{"report_id":"5170cd04-4b5c-4ba5-bd93-c3309bdf5ef9","version":0,"status":"done","tags":[],"date":"2026-10-10T22:00:30Z","url":{"schema":"http","addr":"it-ha.ru/","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"ip":{"addr":"89.111.170.66","port":0,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"it-ha.ru/","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"title":"Ит-Ха — программирование · безопасность · инструменты · CTF","dom":{"size":11013,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (7496)","md5":"712ce521d054d0cbfa20f05dd3d7bead","sha1":"444401d1cf1a05e8e3923327d96ae764936a6365","sha256":"cf2e89375389958bb6bec21170143ca3ba391d9c55970a34c6322dd096e007e3","sha512":"979c9962db8ca5e1b64b484b6efeb06f3a2138000da737dca2b445e4e23735d9c858567cd3339a75923dcb0bf72b45b09b60ba176738d84d5bcb0f2a41fd083b","ssdeep":"192:zrXm/W4/+Z20VY0Mi0B00/QlXB569rYMi6hT6I5FT5jAsPX:zrXm/W4w6jo76lRj","tlshash":"5f328360858d487e5027e2cbec2a7b5c3cfb80feab5e111076bd1d7d92d2e64c13a546","dom_hash":"domhashf3331d84f63fac9eeeb2d1fd051aacf8","first_seen":"2026-10-10T22:00:33.241118Z","last_seen":"2026-10-10T22:00:33.241118Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"it-ha.ru/","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"ip":{"addr":"89.111.170.66","port":0,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-14T22:00:30Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"it-ha.ru","ip":{"addr":"89.111.170.66","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"domain_registered":"2023-08-15","domain_rank":0,"first_seen":"2019-04-17T17:15:42Z","last_seen":"2026-09-16T14:10:41.911054Z","alert_count":12,"request_count":6,"received_data":837275,"sent_data":2645,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"it-ha.ru/assets/index-it-ha-seo-v2.js","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"ip":{"addr":"89.111.170.66","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"711559f942fba8ee6da375595bfc48fc","sha1":"518cf61d67de807a814c4bcb40391adc5c8bdc71","sha256":"d2f233a898431469c336a9666e1dacdce6765fda7459575966d0e9b48248f39c","sha512":"7dedd4febe56573ad13252472de575fe5a7f9861d691d28f6632a0f7e8b3b3ad8f27bbe6a68fa03fb394201d731724629febe9d175df2d02aa897a8a912c9dc1","ssdeep":"3072:p3k4lsolcqPEUySBPYDZ6tLz6l5B1/F/XAKgPz6h4y05UADQn9SbR:p0DOcqPEtSBPSZ6tfqB3gPz6h4yXVO","tlshash":"514439d870e9b6a16a6255b6006f590f727e143b5c0d0870b130fdbe3ab5484a2bbfdd","size":266700,"data":"","first_seen":"2026-09-16T14:10:42.468991Z","last_seen":"2026-10-10T22:00:33.255422Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"it-ha.ru/","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"ip":{"addr":"89.111.170.66","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-10-10T21:59:59.444Z","timestamp":1791669599444,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"it-ha.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:19:10 GMT","end":"Sun, 29 Nov 2026 08:19:09 GMT"},"fingerprint":{"sha1":"64:BD:AA:02:EC:B7:94:37:D8:65:9D:87:BF:8A:EF:36:C5:F5:EC:4E","sha256":"76:95:2E:F9:02:33:79:96:B5:28:AA:E1:F8:F8:A4:22:3E:7A:36:C6:20:5C:46:95:CD:CF:A3:59:5B:78:54:6E"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: it-ha.