{"report_id":"7533055e-d837-4972-a77b-9b411d00925e","version":6,"status":"done","tags":[],"date":"2026-03-28T03:53:24Z","url":{"schema":"http","addr":"http-slon2-at.ru","fqdn":"http-slon2-at.ru","domain":"http-slon2-at.ru","tld":"ru"},"ip":{"addr":"104.21.42.149","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"http-slon2-at.ru/","fqdn":"http-slon2-at.ru","domain":"http-slon2-at.ru","tld":"ru"},"title":"Slon2 at — продажа авто из Европы в России","dom":{"size":13758,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"07e836495d34b1849b236d40e024164d","sha1":"5f4e72658f5c2d21cf3c53279c3b9bbd9ce182b9","sha256":"8a87222917d2b87ec680f25b46bea918a622fe30d77f1f2714c2522ed6ec6c6e","sha512":"12dab142d2b5f74812744da0e23cda22ad018e3d6136336bfe07c6a4b19f5381c592aa61d8945a5468b2bec1567e3a864aa15cd09fe9b730dec159192a5adc52","ssdeep":"384:Tw1G6qeHTvHYsK+xjNkeRZ8BESySacvo9RrBFd:GJ5xj2ESySuRrF","tlshash":"8552ef2255f6049a1045a046de10ab0d7cea4c7ffe6b6312317c1eee3fe2b54c92b61e","dom_hash":"domhash21fd04fbc6f7d3b52c545039068f6d9d","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"http-slon2-at.ru","fqdn":"http-slon2-at.ru","domain":"http-slon2-at.ru","tld":"ru"},"ip":{"addr":"104.21.42.149","port":0,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-02T03:53:24Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"http-slon2-at.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"http-slon2-at.ru","ip":{"addr":"172.67.163.9","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2026-02-27","domain_rank":0,"first_seen":"2026-03-28T03:53:24.794407Z","last_seen":"2026-03-28T03:53:24.794407Z","alert_count":5,"request_count":5,"received_data":82620,"sent_data":2240,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"http-slon2-at.ru/","fqdn":"http-slon2-at.ru","domain":"http-slon2-at.ru","tld":"ru"},"ip":{"addr":"172.67.163.9","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"bfec4d0b23532d43902a5acfeebedaeb","sha1":"16026e2c016c00dc9c9873be5702bde730462925","sha256":"7f998031c017ba649e0b7a012378631eef7f02e61264c8f4ee622065f2f29890","sha512":"41ac8fd4afb60a2a24f60302b6d778c6f9553eb4ae99025a0e703e4a4c171706cf7c73cc9a45fa58c78a4fc779d5c170a368a928c9a7b069571439d5e6980c5d","ssdeep":"","tlshash":"b4c08c3fbb860458888a617249ec12946424d0067a129d8a24009920ceea9a4b41ae94","size":154,"data":"","first_seen":"2026-03-28T03:53:27.23822Z","last_seen":"2026-03-28T03:53:27.23822Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"http-slon2-at.ru/captcha/8.png","fqdn":"http-slon2-at.ru","domain":"http-slon2-at.ru","tld":"ru"},"ip":{"addr":"172.67.163.9","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://http-slon2-at.ru/","date":"2026-03-28T03:53:04.107Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"http-slon2-at.ru","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 04:25:13 GMT","end":"Thu, 28 May 2026 04:25:12 GMT"},"fingerprint":{"sha1":"39:74:7D:3F:60:DE:AB:DE:C4:CF:EC:1B:F0:3C:59:F4:5E:64:65:40","sha256":"EC:B8:8B:39:4F:BA:66:AB:4A:D8:DB:AD:06:43:99:D9:BB:75:02:2B:AA:56:4F:25:43:73:AC:CA:D4:38:C5:C0"}}},"request":{"raw":"GET /captcha/8.png HTTP/1.1\r\nHost: http-slon2-at.