{"report_id":"843c41fe-9114-4678-b048-97163da594cd","version":0,"status":"done","tags":[],"date":"2026-08-25T21:14:53Z","url":{"schema":"http","addr":"tcommander.ru/","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"tcommander.ru/","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"title":"Скачать Total Commander 11.58 для Windows — двухпанельный файловый менеджер","dom":{"size":16989,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"9e9a823939413a51f35185c00a0586bc","sha1":"3227b60c2148bc96752d1833b9e591dcb3abfd3c","sha256":"ba9561b7e2386ae010e037aab7dd39ce431869257a7387c06b78eb298cff6553","sha512":"897fd4b900d52c80b160aa2fc5d9835da1f7396cb7b81b54296caa341dfa6482ed12890c4c7c7c080f24698b5c254051643307850a1d13894c30edd2c72117bc","ssdeep":"192:dhnGV4aR2fP3VuuP1V9uk83epVJdVVJsr3E2Yb0cVpFV5/CDSV9435VWj:3raO3VdPjTZQ3E2Y97vMVWj","tlshash":"d972526262ec586e5102a18bce147b1d2da745ffaa1e660135bc1c7d3fe2c68cd3b21c","dom_hash":"domhash6bc0e5385ac754a6028a3d2e1ce1263b","first_seen":"2026-08-25T20:53:06.563317Z","last_seen":"2026-08-25T21:14:54.436552Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"tcommander.ru/","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:14:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"tcommander.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-14","domain_rank":0,"first_seen":"2026-08-25T20:53:02.746702Z","last_seen":"2026-08-25T20:53:02.746702Z","alert_count":14,"request_count":7,"received_data":154612,"sent_data":3418,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"tcommander.ru/","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"4152f763634cf2936d9572f2c995c0d6","sha1":"d25df772d734f374218b6a8896787deb161be0de","sha256":"399d81ea901e755b4e2becfe567ddd75b1d38ffcf8849d9eee396bf243a4a4e4","sha512":"6cd93d5109e63115041377a4fc2aa651fae25b0efda1ce1f06c8c489e9dcf1c019122dc3c92524ec794b42434f19ae2e8cae37303f5f7a455e0b32fd018ffa21","ssdeep":"","tlshash":"21f0e177b88492b5c3fa2131532fa34cb16728b924896d38850d8881397ac59102fd6d","size":576,"data":"","first_seen":"2026-08-25T20:53:06.591858Z","last_seen":"2026-08-25T21:14:54.455421Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"tcommander.ru/js/main.js","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"04581795b3249c94dd43c2a96737a490","sha1":"b3405e8e49a070a96e6288ef5c8f44b78d34a8c1","sha256":"c4188394da11bbe3c64f73a436266729aba4f129eaa9a98acf16c02de57f0b04","sha512":"b972fa4144c9aff5a0fa6e8f940cf1db40b854b8718993b7d40d9b7301cec14ee8c0d040e795c48dbb031737aa91c8ba24c12e7e4c598f8703fa2129aeb2d4d9","ssdeep":"192:PsHlFQsBAnnlsG56aKFHFcki5R80N6mtPg:PsFMnlsG56aKFlc5Y0N6ma","tlshash":"3be15365ec49327694f3e37eeb5a564cfe700167510582013dacda063fb4a6843beee8","size":7229,"data":"","first_seen":"2026-08-25T20:53:06.582892Z","last_seen":"2026-08-25T21:14:54.446286Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"tcommander.ru/","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:14:25.890Z","timestamp":1787692465890,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tcommander.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:39 GMT","end":"Mon, 16 Nov 2026 20:09:38 GMT"},"fingerprint":{"sha1":"96:CB:95:6A:CE:60:AD:3C:AA:7B:7D:22:14:F0:C7:31:00:D8:57:6C","sha256":"44:2A:2B:6A:38:9E:99:27:E6:D0:37:95:1E:54:AB:1E:B5:44:DA:9B:41:CF:46:C1:7D:5E:EF:E2:D5:C2:2F:09"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: tcommander.