{"report_id":"47831535-bfaa-43d5-8a45-faf0161e998d","version":0,"status":"done","tags":[],"date":"2026-08-25T20:58:53Z","url":{"schema":"http","addr":"cupheadplay.ru/","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"cupheadplay.ru/","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"title":"Cuphead — версии, установка и гайды по игре","dom":{"size":12032,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2490)","md5":"c51a485804770e49350dd08a68e534a1","sha1":"f6b05203c2a2ee1a2996ec9ee9e25593fdf28cb4","sha256":"57db5d01b41fb199fcd7e2640448f743970faab7bf9e98f5e4114695f913be8e","sha512":"fbad758507188be496e13658ebb92eb779c8991884e20e4708022c59da7eabc2963c4aa54946b6444fa30f67056ed8044f1f6bb58aaf21a6c61b13955aab46c3","ssdeep":"192:wDYXpsUGcg7PMrVDpN7dHQSyhpiDt8YxC+8:zsN7krVDPdwSyh4fC+8","tlshash":"78423f225199247f131765dfe512bb0c74f741beeb264b2312b81ebb2af2c148a1b51b","dom_hash":"domhash29b504438c57e7250efafaa3b33c9bfa","first_seen":"2026-08-25T20:52:03.022073Z","last_seen":"2026-08-25T20:58:54.621844Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"cupheadplay.ru/","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T20:58:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"cupheadplay.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-10","domain_rank":0,"first_seen":"2026-08-25T20:51:59.169305Z","last_seen":"2026-08-25T20:51:59.169305Z","alert_count":12,"request_count":6,"received_data":164375,"sent_data":2854,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cupheadplay.ru/assets/js/main.js","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"465ef51e2560ce4c6b4b5836a1a1700b","sha1":"7d304eed2b3538ae936f69ab60407168b8d4cf57","sha256":"b20d8cf7e36972354cb602312309624cc28db6a06495521291426db5b4f78a88","sha512":"241546ab6d2370ac49dc2c5e1c3a5dcb21ad1a0b4c901f38a3a1b7c59d8f37594ea64b27122f92cfe25985244df258564ecf78e8deef3547e314e86e84dc0743","ssdeep":"96:JMPVy7jtUjvNYsXVYFQPdcXX4PHp6KzYtF8EdwaahtSN/RE+Dto6:qtSRUjvNN6YdcXoPJjlow9tS5Rfh7","tlshash":"ccf1d868602521b645b763fd9f839144fb75047bb006d2453fac4e443fb19a693f2ee8","size":7515,"data":"","first_seen":"2026-08-25T20:52:03.035296Z","last_seen":"2026-08-25T20:58:54.624192Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"cupheadplay.ru/favicon.svg","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cupheadplay.ru/","date":"2026-08-25T20:58:26.821Z","timestamp":1787691506821,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cupheadplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:18:49 GMT","end":"Sun, 08 Nov 2026 19:18:48 GMT"},"fingerprint":{"sha1":"A1:4C:5A:43:41:94:97:F5:31:FC:7D:B2:55:85:F7:AB:BE:45:27:3B","sha256":"7B:05:05:73:12:67:B8:16:61:B5:5E:2A:25:1A:5E:68:53:29:FA:9C:7A:EE:D3:C7:C6:A9:84:0E:31:87:BB:F2"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: cupheadplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cupheadplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:58:26 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 238\r\nlast-modified: Tue, 11 Aug 2026 18:53:20 GMT\r\netag: \"15c-658c9fc0f5d66-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":348,"size_decoded":650,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"0251756b45889c2b97299b6f43b59f87","sha1":"7ebd6fe9996a3750df7bfa57865caa0c0c6479ae","sha256":"30fa345a0faad1bfed33081c40286b7d5be927fd10c1d099da842e637e594c4d","sha512":"d27fa66f2a628af4de61ad1ea54c85563d681bb916ec377eee5a92af8f205dec45ead010a435533faeb784ab59aed7f9a3b676d38607c0548fd7eec18792ee3c","ssdeep":"","tlshash":"c3e0263ad35d4d2cbf15811ceb7a3962122a30ea2509103ae86c1030630b25ff4ff5f8","first_seen":"2026-08-25T20:52:03.045095Z","last_seen":"2026-08-25T20:58:54.622469Z","times_seen":2,"resource_available":false,"data":null}},"time_used":68,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cupheadplay.ru/","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T20:58:26.067Z","timestamp":1787691506067,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cupheadplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:18:49 GMT","end":"Sun, 08 Nov 2026 19:18:48 