{"report_id":"3a97b43b-5427-4523-9b91-397e2418913c","version":0,"status":"done","tags":[],"date":"2026-08-25T21:00:57Z","url":{"schema":"http","addr":"getaf.ru/","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"getaf.ru/","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"title":"ABBYY FineReader — скачать бесплатно на русском | FineReader Hub","dom":{"size":16142,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (304)","md5":"9ec7afd168b5690604b13c51e0dbb8ea","sha1":"5fd4303fde385614376655ac0705d06ebfa9f026","sha256":"217bd1543004eae5b8aec078d8c5a15bbe99284602a195644ae6ab39cc17aea5","sha512":"e417f48d4c57407bdbf740f51e50ad7a0a3ec5ddb8d53a89d87b58b7ce3b9a67afb2b44ebeaf006b9f8b8891af9700f970078d41feff0af3bce8428c20655d14","ssdeep":"192:zRAti/88bDiBFnMvVV9Cl+MpsgF+BTpG9KNHeEi6h:zRAk/8aDiBavE5spJpGMbFh","tlshash":"8172336160f964ab4102608bde146f0d3d978abf9f4e161072bc396e6fe2d45ca2b50d","dom_hash":"domhashb37a2c164d6bf3f67d3fda09d0c198e2","first_seen":"2026-08-25T20:58:45.515393Z","last_seen":"2026-08-25T21:00:58.467945Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"getaf.ru/","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:00:57Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"getaf.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-14","domain_rank":0,"first_seen":"2026-08-25T20:58:42.567504Z","last_seen":"2026-08-25T20:58:42.567504Z","alert_count":36,"request_count":9,"received_data":310180,"sent_data":4292,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"getaf.ru/","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"0cffeef81c9d084c981da14bc830c0d2","sha1":"889335c512a3b83644bce4c044c9292813b3c612","sha256":"adcab3bd54c74ff6f4d4dbf46c62f3ec9718a66e97841b5c95a21806269e77dc","sha512":"ed7d3f74d678568252cadab4badfa7dee3fd46278b733cc1ba1c5b89b98a6a7f9685af0fda827f2f04f5fec7c0fd0d40db93dd126afac2994adbc7b85dc4aab8","ssdeep":"","tlshash":"ccf02677b88492b5c3f72131532bb30c712728b920c97c35860d8881397ac59102fd7d","size":576,"data":"","first_seen":"2026-08-25T20:58:45.542958Z","last_seen":"2026-08-25T21:00:58.488201Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/js/download-studio.js","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"a3c67499f5f29668b0ae990fb30598c1","sha1":"b7c3d4df743963bcf3f77c572030a53b9870f9cb","sha256":"b6933e77a276a333255f146d753f560395801e762b567436c8f52d8d1c8587ea","sha512":"ee103197e8c2a91449bbde9daed3188cd2b8e10b1501c64d1082011458c8d863fbe6460c936ce4b0bf51523f4db99c88fdc41b524182cc3b546a6bdc4a2420e4","ssdeep":"192:7l20Rc65OTxnSYAeb9zlsty/Hvoy0JsFRk:7EGU9fbplstkPoBsFm","tlshash":"8de1a664a849757650b3937fee1a294cfa71027b9504c3003cbc5a5a3ff0ea542bdde9","size":7117,"data":"","first_seen":"2026-08-25T20:58:45.539521Z","last_seen":"2026-08-25T21:00:58.471697Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/js/main.js","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"2e183f0f16a9425f463468f2c2be1800","sha1":"8c694cd1b855dbcf1698957230841dc3fcaf50c5","sha256":"3d173eedcaf7fa097213f2d651661feb20d5863195e3760c195f305d94106c5d","sha512":"ac059718f5fdce19d789817fd53791761051992bb5f11dd55ae1c4d490e9ee0e963f3d2997f82772f1cd48fffff0d4546987c9c974ffef09ddc6bf9c0e1daccd","ssdeep":"","tlshash":"c911597fb1061173c47773f555999268fba1102754029e233e9dc6410f758652a3eef8","size":944,"data":"","first_seen":"2026-08-25T20:58:45.540821Z","last_seen":"2026-08-25T21:00:58.485399Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"getaf.ru/css/style.css","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://getaf.ru/","date":"2026-08-25T21:00:30.214Z","timestamp":1787691630214,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getaf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:06 