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 10 Oct 2026 21:59:59 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nX-Content-Type-Options: nosniff, nosniff\r\nX-Frame-Options: SAMEORIGIN, SAMEORIGIN\r\nReferrer-Policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\nPermissions-Policy: camera=(), microphone=(), geolocation=(), payment=()\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1716,"size_decoded":1142,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (332)","md5":"af83d33aeccf15bed006976cce4bd975","sha1":"6fb8e4ecb13b9cacde0d038aa5d89fa8647ea6e9","sha256":"a31784a3aa8ab9afce0c368eb876adf58825005ba73b57ab035c5741249966fe","sha512":"dc94552f4c75d6c3cb72f615a369e8e6f3312f48b47739166877d0b798307bdb42f1d2ca22e242a7722e3a146398f7dc0988d50cb22d10ebb955db80258dabc9","ssdeep":"","tlshash":"1431b0539804c81e8124634adc4af84ced97c23e6fa59910b2fd407e65e1b61ca7727a","first_seen":"2026-10-10T22:00:33.25143Z","last_seen":"2026-10-10T22:00:33.25143Z","times_seen":1,"resource_available":true,"data":null}},"time_used":199,"timings":{"blocked":-1,"dns":99,"connect":21,"send":0,"wait":29,"receive":0,"ssl":50},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"it-ha.ru/assets/index-it-ha-seo-v2.js","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"ip":{"addr":"89.111.170.66","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://it-ha.ru/","date":"2026-10-10T21:59:59.817Z","timestamp":1791669599817,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"it-ha.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:19:10 GMT","end":"Sun, 29 Nov 2026 08:19:09 GMT"},"fingerprint":{"sha1":"64:BD:AA:02:EC:B7:94:37:D8:65:9D:87:BF:8A:EF:36:C5:F5:EC:4E","sha256":"76:95:2E:F9:02:33:79:96:B5:28:AA:E1:F8:F8:A4:22:3E:7A:36:C6:20:5C:46:95:CD:CF:A3:59:5B:78:54:6E"}}},"request":{"raw":"GET /assets/index-it-ha-seo-v2.js HTTP/1.1\r\nHost: it-ha.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://it-ha.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 10 Oct 2026 21:59:59 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Sat, 12 Sep 2026 10:19:14 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6aa52722-411cc\"\r\nExpires: Sun, 11 Oct 2026 21:59:59 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":266700,"size_decoded":80951,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (43376)","md5":"711559f942fba8ee6da375595bfc48fc","sha1":"518cf61d67de807a814c4bcb40391adc5c8bdc71","sha256":"d2f233a898431469c336a9666e1dacdce6765fda7459575966d0e9b48248f39c","sha512":"7dedd4febe56573ad13252472de575fe5a7f9861d691d28f6632a0f7e8b3b3ad8f27bbe6a68fa03fb394201d731724629febe9d175df2d02aa897a8a912c9dc1","ssdeep":"3072:p3k4lsolcqPEUySBPYDZ6tLz6l5B1/F/XAKgPz6h4y05UADQn9SbR:p0DOcqPEtSBPSZ6tfqB3gPz6h4yXVO","tlshash":"514439d870e9b6a16a6255b6006f590f727e143b5c0d0870b130fdbe3ab5484a2bbfdd","first_seen":"2026-09-16T14:10:42.468991Z","last_seen":"2026-10-10T22:00:33.255422Z","times_seen":2,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"it-ha.ru/assets/index-DaW00hAf.css","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"ip":{"addr":"89.111.170.66","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://it-ha.ru/","date":"2026-10-10T21:59:59.819Z","timestamp":1791669599819,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"it-ha.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:19:10 GMT","end":"Sun, 29 Nov 2026 08:19:09 GMT"},"fingerprint":{"sha1":"64:BD:AA:02:EC:B7:94:37:D8:65:9D:87:BF:8A:EF:36:C5:F5:EC:4E","sha256":"76:95:2E:F9:02:33:79:96:B5:28:AA:E1:F8:F8:A4:22:3E:7A:36:C6:20:5C:46:95:CD:CF:A3:59:5B:78:54:6E"}}},"request":{"raw":"GET /assets/index-DaW00hAf.css HTTP/1.1\r\nHost: it-ha.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://it-ha.