{"report_id":"5cd1f4c6-3b96-4ea5-8d2d-3c39993adcc4","version":0,"status":"done","tags":[],"date":"2026-08-25T21:17:03Z","url":{"schema":"http","addr":"thewitcherplay.ru/","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"thewitcherplay.ru/","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"title":"The Witcher — скачать игры серии и выбрать версию | Ведьмачий Путь","dom":{"size":12274,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (1373)","md5":"e70a549a82124f11bd61ab9632e4f8b6","sha1":"7e83fbe26b617e8410a42c01027bdc253ff530ae","sha256":"b4c9f7beb59acebe9aa44018a3d1a25505e8b107fcfcd612ab20e558c6d8eaef","sha512":"7572f670c85742a4fc8d4ed363a540aa61f981843f2293b190d353c3e43bed18c3f0a7bcac357ea4d39102e33aa85fb2ee76297a3420dd7c11535cf20e188647","ssdeep":"192:2P6qDD0+L0IV9Xu0EXBbRYmLqpsFmDc6+Yt6cSkfB4:JqDDFL0Y1FpbD1+ySz","tlshash":"4b42417161c520af1213b1cae4197f4eb4f341feab675b2216fc1daa3af2c50cd1952a","dom_hash":"domhash682bbfd381a9544eb2a71e036a116b4f","first_seen":"2026-08-25T20:56:44.117299Z","last_seen":"2026-08-25T21:17:04.754513Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"thewitcherplay.ru/","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:17:03Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"thewitcherplay.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-13","domain_rank":0,"first_seen":"2026-08-25T20:56:40.597582Z","last_seen":"2026-08-25T20:56:40.597582Z","alert_count":36,"request_count":9,"received_data":985022,"sent_data":4508,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"thewitcherplay.ru/","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"8745e623b951848757a5f032721b6c7d","sha1":"c6c931306f601373b384a061922f0aaef6ef60b7","sha256":"788cb0d2f2c1bfa9f517bb92f2f3dd92f69abdfb16f7c57ac1d659d1c85dcbb0","sha512":"0f55f31ea6bf98d9f1061e552e7d176b21a9cf0b47dfeb11ee6c1003902683fb780fbcb28e452a044e03d23fad92979ab5f414f3d203bdb655187cb43d3188d4","ssdeep":"","tlshash":"8bf0e177b88492b5c2f63132532ba34c711718b920896c34864d8c813a7ac5d103f9ac","size":576,"data":"","first_seen":"2026-08-25T20:56:44.151277Z","last_seen":"2026-08-25T21:17:04.762667Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"thewitcherplay.ru/assets/js/main.js","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"27e6b906eb5f0226abc3111ab71e9160","sha1":"04f07a9531edb6d6940dc5639dfdd483fde2263b","sha256":"2af7e5b7b09eb9d9269357ebfa4791c45b3b3b600693c444d40293d22c28b2f5","sha512":"a6bbd5162a90f0760faaf62aa5b551b67884982defd1dba2f1895477ffa99eff0d4f76692423537ba54d1ef38153007cbcb26dc61db9d0244648566659735253","ssdeep":"192:BttFOUePLOlEN1kQnyUvYG3jvhzGfVzADvu:6VKlET8UvYcvhyfVzCvu","tlshash":"f2029658a195257a047753be9b475668fb72047b700382503eac4e483fb1a5282bfdd9","size":8587,"data":"","first_seen":"2026-08-25T20:56:44.132688Z","last_seen":"2026-08-25T21:17:04.76078Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"thewitcherplay.ru/assets/icons/icons.svg","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://thewitcherplay.ru/","date":"2026-08-25T21:16:36.628Z","timestamp":1787692596628,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"thewitcherplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:27 GMT","end":"Wed, 11 Nov 2026 19:44:26 GMT"},"fingerprint":{"sha1":"C6:B3:B4:22:A0:05:62:76:E5:B6:87:F3:16:A3:EE:69:2F:65:8C:79","sha256":"DD:A4:4E:55:43:27:63:2B:03:77:52:E8:9B:15:4E:9F:DF:22:A9:84:E8:66:38:40:1E:5D:71:78:00:1C:BA:98"}}},"request":{"raw":"GET /assets/icons/icons.svg HTTP/1.1\r\nHost: thewitcherplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://thewitcherplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:16:36 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 