"schema":"http","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":0,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"title":"Авторизация","dom":{"size":10295,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1049)","md5":"828fe7f9d4cd6417b7fa7ec5c66c0771","sha1":"439d317b21a62903d04de029dc3c0cd11197e90d","sha256":"d35023f000bd418d200602f8482d07714f2b9225bdf4c0319ccdca19807f8935","sha512":"d9dcd811c934ec24caac3fab16141ca5b4d436d68e9a97b6a71bb13c40015736c0aaa2017252d99bd2d24b49521dcabc5b51a602f688e01a02acc42c766ceb9d","ssdeep":"192:HdD9DLxFJMyL5Ocsp2GC0kP1PgZEz3dU3a3z3T3bqhyZYyQyP1AFQP1pjnylKXSH:H10yL5OdplC06PaEzaqjjrqhmYyQazdo","tlshash":"3922e924bc0c9d5f40e304a4b91a7c0c75ff49376a03cd91e1b51968aefaef2621ae4d","dom_hash":"domhashb504c165d7779d6c1411c28d9f914b8b","first_seen":"2026-09-05T19:11:20.854147Z","last_seen":"2026-09-05T19:11:20.854147Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":0,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-10T19:11:10Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"crm.layton.ru","ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"domain_registered":"2009-08-02","domain_rank":0,"first_seen":"2025-06-16T06:04:41.943183Z","last_seen":"2026-06-14T10:07:28.270111Z","alert_count":38,"request_count":19,"received_data":698577,"sent_data":10474,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"1C-Bitrix","description":"1C-Bitrix is a system of web project management, universal software for the creation, support and successful development of corporate websites and online stores.","website":"https://www.1c-bitrix.ru","common_platform_enumeration":"","icon":"1C-Bitrix.svg","categories":["CMS","Ecommerce"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/main/popup/dist/main.popup.bundle.min.js?176056746667261","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"d0c9dbc1c6c425c1d02457d3a809f189","sha1":"4a3893b162ae8a77e0090cf4e23a66cede9483fc","sha256":"a74597d52cf68cfa049abea6a865f64422605cf5fedb42824df1c736d12114a1","sha512":"4cd10f9eb447c0d5df4e2b7168100d3f456aa0a9a8edc4c9ccbe415786462917304b03643a1327e43493683b4f0695b54bc934ab604ac1733b286e579d65947a","ssdeep":"1536:zeLulbv/hiY4WAAKSluKB5YHuqow/4zZNggz1g:VhCWAAKSluKBbqow/4zZVg","tlshash":"9963c81032856636d6d9e16d9a5b320a7235628195c7c86cb93cfccadde0e1a3773f38","size":67261,"data":"","first_seen":"2025-08-31T10:12:09.613086Z","last_seen":"2026-09-05T19:11:20.898906Z","times_seen":456,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"0bbc5af3c8ebdbd61441b81f9eb2adc9","sha1":"aab3b1e6b9fdafdfdf9aacfb80ce3d3d0ecdb792","sha256":"381a55885947040cbb0867382b0c812472b7945fc116dcf12c7ac45effe12e17","sha512":"871ae17fa78411c6478aeb8961ce53aa79c70710eeb6a4d8a00b90b6ddc86b8e96ac4f74aa256c01b6fff7ae48f742c5ba61c13ce24f1cf054fa7362b9b4c771","ssdeep":"","tlshash":"70018e1ee6450ed2140a2de15a0f441c99b2dd731f22106759782eecb8efae720ede17","size":840,"data":"","first_seen":"2024-06-10T03:52:09Z","last_seen":"2026-09-05T19:11:20.910007Z","times_seen":2796,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"1214d50c3b239c23997a9925c27902ae","sha1":"3dbf0155ac869d7336b85d6eb4f0b03a869071cd","sha256":"deb1a2e04634a430be5c363e23a128b0a3c2357234f94bbe5aaa72d35ae6b40f","sha512":"0cafbaec385c813d637aca1af4d7471b37fe406186975e7ca766ab4d6b93bb45c1ed919c47ac37e7b535413281c6324b3c4557342cb44625a20dd61237adec55","ssdeep":"","tlshash":"63c08c86258a448ee077b0a332db3711f007442269846ccad2e82085a30b0c79a0f7c5","size":168,"data":"","first_seen":"2023-03-07T01:03:14Z","last_seen":"2026-09-05T22:28:31.669062Z","times_seen":15064,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"865418d2efc4b130c3e6e60f6d092b87","sha1":"3eec6f7e490d05e0b40d97d00387252e2e23d5ec","sha256":"7f46b1477f54e032af437157eb75532297c0a6ed7b3eb91009a89135b4ddbbe0","sha512":"304ae37176505afac39ac95fbb45a405333b9669fe7b3330750e5f17df098c2889243022fe6bb70c0c720e027dd4c2f620cbe6efaa03de1c8b50660f41cb17c0","ssdeep":"","tlshash":"cbe0d81ae5060c2b5553f062be13ee43f76742f96f92c72115381d697bab751c715c00","size":395,"data":"","first_seen":"2025-11-07T09:04:48.746211Z","last_seen":"2026-09-05T19:11:20.912376Z","times_seen":20,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"cfb32c113e618ed73d3682dacea2e980","sha1":"f0c7d976b4892d72472ec362645b6444f7d94779","sha256":"ff26e006d23a25a73e53a026840f27857865e9ad6f3b56ebdc5002a52f04f006","sha512":"fccde441bc0492a51a7ae950845e0cc8dd130ed51776c4ff4b907a515d56776cad59694f1bcbc277b41c781cbc9d356a45021b1b6f52a08b8f490cd096faa7ab","ssdeep":"","tlshash":"fe0149d20a3a70cb0333e81de9046f0d26e9c77d6d6741c348360ebd61a40f56639729","size":686,"data":"","first_seen":"2024-06-10T03:52:10Z","last_seen":"2026-09-05T19:58:46.324227Z","times_seen":9086,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"3370f36111b7338e94d0801f07c8329e","sha1":"3655d2b667a5ff0c773ed85a8009234a911142d4","sha256":"42b966bffeae678d0f8f413b0f283a9b09f97fb3e44f88f2015affb2e90b3457","sha512":"7a008cbf041f1e76a1d15d18368dff9e7381552f30b5bf1ef0068b43fccef9e632e7ebdb385e25c726600b6a81e6ce1ed9def2d84f48b9e082366bb9fff71ecf","ssdeep":"","tlshash":"d7a0245c5001dc45ccd1c14c5f5313743133441f10d474531d7c3c0000733001013007","size":82,"data":"","first_seen":"2024-06-10T03:52:10Z","last_seen":"2026-09-05T22:28:31.675032Z","times_seen":9977,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"bf9adff0c7b770ed62515d2cbe8b7f87","sha1":"84c4997dec07e8f04c7fe34bef0e531e3adde673","sha256":"a668b8e69885e517e6053fe76080226df564844167f1443d253b38ecd6d39519","sha512":"a391fb9a2d02d7c28fa4d76e489aa761cb588d01d96c457faa21be6c101891778efea912afe2fcb26f6023a04765cd0366e57abcac2c407ba563b7063deb77fb","ssdeep":"","tlshash":"1811ec6d611c6fcdb3e708ea3c4b68060b9239577607c7a1c5171088ea29cf2211fdce","size":1041,"data":"","first_seen":"2024-12-18T22:04:13.737464Z","last_seen":"2026-09-05T22:28:31.676464Z","times_seen":658,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"8dd68de26519114adcdb561df9807829","sha1":"c5fe454c935af27d94a70a882da9db2980deb975","sha256":"8c1154cb90a7a1611acb7bde9f4a57d8f150bef2398f353ae57403108828d7ca","sha512":"ff502992dfa6b8fdbc5cec4235f73f2e66e8769ea324e7becbec14e4a0f1e421a7e83884eee0ef28b7a599499875735f6367c802e1627b3056d70d2e92ef9193","ssdeep":"","tlshash":"00b0129c58249c498ca0838c5b623b602222803f20e4640b6a4c7d0470f53034105903","size":96,"data":"","first_seen":"2024-07-17T11:12:45Z","last_seen":"2026-09-05T19:11:20.922036Z","times_seen":522,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"5fb69dc6a6553a84cc01fffabc114e38","sha1":"0dec6ea8171527c7bc29dd0c4fb3cd28fefb3418","sha256":"79f8af2c567762ba75433cf59388552e089a0ee41d3104a80bd2a34b15d40991","sha512":"5af49ceea1b09a8ae229703377ae6563fb3b53ded4a9c813661f72fc6dcaf0163f58cc64b79908ce2142ddad82a1d4a21cbddb905d95746f00448a12df302bd9","ssdeep":"","tlshash":"51b0129d8860984a8ca193499fa23b702252842b10d4680a674c6e4410b530a5009a0b","size":94,"data":"","first_seen":"2024-06-10T03:52:11Z","last_seen":"2026-09-05T22:28:31.695336Z","times_seen":4882,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"7530d8a7630f6951dc19f8aa9e72153c","sha1":"f009e75b86ce357203d766e7daccbdbef35378b7","sha256":"6659d94985847595ac1354e31474cf6e9b54f194c747e5ce0fa773fec012b9f0","sha512":"7178f9410f60fea812f618f22778f0106dbe8dccd1abf6512f0b24d7f1bb133ac79193145dd3e415a23a918b1628ca2f369297b633e0f9d8fd6e1ca9bd85eeeb","ssdeep":"","tlshash":"10b012689401ec554c64819c6e9212683111401b206479562b4829401cb3200000201b","size":88,"data":"","first_seen":"2024-06-10T03:52:11Z","last_seen":"2026-09-05T22:28:31.698093Z","times_seen":4886,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"ac2da76c4f297c3cdfcb943439cfec44","sha1":"debeeed837139ae85146b48ab862670396fe97cc","sha256":"d7b7fa6da3b1c9215c054bfa2f637157def707def4798fd272f91e6ec2a851a9","sha512":"2e11b7f8afd060f96f6c2d20c321d3b6401191319f98bf4b4d6f3f83a348e1b6ea753a85559b7887fa09ee8df936bb19748f67d1f9f87102943becd90e56698b","ssdeep":"","tlshash":"0ca012594410a80588a881a84b522b603211402b20d43819165c694820b13024005017","size":82,"data":"","first_seen":"2024-06-10T03:52:11Z","last_seen":"2026-09-05T19:11:20.930285Z","times_seen":4795,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"e806080ee0535277c5210dce58daa9d5","sha1":"4fa7e05e625b81e9e533237214fe1033a1f49c25","sha256":"48de0025b700e4760d84dcaca8cd904959aa730445017b4ce58390f4e5628fea","sha512":"c46284230824f693cbfa01b506a5308eeef10967066dc1c62420120e8b26621ad843f9df55c14b4d03c8e7eed0547b03cf2627027c4c9ce6fd8af4b6836add44","ssdeep":"","tlshash":"a7a012a844109805c8e481484b5237702211402b14e42409155c2c0410613024005003","size":79,"data":"","first_seen":"2024-06-10T03:52:10Z","last_seen":"2026-09-05T19:11:20.932569Z","times_seen":3779,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"a935281345ced384f0d64a586b697e18","sha1":"f8f0040a55fcbe69b9a9132218e3eaa10096cdf2","sha256":"fc95fbd1ce80e13f0b22ecfe65ee8caf5cb2faedddc12b25fb5615e1eed77b2f","sha512":"d73463310d2556ae2b6154fd4829e08754eda6043512389f63f8febce3b73cec0514c4e023b409b3719e7ec172c265ccc7df3548c26720bd8236edfbd998388d","ssdeep":"","tlshash":"b3e026a1dd8325085ef294832a227192e4ff32052a639f846f593d205eec8206b3366c","size":345,"data":"","first_seen":"2026-09-05T19:11:20.933409Z","last_seen":"2026-09-05T19:11:20.933409Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"6817c5676450b0c77f5dca002047afa2","sha1":"18788a076ce6290ce63770a9285c887bce668370","sha256":"1c536914a1a9754d792f1fd39202dc0fa5736a7d46becaf1cb5e2f0ce4757e75","sha512":"69ec3bea682b6d6249373ba9af883b8186880859695049eb7d71807f4165d867d4c89f4044e6681f102da5ffbf0e0b5018a4252457aecfd7d0508c288f244e6d","ssdeep":"","tlshash":"a2d0a711c77c092c4e1515d9e2215ad5370f827b0c915499786b3ca89c00e05d07c669","size":232,"data":"","first_seen":"2026-09-01T05:37:33.567007Z","last_seen":"2026-09-05T22:28:31.722341Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"c273dd435e758848835585d64769e571","sha1":"e3d6333f0e37a8e6c7fbbc4e3370e335e5fccd73","sha256":"848b1535597128974eeeaae9be7e491126658d73b92b5612ecf81323dc37bba4","sha512":"18e501e714d50793c6bb489d0ceffd63bff57eafeb2ed3ba1cb622bc745b0f11d36c939600b1d06ae988c0bdfef4167d1c989967e5471e16e898b9d534daa3b8","ssdeep":"","tlshash":"b6f0ac10fe1e94a48e6e611e43ca5acab6bcf4e6904258d5fc60cc1179f4d4b03d9f09","size":622,"data":"","first_seen":"2026-09-05T19:11:20.938074Z","last_seen":"2026-09-05T19:11:20.938074Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"235a5e9c7fa7c8da7fb64a2e0cb4f7a3","sha1":"32128357bc7a738d7c7628392f833cca34451b33","sha256":"cbea2fc4ded08f61133982f009a01df361559d6c4902f147c0c6c00fde485593","sha512":"cd706491ff275426c0851cde174bf668dfeaa9a10f0b5c658e0ba62379162d2168d2e9c58ea0a8851ebec8f33542f37baf79c5373d24b3516e3be1fe68831e78","ssdeep":"","tlshash":"8611af69f20c582fd0373335b4ae384873be0d7f5e046c01939175a54ab9869419addf","size":1053,"data":"","first_seen":"2026-08-24T20:13:30.959959Z","last_seen":"2026-09-05T19:11:20.940556Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/main/core/core_fx.min.js?17117254619768","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"cf0a6241bc8bf1c85a8d7ae705340958","sha1":"dd168d4c7230a1647d21217c69c404fe2c6a04b1","sha256":"a83acc36583ad28eea1993