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:14:26 GMT\r\ncontent-type: text/html\r\ncontent-length: 5142\r\nlast-modified: Sat, 22 Aug 2026 13:54:13 GMT\r\netag: \"43ff-659a31696afde-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":17407,"size_decoded":5603,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"0c551fc8c1fb4e09a2f18c5d42e404b3","sha1":"960307d2af185f2045351b94f489d90ea4eb7d98","sha256":"4be72d69f342f06d17ce5bd548ca46438145d53b5c16bdc8a45bc92d384cdbc6","sha512":"f256c2bc9459626d31ad2307e8bd94bc6e1187d56ffb241de22fddefb0a0c8182faf93994a4e7bb68443801fa972a62e6899890a2c9cfb8c54eede3ffffaf1d7","ssdeep":"192:NkG2qamzM5W1FZdZ79uT83JqVJJVVrsaaz2Xz0DVGFqiBhDSV9I3/VNm:CzsnZd2jb5az2XIUxrVNm","tlshash":"8772426222c8585e4122a15bca147b5dfca741bf6b1b660135bc2d7f3ff2918cd3b258","first_seen":"2026-08-25T20:53:06.573994Z","last_seen":"2026-08-25T21:14:54.440402Z","times_seen":2,"resource_available":false,"data":null}},"time_used":201,"timings":{"blocked":0,"dns":47,"connect":43,"send":0,"wait":63,"receive":0,"ssl":48},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tcommander.ru/css/style.css","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://tcommander.ru/","date":"2026-08-25T21:14:26.280Z","timestamp":1787692466280,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tcommander.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:39 GMT","end":"Mon, 16 Nov 2026 20:09:38 GMT"},"fingerprint":{"sha1":"96:CB:95:6A:CE:60:AD:3C:AA:7B:7D:22:14:F0:C7:31:00:D8:57:6C","sha256":"44:2A:2B:6A:38:9E:99:27:E6:D0:37:95:1E:54:AB:1E:B5:44:DA:9B:41:CF:46:C1:7D:5E:EF:E2:D5:C2:2F:09"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: tcommander.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tcommander.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:14:26 GMT\r\ncontent-type: text/css\r\ncontent-length: 3368\r\nlast-modified: Fri, 14 Aug 2026 08:55:05 GMT\r\netag: \"3401-658fdfa0c5657-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13313,"size_decoded":3829,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"f457af38fefdb437b407438a5db0839e","sha1":"de839870f670edb6a26f65fff584c0e31a26db47","sha256":"57388aa2a6f29392c818a4872010ad31f3c6daac4f498c290b4f3b0967b64ed5","sha512":"d98b8fc4e03cf5c98a570700ae99a17a4c082df24852475b6c29343ca89d9ebd70c7f1d8ddd11963d3fcce24631343134cb824064925a32504395b8d9f687650","ssdeep":"192:eJhFgEvC9DnopNAZfucA99jfPicxBusm69H56v:WqjZfucUBzmS5W","tlshash":"d3524095ab286138f537e7a5fb93d789e7987152590003bdbee4000891ca37d817afdc","first_seen":"2026-08-25T20:53:06.58195Z","last_seen":"2026-08-25T21:14:54.442962Z","times_seen":2,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tcommander.ru/js/main.js","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://tcommander.ru/","date":"2026-08-25T21:14:26.283Z","timestamp":1787692466283,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tcommander.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:39 GMT","end":"Mon, 16 Nov 2026 20:09:38 GMT"},"fingerprint":{"sha1":"96:CB:95:6A:CE:60:AD:3C:AA:7B:7D:22:14:F0:C7:31:00:D8:57:6C","sha256":"44:2A:2B:6A:38:9E:99:27:E6:D0:37:95:1E:54:AB:1E:B5:44:DA:9B:41:CF:46:C1:7D:5E:EF:E2:D5:C2:2F:09"}}},"request":{"raw":"GET /js/main.js HTTP/1.1\r\nHost: tcommander.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tcommander.