{"report_id":"678c6660-5f00-4a35-84db-c1eb1c57201e","version":6,"status":"done","tags":[],"date":"2026-03-07T01:07:11Z","url":{"schema":"https","addr":"rabbyts.xyz/","fqdn":"rabbyts.xyz","domain":"rabbyts.xyz","tld":"xyz"},"ip":{"addr":"185.62.58.23","port":0,"asn":62370,"as":"Snel.com B.V.","country":"The Netherlands","country_code":"NL"},"final":{"url":{"schema":"https","addr":"rabbyts.xyz/","fqdn":"rabbyts.xyz","domain":"rabbyts.xyz","tld":"xyz"},"title":"Портал государственных услуг Российской Федерации","dom":{"size":0,"mime_type":"text/plain; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T22:46:17.230058Z","times_seen":17894017,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"rabbyts.xyz/","fqdn":"rabbyts.xyz","domain":"rabbyts.xyz","tld":"xyz"},"ip":{"addr":"185.62.58.23","port":0,"asn":62370,"as":"Snel.com B.V.","country":"The Netherlands","country_code":"NL"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-04-11T01:07:11Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"rabbyts.xyz/__jsch/static/script.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null},"summary":[{"fqdn":"rabbyts.xyz","ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2025-11-21","domain_rank":0,"first_seen":"2026-03-07T01:07:11.385626Z","last_seen":"2026-03-07T01:07:11.385626Z","alert_count":1,"request_count":3,"received_data":53804,"sent_data":1380,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"gu-st.ru","ip":{"addr":"46.235.186.70","port":443,"asn":34879,"as":"OOO Sovremennye setevye tekhnologii","country":"Russia","country_code":"RU"},"domain_registered":"2016-05-30","domain_rank":22418,"first_seen":"2017-01-30T19:09:12Z","last_seen":"2026-03-03T05:42:46.071061Z","alert_count":0,"request_count":2,"received_data":213444,"sent_data":1047,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"rabbyts.xyz/","fqdn":"rabbyts.xyz","domain":"rabbyts.xyz","tld":"xyz"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-07T01:06:48.229Z","timestamp":0,"http_version":"","security_state":"broken","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: rabbyts.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T22:46:17.230058Z","times_seen":17894017,"resource_available":true,"data":null}},"time_used":232,"timings":{"blocked":0,"dns":52,"connect":28,"send":0,"wait":0,"receive":0,"ssl":150},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rabbyts.xyz/","fqdn":"rabbyts.xyz","domain":"rabbyts.xyz","tld":"xyz"},"ip":{"addr":"185.62.58.23","port":443,"asn":62370,"as":"Snel.com B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-07T01:06:49.593Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gosuslugi.ru","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 11 Nov 2025 11:42:01 GMT","end":"Sat, 12 Dec 2026 14:20:04 GMT"},"fingerprint":{"sha1":"A3:D3:5E:A6:90:5D:F0:DE:DD:79:A8:66:CC:9B:BC:E6:3B:B1:A1:19","sha256":"0E:05:92:F5:EF:99:07:CA:8F:D8:90:11:FB:0A:98:EC:79:FF:C5:DF:BB:0D:B0:93:18:C3:82:FF:44:C4:87:05"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rabbyts.