GMT"},"fingerprint":{"sha1":"A1:4C:5A:43:41:94:97:F5:31:FC:7D:B2:55:85:F7:AB:BE:45:27:3B","sha256":"7B:05:05:73:12:67:B8:16:61:B5:5E:2A:25:1A:5E:68:53:29:FA:9C:7A:EE:D3:C7:C6:A9:84:0E:31:87:BB:F2"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: cupheadplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:58:26 GMT\r\ncontent-type: text/html\r\ncontent-length: 3529\r\nlast-modified: Tue, 11 Aug 2026 18:53:21 GMT\r\netag: \"2f07-658c9fc12c877-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12039,"size_decoded":3990,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2490)","md5":"f911db12894814eb5d12a2ca52d1b6d3","sha1":"e15a0caaebd479c6fc31b976cdd92108ee4fbe73","sha256":"53489bf34e5b1281edda23787d66bd5d719ce7dcaff714d886cd76b801cdba3d","sha512":"3e5486976fce304ce05a0987503d1ad3a9f7cc44befa7613b9ed015704e9ee0c29b3527c46fe31a9d5ee48cc060ea15e9543c532173fa944b58d776cd976674f","ssdeep":"192:cDYXpsUpcg7PMrVDpN7dHQSyhpiDt8Yxtz8:Xsk7krVDPdwSyh4ftz8","tlshash":"f4423f225198247f131765dfe512bb0c74f741beeb264b2312bc1ebb2af2c148a1b51b","first_seen":"2026-08-25T20:52:03.027427Z","last_seen":"2026-08-25T20:58:54.623054Z","times_seen":2,"resource_available":false,"data":null}},"time_used":261,"timings":{"blocked":-1,"dns":77,"connect":54,"send":0,"wait":70,"receive":0,"ssl":60},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cupheadplay.ru/assets/css/styles.css","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://cupheadplay.ru/","date":"2026-08-25T20:58:26.492Z","timestamp":1787691506492,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cupheadplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:18:49 GMT","end":"Sun, 08 Nov 2026 19:18:48 GMT"},"fingerprint":{"sha1":"A1:4C:5A:43:41:94:97:F5:31:FC:7D:B2:55:85:F7:AB:BE:45:27:3B","sha256":"7B:05:05:73:12:67:B8:16:61:B5:5E:2A:25:1A:5E:68:53:29:FA:9C:7A:EE:D3:C7:C6:A9:84:0E:31:87:BB:F2"}}},"request":{"raw":"GET /assets/css/styles.css HTTP/1.1\r\nHost: cupheadplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cupheadplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:58:26 GMT\r\ncontent-type: text/css\r\ncontent-length: 2900\r\nlast-modified: Tue, 11 Aug 2026 18:53:23 GMT\r\netag: \"23cf-658c9fc33be9b-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9167,"size_decoded":3361,"mime_type":"text/css","magic":"ASCII text, with very long lines (9166)","md5":"9be8b76d2cb7c6e82f4aeed9c9fc2e0c","sha1":"2639f2747c3201e77daeeac59c1093e15f690e37","sha256":"1dff47bcec5fb9c28952e7f044535576cf347b759fee1ec7f98f7021968b4dc1","sha512":"42003e3501cd1e11d5eec21944325b7d406b5be53ff50e409371f46be748df8bc06387ff332fc6eaf40ee35e5ed37ee7d215f7cc73640ba613374d1c22bdd5d0","ssdeep":"192:nU5lBJ+UKKw2L2+zUvXiDfuuhGaYHkdq4ralpzP:bUKN2L2+ziEhGrH94kzP","tlshash":"f512c8616618312cf377d1a5e9e0678e7024e003e5270bfdefe5e268c5c22a726b674d","first_seen":"2026-08-25T20:52:03.031327Z","last_seen":"2026-08-25T20:58:54.623649Z","times_seen":2,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cupheadplay.ru/assets/js/main.js","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://cupheadplay.ru/","date":"2026-08-25T20:58:26.493Z","timestamp":1787691506493,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cupheadplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:18:49 GMT","end":"Sun, 08 Nov 2026 19:18:48 GMT"},"fingerprint":{"sha1":"A1:4C:5A:43:41:94:97:F5:31:FC:7D:B2:55:85:F7:AB:BE:45:27:3B","sha256":"7B:05:05:73:12:67:B8:16:61:B5:5E:2A:25:1A:5E:68:53:29:FA:9C:7A:EE:D3:C7:C6:A9:84:0E:31:87:BB:F2"}}},"request":{"raw":"GET /assets/js/main.js HTTP/1.1\r\nHost: cupheadplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cupheadplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:58:26 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 13:59:56 GMT\r\netag: W/\"1d5b-659a32b08fbeb\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7515,"size_decoded":3067,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"465ef51e2560ce4c6b4b5836a1a1700b","sha1":"7d304eed2b3538ae936f69ab60407168b8d4cf57","sha256":"b20d8cf7e36972354cb602312309624cc28db6a06495521291426db5b4f78a88","sha512":"241546ab6d2370ac49dc2c5e1c3a5dcb21ad1a0b4c901f38a3a1b7c59d8f37594ea64b27122f92cfe25985244df258564ecf78e8deef3547e314e86e84dc0743","ssdeep":"96:JMPVy7jtUjvNYsXVYFQPdcXX4PHp6KzYtF8EdwaahtSN/RE+Dto6:qtSRUjvNN6YdcXoPJjlow9tS5Rfh7","tlshash":"ccf1d868602521b645b763fd9f839144fb75047bb006d2453fac4e443fb19a693f2ee8","first_seen":"2026-08-25T20:52:03.035296Z","last_seen":"2026-08-25T20:58:54.624192Z","times_seen":2,"resource_available":true,"data":null}},"time_used":84,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cupheadplay.ru/assets/images/cuphead-hero.webp","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://cupheadplay.ru/","date":"2026-08-25T20:58:26.499Z","timestamp":1787691506499,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cupheadplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:18:49 GMT","end":"Sun, 08 Nov 2026 19:18:48 GMT"},"fingerprint":{"sha1":"A1:4C:5A:43:41:94:97:F5:31:FC:7D:B2:55:85:F7:AB:BE:45:27:3B","sha256":"7B:05:05:73:12:67:B8:16:61:B5:5E:2A:25:1A:5E:68:53:29:FA:9C:7A:EE:D3:C7:C6:A9:84:0E:31:87:BB:F2"}}},"request":{"raw":"GET /assets/images/cuphead-hero.webp HTTP/1.1\r\nHost: cupheadplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cupheadplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:58:26 GMT\r\ncontent-type: image/webp\r\ncontent-length: 128706\r\nlast-modified: Tue, 11 Aug 2026 18:53:24 GMT\r\netag: \"1f6c2-658c9fc442a0d\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":128706,"size_decoded":129120,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1400x933, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"473f60bd00dc70aa2121e79bc42e072a","sha1":"5ce901608734b538f2dd3a0d44f22a54cbdfbee5","sha256":"bdab3f8e016c6439ffbd535317d29a1cf975a1ee61212337d1842f443647ec73","sha512":"f0c506d8affb463404018bbd85e55deb174f2e1ecd62f73e222067f31e3e91fb073c054384bcb288960ff0d5703a654f719b3efcc30da3b9233bef717fdd38bc","ssdeep":"3072:Avns3FM1HCrJ8mOjbdyYT37l7actytWCEU4Deq1atkTAvNpstsBctL6nqA:Avs0mGdb7F9C4Dh3sHsqc6qA","tlshash":"05c312481f34171c281d97ec400af66bb75150211db2fbe767efdad2b8a2d4a68e3c61","first_seen":"2026-08-25T20:52:03.038443Z","last_seen":"2026-08-25T20:58:54.625303Z","times_seen":2,"resource_available":false,"data":null}},"time_used":317,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":216,"receive":101,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cupheadplay.ru/assets/icons.svg","fqdn":"cupheadplay.ru","domain":"cupheadplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://cupheadplay.ru/","date":"2026-08-25T20:58:26.596Z","timestamp":1787691506596,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.cupheadplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:18:49 GMT","end":"Sun, 08 Nov 2026 19:18:48 GMT"},"fingerprint":{"sha1":"A1:4C:5A:43:41:94:97:F5:31:FC:7D:B2:55:85:F7:AB:BE:45:27:3B","sha256":"7B:05:05:73:12:67:B8:16:61:B5:5E:2A:25:1A:5E:68:53:29:FA:9C:7A:EE:D3:C7:C6:A9:84:0E:31:87:BB:F2"}}},"request":{"raw":"GET /assets/icons.svg HTTP/1.1\r\nHost: cupheadplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://cupheadplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:58:26 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 1007\r\nlast-modified: Tue, 11 Aug 2026 18:53:23 GMT\r\netag: \"fb2-658c9fc32728d-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4018,"size_decoded":1420,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"37f839393c91cee7a45c80d3fedf2004","sha1":"b5e7611444042026b616e04b7715b5df43c95540","sha256":"de5062a42782847ecbb4242e2d091152f3be8a897766e0c9b0f09cf8a424d252","sha512":"ea4209a055461f5b034abaf7614970426cf03c0af5f76acb67e67c21647b7e88d83a104c7f36acd4027c0668307873b5f178ab9bdccea3098b9180df54b67242","ssdeep":"","tlshash":"6581395a63180d2cb86349b9eb68737a513e73c32588517c6c7e0134279668ee93bbd4","first_seen":"2026-08-25T20:52:03.041377Z","last_seen":"2026-08-25T20:58:54.625898Z","times_seen":2,"resource_available":false,"data":null}},"time_used":119,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"cupheadplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}