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:14:26 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:02:09 GMT\r\netag: W/\"1c3d-659a332ed3fed\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":7229,"size_decoded":2957,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"04581795b3249c94dd43c2a96737a490","sha1":"b3405e8e49a070a96e6288ef5c8f44b78d34a8c1","sha256":"c4188394da11bbe3c64f73a436266729aba4f129eaa9a98acf16c02de57f0b04","sha512":"b972fa4144c9aff5a0fa6e8f940cf1db40b854b8718993b7d40d9b7301cec14ee8c0d040e795c48dbb031737aa91c8ba24c12e7e4c598f8703fa2129aeb2d4d9","ssdeep":"192:PsHlFQsBAnnlsG56aKFHFcki5R80N6mtPg:PsFMnlsG56aKFlc5Y0N6ma","tlshash":"3be15365ec49327694f3e37eeb5a564cfe700167510582013dacda063fb4a6843beee8","first_seen":"2026-08-25T20:53:06.582892Z","last_seen":"2026-08-25T21:14:54.446286Z","times_seen":2,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tcommander.ru/assets/logo.png","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tcommander.ru/","date":"2026-08-25T21:14:26.293Z","timestamp":1787692466293,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tcommander.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:39 GMT","end":"Mon, 16 Nov 2026 20:09:38 GMT"},"fingerprint":{"sha1":"96:CB:95:6A:CE:60:AD:3C:AA:7B:7D:22:14:F0:C7:31:00:D8:57:6C","sha256":"44:2A:2B:6A:38:9E:99:27:E6:D0:37:95:1E:54:AB:1E:B5:44:DA:9B:41:CF:46:C1:7D:5E:EF:E2:D5:C2:2F:09"}}},"request":{"raw":"GET /assets/logo.png HTTP/1.1\r\nHost: tcommander.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tcommander.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:14:26 GMT\r\ncontent-type: image/png\r\ncontent-length: 27480\r\nlast-modified: Fri, 14 Aug 2026 08:55:04 GMT\r\netag: \"6b58-658fdfa03b33c\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27480,"size_decoded":27891,"mime_type":"image/png","magic":"PNG image data, 168 x 160, 8-bit/color RGBA, non-interlaced","md5":"578691384602b37f314e11cf61896243","sha1":"dc50f2c38d939186dfe1ec1a8f7c9f22cefc91fc","sha256":"48da320173380f9bf70ef0f72f6269e6cfd8683df28440af6cb23225e289e47f","sha512":"dfa1a1968e05e04e4aeaf97e9c15a64cfaa9990e8b4890deacb8f411c27b7c7c968ed8c8f0b99821126d82d73116ebaa8a3dfa90ddbce741be72f3769831922b","ssdeep":"768:NDNq0kQVVMdbtNK+Xn2q+ozPidZ4If3cWD:NJfkWMdRNpn2qoB/cWD","tlshash":"52c2e0e29f15cc8ea9d01e2cf83d7545929087581b39f61e6141b7f833a90789e9c0ee","first_seen":"2026-08-25T20:53:06.566589Z","last_seen":"2026-08-25T21:14:54.448495Z","times_seen":2,"resource_available":false,"data":null}},"time_used":94,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":41,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tcommander.ru/assets/apple-touch-icon.png","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tcommander.ru/","date":"2026-08-25T21:14:26.606Z","timestamp":1787692466606,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tcommander.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:39 GMT","end":"Mon, 16 Nov 2026 20:09:38 GMT"},"fingerprint":{"sha1":"96:CB:95:6A:CE:60:AD:3C:AA:7B:7D:22:14:F0:C7:31:00:D8:57:6C","sha256":"44:2A:2B:6A:38:9E:99:27:E6:D0:37:95:1E:54:AB:1E:B5:44:DA:9B:41:CF:46:C1:7D:5E:EF:E2:D5:C2:2F:09"}}},"request":{"raw":"GET /assets/apple-touch-icon.png HTTP/1.1\r\nHost: tcommander.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tcommander.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:14:26 GMT\r\ncontent-type: image/png\r\ncontent-length: 22907\r\nlast-modified: Fri, 14 Aug 2026 08:55:00 GMT\r\netag: \"597b-658fdf9c49d94\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":22907,"size_decoded":23318,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"8b9ee9df832053479af10bbff0262048","sha1":"b599f3d6f76f9d6fdb7e82eb98d8af33be5d0687","sha256":"56799759309e42d19f19fdae619ae0b38970f1d1876b26e4faff3f3c548fa524","sha512":"25bd1b8b49826a5aad3e77100922536daef3e1125d90b4e70f8e7a144d9437bd522d3b051dafa8a6b631f35684026fba4f11f815777a69c467da27520d646bdb","ssdeep":"384:I1t8uxFlgZB3nXMxTFcCf+fnLO/Qo19Fos4Rz3FeXwbG+EVpUEqVvJ1Iq:I1SuxwZB3X4CC2vLyfOsAb03+Rsq","tlshash":"b9a2e1876961907c00c34d94dffba46a1fad30d8a2d95ccc8f5de5248dd6c2950867df","first_seen":"2026-08-25T20:53:06.585051Z","last_seen":"2026-08-25T21:14:54.450485Z","times_seen":2,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tcommander.ru/assets/favicon-16.png","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tcommander.ru/","date":"2026-08-25T21:14:26.607Z","timestamp":1787692466607,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tcommander.