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 07 Mar 2026 01:06:49 GMT\r\nContent-Type: text/html\r\nContent-Length: 9376\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Tue, 11 Mar 2025 14:42:14 GMT\r\nETag: \"67d04bc6-24a0\"\r\nExpires: Sat, 07 Mar 2026 01:06:48 GMT\r\nCache-Control: no-cache\r\nAccept-Ranges: bytes\r\nStrict-Transport-Security: max-age=16070400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9376,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2099)","md5":"0d849f724dfcbd86391afe0b812f6a6d","sha1":"8400f557018171b31ddbb00f1b596b4e3f052cf8","sha256":"1d8fd9af92029911fb4023153434cb51bd2da78a69d8c0435cadd376a36735e6","sha512":"e1c376da65f123485eacd3bd7f23de7fa7a0098a30881301511dbb6c9d86ad8d9099871b6c14b813b30b884dc32cfe0e3f3871b5bd2d961330757125c004ef38","ssdeep":"192:yoHTVGkxS2zA+1AU057rd8k+nwvgNHHFc3Y:vwu657rdp+fFc3Y","tlshash":"9812d9f711f862a87186c3f0d8247419f90b28bbb7110954f26dac9e5fe1884c6c7e5d","first_seen":"2025-04-08T10:13:15.270716Z","last_seen":"2026-05-29T18:17:03.999568Z","times_seen":93,"resource_available":false,"data":null}},"time_used":369,"timings":{"blocked":149,"dns":5,"connect":28,"send":0,"wait":69,"receive":1,"ssl":106},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gu-st.ru/portal-st/lib-assets/fonts/Lato-Regular.woff2","fqdn":"gu-st.ru","domain":"gu-st.ru","tld":"ru"},"ip":{"addr":"46.235.186.70","port":443,"asn":34879,"as":"OOO Sovremennye setevye tekhnologii","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rabbyts.xyz/","date":"2026-03-07T01:06:49.956Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.gu-st.ru","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 07 May 2025 11:42:01 GMT","end":"Mon, 08 Jun 2026 10:09:08 GMT"},"fingerprint":{"sha1":"24:AB:74:E2:D7:3D:AB:D6:77:8B:23:F5:46:57:98:D9:24:BA:AB:0A","sha256":"8F:6F:96:11:E6:AE:D6:5F:BC:A2:4E:C5:46:16:C9:18:DC:26:37:AE:A0:C0:03:FD:ED:0D:E8:B5:49:AC:DD:D3"}}},"request":{"raw":"GET /portal-st/lib-assets/fonts/Lato-Regular.woff2 HTTP/1.1\r\nHost: gu-st.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://rabbyts.xyz/\r\nOrigin: https://rabbyts.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 01:06:50 GMT\r\ncontent-type: application/octet-stream\r\nlast-modified: Fri, 06 Mar 2026 12:51:18 GMT\r\nexpires: Sat, 07 Mar 2026 02:09:59 GMT\r\ncache-control: max-age=7200\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Origin, Accept, Authorization, Cache-Control, Content-Type, DNT, If-Modified-Since, Keep-Alive, Origin, User-Agent, X-Mx-ReqToken, X-Requested-With, X-TimeZone-Offset, X-Origin, Accept, Authorization, srcUrl, DNT, X-Mx-ReqToken, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, X-Cache-Date, X-Atmosphere-tracking-id, X-B3-Spanid, X-Atmosphere-Framework, X-TimeZone-Offset, X-Atmosphere-Transport, test-scope, schema, x-order-id, x-form-id, X-B3-TraceId, X-B3-SpanId, X-B3-ParentSpanId, X-B3-Sampled, X-B3-Podname, *\r\naccess-control-expose-headers: X-Cache-Date,Authorization,Accept\r\nstrict-transport-security: max-age=157680000\r\naccess-control-allow-origin: *\r\nx-ngenix-cache: HIT, HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":182708,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 182708, version 