399\r\nlast-modified: Thu, 13 Aug 2026 21:52:09 GMT\r\netag: \"4d0-658f4b737cbbd-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1232,"size_decoded":811,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"ef496b63425ef48edd592dae9833e924","sha1":"b0685604aef47ceed7289eb06ddd0a2e9dd49226","sha256":"b473c66753f081ce1b9f9989261fdef4dcd440b826827c38ef52c326d4d5c8ca","sha512":"386636534cfb1c468d556354074e5107b39d13b8d3d4be24edb924513279fbed8f83bf805666b86c507bdbb9da5129b1460b361a02a10bdbd3dfc7ca2ae79ed2","ssdeep":"","tlshash":"c4212f1597196938e461416fe36cb17e517fa2c6228d147c7c581a2a6748bcff833bcc","first_seen":"2026-08-25T20:56:44.1461Z","last_seen":"2026-08-25T21:17:04.755464Z","times_seen":2,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"thewitcherplay.ru/assets/images/favicon.png","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://thewitcherplay.ru/","date":"2026-08-25T21:16:36.705Z","timestamp":1787692596705,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"thewitcherplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:27 GMT","end":"Wed, 11 Nov 2026 19:44:26 GMT"},"fingerprint":{"sha1":"C6:B3:B4:22:A0:05:62:76:E5:B6:87:F3:16:A3:EE:69:2F:65:8C:79","sha256":"DD:A4:4E:55:43:27:63:2B:03:77:52:E8:9B:15:4E:9F:DF:22:A9:84:E8:66:38:40:1E:5D:71:78:00:1C:BA:98"}}},"request":{"raw":"GET /assets/images/favicon.png HTTP/1.1\r\nHost: thewitcherplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://thewitcherplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:16:36 GMT\r\ncontent-type: image/png\r\ncontent-length: 355751\r\nlast-modified: Thu, 13 Aug 2026 21:52:10 GMT\r\netag: \"56da7-658f4b74894f1\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":355751,"size_decoded":356164,"mime_type":"image/png","magic":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","md5":"cafed22b53f7db3c7501f7f08a4239bc","sha1":"e433fe11cd9c6118cff3c8d4797d9a7e3ee51b54","sha256":"1001f622bc2bafd2c0818030d7d7e80dd28fbaf6925a9e41d441685a618a2a2c","sha512":"6d81c45e42f988144543ccc50b35c7c7e83dc0fb391b7b9358c0f3d36fc85c839d1a6e64ea788020e227ac9102d4ae477c31d07b997e119ec120011da95b0e80","ssdeep":"6144:iQXezaISOEhsH6lJptSwk2g49gm1J0fOXGm2ey8mVL3GCpwV+TM1y8EVjLlLGBLp:i+p6EhQ6Dr5kBI1J0wGJ7pWCWI8EVVkF","tlshash":"987423292906cff2d54724754ca2b110e79231bfca952bd9d98b80f9babf45f4394323","first_seen":"2026-08-25T20:56:44.143069Z","last_seen":"2026-08-25T21:17:04.756283Z","times_seen":2,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":40,"receive":37,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"thewitcherplay.ru/assets/images/witcher-world.webp","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://thewitcherplay.ru/","date":"2026-08-25T21:16:36.630Z","timestamp":1787692596630,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"thewitcherplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:27 GMT","end":"Wed, 11 Nov 2026 19:44:26 GMT"},"fingerprint":{"sha1":"C6:B3:B4:22:A0:05:62:76:E5:B6:87:F3:16:A3:EE:69:2F:65:8C:79","sha256":"DD:A4:4E:55:43:27:63:2B:03:77:52:E8:9B:15:4E:9F:DF:22:A9:84:E8:66:38:40:1E:5D:71:78:00:1C:BA:98"}}},"request":{"raw":"GET /assets/images/witcher-world.webp HTTP/1.1\r\nHost: thewitcherplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://thewitcherplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:16:36 GMT\r\ncontent-type: image/webp\r\ncontent-length: 192250\r\nlast-modified: Thu, 13 Aug 2026 21:52:13 GMT\r\netag: \"2eefa-658f4b774ba94\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":192250,"size_decoded":192664,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"7b4d461679a6b96cbf5546b2c415f06b","sha1":"16c96eaeb9cda78f795aa05adecff87e000980a2","sha256":"1e00d068b1dc670eacd361ade9f0d73c8bb7e2559794f9ed9375b0aac558fa8d","sha512":"ead9564154323bb188d536f043538ebc2052bf2cf8b45a96094dae5d37e038b67073d4eb58a9fbed96e717e28b65623990b5a1fab77f718c53cf8ecd3c735ee4","ssdeep":"3072:ue1WtdzKQ0cQnYH1eEj6M/1vAnRzEqCe1X/dzzRA8Flfo5+6+P6NVLgT4e2IxYNm:ubdzKI2yeEe0TebzR9KJ+iLgTVxYNbq","tlshash":"6e141291aab56ef8b9902b8cd1a0e1c8ead2774003e1c76ff5a95c35151bfc0144bef9","first_seen":"2026-08-25T20:56:44.148578Z","last_seen":"2026-08-25T21:17:04.757572Z","times_seen":2,"resource_available":false,"data":null}},"time_used":70,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"thewitcherplay.ru/assets/images/favicon.ico","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://thewitcherplay.ru/","date":"2026-08-25T21:16:36.707Z","timestamp":1787692596707,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"thewitcherplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:27 GMT","end":"Wed, 11 Nov 2026 19:44:26 GMT"},"fingerprint":{"sha1":"C6:B3:B4:22:A0:05:62:76:E5:B6:87:F3:16:A3:EE:69:2F:65:8C:79","sha256":"DD:A4:4E:55:43:27:63:2B:03:77:52:E8:9B:15:4E:9F:DF:22:A9:84:E8:66:38:40:1E:5D:71:78:00:1C:BA:98"}}},"request":{"raw":"GET /assets/images/favicon.ico HTTP/1.1\r\nHost: thewitcherplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://thewitcherplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:16:36 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 8013\r\nlast-modified: Thu, 13 Aug 2026 21:52:10 GMT\r\netag: \"1f4d-658f4b7412e44\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8013,"size_decoded":8426,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 3 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 32x32 with \n- PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"95c7e8a776ff664f47ae5f6996a373b6","sha1":"21aabec1bf558ff234229f178191181e5c66dee2","sha256":"0f656eb45db7309d82e81e2167d5c187ca28936a813ecc183684416efffb0cd3","sha512":"4664ff8be90021143e18a7873f652c9288ad57d86219cf54a1a41980885d3a3c601070d3e753397a48949be7c68a4f1559260997e09589e080789026c7c35cba","ssdeep":"192:9LQpQ/ix86H45GKEBx+YkH7/mwRzZkm3Qx0KK6Z5:9LQ6u45M+TtRzr3Q3Xr","tlshash":"d2f19e86d5257729cce6923c4946c7e14c96481c9e64643b92b2641b8e2737c82d2fff","first_seen":"2026-08-25T20:56:44.140507Z","last_seen":"2026-08-25T21:17:04.758251Z","times_seen":2,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"thewitcherplay.ru/","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:16:36.010Z","timestamp":1787692596010,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"thewitcherplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:27 GMT","end":"Wed, 11 Nov 2026 19:44:26 GMT"},"fingerprint":{"sha1":"C6:B3:B4:22:A0:05:62:76:E5:B6:87:F3:16:A3:EE:69:2F:65:8C:79","sha256":"DD:A4:4E:55:43:27:63:2B:03:77:52:E8:9B:15:4E:9F:DF:22:A9:84:E8:66:38:40:1E:5D:71:78:00:1C:BA:98"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: thewitcherplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:16:36 GMT\r\ncontent-type: text/html\r\ncontent-length: 3808\r\nlast-modified: Thu, 13 Aug 2026 21:52:06 GMT\r\netag: \"2fd5-658f4b711ad30-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12245,"size_decoded":4269,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1373), with CRLF line