a9b89c3fce5eb6f3f5cd8945992012cda9dfe1a4b9","sha512":"b530874f6122bdf2a405dd9edc60a6fc4c421812386656d5168c9a679fbfd6acb4524e7c6adcd98c1217d303ceca909cd8a34f8337f8266d0e97636b11561a90","ssdeep":"192:iQpe7kR3aGv0yHyX07PNtuk+GXPETqR1Vt3bkAjWAw/C:iBQ0yHyX07PGk+Gr1VtgiWAw/C","tlshash":"2e12464db253732997d3e2b6620b030d6234c7793909014db4b4d7e5ed35e0ee2abab9","size":9768,"data":"","first_seen":"2023-03-08T05:11:44Z","last_seen":"2026-09-06T11:02:29.750306Z","times_seen":1343,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"5658b62f52414e84ce3a3755cff68975","sha1":"3bad30ac0e97517747ebb0510254356d80702665","sha256":"3d539b07305e11394716fdf037643796a2d0464c17d823dca963bc9b35359403","sha512":"5a981ee0e6cc44f16c6faa0299239f4a35759916b5ee25ab0df508cb83b915341feb22f567e821bcab6a5ff0b3999ebb71e07e17c47a20a5b277d186ba677809","ssdeep":"","tlshash":"97e02065cdc315085ee2d4876b637091e4fe32053e63cf445f5929204d6c5005f32648","size":345,"data":"","first_seen":"2026-09-05T19:11:20.943213Z","last_seen":"2026-09-05T19:11:20.943213Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/main/core/core.min.js?1760567457229643","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"0ad11792917af7699844f76f5ab72ef6","sha1":"f629111650b14d6be3d7f563c746b6ca6ef8c2b2","sha256":"df28a6b2504c10b11a817930c5e07a0a98e205a6a34003784862861ccf270ef0","sha512":"c91b3445f2df708650efa55c00ac92ffdc1b0aba03c588e3b85cc93d2f6939fdcbafc3efcbfeed207c1e82613c8cecd9a59b163010f88dbdaf6de7d827332063","ssdeep":"3072:+z38SMLrVp+eWdtJy2ZARsFmuYrJqUdIbF6wGTQMjce:+z38SMLrVpOwV+RHe","tlshash":"2c24178831d2b17683eb64b4543f210bf23568a6658ec090f278ecd27db4d1a9677f78","size":229643,"data":"","first_seen":"2025-07-18T04:50:08.426564Z","last_seen":"2026-09-05T19:11:20.888749Z","times_seen":2164,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/pull/protobuf/protobuf.min.js?171172546876433","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"cdf1137b813b709c10d31045d0037a6c","sha1":"c3f513d708b64cd58cc9c6cac45b428c97297999","sha256":"33bd1842b7778216197b870e8f3b4e387d9511905c04ea5a07934b3c614ef109","sha512":"65caa244bece1e12e05b41bc18508cc42491b2597bb7764e5944efe3e8a347e188117ab2f4e2dde9e75f7af0b961ba56c2fb5905ff0db98ef97bc915343e500c","ssdeep":"768:dYc+T6XvjDnZgeuXP0rYl1Z1KsrZHp4PvHSoGh3PP7+0ApzSxTiDBWdXxZZC0GA9:q8DXqp/rZsyoG8U+WXeTADL5","tlshash":"3873fa8832a5b06643e758e0841f100bf235d96d984ec19cf758ece12cb99b99277fbd","size":76433,"data":"","first_seen":"2023-03-07T13:11:13Z","last_seen":"2026-09-05T20:27:51.503152Z","times_seen":4827,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"ca24eeb561c06e31de5945e8ff28ab47","sha1":"840f9aa238bba167c417206d220081e1659682d8","sha256":"9e8962496e9110f323e84acc2aa3ab4b9a817931cd91fa5f09041e37843951e9","sha512":"14affc3005c7d62a57617f3d006b9ce9edd424ca112a4803f8144ef0f4f606c4d62389b6741c80a356ce39b3efe27b0f4c4c523f2c8a46a969b184952810f61f","ssdeep":"","tlshash":"98e02061cd8226085ef2d4871b2371a1e4fe62492e239e485f086d105d9c5105b32745","size":345,"data":"","first_seen":"2026-09-05T19:11:20.945603Z","last_seen":"2026-09-05T19:11:20.945603Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"5d12069061a74b1c3a8e8111204dd7ad","sha1":"8bfa1a1af0ebc3ac1dc6057b528962357fae7f1b","sha256":"fa51fa276c5897badf326f08d1e7c7c2e63ebb2b3f6284c5632bcf35cc09ffdf","sha512":"3b99bb6ea146d48b1118c1ea50436371996ea5cc38448ad84d59c117fe0b0514ce214047c0ed9a0304a3d35179b9c03c969a7ccb7f69d8f9bc4bbbbe41b2d3c0","ssdeep":"","tlshash":"a4e026a5cd83290c5fe294872a6370d2a0ff72092f168e445f1969205eac8006b32658","size":345,"data":"","first_seen":"2026-09-05T19:11:20.947753Z","last_seen":"2026-09-05T19:11:20.947753Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"eval","is_inline":false,"md5":"f0ffd3b7c2574ac324603ed00488c850","sha1":"623e76c36aa2a886542011e28412cc761d7ceb01","sha256":"c4d0cf241a1bfa1c8bf4cf24e8f89d2ab786a284a39adb2fc8df7ea14e73c154","sha512":"436f9fb4816f6975fec0d965dfc0db4c3c38c53632dd4dc99a6c1a2dd9562fbd67176d0118549ff573c97e3394bad4d601c425cf670acab249ebc8d260591fa2","ssdeep":"","tlshash":"1540000003c00000300000c0000000000003c00000000000c000000000c00000300030","size":7,"data":"","first_seen":"2023-03-07T01:03:35Z","last_seen":"2026-09-06T12:37:11.88525Z","times_seen":86172,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/pull/protobuf/model.min.js?171172546814190","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"5fdcebc0b20d80cc512ab992d236242c","sha1":"2f81f88790665be76b5fb8640dea32997019333b","sha256":"6c9b5de3c1416c5aec8d608287ac497758530c4f8228725bc33e49cbeee28382","sha512":"7fe250dced26b906cbd2a01cf971d1b753c05c0d8cd085736d5134a03ecafb64d26b0e0c3621dfc09e3db3b893b2ac9e5b011528872719625a8c608436041296","ssdeep":"192:qS20h7Z57wTEwDPUVYC3TU6BgXUPjs9TwbN6shUC:qmn73rrBgaQ9E/j","tlshash":"e952748095b1f90ad797f8bc6817244fe169b5169438b450b22cfb52f0b01ae13ef76e","size":14190,"data":"","first_seen":"2023-03-07T13:11:13Z","last_seen":"2026-09-06T10:25:35.388689Z","times_seen":6812,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/main/core/core_promise.min.js?17117254612490","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"e2e144d73a70c7af12cb679cfb5b9bcd","sha1":"288382dd929aefe03c6e37fed351ecb5e4b0a587","sha256":"30fd2c1451c856b183610ae1221a200aeec55b4810fc5cf702373a1e61bc4b9b","sha512":"acfe435e19994343d3b210a3a282d2e1760276ec8b0bad54fdcc4d11f45f8403df2160f587d1f4cde0f0e080fb1a041b2ffe62e706e62f826d85705b9255d50f","ssdeep":"","tlshash":"e151bf1b382ca13e05ae99b0500b4d1bf233a43f55e056adb634e8f6583a90d11bfbb5","size":2490,"data":"","first_seen":"2023-03-07T01:19:19Z","last_seen":"2026