GMT","end":"Mon, 16 Nov 2026 20:09:05 GMT"},"fingerprint":{"sha1":"23:11:F5:5D:F5:66:3A:C4:E1:ED:4C:51:4A:C1:AD:BF:F4:10:03:F1","sha256":"93:97:90:9D:FA:50:1C:38:3D:B6:E6:CB:14:C4:FE:BC:AD:C1:DD:6F:B5:87:36:AA:FD:69:66:E4:21:89:36:12"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: getaf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getaf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:00:30 GMT\r\ncontent-type: text/css\r\ncontent-length: 4085\r\nlast-modified: Fri, 14 Aug 2026 08:54:23 GMT\r\netag: \"3f09-658fdf78e0b5e-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16137,"size_decoded":4546,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with CRLF line terminators","md5":"90448039fc2e44cf7f4549fe02144f8e","sha1":"e503cc0c0ccacb0993044d27cc1cd1e2868c7970","sha256":"e9937f7531e2cfd81686f5b51d1eb3a34021265604428f92d032c9522d48f0b2","sha512":"93085ce149e5540800544a3bbcccc62e78ce26ba9ab34ccf274fe1e95ecfe76b675256e7d733492ab7d9c22b96f285c52681e1d582eec92114522fb16c024e89","ssdeep":"192:AgkidJh82KstNGj2olE8f+1iztqYReRYeOTWPGaiLyH+G1i70KM8eNI4OAUDGQvV:SiQhtHReZOTWOpMfy7x","tlshash":"b6724f59af2a5124e833eb74f787871ef7a861228e0113bd7ee5504852c92bc407ef8c","first_seen":"2026-08-25T20:58:45.538219Z","last_seen":"2026-08-25T21:00:58.470164Z","times_seen":2,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":136,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/js/download-studio.js","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://getaf.ru/","date":"2026-08-25T21:00:30.221Z","timestamp":1787691630221,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getaf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:06 GMT","end":"Mon, 16 Nov 2026 20:09:05 GMT"},"fingerprint":{"sha1":"23:11:F5:5D:F5:66:3A:C4:E1:ED:4C:51:4A:C1:AD:BF:F4:10:03:F1","sha256":"93:97:90:9D:FA:50:1C:38:3D:B6:E6:CB:14:C4:FE:BC:AD:C1:DD:6F:B5:87:36:AA:FD:69:66:E4:21:89:36:12"}}},"request":{"raw":"GET /js/download-studio.js HTTP/1.1\r\nHost: getaf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getaf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:00:30 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:00:24 GMT\r\netag: W/\"1bcd-659a32ca86f9b\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7117,"size_decoded":2981,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"a3c67499f5f29668b0ae990fb30598c1","sha1":"b7c3d4df743963bcf3f77c572030a53b9870f9cb","sha256":"b6933e77a276a333255f146d753f560395801e762b567436c8f52d8d1c8587ea","sha512":"ee103197e8c2a91449bbde9daed3188cd2b8e10b1501c64d1082011458c8d863fbe6460c936ce4b0bf51523f4db99c88fdc41b524182cc3b546a6bdc4a2420e4","ssdeep":"192:7l20Rc65OTxnSYAeb9zlsty/Hvoy0JsFRk:7EGU9fbplstkPoBsFm","tlshash":"8de1a664a849757650b3937fee1a294cfa71027b9504c3003cbc5a5a3ff0ea542bdde9","first_seen":"2026-08-25T20:58:45.539521Z","last_seen":"2026-08-25T21:00:58.471697Z","times_seen":2,"resource_available":true,"data":null}},"time_used":129,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":129,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/assets/img/cards-set.webp","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://getaf.ru/","date":"2026-08-25T21:00:30.623Z","timestamp":1787691630623,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getaf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:06 GMT","end":"Mon, 16 Nov 2026 20:09:05 GMT"},"fingerprint":{"sha1":"23:11:F5:5D:F5:66:3A:C4:E1:ED:4C:51:4A:C1:AD:BF:F4:10:03:F1","sha256":"93:97:90:9D:FA:50:1C:38:3D:B6:E6:CB:14:C4:FE:BC:AD:C1:DD:6F:B5:87:36:AA:FD:69:66:E4:21:89:36:12"}}},"request":{"raw":"GET /assets/img/cards-set.webp HTTP/1.1\r\nHost: getaf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getaf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:00:30 GMT\r\ncontent-type: image/webp\r\ncontent-length: 63406\r\nlast-modified: Fri, 14 Aug 2026 08:54:20 GMT\r\netag: \"f7ae-658fdf75c7701\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":63406,"size_decoded":63818,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"499929731721bb2781fe572c8c29530d","sha1":"c9e5ffdde26afc70f4f8067b7d56dce491ad2473","sha256":"fd6679010ac7a14981ef9de1780423a0548e53cf41f0629f64c163935fdb3a86","sha512":"0b3d91354e26b27729dc6295a5c0b0deb0524e036b2e83e2460e49fb333c2a4a73876320dda47feffabbd9ac89d8d24cf5723ebee978f1fa3de09e7eaafe35d1","ssdeep":"768:pX6gvGteG8K9GhJH1jMGe6rkD1Fy2PH6W/hN/XIYwACUJbka6PTDnTiVkCrBQl1:N6gvM8iUJHRPixPHT1xXp67D2VLBY","tlshash":"3653026aa30c1fefa5cc365ddd8cd71e8c564de32d9241a89acc4c8816770eddb21c29","first_seen":"2026-08-25T20:58:45.526084Z","last_seen":"2026-08-25T21:00:58.472839Z","times_seen":2,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/assets/img/apple-touch-icon.png","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getaf.ru/","date":"2026-08-25T21:00:30.690Z","timestamp":1787691630690,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getaf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:06 GMT","end":"Mon, 16 Nov 2026 20:09:05 GMT"},"fingerprint":{"sha1":"23:11:F5:5D:F5:66:3A:C4:E1:ED:4C:51:4A:C1:AD:BF:F4:10:03:F1","sha256":"93:97:90:9D:FA:50:1C:38:3D:B6:E6:CB:14:C4:FE:BC:AD:C1:DD:6F:B5:87:36:AA:FD:69:66:E4:21:89:36:12"}}},"request":{"raw":"GET /assets/img/apple-touch-icon.png HTTP/1.1\r\nHost: getaf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getaf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:00:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 31963\r\nlast-modified: Fri, 14 Aug 2026 08:54:19 GMT\r\netag: \"7cdb-658fdf74c9c1a\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31963,"size_decoded":32374,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGB, non-interlaced","md5":"9d4afb1b1d89bfacb22eeb74be2c5657","sha1":"088490c8afe64393950a3f7c6a6a3afa41e7af60","sha256":"75968b7e2fb070991d0954c1c06d73daa62d117ecd68da05cf961669cb7a5545","sha512":"f68f8917713a5cbace60234fcfb47d5ea35b4f336d9215c0c13f209a41573757e19dc5009efa0a88bb11973910b51ecc10a9a20b58dd31969af53d3d71f8caac","ssdeep":"768:RjXNYXbgYlIjL2aaCi+TXGCTgwq/CToXmW/i8OU76G1mYsxSks:Rj9CgOOWooXbi8Z7fZ","tlshash":"4ae2f1266b6b2134d5b710bdcb7610c3d3e31c5129ee0328d469292b7a23caa536dff5","first_seen":"2026-08-25T20:58:45.530001Z","last_seen":"2026-08-25T21:00:58.473935Z","times_seen":2,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:00:29.875Z","timestamp":1787691629875,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getaf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:06 GMT","end":"Mon, 16 Nov 2026 20:09:05 GMT"},"fingerprint":{"sha1":"23:11:F5:5D:F5:66:3A:C4:E1:ED:4C:51:4A:C1:AD:BF:F4:10:03:F1","sha256":"93:97:90:9D:FA:50:1C:38:3D:B6:E6:CB:14:C4:FE:BC:AD:C1:DD:6F:B5:87:36:AA:FD:69:66:E4:21:89:36:12"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: getaf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:00:29 GMT\r\ncontent-type: text/html\r\ncontent-length: 4468\r\nlast-modified: Fri, 14 Aug 2026 08:54:17 GMT\r\netag: \"40e8-658fdf7386006-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16616,"size_decoded":4929,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"b9f53a112459b74cae65ccff095383b5","sha1":"0a778ccc717dc4ca18c95e8b5f3e37b0cd9e09ec","sha256":"f06b569ab650d9a2d9633a3872f69f35d27b7ff9d8ef65d752c68acb20f7d247","sha512":"71d3b5214b9df404a951f8e80672396ff2d14ddab5e617db918ac6d32551f52eedc19d4f443852228e0c6f05603c5a49d433fd3576e0d14f0c5b642df7826029","ssdeep":"96:TrzWNBmiMrvVbH9Z76YCloadSb1MQriPAstOFncGUWABBlANGpeAa69eAJWSzC8A:TGAiMrt9Z79CtMs4sgFq8P18Sgf2nk2","tlshash":"4972107161c9a8ab4132908ade146f48fc9786ffab4e561171fc3a6f2ff2c14ca27505","first_seen":"2026-08-25T20:58:45.535455Z","last_seen":"2026-08-25T21:00:58.474883Z","times_seen":2,"resource_available":false,"data":null}},"time_used":129,"timings":{"blocked":0,"dns":4,"connect":33,"send":0,"wait":52,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/assets/img/hero-main.webp","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getaf.ru/","date":"2026-08-25T21:00:30.216Z","timestamp":1787691630216,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getaf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:06 GMT","end":"Mon, 16 Nov 2026 20:09:05 GMT"},"fingerprint":{"sha1":"23:11:F5:5D:F5:66:3A:C4:E1:ED:4C:51:4A:C1:AD:BF:F4:10:03:F1","sha256":"93:97:90:9D:FA:50:1C:38:3D:B6:E6:CB:14:C4:FE:BC:AD:C1:DD:6F:B5:87:36:AA:FD:69:66:E4:21:89:36:12"}}},"request":{"raw":"GET /assets/img/hero-main.webp HTTP/1.1\r\nHost: getaf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getaf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:00:30 GMT\r\ncontent-type: image/webp\r\ncontent-length: 124022\r\nlast-modified: Fri, 14 Aug 2026 08:54:21 GMT\r\netag: \"1e476-658fdf76c78f8\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":124022,"size_decoded":124436,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"c767442c51ef7d4caccff7d91582a01a","sha1":"918e2fd3789fd1d74c545c973e4f100a279aa5e3","sha256":"2d572ae403ec2a124930c6743b731254691cf6259e6d4bcb82751aac38504daa","sha512":"6f9f72eae2762c2dcfa0739535779bfa066d2d706b00560a1696c924d403842407e061416d501bbd8284694795a809411e1b1659c1e09083ccb8869ba258987c","ssdeep":"3072:/MlUgJ3iIq1f7hdgphI/eJMzwi08va0e/zOZv4edayGZAW:GUgJ54f7ghIWJ3i08va0e/zO94ed4AW","tlshash":"c6c3124e998cd7d377ca88dacf001567be48e6726683f70d0e62f52299409cc81367aa","first_seen":"2026-08-25T20:58:45.520773Z","last_seen":"2026-08-25T21:00:58.475834Z","times_seen":2,"resource_available":false,"data":null}},"time_used":135,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":44,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/js/main.js","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://getaf.ru/","date":"2026-08-25T21:00:30.224Z","timestamp":1787691630224,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getaf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:06 GMT","end":"Mon, 16 Nov 2026 20:09:05 GMT"},"fingerprint":{"sha1":"23:11:F5:5D:F5:66:3A:C4:E1:ED:4C:51:4A:C1:AD:BF:F4:10:03:F1","sha256":"93:97:90:9D:FA:50:1C:38:3D:B6:E6:CB:14:C4:FE:BC:AD:C1:DD:6F:B5:87:36:AA:FD:69:66:E4:21:89:36:12"}}},"request":{"raw":"GET /js/main.js HTTP/1.1\r\nHost: getaf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getaf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:00:30 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 944\r\nlast-modified: Fri, 14 Aug 2026 08:54:23 GMT\r\netag: \"3b0-658fdf794be58\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":944,"size_decoded":1358,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"2e183f0f16a9425f463468f2c2be1800","sha1":"8c694cd1b855dbcf1698957230841dc3fcaf50c5","sha256":"3d173eedcaf7fa097213f2d651661feb20d5863195e3760c195f305d94106c5d","sha512":"ac059718f5fdce19d789817fd53791761051992bb5f11dd55ae1c4d490e9ee0e963f3d2997f82772f1cd48fffff0d4546987c9c974ffef09ddc6bf9c0e1daccd","ssdeep":"","tlshash":"c911597fb1061173c47773f555999268fba1102754029e233e9dc6410f758652a3eef8","first_seen":"2026-08-25T20:58:45.540821Z","last_seen":"2026-08-25T21:00:58.485399Z","times_seen":2,"resource_available":true,"data":null}},"time_used":128,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":127,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/assets/img/logo-mark.png","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getaf.ru/","date":"2026-08-25T21:00:30.228Z","timestamp":1787691630228,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getaf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:06 