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 10 Oct 2026 21:59:59 GMT\r\nContent-Type: text/css\r\nLast-Modified: Tue, 18 Aug 2026 10:08:00 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6a842f00-9dfd\"\r\nExpires: Sun, 11 Oct 2026 21:59:59 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40445,"size_decoded":8806,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (40440)","md5":"b8df29818edce957c966aa5879ea8503","sha1":"b59183653b750262b5476ee367e58289f63b8417","sha256":"e365c9f9a0f797cea9d09134d7eb1c416787cad57ec9b9995b9ca126bd35a964","sha512":"b21c4b8b43dc370fac99b5f8d3ac9c39d4e03d1730f47dfc8367f3306b0641193dc74d4717edc2e03619c397f7aff0d6940d9de907763a11c207d11bfb6eaf6e","ssdeep":"768:c/Wu1BbOEjsmW/QzNUzNDptMEWCT/BW5B6Yc:pedoQzNUzNtqBCV4Lc","tlshash":"e8035023e594262ef17bd0b8e480b6ce7454e613d11657fcfda0f239c8ca0a3197a74a","first_seen":"2026-09-16T14:10:42.470413Z","last_seen":"2026-10-10T22:00:33.261127Z","times_seen":2,"resource_available":true,"data":null}},"time_used":143,"timings":{"blocked":-1,"dns":0,"connect":46,"send":0,"wait":47,"receive":0,"ssl":50},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"it-ha.ru/api?entity=home","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"ip":{"addr":"89.111.170.66","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://it-ha.ru/","date":"2026-10-10T22:00:00.055Z","timestamp":1791669600055,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"it-ha.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:19:10 GMT","end":"Sun, 29 Nov 2026 08:19:09 GMT"},"fingerprint":{"sha1":"64:BD:AA:02:EC:B7:94:37:D8:65:9D:87:BF:8A:EF:36:C5:F5:EC:4E","sha256":"76:95:2E:F9:02:33:79:96:B5:28:AA:E1:F8:F8:A4:22:3E:7A:36:C6:20:5C:46:95:CD:CF:A3:59:5B:78:54:6E"}}},"request":{"raw":"GET /api?entity=home HTTP/1.1\r\nHost: it-ha.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://it-ha.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 10 Oct 2026 22:00:00 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Authorization\r\nX-Content-Type-Options: nosniff, nosniff\r\nX-Frame-Options: SAMEORIGIN, SAMEORIGIN\r\nReferrer-Policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\nPermissions-Policy: camera=(), microphone=(), geolocation=(), payment=()\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":260809,"size_decoded":43032,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"31ba49a381a8df12131befe6b11898fe","sha1":"d71039e45e35fdc22ee9f6a3e38c2a48d1943a1d","sha256":"4730d7a85a86b441d663c16c953c565da6e3eada0c84f109ff598264eee1f1ed","sha512":"4ffedd739f1c70b7929df53ebec90ece94da6aaee98c184350b6a7a74782134b5d6a3e7cb033b0004c42696f85bb89ec7e98b352c1e2f4721fc9c18295a9833b","ssdeep":"6144:n8S2K+BQLx90eHDi66wj8A1LU2X1UNNWOg1pO1ZBtkZa4R2pxc0RHfIB/Z5kPc92:n8S2K+BQLx90eHDi66wj8A1LU2X1UNNZ","tlshash":"b7449c6065ee50be0584b4cfcb0dad4d38bf88fe2f5b536225682d6e74e1024ca78e5d","first_seen":"2026-09-16T14:10:42.467809Z","last_seen":"2026-10-10T22:00:33.263686Z","times_seen":2,"resource_available":true,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":85,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"it-ha.ru/api?entity=home","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"ip":{"addr":"89.111.170.66","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://it-ha.ru/","date":"2026-10-10T22:00:00.056Z","timestamp":1791669600056,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"it-ha.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:19:10 GMT","end":"Sun, 29 Nov 2026 08:19:09 GMT"},"fingerprint":{"sha1":"64:BD:AA:02:EC:B7:94:37:D8:65:9D:87:BF:8A:EF:36:C5:F5:EC:4E","sha256":"76:95:2E:F9:02:33:79:96:B5:28:AA:E1:F8:F8:A4:22:3E:7A:36:C6:20:5C:46:95:CD:CF:A3:59:5B:78:54:6E"}}},"request":{"raw":"GET /api?entity=home HTTP/1.1\r\nHost: it-ha.