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://http-slon2-at.ru/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 28 Mar 2026 03:53:04 GMT\r\ncontent-type: image/png\r\ncontent-length: 11624\r\nlast-modified: Sat, 25 Jan 2025 09:51:56 GMT\r\npriority: u=4,i=?0\r\netag: \"6794b43c-2d68\"\r\nexpires: Mon, 27 Apr 2026 03:53:04 GMT\r\ncache-control: max-age=2592000\r\naccept-ranges: bytes\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SmbGlDA%2BIPbN5AGFgvcVHX%2BKVD1bH9q%2FaggskKSFu2vP8v2KTSuG8Tsohf0IL%2Bzbz95r%2BGVrD%2BWCByHDC9GTQXyQV43ZJSCdfyfHnh7MA47kx2f7TM3yaN58WFO7anXNUtx%2B\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: 9e33af88ab345685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":11624,"size_decoded":0,"mime_type":"image/png","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: \"Blender:File:C:\\Projects\\captcha\\captcha-3.blend\", comment: \"Blender:Date:2023/02/14 23:03:15\", comment: \"Blender:Time:00:00:00:00\", comment: \"Blender:Frame:000\", comment: \"Blender:Camera:Camera\", comment: \"Blender:Scene:Scene\", comment: \"Blender:RenderTime:00:00.08\", baseline, precision 8, 380x120, components 3","md5":"ba17a6f7878923d5f1efb58a07384d9c","sha1":"d47ca9a625e4bcdfe99a1e6ef17e1d8cd6192acd","sha256":"39dec43d24a8895823bc7749a948c944d5071057c8f2b1cf53a1cf65810c0713","sha512":"d634d880158f49935d7235e28b5ccf03180ced5b96ea3fe88624bd1ba868d77945f576b868842b8a41345b7c477b5299149efb70a6a4b6082be780ddab3e5a35","ssdeep":"192:SjyA4Hannv7uNgkJATPfF1ybFS9PY3/ESomUoq83FAhF3vdjQ6o8vtCE3O1wtLby:WyArv8JAzqbF38nmUr8VAhVvm6z01mmj","tlshash":"1b32bf19f86f604168ec15f4725a1b0d82dd5e46fbc99f89731b02f3a6202f63989a29","first_seen":"2026-03-28T03:53:27.230195Z","last_seen":"2026-03-28T03:53:27.230195Z","times_seen":1,"resource_available":false,"data":null}},"time_used":477,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":473,"receive":4,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"http-slon2-at.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"http-slon2-at.ru/favicon.ico","fqdn":"http-slon2-at.ru","domain":"http-slon2-at.ru","tld":"ru"},"ip":{"addr":"172.67.163.9","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://http-slon2-at.ru/","date":"2026-03-28T03:53:04.232Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"http-slon2-at.ru","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 04:25:13 GMT","end":"Thu, 28 May 2026 04:25:12 GMT"},"fingerprint":{"sha1":"39:74:7D:3F:60:DE:AB:DE:C4:CF:EC:1B:F0:3C:59:F4:5E:64:65:40","sha256":"EC:B8:8B:39:4F:BA:66:AB:4A:D8:DB:AD:06:43:99:D9:BB:75:02:2B:AA:56:4F:25:43:73:AC:CA:D4:38:C5:C0"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: http-slon2-at.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://http-slon2-at.ru/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 28 Mar 2026 03:53:04 GMT\r\ncontent-type: image/x-icon\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ZVm1YqCevGel2dkcrOnKV2qCNJdAAOQzF8xd2%2FLib22%2FVxJvDfJVn%2BdjT930YIE9TW0%2FKCrGGvNLdUH1Adrb6V9gghdKGytB29Y4bjRUJ543KGtCsX3EWXKaihYYDQGj5K29\"}]}\r\nlast-modified: Wed, 25 Feb 2026 10:43:24 GMT\r\npriority: u=6,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nexpires: Mon, 27 Apr 2026 03:53:04 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: br\r\ncf-cache-status: MISS\r\netag: W/\"699ed24c-bb1f\"\r\ncf-ray: 9e33af897b375685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":47903,"size_decoded":0,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 1 icon, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"116bccaccb82c6def05a91dfeb79ef94","sha1":"65f6007c580b590f9a82c113565e67c38c0674ca","sha256":"bace8f3fb0ebbb656d37c8b6b84cecca619285fdd100fc0eb2192bf26b55202c","sha512":"bc8c2634f78e50479adeb17d9a67826b0f0d116fadbeccf5fb282e0f89c7732f41801cd4ff3df86490fdf78b55ecca4373528e1f1471866680df1350ffbc63e3","ssdeep":"768:MBVefPRxAVT4iyIFqjvszhl7Vq3VSPUXCUri4gS8AhXqde4uZE8vNDmmRcUS8x2N:YsRGVTTLoEzhl5mMUZ9O8vRmodS8gXgu","tlshash":"4323f2180c603c9be16b2c74d237f5a8f63e5ecadd15d6e551b8c1ae806e15e812cd8d","first_seen":"2026-03-28T03:53:27.23291Z","last_seen":"2026-03-28T03:53:27.23291Z","times_seen":1,"resource_available":false,"data":null}},"time_used":588,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":475,"receive":112,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"http-slon2-at.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"http-slon2-at.ru/","fqdn":"http-slon2-at.ru","domain":"http-slon2-at.ru","tld":"ru"},"ip":{"addr":"172.67.163.9","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-03-28T03:53:03.016Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"http-slon2-at.ru","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 04:25:13 GMT","end":"Thu, 28 May 2026 04:25:12 GMT"},"fingerprint":{"sha1":"39:74:7D:3F:60:DE:AB:DE:C4:CF:EC:1B:F0:3C:59:F4:5E:64:65:40","sha256":"EC:B8:8B:39:4F:BA:66:AB:4A:D8:DB:AD:06:43:99:D9:BB:75:02:2B:AA:56:4F:25:43:73:AC:CA:D4:38:C5:C0"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: http-slon2-at.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Sat, 28 Mar 2026 03:53:03 GMT\r\ncontent-type: text/html\r\nserver: cloudflare\r\nlast-modified: Fri, 27 Feb 2026 11:54:03 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nvary: Accept-Encoding\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=V%2Bi%2FWx6t9hP1S0VKZYBLEDnLSV1%2F9ZxS18S7XF3TnZXnHrVhARl4dlu9G3tlF0Asahtb5zCgH5XJA3%2FndEPI67WNefNXN4xwrc1JyLOeXCQlo8mTYzWQuXMF7KCNTBa7Q6z2\"}]}\r\ncf-cache-status: DYNAMIC\r\ncontent-encoding: br\r\ncf-ray: 9e33af823a2ab4f7-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":14036,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"2c8302fece9e5f00dede0fab56aa02fd","sha1":"255349be37decab3b671655af5208c6c29aca322","sha256":"8b592691daeb7f6adeac4a68ee2cf7be476d02873f13d8c30aa39e896852d656","sha512":"2442ded056f9974ba0b3e46b8988e9fdd82734f87dc7c9cdb6b0979eafead7d9cfc4915a5b3d1932d676fe8f4cd7cb489025d74367ffd5809720ea05d001a088","ssdeep":"384:hw1G6qeHTvHYsKkx6NkeRZ8BESySacvo9RrBFh:sJTx62ESySuRrp","tlshash":"f352ef2255f6149a1045a046de10ab0d7cea4c7ffe6b6312317c1eee3fe2b54c92b61e","first_seen":"2026-03-28T03:53:27.234727Z","last_seen":"2026-03-28T03:53:27.234727Z","times_seen":1,"resource_available":false,"data":null}},"time_used":489,"timings":{"blocked":62,"dns":40,"connect":3,"send":0,"wait":365,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"http-slon2-at.