{"report_id":"5c4ef47f-5c14-42ab-aa2f-a3d2b5d452da","version":0,"status":"done","tags":[],"date":"2026-08-25T21:18:11Z","url":{"schema":"http","addr":"windowsmp.ru/","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"windowsmp.ru/","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"title":"Windows Media Player — скачать бесплатно для Windows 11 и Windows 10","dom":{"size":13128,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"34306107a97891c41f720ebff0ff3c2b","sha1":"c0b9b95d48c8a392284d75a8d305c702fda803bc","sha256":"8bdaba59c537d0f181015e9a3b23c186cba509b3cf8e0815afa2120d66f01aec","sha512":"1e77a424ade5f06c853f1a62a543f20a4bae42c5b977fc784033c52770bbe158711d41c077ccb5e62c71b45f6491a1eaccb5e442ca8f9c9ab621caad43a98f85","ssdeep":"192:cn34a/gxWuHIxgSu1mSV9hoY4ZAFvXnfsLMquw5kAi8V5q0Yq4HRhDB2:urqmqBf7qucc8","tlshash":"b042617254f5649b0151a047ee167f4e3da681bfae1b1b1072bc2dae7fe3851c82b20d","dom_hash":"domhashe3ff04e450a306589b7cb665a926ae4d","first_seen":"2026-08-25T20:53:18.384754Z","last_seen":"2026-08-25T21:18:12.097955Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"windowsmp.ru/","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:18:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"windowsmp.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-14","domain_rank":0,"first_seen":"2026-08-25T20:53:14.18062Z","last_seen":"2026-08-25T20:53:14.18062Z","alert_count":22,"request_count":11,"received_data":417644,"sent_data":5490,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"windowsmp.ru/","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"dc918d87cae88ebf8b540299f5108420","sha1":"9932808622f015ef2af7e0f86dc991d037d72039","sha256":"d66f39194d5f0d4a6d798d6e09a16cd4f0ab16e1a2e77084a635ee0ecfdefe12","sha512":"88d5d5eb4fb7a9e0a7029c3afe48c15a73190e33da81267bbd28eb2802e8cea6b7db86062ea38072b0c31d4963732e120d767bba27504f97017c2f9d508624ed","ssdeep":"","tlshash":"3af0e1b7fc8892b5c2fa2131532fa34cb16728b924896d34850d8895797ac59102fd6d","size":576,"data":"","first_seen":"2026-08-25T20:53:18.416316Z","last_seen":"2026-08-25T21:18:12.109112Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/js/main.js","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"931f9c6582353c0dd39dbc7d2425bb65","sha1":"ae46b4c6866252fb1f506ba921237361eff02ca7","sha256":"5221ea3186096b89f4eaeef6e8439d292cedc224f3be3ad1097fc086e7aec262","sha512":"d1203df768b7901ec4674eae7420b6aacbe1f25e42fa314a955092a9487de68650d631a6f0f3efb19bb6b7375a9d44d9ba83bd68bf43fd9194b9c60520b7e899","ssdeep":"96:PsHih6pfOXbF9ABuAoYhzrbXBSqKe6hTvL4qim/5q65aw9CZ2wbnY0rqaj:PsHih0GIYAnhzPBSqTMxDw2wbF3","tlshash":"4fd15624e84636b244b763beaf5b554cfbb001bb9404c5113dacee452fb4a71027dee9","size":6561,"data":"","first_seen":"2026-08-25T20:53:18.39131Z","last_seen":"2026-08-25T21:18:12.09958Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"windowsmp.ru/assets/js/main.js","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.604Z","timestamp":1787692664604,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/js/main.js HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:02:33 GMT\r\netag: W/\"19a1-659a33459a83d\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":6561,"size_decoded":2748,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"931f9c6582353c0dd39dbc7d2425bb65","sha1":"ae46b4c6866252fb1f506ba921237361eff02ca7","sha256":"5221ea3186096b89f4eaeef6e8439d292cedc224f3be3ad1097fc086e7aec262","sha512":"d1203df768b7901ec4674eae7420b6aacbe1f25e42fa314a955092a9487de68650d631a6f0f3efb19bb6b7375a9d44d9ba83bd68bf43fd9194b9c60520b7e899","ssdeep":"96:PsHih6pfOXbF9ABuAoYhzrbXBSqKe6hTvL4qim/5q65aw9CZ2wbnY0rqaj:PsHih0GIYAnhzPBSqTMxDw2wbF3","tlshash":"4fd15624e84636b244b763beaf5b554cfbb001bb9404c5113dacee452fb4a71027dee9","first_seen":"2026-08-25T20:53:18.39131Z","last_seen":"2026-08-25T21:18:12.09958Z","times_seen":2,"resource_available":true,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/img/wmp-logo.png","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.612Z","timestamp":1787692664612,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/img/wmp-logo.png HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: image/png\r\ncontent-length: 64233\r\nlast-modified: Fri, 14 Aug 2026 08:55:11 GMT\r\netag: \"fae9-658fdfa7124fa\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":64233,"size_decoded":64644,"mime_type":"image/png","magic":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","md5":"8a60e3f794de6e373a36e732b5cac98d","sha1":"086222a6277fb6e4675fe3e2d6deea255dcdcc3e","sha256":"48659b6f45e7deb8c934e0e7b4fb487d36de6e219dd86aaec51d85c288f7d145","sha512":"2255f0d218ddf001cfdaf11c1db66bc1d978b881ab86e32bbfb232bb4d35639afdf1c30abaf7a986bd9e52320853257b366696e92a044347ada391d0dd4d2d90","ssdeep":"1536:W4WpCnJKYwrAmhnAeTtmlHkwprtU+42VqkzHLy/41XDq:7W86MCt+EwvJzhLAGe","tlshash":"5153021997c0529189cb3bcd9a2be95ad69ad5acccc14defd13ecc020f028621943ff5","first_seen":"2026-08-25T20:53:18.408482Z","last_seen":"2026-08-25T21:18:12.100414Z","times_seen":2,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":84,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/img/apple-touch-icon.png","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.883Z","timestamp":1787692664883,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/img/apple-touch-icon.png HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: image/png\r\ncontent-length: 37528\r\nlast-modified: Fri, 14 Aug 2026 08:55:09 GMT\r\netag: \"9298-658fdfa46c480\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":37528,"size_decoded":37939,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"02edaaa7fc86254aff6eb9fe97a69079","sha1":"a42c261917e8692f6e4280075ba7e54d8211b695","sha256":"dce7f154ef2136891a83828ba0b877498bdd0c193771113d9f82dcaa9b7b952c","sha512":"e500004bfc1c48e21b497a48973605b44072b93a0d7e56b87dfb18a2070ccada978ec7c9ff2b3f178b305a6fe867cb3c25a47399c5af4dce180bf0abea971e49","ssdeep":"768:OixbFk1NRbKS0lFswnMoRIAhbiEJw1wczN3nNQ0B/:O4Kx+S0Xtno2iE0ZpiG","tlshash":"95f2f1465aa2f5a09a4a362e3e2f2f92fe1f25d294ce843c17039591d1d088a247cf77","first_seen":"2026-08-25T20:53:18.400439Z","last_seen":"2026-08-25T21:18:12.101201Z","times_seen":2,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":37,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/img/favicon-32.png","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.884Z","timestamp":1787692664884,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/img/favicon-32.png HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: image/png\r\ncontent-length: 2397\r\nlast-modified: Fri, 14 Aug 2026 08:55:09 GMT\r\netag: \"95d-658fdfa4a990b\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2397,"size_decoded":2806,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"07b5385b4547188ae83924cd96cea163","sha1":"5d03312a14dc287c8f5b0dc24c920a6190d14100","sha256":"940aa43d9a98d8a33d1394b8b350a72ab5caae567c21b0dd875e39dc3fb3f712","sha512":"0495af2010bfcefe9b199364028516d663e7921dc7f3ba7163a3872db26450a74d63cfd3386bfae4551e6019d1b9f716500babcb54de905e88849ae995da271b","ssdeep":"","tlshash":"c6411b3a5bf44f6df0d45900d54346824d0b00c96426c6fd63b9945bcf671553df45eb","first_seen":"2026-08-25T20:53:18.412637Z","last_seen":"2026-08-25T21:18:12.101988Z","times_seen":2,"resource_available":false,"data":null}},"time_used":43,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":43,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/img/tile-library.jpg","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.886Z","timestamp":1787692664886,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/img/tile-library.jpg HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 47866\r\nlast-modified: Fri, 14 Aug 2026 08:55:11 GMT\r\netag: \"bafa-658fdfa646aeb\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":47866,"size_decoded":48278,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 720x720, components 