terminators","md5":"f8f109d9cd4926630ef879b37f4fc13d","sha1":"a76a00f646802018024d41a0c7d6feb540038c60","sha256":"730690737df82123ff7b2d46b7b6ee308838d2dccc8680314162eed6ce5fcc10","sha512":"e014e9cfb15b9a5571d9a0c30f0fd2c399342d4fb4f0ca3d4ba7d9e3b5b42e0c093c18e7267072426d562b1cb22f874c7ec100f95c14ce0f77bd6463f4c34eac","ssdeep":"192:sc6ok4p+IGQZ79X/0EXnVR7mLqpsEmD86+Yt6cSZfB8:Gok4UIGQY4FpSDV+ySk","tlshash":"9642937161c524af1213b1dae4097f4eb4b341feab675b2216fc2dab3af2c10cd19516","first_seen":"2026-08-25T20:56:44.124101Z","last_seen":"2026-08-25T21:17:04.759399Z","times_seen":2,"resource_available":false,"data":null}},"time_used":91,"timings":{"blocked":0,"dns":4,"connect":22,"send":0,"wait":38,"receive":0,"ssl":27},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"thewitcherplay.ru/assets/css/styles.css","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://thewitcherplay.ru/","date":"2026-08-25T21:16:36.293Z","timestamp":1787692596293,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"thewitcherplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:27 GMT","end":"Wed, 11 Nov 2026 19:44:26 GMT"},"fingerprint":{"sha1":"C6:B3:B4:22:A0:05:62:76:E5:B6:87:F3:16:A3:EE:69:2F:65:8C:79","sha256":"DD:A4:4E:55:43:27:63:2B:03:77:52:E8:9B:15:4E:9F:DF:22:A9:84:E8:66:38:40:1E:5D:71:78:00:1C:BA:98"}}},"request":{"raw":"GET /assets/css/styles.css HTTP/1.1\r\nHost: thewitcherplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://thewitcherplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:16:36 GMT\r\ncontent-type: text/css\r\ncontent-length: 3820\r\nlast-modified: Thu, 13 Aug 2026 21:52:09 GMT\r\netag: \"3194-658f4b73337c6-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12692,"size_decoded":4281,"mime_type":"text/css","magic":"ASCII text, with very long lines (1704), with CRLF line terminators","md5":"5a99843399d712707cc8713b334c647b","sha1":"362d98e7ff97a67102da26ed3e5bc0dea52120ef","sha256":"f8b9cb0fe94f740f9c6ed6cde1f823f283eb97f29c9867c7652d93b999a17c0f","sha512":"7d048c887cdc4783245c8a44ad3d1e8b96e2626c711a3d9d8b9f1a06895efc1405dc8b9babae945550af692f132b46ec9baae269bede34ddb0540b665c0db6b6","ssdeep":"192:s8c7ymXt13m1imuT6olPWW1ZIld7TMRWt5Ofr5D32Rq4+45VmJru:s/7t/21iJT68PF6TvjOlDmRqQ5VEi","tlshash":"d1429572a614313cf72be2a5f5d5a78e7124f123e51747e9fec2a22884c72b31a2570d","first_seen":"2026-08-25T20:56:44.127753Z","last_seen":"2026-08-25T21:17:04.760074Z","times_seen":2,"resource_available":false,"data":null}},"time_used":109,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":109,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"thewitcherplay.ru/assets/js/main.js","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://thewitcherplay.ru/","date":"2026-08-25T21:16:36.294Z","timestamp":1787692596294,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"thewitcherplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:27 GMT","end":"Wed, 11 Nov 2026 19:44:26 GMT"},"fingerprint":{"sha1":"C6:B3:B4:22:A0:05:62:76:E5:B6:87:F3:16:A3:EE:69:2F:65:8C:79","sha256":"DD:A4:4E:55:43:27:63:2B:03:77:52:E8:9B:15:4E:9F:DF:22:A9:84:E8:66:38:40:1E:5D:71:78:00:1C:BA:98"}}},"request":{"raw":"GET /assets/js/main.js HTTP/1.1\r\nHost: thewitcherplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://thewitcherplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:16:36 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:02:15 GMT\r\netag: W/\"218b-659a333548388\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8587,"size_decoded":3378,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"27e6b906eb5f0226abc3111ab71e9160","sha1":"04f07a9531edb6d6940dc5639dfdd483fde2263b","sha256":"2af7e5b7b09eb9d9269357ebfa4791c45b3b3b600693c444d40293d22c28b2f5","sha512":"a6bbd5162a90f0760faaf62aa5b551b67884982defd1dba2f1895477ffa99eff0d4f76692423537ba54d1ef38153007cbcb26dc61db9d0244648566659735253","ssdeep":"192:BttFOUePLOlEN1kQnyUvYG3jvhzGfVzADvu:6VKlET8UvYcvhyfVzCvu","tlshash":"f2029658a195257a047753be9b475668fb72047b700382503eac4e483fb1a5282bfdd9","first_seen":"2026-08-25T20:56:44.132688Z","last_seen":"2026-08-25T21:17:04.76078Z","times_seen":2,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"thewitcherplay.ru/assets/images/witcher-path-logo-dark.webp","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://thewitcherplay.ru/","date":"2026-08-25T21:16:36.299Z","timestamp":1787692596299,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"thewitcherplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:27 