-09-06T04:36:17.397823Z","times_seen":2520,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/rest/client/rest.client.min.js?17117254689240","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"65cb55d65bce0121b37c3f756db51f45","sha1":"a73f2b03323c0dfcce8bddcbb7c0c0d51dcb46d4","sha256":"5091a00509b006388997b171d01e78296119e41fe88889dfb50f9611bdb17804","sha512":"cc5167a38cafb83c2c8e9376b135459acf35a64b4faee5d8df394a55bd1bd8d720f8160cf4855ca962532a2bf9d09168211258248bedd181bc16ed323e99c0c0","ssdeep":"192:5q60vE2mxJ2EQLnIBH0uYLcC9sYBEMJ/cJXmVtrCUeVQt4bIWIW4h1WjBUZK08:gnfuYLbsYiJUxeV3pp4hcjBgK08","tlshash":"7612c64e3d14b0624ffb61b0441f229ba27e827929de882c6558d4e53cf984f4e3bf64","size":9240,"data":"","first_seen":"2023-03-07T13:11:13Z","last_seen":"2026-09-06T10:25:35.394128Z","times_seen":6758,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/pull/client/pull.client.min.js?176056710249849","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"a06fccb40781b642836dced116074499","sha1":"f53380f8d6a4ad6cf29cb7e211b5dc0a9ee57a6f","sha256":"a33069f57a332f5bd162e24fcd38505c1b19d672c31f5783ada4741ddce24a9e","sha512":"f70772b01fcc6446990378e66df49f641022d251d463e1d7fc7c579468c2c1d5a86970b3a8930288cc57c7f141e199a7d99d447b6f95876ab5f061a32451dba0","ssdeep":"1536:lDPTGU78iZxGDtOxSuUnV7X8lF4ugbXmcMXxW:i8O2co4","tlshash":"9f23b80361b9683707fa416178351102f3355ae0370a84adff7c7cfae935a89926bb75","size":49849,"data":"","first_seen":"2025-04-20T05:36:38.359345Z","last_seen":"2026-09-06T10:25:35.398011Z","times_seen":4186,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"crm.layton.ru/","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-05T19:10:36.315Z","timestamp":1788635436315,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:36 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: HTTPS\r\np3p: policyref=\"/bitrix/p3p.xml\", CP=\"NON DSP COR CUR ADM DEV PSA PSD OUR UNR BUS UNI COM NAV INT DEM STA\"\r\nx-powered-cms: Bitrix Site Manager (97be743d81b4d351840923749294d0de)\r\nset-cookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P; path=/; HttpOnly\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nx-bitrix-ajax-status: Authorize\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"lbhML0wPcJN5zlLv7upD2DIObReHyS5P","quoted":false,"path":"/","secure":false,"http_only":true,"same_site":"","partitioned":false,"raw":"PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P; path=/; HttpOnly"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"1C-Bitrix","description":"1C-Bitrix is a system of web project management, universal software for the creation, support and successful development of corporate websites and online stores.","website":"https://www.1c-bitrix.ru","common_platform_enumeration":"","icon":"1C-Bitrix.svg","categories":["CMS","Ecommerce"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":10301,"size_decoded":4661,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1049), with CRLF, LF line terminators","md5":"230dc6c55cd499a1e5497fe372aec890","sha1":"04dc87282db4c5aa7e85bad44e974480bbb9cfb3","sha256":"eb6a2f1fea6b7cbe70e375d90006bf0146864fb402a699367ad6cdf1acbe2e97","sha512":"609def1551a928f497dd7a6595ad4301c65a4adfbd8d74729480b53b0b4db3d4768bec72b69971feea3e82235572780c5f6f307320599d892e98fbbd2b3114fc","ssdeep":"192:zrfMZ8iOJsMA2BC0kP1PgZEz3dU3a3z3T3bqhyZYyQyP1AFQP1pjnylKXSuEz:zrkZ8iO6X2C06PaEzaqjjrqhmYyQazdG","tlshash":"8c22e828bc0c9d5f40e314a8781a7c0c75ff49376603cd90e1b519586efaef2622ae4e","first_seen":"2026-09-05T19:11:20.862054Z","last_seen":"2026-09-05T19:11:20.862054Z","times_seen":1,"resource_available":false,"data":null}},"time_used":766,"timings":{"blocked":0,"dns":77,"connect":160,"send":0,"wait":340,"receive":0,"ssl":188},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/ui/design-tokens/dist/ui.design-tokens.min.css?176056674923463","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.255Z","timestamp":1788635437255,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/ui/design-tokens/dist/ui.design-tokens.min.css?176056674923463 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Oct 2025 22:19:09 GMT\r\netag: W/\"68f01ddd-5ba7\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23463,"size_decoded":5200,"mime_type":"text/css","magic":"ASCII text, with very long lines (23463), with no line terminators","md5":"6bd6f9ea8f0c54e08e3a12b977f1b720","sha1":"c115c5cf987a3edc217f8e1ecfa0a59edcb4d85a","sha256":"8909230ab0cbf3ec50721843f05a08256c6f3087b8cee954c2e921feed611f5a","sha512":"3524e572b6d7c8646333759c99a0598f9abefb10250d70fbe9b9a57a5dd17f1ec24f11a3a825aee09288f796ca024b6aa7b1ea251a7c52499765343d4bfcefaa","ssdeep":"192:6YB5e1lXgD+eKA5sWbbRRKQrRcsbY8e56WFKG9PNB82FHI8FetwIpE6dyWsa8zR/:dEicPCwvqjVegYIGk2jCdSHYG","tlshash":"5fb25aacf7d24817376f4abe95e892fdb7644897441342e9a371718b7c892f72843223","first_seen":"2024-06-10T03:52:20Z","last_seen":"2026-09-06T07:09:16.593638Z","times_seen":5092,"resource_available":false,"data":null}},"time_used":815,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":815,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/rest/client/rest.client.min.js?17117254689240","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.269Z","timestamp":1788635437269,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/rest/client/rest.client.min.js?17117254689240 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 29 Mar 2024 15:17:48 GMT\r\netag: W/\"6606db9c-2418\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9240,"size_decoded":3930,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9200)","md5":"65cb55d65bce0121b37c3f756db51f45","sha1":"a73f2b03323c0dfcce8bddcbb7c0c0d51dcb46d4","sha256":"5091a00509b006388997b171d01e78296119e41fe88889dfb50f9611bdb17804","sha512":"cc5167a38cafb83c2c8e9376b135459acf35a64b4faee5d8df394a55bd1bd8d720f8160cf4855ca962532a2bf9d09168211258248bedd181bc16ed323e99c0c0","ssdeep":"192:5q60vE2mxJ2EQLnIBH0uYLcC9sYBEMJ/cJXmVtrCUeVQt4bIWIW4h1WjBUZK08:gnfuYLbsYiJUxeV3pp4hcjBgK08","tlshash":"7612c64e3d14b0624ffb61b0441f229ba27e827929de882c6558d4e53cf984f4e3bf64","first_seen":"2023-03-07T13:11:13Z","last_seen":"2026-09-06T10:25:35.394128Z","times_seen":6758,"resource_available":true,"data":null}},"time_used":2679,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2679,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/main/core/core_fx.min.js?17117254619768","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.272Z","timestamp":1788635437272,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/main/core/core_fx.min.js?17117254619768 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 29 Mar 2024 15:17:41 GMT\r\netag: W/\"6606db95-2628\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9768,"size_decoded":3612,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (9732)","md5":"cf0a6241bc8bf1c85a8d7ae705340958","sha1":"dd168d4c7230a1647d21217c69c404fe2c6a04b1","sha256":"a83acc36583ad28eea1993a9b89c3fce5eb6f3f5cd8945992012cda9dfe1a4b9","sha512":"b530874f6122bdf2a405dd9edc60a6fc4c421812386656d5168c9a679fbfd6acb4524e7c6adcd98c1217d303ceca909cd8a34f8337f8266d0e97636b11561a90","ssdeep":"192:iQpe7kR3aGv0yHyX07PNtuk+GXPETqR1Vt3bkAjWAw/C:iBQ0yHyX07PGk+Gr1VtgiWAw/C","tlshash":"2e12464db253732997d3e2b6620b030d6234c7793909014db4b4d7e5ed35e0ee2abab9","first_seen":"2023-03-08T05:11:44Z","last_seen":"2026-09-06T11:02:29.750306Z","times_seen":1343,"resource_available":true,"data":null}},"time_used":2676,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2676,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/templates/login/images/ld_blue.gif","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:38.558Z","timestamp":1788635438558,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/templates/login/images/ld_blue.gif HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/bitrix/templates/login/template_styles.min.css?176056735544611\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:38 GMT\r\ncontent-type: image/gif\r\ncontent-length: 13968\r\nlast-modified: Fri, 29 Mar 2024 15:17:39 GMT\r\netag: \"6606db93-3690\"\r\nexpires: Mon, 05 Oct 2026 19:10:38 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13968,"size_decoded":14328,"mime_type":"image/gif","magic":"GIF image data, version 89a, 64 x 64","md5":"da96772c9cfeb7f7b442c81cabea06d0","sha1":"137d81204de775577d030ffefcaf2af23cdcf638","sha256":"f7f6df287dd738653e33f839392afb4263a9d7e1a173ae7a6de37fd630e0e651","sha512":"55b1eac8116cfd791ddbdef0361b3b3dd9059ef5760e8778f9863c62b6db96c92a5580c0395c6cf063817469e07a75434f05358b5e837b90d2910385fff31267","ssdeep":"192:amH0M0YmwbaUeAnZyxbyvlg3eNID7baSSH5tcMLCrbEZ5NZeNIcUU0OtHgU6m1im:amUFUr47ZQ5tHkYZdch16zKz3","tlshash":"a352aea0ce62219dcc05c7318b48bac5d5dfc360c22b6b2d5bf15445a2bb85bf4d348b","first_seen":"2023-05-19T02:54:23Z","last_seen":"2026-09-05T19:11:20.871793Z","times_seen":336,"resource_available":false,"data":null}},"time_used":4985,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1389,"receive":3596,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/intranet/intranet-common.min.css?171172546661199","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.253Z","timestamp":1788635437253,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/intranet/intranet-common.min.css?171172546661199 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 29 Mar 2024 15:17:46 GMT\r\netag: W/\"6606db9a-ef0f\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":61199,"size_decoded":12426,"mime_type":"text/css","magic":"ASCII text, with very long lines (19394)","md5":"c58b59964f1efe8aec5fd6a01ab11701","sha1":"2be7bff0e9f1e2df9aae399b1f73d2a28ef0992e","sha256":"53a635376d76cb25dcda38d08ed5b7e1897f47abdf2ed1a54892d43d0f43ad51","sha512":"1a5af50f1212f580e49d6021787473a451c37dd24c4bdb88abf636aba21ec673adbcd0da449b42b29f3c663da63a5c0aeb93af11a87b636b5515e6edb520d271","ssdeep":"1536:H6va4pacaEAGt0+iGOzlBKk5COBKVucyku8ku2kuwhuwjuw/Eucy2u8Ju2zu2ueU:Y6COstfPend7iKYGp2pp","tlshash":"7e5364db9094252ea72743b249d36d4872a0dfd2e9102697e715f4ec43eccbf216bb12","first_seen":"2023-04-10T06:27:50Z","last_seen":"2026-09-05T19:11:20.884742Z","times_seen":1066,"resource_available":false,"data":null}},"time_used":323,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":323,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/ui/fonts/montserrat/ui.font.montserrat.min.css?17117254692209","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.256Z","timestamp":1788635437256,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/ui/fonts/montserrat/ui.font.montserrat.min.css?17117254692209 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 29 Mar 2024 15:17:49 GMT\r\netag: W/\"6606db9d-8a1\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2209,"size_decoded":660,"mime_type":"text/css","magic":"ASCII text, with very long lines (2209), with no line