2.983","md5":"bd03a2cc277bbbc338d464e679fe9942","sha1":"cbff48bce12e71565156bb331b0c9979746a5680","sha256":"983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f","sha512":"a8fbc47aca9c6875fc54983439687323d8e8db4ca8f244ed3c77ca91893a23d3cfbd62857b1e6591f2bc570c47342eed1f4a6010e349ef1ac100045ef89cbfd0","ssdeep":"3072:a+zq/3zkl+ciohnxbjroiZ/XPHi8Mo/Oqh/J41RZ7E/Aur2mmxuN/y424XqtjiJy:aYq/IlDfcipXf9h/sTE9lwuN524Xq9i4","tlshash":"c0041258a194dee5fe761a3a03b7c540ea8e7ab041dbc6f6f0b994497e211210fcd5cc","first_seen":"2023-04-13T01:33:41Z","last_seen":"2026-08-14T18:17:04.517811Z","times_seen":5706,"resource_available":false,"data":null}},"time_used":284,"timings":{"blocked":119,"dns":28,"connect":39,"send":0,"wait":45,"receive":0,"ssl":49},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gu-st.ru/portal-st/lib-assets/fonts/Lato-Bold.woff2","fqdn":"gu-st.ru","domain":"gu-st.ru","tld":"ru"},"ip":{"addr":"46.235.186.70","port":443,"asn":34879,"as":"OOO Sovremennye setevye tekhnologii","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rabbyts.xyz/","date":"2026-03-07T01:06:49.959Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.gu-st.ru","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Wed, 07 May 2025 11:42:01 GMT","end":"Mon, 08 Jun 2026 10:09:08 GMT"},"fingerprint":{"sha1":"24:AB:74:E2:D7:3D:AB:D6:77:8B:23:F5:46:57:98:D9:24:BA:AB:0A","sha256":"8F:6F:96:11:E6:AE:D6:5F:BC:A2:4E:C5:46:16:C9:18:DC:26:37:AE:A0:C0:03:FD:ED:0D:E8:B5:49:AC:DD:D3"}}},"request":{"raw":"GET /portal-st/lib-assets/fonts/Lato-Bold.woff2 HTTP/1.1\r\nHost: gu-st.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://rabbyts.xyz/\r\nOrigin: https://rabbyts.xyz\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 07 Mar 2026 01:06:50 GMT\r\ncontent-type: application/octet-stream\r\nlast-modified: Fri, 06 Mar 2026 12:51:18 GMT\r\nexpires: Sat, 07 Mar 2026 02:09:51 GMT\r\ncache-control: max-age=7200\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS\r\naccess-control-allow-headers: X-Origin, Accept, Authorization, Cache-Control, Content-Type, DNT, If-Modified-Since, Keep-Alive, Origin, User-Agent, X-Mx-ReqToken, X-Requested-With, X-TimeZone-Offset, X-Origin, Accept, Authorization, srcUrl, DNT, X-Mx-ReqToken, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, X-Cache-Date, X-Atmosphere-tracking-id, X-B3-Spanid, X-Atmosphere-Framework, X-TimeZone-Offset, X-Atmosphere-Transport, test-scope, schema, x-order-id, x-form-id, X-B3-TraceId, X-B3-SpanId, X-B3-ParentSpanId, X-B3-Sampled, X-B3-Podname, *\r\naccess-control-expose-headers: X-Cache-Date,Authorization,Accept\r\nstrict-transport-security: max-age=157680000\r\naccess-control-allow-origin: *\r\nx-ngenix-cache: HIT, HIT\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":28520,"size_decoded":0,"mime_type":"application/octet-stream","magic":"Web Open Font Format (Version 2), TrueType, length 28520, version 1.0","md5":"15305df63a1d3199afb774825ef82ff6","sha1":"cc8f3b302abb27841c25e5a753a68f33884ac431","sha256":"d89f199ceae883e8dbc2ad5b3b57e3052cfc3d08774b56de4a03db17db03209f","sha512":"f821a73a85a8f3d3d79fc8f6c5b89b8e6c28471b4368d7559ec9624fe6ca513391bcc8f96ee7dc99440ab99428ea71df0c4f476d009010e5277d0377d5d3263a","ssdeep":"768:ORsqw9vbjksHvfIbLc21uwTh5pJN4koBB8Vm:OTs3hvwbkwTjZ4h4m","tlshash":"d4d2f1cf3e74a5ecd62a4073382d5d155002d2b58eab9ea360de1d56e6f90883c23af0","first_seen":"2023-07-30T13:40:47Z","last_seen":"2026-07-17T05:37:04.722049Z","times_seen":86,"resource_available":false,"data":null}},"time_used":246,"timings":{"blocked":118,"dns":0,"connect":0,"send":0,"wait":128,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rabbyts.xyz/__jsch/static/script.js","fqdn":"rabbyts.xyz","domain":"rabbyts.xyz","tld":"xyz"},"ip":{"addr":"185.62.58.23","port":443,"asn":62370,"as":"Snel.com