GMT","end":"Wed, 11 Nov 2026 19:44:26 GMT"},"fingerprint":{"sha1":"C6:B3:B4:22:A0:05:62:76:E5:B6:87:F3:16:A3:EE:69:2F:65:8C:79","sha256":"DD:A4:4E:55:43:27:63:2B:03:77:52:E8:9B:15:4E:9F:DF:22:A9:84:E8:66:38:40:1E:5D:71:78:00:1C:BA:98"}}},"request":{"raw":"GET /assets/images/witcher-path-logo-dark.webp HTTP/1.1\r\nHost: thewitcherplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://thewitcherplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:16:36 GMT\r\ncontent-type: image/webp\r\ncontent-length: 314836\r\nlast-modified: Thu, 13 Aug 2026 21:52:11 GMT\r\netag: \"4cdd4-658f4b75b9497\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":314836,"size_decoded":315250,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"d0edadef6e852655bd8a2ad516609d19","sha1":"3f38788522c44c8824d58e777bb9bc4259e5289e","sha256":"807f8af68bb69ab563bd1d74704795fe29bb242e15b506e3d2083c7d194cf7a0","sha512":"760f6132db5d7d7b0e193015c152ec076cdc317195f18bf8973a2ffd7ccec86a965341319c111f97f3724168e737f0f3b2b2067bd77f2eeee9aa8935001bfc66","ssdeep":"6144:FTGzIwgf6er3n5GzxSjI9FK70th3oMy0YaZa8hEBcvLAQ5C5in0+mop/B6E6mhI:Fbw6Pz5gFK70th3O0f88OBuLAEn0+mbl","tlshash":"3c6423d0319d2c274459d29bff3e5ec813aad1a4207aafe88cb3d3680942f4755da61f","first_seen":"2026-08-25T20:56:44.136951Z","last_seen":"2026-08-25T21:17:04.76132Z","times_seen":2,"resource_available":false,"data":null}},"time_used":127,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"thewitcherplay.ru/assets/images/witcher-hero.webp","fqdn":"thewitcherplay.ru","domain":"thewitcherplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://thewitcherplay.ru/","date":"2026-08-25T21:16:36.303Z","timestamp":1787692596303,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"thewitcherplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:27 GMT","end":"Wed, 11 Nov 2026 19:44:26 GMT"},"fingerprint":{"sha1":"C6:B3:B4:22:A0:05:62:76:E5:B6:87:F3:16:A3:EE:69:2F:65:8C:79","sha256":"DD:A4:4E:55:43:27:63:2B:03:77:52:E8:9B:15:4E:9F:DF:22:A9:84:E8:66:38:40:1E:5D:71:78:00:1C:BA:98"}}},"request":{"raw":"GET /assets/images/witcher-hero.webp HTTP/1.1\r\nHost: thewitcherplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://thewitcherplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:16:36 GMT\r\ncontent-type: image/webp\r\ncontent-length: 75594\r\nlast-modified: Thu, 13 Aug 2026 21:52:11 GMT\r\netag: \"1274a-658f4b754743c\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":75594,"size_decoded":76007,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4b97dbdd9b1f623aa97eb52a683b1be2","sha1":"2b4390c56758f83ab740ddd51eb11ed71c04c836","sha256":"09e69ea10ba222be11296e55b7f93745cb51bfcddbf76ce5c6dbed930b4eb805","sha512":"46e069be6bd23015576586c655cfd918fad807b3a28c735a53c4c8afe04b01a2c1110672bef7abce98c481b5df0e8121164700e4d5e8e741ace22c2c7961e2ec","ssdeep":"1536:ZZKh04b/3941H3e+rVkZ2hLFj2t4AOELgjDwr:i04b/eR3rrY0L84A10wr","tlshash":"7473020b60b8b5ebd07e67b106706ca06e9f0db6ca98042ded5c6284f10da1d7d6d7ca","first_seen":"2026-08-25T20:56:44.138369Z","last_seen":"2026-08-25T21:17:04.762006Z","times_seen":2,"resource_available":false,"data":null}},"time_used":121,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":23,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"thewitcherplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}