terminators","md5":"e63ce1c1f5ddfce02f61895705bf3761","sha1":"ad2049a2f38b85b0413cb60df3907591cf71eec4","sha256":"fc30ac3c5883044bea08dbd0f89f8a77d317139a29d260a9247a5a3338036b59","sha512":"ec4db4e0f923a8111c4aca6be9e053c1035b50662b775c725ae1b74df05a80ec5f9e3a9eb68470776fac2690227b06eaffbe816ee925961514b721b243cd2182","ssdeep":"","tlshash":"5b413d297bdb6119a46a0c9a319d6216194730bbb479c413781d3ca9fee3c263b60f38","first_seen":"2023-04-18T10:39:38Z","last_seen":"2026-09-06T07:09:16.606537Z","times_seen":643,"resource_available":false,"data":null}},"time_used":814,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":814,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/main/core/core.min.js?1760567457229643","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.264Z","timestamp":1788635437264,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/main/core/core.min.js?1760567457229643 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 15 Oct 2025 22:30:57 GMT\r\netag: W/\"68f020a1-3810b\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":229643,"size_decoded":80638,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65418)","md5":"0ad11792917af7699844f76f5ab72ef6","sha1":"f629111650b14d6be3d7f563c746b6ca6ef8c2b2","sha256":"df28a6b2504c10b11a817930c5e07a0a98e205a6a34003784862861ccf270ef0","sha512":"c91b3445f2df708650efa55c00ac92ffdc1b0aba03c588e3b85cc93d2f6939fdcbafc3efcbfeed207c1e82613c8cecd9a59b163010f88dbdaf6de7d827332063","ssdeep":"3072:+z38SMLrVp+eWdtJy2ZARsFmuYrJqUdIbF6wGTQMjce:+z38SMLrVpOwV+RHe","tlshash":"2c24178831d2b17683eb64b4543f210bf23568a6658ec090f278ecd27db4d1a9677f78","first_seen":"2025-07-18T04:50:08.426564Z","last_seen":"2026-09-05T19:11:20.888749Z","times_seen":2164,"resource_available":true,"data":null}},"time_used":1582,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1582,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/ui/fonts/opensans/ui.font.opensans.min.css?17117254692320","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.260Z","timestamp":1788635437260,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/ui/fonts/opensans/ui.font.opensans.min.css?17117254692320 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 29 Mar 2024 15:17:49 GMT\r\netag: W/\"6606db9d-910\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2320,"size_decoded":668,"mime_type":"text/css","magic":"ASCII text, with very long lines (2320), with no line terminators","md5":"82527a21acaba47e5e9d367437d64428","sha1":"54955d72d394cedb976520fd2ea5f65ecff43d18","sha256":"47d42f9f412d0c8854bfed1c7b1b433eaf6df4d0d67e7619ee6c9cb7b0289c90","sha512":"e0a0473f0444e056ad895a03b4eff808cb48fa377a973aab3d6e798e9bb2393225bb27d071633d186bcf6f60b406d1e3ee30f760ce3aaa09e8d5c5aedaa1fd2a","ssdeep":"","tlshash":"b041e322ded6283d89a32c93bdce3e39590624621469c447b7185eb48da3a1e7368f1d","first_seen":"2023-04-07T08:59:30Z","last_seen":"2026-09-06T07:09:16.541627Z","times_seen":4826,"resource_available":false,"data":null}},"time_used":811,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":811,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/templates/login/template_styles.min.css?176056735544611","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.262Z","timestamp":1788635437262,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/templates/login/template_styles.min.css?176056735544611 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Oct 2025 22:29:15 GMT\r\netag: W/\"68f0203b-ae43\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44611,"size_decoded":14521,"mime_type":"text/css","magic":"ASCII text, with very long lines (44611), with no line terminators","md5":"c7c056fc6f21fa983c81bea665cfafbf","sha1":"030231e8f4283ebe9c2d09ce057825a87076c7ed","sha256":"996e409c66fca13f1544bcd031fcb0bdeda9c13de8d623f035a43b17e4769edd","sha512":"690cf4e3aafc6a9005611d7476fef47972beea737190b409c8a9b7796918dff4f2e211a66c4c7bc5d004f1e24ef13b8bdcd208abe8f1aa36deee978c689ef08e","ssdeep":"768:Us02sgtcLeqZkXDpq5X99QCxS/v/hJh99afZb99ELjzyBURTK/cE2DDimJ:dsZLB99EGEE2DDi8","tlshash":"87131a7c72143d4ef47bc8169d917249702847b7fb228e78ea7a7229cd835f4a1f2624","first_seen":"2025-06-25T08:18:27.769876Z","last_seen":"2026-09-05T19:11:20.892721Z","times_seen":16,"resource_available":false,"data":null}},"time_used":1272,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":1272,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/pull/protobuf/protobuf.min.js?171172546876433","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.265Z","timestamp":1788635437265,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/pull/protobuf/protobuf.min.js?171172546876433 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 29 Mar 2024 15:17:48 GMT\r\netag: W/\"6606db9c-12a91\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":76433,"size_decoded":26717,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"cdf1137b813b709c10d31045d0037a6c","sha1":"c3f513d708b64cd58cc9c6cac45b428c97297999","sha256":"33bd1842b7778216197b870e8f3b4e387d9511905c04ea5a07934b3c614ef109","sha512":"65caa244bece1e12e05b41bc18508cc42491b2597bb7764e5944efe3e8a347e188117ab2f4e2dde9e75f7af0b961ba56c2fb5905ff0db98ef97bc915343e500c","ssdeep":"768:dYc+T6XvjDnZgeuXP0rYl1Z1KsrZHp4PvHSoGh3PP7+0ApzSxTiDBWdXxZZC0GA9:q8DXqp/rZsyoG8U+WXeTADL5","tlshash":"3873fa8832a5b06643e758e0841f100bf235d96d984ec19cf758ece12cb99b99277fbd","first_seen":"2023-03-07T13:11:13Z","last_seen":"2026-09-05T20:27:51.503152Z","times_seen":4827,"resource_available":true,"data":null}},"time_used":2683,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2683,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/pull/client/pull.client.min.js?176056710249849","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.270Z","timestamp":1788635437270,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/pull/client/pull.client.min.js?176056710249849 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 