B.V.","country":"The Netherlands","country_code":"NL"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rabbyts.xyz/","date":"2026-03-07T01:06:49.961Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gosuslugi.ru","organization":""},"issuer":{"commonName":"GlobalSign GCC R3 DV TLS CA 2020","organization":"GlobalSign nv-sa"},"validity":{"start":"Tue, 11 Nov 2025 11:42:01 GMT","end":"Sat, 12 Dec 2026 14:20:04 GMT"},"fingerprint":{"sha1":"A3:D3:5E:A6:90:5D:F0:DE:DD:79:A8:66:CC:9B:BC:E6:3B:B1:A1:19","sha256":"0E:05:92:F5:EF:99:07:CA:8F:D8:90:11:FB:0A:98:EC:79:FF:C5:DF:BB:0D:B0:93:18:C3:82:FF:44:C4:87:05"}}},"request":{"raw":"GET /__jsch/static/script.js HTTP/1.1\r\nHost: rabbyts.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://rabbyts.xyz/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sat, 07 Mar 2026 01:06:49 GMT\r\nContent-Type: application/javascript\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=10\r\nLast-Modified: Wed, 16 Mar 2022 14:01:25 GMT\r\nVary: Accept-Encoding, Accept-Encoding\r\nETag: W/\"6231edb5-a88f\"\r\nExpires: Sat, 07 Mar 2026 01:06:48 GMT\r\nCache-Control: no-cache\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: X-Origin, Accept, Authorization, srcUrl, DNT, X-Mx-ReqToken, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, X-Cache-Date, X-Atmosphere-tracking-id, X-Atmosphere-Framework, X-TimeZone-Offset, X-Atmosphere-Transport, test-scope, schema, *\r\nAccess-Control-Expose-Headers: X-Cache-Date,Authorization,Accept\r\nContent-Encoding: gzip\r\nStrict-Transport-Security: max-age=16070400\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":43151,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (43151), with no line terminators","md5":"9dd1a66703c49f6edf01634cc1c4c576","sha1":"56639202c042d29277de4ebd6cebbe9de418703f","sha256":"4672adf4946dc86afd8517cf7af5c73fc6458e60ffa4270fa699c1242006117b","sha512":"82d37c9e95f5381e1db8f2336daeb23869882b0bb1ee4c0b7b70c9775e9c4d95c0a29f08e3ffe8c41b971049e1bfb7359a3c8e66dfe1cf07d1691523c514d1d7","ssdeep":"768:pC2hJHy1TCucKIGEDYYcptcFE98iV6Hg6KjTWwffeCTgWd5+nGRvKYX40OdHW1Ij:d0EDYYcptcFE9B84FkkU9","tlshash":"0e13a74167809c889617effe371ab0f5d0050dbeb7904adfbb003975fda5a289ad4a31","first_seen":"2023-05-20T13:08:37Z","last_seen":"2026-05-29T18:17:03.936128Z","times_seen":118,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":79,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"Nextron YARA rules","description":"Public Nextron YARA rules","scan_date":"2026-03-07","alert":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","trigger":"rabbyts.xyz/__jsch/static/script.js","verdict":"malware","severity":"medium","comment":"","link":"https://github.com/Neo23x0/signature-base","meta":{"author":"@imp0rtp3 (modified by Florian Roth)","date":"2020-09-06","description":"Unique code from Jetriz, Swid \u0026 Jeniva of the Tetris framework","reference":"https://imp0rtp3.wordpress.com/2021/08/12/tetris","rule":"apt_CN_Tetris_JS_advanced_1"}}],"urlquery":null}}]}