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"http-slon2-at.ru/style.css?v=1","fqdn":"http-slon2-at.ru","domain":"http-slon2-at.ru","tld":"ru"},"ip":{"addr":"172.67.163.9","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://http-slon2-at.ru/","date":"2026-03-28T03:53:03.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"http-slon2-at.ru","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 04:25:13 GMT","end":"Thu, 28 May 2026 04:25:12 GMT"},"fingerprint":{"sha1":"39:74:7D:3F:60:DE:AB:DE:C4:CF:EC:1B:F0:3C:59:F4:5E:64:65:40","sha256":"EC:B8:8B:39:4F:BA:66:AB:4A:D8:DB:AD:06:43:99:D9:BB:75:02:2B:AA:56:4F:25:43:73:AC:CA:D4:38:C5:C0"}}},"request":{"raw":"GET /style.css?v=1 HTTP/1.1\r\nHost: http-slon2-at.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://http-slon2-at.ru/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 OK\r\nserver: cloudflare\r\ndate: Sat, 28 Mar 2026 03:53:04 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 27 Feb 2026 11:50:53 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nvary: Accept-Encoding\r\netag: W/\"69a1851d-185f\"\r\nexpires: Mon, 27 Apr 2026 03:53:03 GMT\r\ncache-control: max-age=2592000\r\ncontent-encoding: gzip\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=81DCjUimn1nWFy5o3Ih5eMEY9llHa6SArN3US7N%2Bx4Fe8xsopMnWza8WVlhzyCpiQeL9iIXBL8MDP%2B9%2BNNBBQZMieUhADpMALlGBa1MzHCbKn7WOLtJXL%2Bx5phpHjVT3FdwT\"}]}\r\ncf-ray: 9e33af861b0a5685-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":6239,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text","md5":"0064ff9f711902c4e09f00268a20dfdb","sha1":"6f748327ddf72861d92a3156501522d1a3094f0f","sha256":"f15410cc86e176d0daf70fa62b281dad83ab0cc4a76a6d47cd89c592b0d2439a","sha512":"9b6d202520265023b5b640f73b146a7867aec497c19c172da372e859640b0882ec73fe829fd8a8c66c44b023281e52f24522f48fe0305678be79415552c6e199","ssdeep":"96:Qck21CWm6sFSJswI+vxRb2jJCTAQoIlZNLfKNeCltWYAxP0D/xWuiqM:RNIbFRwTvxRgCkAwNdnWYAxP0D/4uM","tlshash":"6ed1dfc76bb41508f90f98b8a591dbe3735c4883414eda79abb4211cfc893e4a973b4d","first_seen":"2026-03-28T03:53:27.236098Z","last_seen":"2026-03-28T03:53:27.236098Z","times_seen":1,"resource_available":false,"data":null}},"time_used":364,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":363,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"http-slon2-at.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"http-slon2-at.ru/captcha/1.png","fqdn":"http-slon2-at.ru","domain":"http-slon2-at.ru","tld":"ru"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://http-slon2-at.ru/","date":"2026-03-28T03:53:03.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"http-slon2-at.ru","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Fri, 27 Feb 2026 04:25:13 GMT","end":"Thu, 28 May 2026 04:25:12 GMT"},"fingerprint":{"sha1":"39:74:7D:3F:60:DE:AB:DE:C4:CF:EC:1B:F0:3C:59:F4:5E:64:65:40","sha256":"EC:B8:8B:39:4F:BA:66:AB:4A:D8:DB:AD:06:43:99:D9:BB:75:02:2B:AA:56:4F:25:43:73:AC:CA:D4:38:C5:C0"}}},"request":{"raw":"GET /captcha/1.png HTTP/1.1\r\nHost: http-slon2-at.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://http-slon2-at.ru/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-31T03:31:12.665353Z","times_seen":17627239,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-03-28","alert":"Sinkholed","trigger":"http-slon2-at.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}