3","md5":"d71ebdeb1247987f81bcb6d20a7cb568","sha1":"03643f3f3582c59e06fc39b7878f225f392d4334","sha256":"0d180f17fb30355c15fc5f76ea7e91b9073abb6c8034624fad239796dd1366d6","sha512":"48b5a3e3a27a8f59e0501206ab6e7056474996e7b861f8a39f3fb6d20dcad536f074c1218ab5a17e9a5363e164dffeb16ad1afefba37baf891ae1957d4c85ead","ssdeep":"768:vQwbVOHiJn6SfpYL9fab0gVLRHVKKvAcDDD6GCXz9zA/lO8AR25S3c462AXjgNy+:LbuA6Co9i0W1KKvAcDX6GUhzAtnYwhXW","tlshash":"b823f19461bb3c9b56215e36b58d3c513e02dac58ac24f60c5a3f4ee53092dc4b72b8f","first_seen":"2026-08-25T20:53:18.393479Z","last_seen":"2026-08-25T21:18:12.10289Z","times_seen":2,"resource_available":false,"data":null}},"time_used":37,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":37,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/img/tile-video.jpg","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.892Z","timestamp":1787692664892,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/img/tile-video.jpg HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 41703\r\nlast-modified: Fri, 14 Aug 2026 08:55:11 GMT\r\netag: \"a2e7-658fdfa6cbfe4\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":41703,"size_decoded":42115,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 720x720, components 3","md5":"7ce92bd85c0aba43cd22b5aa5298fae7","sha1":"1b924bb326c22c45dcf0920a6c429dbd6db4fcdc","sha256":"b72f4521fc8f63bef8d0b7dce9c8f808cb5afea9e905be3ebaf23f751990077f","sha512":"c15470d84890bc7c967aa392f7a6c6d700e0020ae6b808b8bcbca51149fae1727af8fc453d7f567690eac27ca47f0fcecb29db5b6180222cda5421ba3304e83c","ssdeep":"768:8keoSPBcP/fY58/Cqb4Z/5Ab79xatXM9XUEq65uJBLQLsxlfQVoKs:BPSPBwYPZBAnE898X0Sl8vs","tlshash":"a313f13f00454549ebd85cfcbabaebb688a1405335b2920a5fac5dd0df4a3f85806a27","first_seen":"2026-08-25T20:53:18.410633Z","last_seen":"2026-08-25T21:18:12.103572Z","times_seen":2,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/css/style.css","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.600Z","timestamp":1787692664600,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/css/style.css HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: text/css\r\ncontent-length: 3030\r\nlast-modified: Fri, 14 Aug 2026 08:55:08 GMT\r\netag: \"2c09-658fdfa42a1d3-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":11273,"size_decoded":3491,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"623478878bbb4c400d008a0083eed46b","sha1":"1b3ab02582e7b001eb97f9cfd319d7b552bcbab1","sha256":"49cf0a0657df1c2d67bde44b2ac7164517f33962d212f82b41a987aef384bd1f","sha512":"13eaebdc1904e226ae34c6031b83956f7c432329eaafd96e4bbda3c6da712c3beeaa3c8682b40d4f6c6dee1f3d9c7a3dd36eff91a6e325c2d1778c32a7a7eb09","ssdeep":"96:AytUhA1+mLW/5QdaS51Pm/0jRIyc/f0HfEDkJzsnE9TRQVtkCqlvTCrZrh+vTA5H:NtUhVz4qyPEkzsnEONee2vQh90Apf","tlshash":"1d3243a623286134b137b7a8fb97d38db66cb112e51502bcbcda5044c2cf6ba4076f5d","first_seen":"2026-08-25T20:53:18.414317Z","last_seen":"2026-08-25T21:18:12.104992Z","times_seen":2,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/img/tile-cd.jpg","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.890Z","timestamp":1787692664890,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/img/tile-cd.jpg HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 52603\r\nlast-modified: Fri, 14 Aug 2026 08:55:10 GMT\r\netag: \"cd7b-658fdfa5fc36c\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":52603,"size_decoded":53015,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 720x720, components 3","md5":"a8997bbb9d93cd8d6804f14b5dd1ae79","sha1":"7e0899b2819483206bd72c81911ecb52e88720f8","sha256":"94cf2f850005b60ca50a2d95f3a7784b0a64fd810bf822e260644b033b878715","sha512":"b38101a19c51dfb866c1a13f80c86dbe73ba928fecbd58f7701ff8d1a96cf23255975696a275606bad0e0e55fc7104f909e5c3a16fd75d91e64a635e0e0a99e9","ssdeep":"1536:oZ5Tl1OneexJ+AzJtqUhxBv6EgnDknCnBZHIm5B8WbMda:WTl1Oee3zJphxBSESkAHBhoQ","tlshash":"e833f120584ce2ad586a4c0825691bfcaa100b09d47a23ad89bef9fbdd114df07b1377","first_seen":"2026-08-25T20:53:18.395877Z","last_seen":"2026-08-25T21:18:12.105801Z","times_seen":2,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":35,"receive":22,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/img/tile-playlist.jpg","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.891Z","timestamp":1787692664891,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/img/tile-playlist.jpg HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 44387\r\nlast-modified: Fri, 14 Aug 2026 08:55:11 GMT\r\netag: \"ad63-658fdfa68d3e9\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":44387,"size_decoded":44799,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 720x720, components 3","md5":"f705aaa53e55f53638a2e3adb69d28bb","sha1":"4a2a09fa7653ae0410985bd04434189580dbc593","sha256":"4da54d8498ae3d92176588a3c89119141df1b834c5c604986b43b8eaf718fd64","sha512":"1e624f2f6a33c58f51e2b6c9d387df6ff81de75af8ff3e39f2e76ee6cff3ec42157d04ce9c9cad31e0e314dbd4e5880628628c82b0c67cb5386469b615cafb93","ssdeep":"768:Cuz9LJsxe6KIdqxPUZDmzZs3hIVCQOV4qAeBzEGjvamjPG:3Jv6K+qxgcy3hQCQOV4qAKzxC","tlshash":"3b13f1a847be17236113ccb18a2148df25eb6a53d04fd476ff31de255b7ea8291e4290","first_seen":"2026-08-25T20:53:18.397945Z","last_seen":"2026-08-25T21:18:12.106515Z","times_seen":2,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:17:44.307Z","timestamp":1787692664307,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: text/html\r\ncontent-length: 4330\r\nlast-modified: Sat, 22 Aug 2026 13:54:41 GMT\r\netag: \"350d-659a3183fc0ac-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13581,"size_decoded":4791,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"1bbbf83abdaef31220233ffb31a56e0b","sha1":"3c5391434643cd192d7b3bee81459eb9a3d66198","sha256":"328d45efdb3e80300aeb8c852febe98e3538cc405888cae8bd1994ec451c491d","sha512":"c0dbf891067db481245ddb805c911a032b957a30d60c3d37400b83fb4cb53f6c702da1b7f35c140b00d66b0c815aea456048e308d58c9b30eab04ab1fa1b9082","ssdeep":"192:1A34sNxW6xG3WRSMoKZ79hou7CVVvzWBsBMqTs5kbi+VLqc8j4tfh/iZ:moKF4YNqTw7F","tlshash":"28523f7154c5689b0132a057ea16af8efd9681bf6a1b1b1171fc2e6f7ff3810c827249","first_seen":"2026-08-25T20:53:18.403299Z","last_seen":"2026-08-25T21:18:12.107386Z","times_seen":2,"resource_available":false,"data":null}},"time_used":87,"timings":{"blocked":-1,"dns":4,"connect":20,"send":0,"wait":37,"receive":0,"ssl":26},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"windowsmp.ru/assets/img/hero.jpg","fqdn":"windowsmp.ru","domain":"windowsmp.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://windowsmp.ru/","date":"2026-08-25T21:17:44.603Z","timestamp":1787692664603,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.windowsmp.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:45 GMT","end":"Mon, 16 Nov 2026 20:09:44 GMT"},"fingerprint":{"sha1":"B8:79:06:FA:E0:38:36:5C:BD:AC:EB:AF:70:64:BB:A1:CA:57:E2:CD","sha256":"EF:42:82:7F:D3:BE:AE:B1:01:1E:42:E1:D8:63:79:D2:AA:E0:12:F7:91:94:4D:4C:CA:8C:88:D5:CA:33:3F:08"}}},"request":{"raw":"GET /assets/img/hero.jpg HTTP/1.1\r\nHost: windowsmp.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://windowsmp.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:17:44 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 90877\r\nlast-modified: Fri, 14 Aug 2026 08:55:10 GMT\r\netag: \"162fd-658fdfa53efd9\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":90877,"size_decoded":91290,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1536x1024, components 3","md5":"00d78b81b6fc91dedda9d46208b75113","sha1":"39ed18f1856b7a6dbb18ecca7437cf3cfa13e3fa","sha256":"0b15b78d310ac2159037d115750b5ebe2b54b1eac9df957107ab699ade489f4e","sha512":"cbc62de938a3f33846dac747dcc4527b40f047d0108f9d147a129d6a3519508680c4f089bdc56f7cd1b92f1648717290f98dac8ce85a76893e5d9b3a2dbd24dd","ssdeep":"1536:B/2b3rljDw/goDu0oErQFJLhD4ibcmHQup+JnojbsVhzZzmyU:obbl3CxK0Lk14iAmonubMXjU","tlshash":"5f93020f4765deabc7427dbc4df130606521a7a89628f1730aeec6a90be61cb7d903c5","first_seen":"2026-08-25T20:53:18.405957Z","last_seen":"2026-08-25T21:18:12.108348Z","times_seen":2,"resource_available":false,"data":null}},"time_used":92,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":54,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"windowsmp.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}