15 Oct 2025 22:25:02 GMT\r\netag: W/\"68f01f3e-c2b9\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":49849,"size_decoded":16109,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (49671)","md5":"a06fccb40781b642836dced116074499","sha1":"f53380f8d6a4ad6cf29cb7e211b5dc0a9ee57a6f","sha256":"a33069f57a332f5bd162e24fcd38505c1b19d672c31f5783ada4741ddce24a9e","sha512":"f70772b01fcc6446990378e66df49f641022d251d463e1d7fc7c579468c2c1d5a86970b3a8930288cc57c7f141e199a7d99d447b6f95876ab5f061a32451dba0","ssdeep":"1536:lDPTGU78iZxGDtOxSuUnV7X8lF4ugbXmcMXxW:i8O2co4","tlshash":"9f23b80361b9683707fa416178351102f3355ae0370a84adff7c7cfae935a89926bb75","first_seen":"2025-04-20T05:36:38.359345Z","last_seen":"2026-09-06T10:25:35.398011Z","times_seen":4186,"resource_available":true,"data":null}},"time_used":2678,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2678,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/main/popup/dist/main.popup.bundle.min.js?176056746667261","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.271Z","timestamp":1788635437271,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/main/popup/dist/main.popup.bundle.min.js?176056746667261 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Wed, 15 Oct 2025 22:31:06 GMT\r\netag: W/\"68f020aa-106bd\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":67261,"size_decoded":18334,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (65536), with no line terminators","md5":"d0c9dbc1c6c425c1d02457d3a809f189","sha1":"4a3893b162ae8a77e0090cf4e23a66cede9483fc","sha256":"a74597d52cf68cfa049abea6a865f64422605cf5fedb42824df1c736d12114a1","sha512":"4cd10f9eb447c0d5df4e2b7168100d3f456aa0a9a8edc4c9ccbe415786462917304b03643a1327e43493683b4f0695b54bc934ab604ac1733b286e579d65947a","ssdeep":"1536:zeLulbv/hiY4WAAKSluKB5YHuqow/4zZNggz1g:VhCWAAKSluKBbqow/4zZVg","tlshash":"9963c81032856636d6d9e16d9a5b320a7235628195c7c86cb93cfccadde0e1a3773f38","first_seen":"2025-08-31T10:12:09.613086Z","last_seen":"2026-09-05T19:11:20.898906Z","times_seen":456,"resource_available":true,"data":null}},"time_used":2677,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2677,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/ui/fonts/montserrat/montserrat-medium.woff2","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:38.570Z","timestamp":1788635438570,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/ui/fonts/montserrat/montserrat-medium.woff2 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/bitrix/js/ui/fonts/montserrat/ui.font.montserrat.min.css?17117254692209\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:38 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 33780\r\nlast-modified: Fri, 29 Mar 2024 15:17:49 GMT\r\netag: \"6606db9d-83f4\"\r\nexpires: Mon, 05 Oct 2026 19:10:38 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":33780,"size_decoded":34141,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 33780, version 1.0","md5":"2f8000ed713fd157f7a76e532a4c6e8b","sha1":"23e25802b90b457b0e774676844c4b3a0622877e","sha256":"c3a63e893dc47bea80aa6c86d67d87c25b341fe75adb2747ba7b64839dc0595b","sha512":"44f8f74a103680a47d58f34e3918ebe104fcfb59dab0bc85d85a235838a12816e3cce4e98dd41a9a3e05c04d60ce7014c39b4ddfaa15c415243b0bdbf6d11f7d","ssdeep":"768:Xopm86XwapMSadFchSiENYvW2KyWp/MQCFeTCOXr9TQJWkem1:XoA8Z4T8+hSiEAseQCY/Xr9ckE","tlshash":"9fe2e165628729aebc025b37e5e16edbfc2941f30b5909c0eeb7f535c42860226e0b75","first_seen":"2023-05-24T01:44:37Z","last_seen":"2026-09-05T19:11:20.901111Z","times_seen":330,"resource_available":false,"data":null}},"time_used":2015,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1377,"receive":638,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/main/popup/dist/main.popup.bundle.min.css?176056725528056","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.261Z","timestamp":1788635437261,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/main/popup/dist/main.popup.bundle.min.css?176056725528056 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 15 Oct 2025 22:27:35 GMT\r\netag: W/\"68f01fd7-6d98\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28056,"size_decoded":7416,"mime_type":"text/css","magic":"ASCII text, with very long lines (28056), with no line terminators","md5":"65be4e5b5e1d1160a5fc92717d59bf6a","sha1":"a6daf4ec20ad59f63263ab645f3f321e7db89ac7","sha256":"baf64153a20ba03a85f8b6a7fa4ef351b967bec389b4f12a886fda177be9a65d","sha512":"85bc3ff5252dd15ce2a6321a92c5b893499cb08bf1d67f282634886c4bb0e86b15019ff83e9dc19ffa0c0ec5e55e7e51f93cbe9ea9bc0fc9fa32e9c54ad25980","ssdeep":"384:1Z2cKKqdJqcHJGXVy0pKc3SWobZSnvfH9Vy0wk:1t2JGXrJSWobIXH9rj","tlshash":"35c295f5e584350da12f8f269797ab58122ae061f4014fbcb528f610e283fd7d3a617e","first_seen":"2025-06-12T11:04:32.620141Z","last_seen":"2026-09-06T00:03:57.536449Z","times_seen":3127,"resource_available":false,"data":null}},"time_used":969,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":969,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/pull/protobuf/model.min.js?171172546814190","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.266Z","timestamp":1788635437266,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/pull/protobuf/model.min.js?171172546814190 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 29 Mar 2024 15:17:48 GMT\r\netag: W/\"6606db9c-376e\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":14190,"size_decoded":2552,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (14156)","md5":"5fdcebc0b20d80cc512ab992d236242c","sha1":"2f81f88790665be76b5fb8640dea32997019333b","sha256":"6c9b5de3c1416c5aec8d608287ac497758530c4f8228725bc33e49cbeee28382","sha512":"7fe250dced26b906cbd2a01cf971d1b753c05c0d8cd085736d5134a03ecafb64d26b0e0c3621dfc09e3db3b893b2ac9e5b011528872719625a8c608436041296","ssdeep":"192:qS20h7Z57wTEwDPUVYC3TU6BgXUPjs9TwbN6shUC:qmn73rrBgaQ9E/j","tlshash":"e952748095b1f90ad797f8bc6817244fe169b5169438b450b22cfb52f0b01ae13ef76e","first_seen":"2023-03-07T13:11:13Z","last_seen":"2026-09-06T10:25:35.388689Z","times_seen":6812,"resource_available":true,"data":null}},"time_used":2682,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2682,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/js/main/core/core_promise.min.js?17117254612490","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:37.267Z","timestamp":1788635437267,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/js/main/core/core_promise.min.js?17117254612490 HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:37 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Fri, 29 Mar 2024 15:17:41 GMT\r\netag: W/\"6606db95-9ba\"\r\nexpires: Mon, 05 Oct 2026 19:10:37 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2490,"size_decoded":1199,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (2449)","md5":"e2e144d73a70c7af12cb679cfb5b9bcd","sha1":"288382dd929aefe03c6e37fed351ecb5e4b0a587","sha256":"30fd2c1451c856b183610ae1221a200aeec55b4810fc5cf702373a1e61bc4b9b","sha512":"acfe435e19994343d3b210a3a282d2e1760276ec8b0bad54fdcc4d11f45f8403df2160f587d1f4cde0f0e080fb1a041b2ffe62e706e62f826d85705b9255d50f","ssdeep":"","tlshash":"e151bf1b382ca13e05ae99b0500b4d1bf233a43f55e056adb634e8f6583a90d11bfbb5","first_seen":"2023-03-07T01:19:19Z","last_seen":"2026-09-06T04:36:17.397823Z","times_seen":2520,"resource_available":true,"data":null}},"time_used":2680,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2680,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/bitrix/templates/login/images/bg_clouds_3.png","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:38.548Z","timestamp":1788635438548,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /bitrix/templates/login/images/bg_clouds_3.png HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/bitrix/templates/login/template_styles.min.css?176056735544611\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:38 GMT\r\ncontent-type: image/png\r\ncontent-length: 8574\r\nlast-modified: Fri, 29 Mar 2024 15:17:39 GMT\r\netag: \"6606db93-217e\"\r\nexpires: Mon, 05 Oct 2026 19:10:38 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":8574,"size_decoded":8933,"mime_type":"image/png","magic":"PNG image data, 1272 x 284, 8-bit/color RGBA, non-interlaced","md5":"c72797137547c3642d2409aac17a613e","sha1":"6aee0c23674b814de50ae0c6b54a1a6b394fb88f","sha256":"c4bebae38085c9bfc08b09c0f5b07ac259d372bd065b9eb3cc05d93485d0e245","sha512":"51fd409535c623bda11e82110b85ac25d1f5f3c2f7d1f55a299ec96f9bb0d18538b4b115ade3a2771da2da8400798e9a6602cda97ac0bf99338feb20b58a701c","ssdeep":"192:ioONgOLPXsAYnDSVL2M55rVqtXwtEX0pqXqmrFBwiV2dn:fOWOLv5q25pqtXw2kpq/FBF2dn","tlshash":"3d029e216a03add7d72905fd1708a100e0761f34f119debf8ead46014fc7a9fe729824","first_seen":"2023-05-19T02:54:23Z","last_seen":"2026-09-05T19:11:20.906914Z","times_seen":329,"resource_available":false,"data":null}},"time_used":4516,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":1400,"receive":3116,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"crm.layton.ru/favicon.ico","fqdn":"crm.layton.ru","domain":"layton.ru","tld":"ru"},"ip":{"addr":"212.109.194.64","port":443,"asn":29182,"as":"JSC IOT","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://crm.layton.ru/","date":"2026-09-05T19:10:43.186Z","timestamp":1788635443186,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"crm.layton.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 24 Jul 2026 22:01:52 GMT","end":"Thu, 22 Oct 2026 22:01:51 GMT"},"fingerprint":{"sha1":"A6:6F:FD:ED:6C:ED:5C:31:6F:38:03:67:46:74:52:1C:09:EA:3D:B2","sha256":"0A:88:77:8D:F5:FC:5E:91:81:B4:C7:6E:6E:DA:D2:93:E4:33:11:43:09:BF:FE:E2:C2:E7:3A:68:9C:91:E8:AC"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: crm.layton.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://crm.layton.ru/\r\nCookie: PHPSESSID=lbhML0wPcJN5zlLv7upD2DIObReHyS5P; BITRIX_SM_TZ=UTC\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 05 Sep 2026 19:10:43 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 4286\r\nlast-modified: Wed, 15 Oct 2025 22:29:14 GMT\r\netag: \"68f0203a-10be\"\r\nexpires: Mon, 05 Oct 2026 19:10:43 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4286,"size_decoded":4648,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel","md5":"c963663aa7fb2e6c4665842f8be818f9","sha1":"aabe01039f01a488322dda35065632f8e66c1ba4","sha256":"eb15e3be2ed9fbc3641170141c9c15e7df75aefbc3af885dec4576328807972d","sha512":"89efee62483f7dd03e00602df564677bd3dd45d9d574207b6c9eba62e3a3fd19dec0a36d62634120b646cd0bff389eb007be20c6ca89b363bed222f22544d48b","ssdeep":"24:su6cvb2r8yAcS1Tl3Dr5jaoVklaHwBL3XaRet1:Ucvb2rDApnTHk+wBLnaEt1","tlshash":"a891cbc2fa11d1a4e38a243425214ff89bab6da0007f4f42152e757b6d3f75222546f3","first_seen":"2025-05-19T09:36:26.404473Z","last_seen":"2026-09-05T19:11:20.907666Z","times_seen":669,"resource_available":false,"data":null}},"time_used":358,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":358,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-05","alert":"Sinkholed","trigger":"crm.layton.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-05","alert":"Phishing Block","trigger":"crm.layton.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}