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://it-ha.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 10 Oct 2026 22:00:00 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Authorization\r\nX-Content-Type-Options: nosniff, nosniff\r\nX-Frame-Options: SAMEORIGIN, SAMEORIGIN\r\nReferrer-Policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\nPermissions-Policy: camera=(), microphone=(), geolocation=(), payment=()\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":260809,"size_decoded":43032,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"31ba49a381a8df12131befe6b11898fe","sha1":"d71039e45e35fdc22ee9f6a3e38c2a48d1943a1d","sha256":"4730d7a85a86b441d663c16c953c565da6e3eada0c84f109ff598264eee1f1ed","sha512":"4ffedd739f1c70b7929df53ebec90ece94da6aaee98c184350b6a7a74782134b5d6a3e7cb033b0004c42696f85bb89ec7e98b352c1e2f4721fc9c18295a9833b","ssdeep":"6144:n8S2K+BQLx90eHDi66wj8A1LU2X1UNNWOg1pO1ZBtkZa4R2pxc0RHfIB/Z5kPc92:n8S2K+BQLx90eHDi66wj8A1LU2X1UNNZ","tlshash":"b7449c6065ee50be0584b4cfcb0dad4d38bf88fe2f5b536225682d6e74e1024ca78e5d","first_seen":"2026-09-16T14:10:42.467809Z","last_seen":"2026-10-10T22:00:33.263686Z","times_seen":2,"resource_available":true,"data":null}},"time_used":196,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":150,"receive":46,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"it-ha.ru/api?entity=site_settings","fqdn":"it-ha.ru","domain":"it-ha.ru","tld":"ru"},"ip":{"addr":"89.111.170.66","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://it-ha.ru/","date":"2026-10-10T22:00:00.058Z","timestamp":1791669600058,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"it-ha.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 31 Aug 2026 08:19:10 GMT","end":"Sun, 29 Nov 2026 08:19:09 GMT"},"fingerprint":{"sha1":"64:BD:AA:02:EC:B7:94:37:D8:65:9D:87:BF:8A:EF:36:C5:F5:EC:4E","sha256":"76:95:2E:F9:02:33:79:96:B5:28:AA:E1:F8:F8:A4:22:3E:7A:36:C6:20:5C:46:95:CD:CF:A3:59:5B:78:54:6E"}}},"request":{"raw":"GET /api?entity=site_settings HTTP/1.1\r\nHost: it-ha.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://it-ha.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 10 Oct 2026 22:00:00 GMT\r\nContent-Type: application/json; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Authorization\r\nX-Content-Type-Options: nosniff, nosniff\r\nX-Frame-Options: SAMEORIGIN, SAMEORIGIN\r\nReferrer-Policy: strict-origin-when-cross-origin, strict-origin-when-cross-origin\r\nPermissions-Policy: camera=(), microphone=(), geolocation=(), payment=()\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":3726,"size_decoded":1686,"mime_type":"application/json; charset=utf-8","magic":"JSON text data","md5":"6717f5363da96ac246d9256baee7346e","sha1":"db64f52928a90b74c6276cfad681f1de9ae6bd8a","sha256":"dde13a68edc03c511df3649c56a41cf6769c40f8fcbdec9efa8b103a5f599068","sha512":"2043b97c039fd7c9ef515137bdf3a0f299db07a7f167383041b4d2f5782739dcdbb652dc3bf666e72fb14146b47f7c7989864fd4c188385c4b2565e228256015","ssdeep":"","tlshash":"4171a220252c5c3b0249b15deccb664bbded157e7ae5422692bcdd3d5de2964c03338b","first_seen":"2026-09-16T14:10:42.472726Z","last_seen":"2026-10-10T22:00:33.268615Z","times_seen":2,"resource_available":true,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":40,"send":0,"wait":52,"receive":0,"ssl":49},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-10-10","alert":"Sinkholed","trigger":"it-ha.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}