GMT","end":"Mon, 16 Nov 2026 20:09:05 GMT"},"fingerprint":{"sha1":"23:11:F5:5D:F5:66:3A:C4:E1:ED:4C:51:4A:C1:AD:BF:F4:10:03:F1","sha256":"93:97:90:9D:FA:50:1C:38:3D:B6:E6:CB:14:C4:FE:BC:AD:C1:DD:6F:B5:87:36:AA:FD:69:66:E4:21:89:36:12"}}},"request":{"raw":"GET /assets/img/logo-mark.png HTTP/1.1\r\nHost: getaf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getaf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:00:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 44497\r\nlast-modified: Fri, 14 Aug 2026 08:54:22 GMT\r\netag: \"add1-658fdf781e9aa\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44497,"size_decoded":44908,"mime_type":"image/png","magic":"PNG image data, 320 x 250, 8-bit/color RGB, non-interlaced","md5":"d7c87ef39ea1647b09a669a4a860183c","sha1":"eb3f38db3983000c2753c48bbc397e74dffca868","sha256":"bd1666fd7cf1b4302522be452361ebbbcc9cc8ee677afef81a62addea138c959","sha512":"cc63e8c03920635361fef31d6821ca85e07626a854286cc0d08283ccc59ae274caac52dd7ce7b74dd7f03465f59c06e46ad16264cce3c11d190e3b5da029cc47","ssdeep":"768:B1wvOn2AKgxQhG2nbDCcdfgb5+p98C7tR/HOkkQWm8xkINXhMTVD145ie6IoJmsc:g8sTGcV4/pQWmYDNxSV86I4K","tlshash":"6c130229abf05a000cd546aaeff8e764ede861364dd8751c9243046b1d3de4dacc2e9f","first_seen":"2026-08-25T20:58:45.541889Z","last_seen":"2026-08-25T21:00:58.486417Z","times_seen":2,"resource_available":false,"data":null}},"time_used":124,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":123,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getaf.ru/assets/img/favicon-32.png","fqdn":"getaf.ru","domain":"getaf.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getaf.ru/","date":"2026-08-25T21:00:30.691Z","timestamp":1787691630691,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getaf.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:06 GMT","end":"Mon, 16 Nov 2026 20:09:05 GMT"},"fingerprint":{"sha1":"23:11:F5:5D:F5:66:3A:C4:E1:ED:4C:51:4A:C1:AD:BF:F4:10:03:F1","sha256":"93:97:90:9D:FA:50:1C:38:3D:B6:E6:CB:14:C4:FE:BC:AD:C1:DD:6F:B5:87:36:AA:FD:69:66:E4:21:89:36:12"}}},"request":{"raw":"GET /assets/img/favicon-32.png HTTP/1.1\r\nHost: getaf.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getaf.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:00:30 GMT\r\ncontent-type: image/png\r\ncontent-length: 1664\r\nlast-modified: Fri, 14 Aug 2026 08:54:20 GMT\r\netag: \"680-658fdf75fe9e2\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1664,"size_decoded":2073,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced","md5":"d595941441ceb1cecc19b637ded480f4","sha1":"c5b8d66033f4cd33353c51a5c798afb8d1807a71","sha256":"c8ef13038a414b74db37fab8e45b8f18407d619b5b39e8abdb687ebcaac8bdf8","sha512":"dba3a7e3576b65258763e01b603ccc3f823b483233c2440700bcbd974ceae064d36559c496b396e992a68870809cbe782d86e396c7faad4ac42816a603b74f0c","ssdeep":"","tlshash":"27311a221505bea5197cf560407b044d3f77f065c43693b316ce7eae3ba82d4e048b48","first_seen":"2026-08-25T20:58:45.532835Z","last_seen":"2026-08-25T21:00:58.487335Z","times_seen":2,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getaf.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}