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:39 GMT","end":"Mon, 16 Nov 2026 20:09:38 GMT"},"fingerprint":{"sha1":"96:CB:95:6A:CE:60:AD:3C:AA:7B:7D:22:14:F0:C7:31:00:D8:57:6C","sha256":"44:2A:2B:6A:38:9E:99:27:E6:D0:37:95:1E:54:AB:1E:B5:44:DA:9B:41:CF:46:C1:7D:5E:EF:E2:D5:C2:2F:09"}}},"request":{"raw":"GET /assets/favicon-16.png HTTP/1.1\r\nHost: tcommander.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tcommander.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:14:26 GMT\r\ncontent-type: image/png\r\ncontent-length: 571\r\nlast-modified: Fri, 14 Aug 2026 08:55:01 GMT\r\netag: \"23b-658fdf9d664b4\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":571,"size_decoded":979,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"d6a32c1abfeb40299d8dfdf5a43c0ffc","sha1":"78f7c96888c9579d7a8e1541e741d271366c78a2","sha256":"8a0162f0aac50a13ff2f669107dc988735fe8b3e188ad49d5fc7da9676a99b80","sha512":"35202333dd8f78d230d825fe168f945c2367daeef6e62513cb4158a9fa9935a46f3a95ed614d8791db4f06f05195b010e24c899edf3a89c885f49c7bbdf36679","ssdeep":"","tlshash":"d7f026ebd5927433d71d53584865e124dc2084ba7dd9d1cb2f8c98787c059c1dcd4a32","first_seen":"2026-08-25T20:53:06.572864Z","last_seen":"2026-08-25T21:14:54.452475Z","times_seen":2,"resource_available":false,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"tcommander.ru/assets/hero.webp","fqdn":"tcommander.ru","domain":"tcommander.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://tcommander.ru/","date":"2026-08-25T21:14:26.608Z","timestamp":1787692466608,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.tcommander.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:39 GMT","end":"Mon, 16 Nov 2026 20:09:38 GMT"},"fingerprint":{"sha1":"96:CB:95:6A:CE:60:AD:3C:AA:7B:7D:22:14:F0:C7:31:00:D8:57:6C","sha256":"44:2A:2B:6A:38:9E:99:27:E6:D0:37:95:1E:54:AB:1E:B5:44:DA:9B:41:CF:46:C1:7D:5E:EF:E2:D5:C2:2F:09"}}},"request":{"raw":"GET /assets/hero.webp HTTP/1.1\r\nHost: tcommander.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://tcommander.ru/css/style.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:14:26 GMT\r\ncontent-type: image/webp\r\ncontent-length: 62720\r\nlast-modified: Fri, 14 Aug 2026 08:55:03 GMT\r\netag: \"f500-658fdf9f245f6\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":62720,"size_decoded":63132,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"3ee460fe775309552b832fbd50eb3b15","sha1":"c132c55332b33dda1f27d567fe3d63986a754cb8","sha256":"2303ac4e3cdd135cd485baeee2905bc05a4013d7b56a102768b98e66037a19d5","sha512":"5149af4345401ac94a7f9b2916bb6bd908daf441a23b9110d3a3651c8420b8e5031953f7c077fa397fdd6f0184a494052e78abd3a62ac7000593e3807bc49a40","ssdeep":"1536:UYBPO6hJzQ+XYXuVt7yW3LKQkSWA1fJKYPEDWcDZe9zfQNdN4jz:tBPO6hJZfGWLrWAFJNP4F2Q3u/","tlshash":"895302e6163245e8a6e72e003185f53d74adfe6435421a0e68d5f4bc4effc8c9e2222d","first_seen":"2026-08-25T20:53:06.583947Z","last_seen":"2026-08-25T21:14:54.454102Z","times_seen":2,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":40,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"tcommander.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}