{"report_id":"89048f99-f8e0-4256-b92a-e7584efde3d1","version":6,"status":"done","tags":["scotiabank","financial","phishing"],"date":"2026-05-16T14:09:20Z","url":{"schema":"http","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":0,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"title":"Sign in | Scotiabank","dom":{"size":86759,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (65085)","md5":"fd5aae4a84d8a801f9fcdcce733b7a50","sha1":"eb5258e018cef54f29dbc821b1bc584ac4d7a37a","sha256":"d7b685866660aa7c3b9b0715f1730210123641060188b0d32d672c399b5304b2","sha512":"8122da9cbc4e3863199e40b1e7a9ef0a29624845810910d522a6abfd1891386b9e98beaf48d37cfb63236db56d21ab0f9c2003be0da63b7f3f4b8aa19919a4fe","ssdeep":"384:i9fdHIiINqJrU9OQwXo+Oj4qRH/9H/LkYZkYdjNGymGnHM6sQEcstXpPH/vH/tkH:CBIiIz77GM2GOJKAmch4303eQAOSKDL8","tlshash":"8b83b76b3e18102de1630b1a93d1e68c3e26ad63c177d8f37b03ed51dbc5b938662615","dom_hash":"domhash8c48ce28db80202243b15a1bcd39a757","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":0,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-06-20T14:09:20Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]},"summary":[{"fqdn":"krasnodar-nextrehab.ru","ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":63,"request_count":21,"received_data":962960,"sent_data":11494,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"1b2918f310a97548c3e9f1f4d9d57720","sha1":"9e8fab86e013bb095d8aa9b9e405a3b759fdfc01","sha256":"289afebaef7e179940474fedf13d0ece70d77401462d31fe5b31eb236e9bd013","sha512":"422fcd14e533ca7feb001f2c266f73f1367d4b6d64d3059fb5415491dcaceef97ae6facfc3d35e53c8f9a2e56c75fae2dd9fc3723f367a243588f74fc53bff5b","ssdeep":"","tlshash":"aa21af2524d80dfb924a072764047e6323fd02b3204e7d75efeadf096aeb1b6177650a","size":1313,"data":"","first_seen":"2026-05-16T14:09:26.636917Z","last_seen":"2026-05-16T14:09:26.636917Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"introduction_type":"eventHandler","is_inline":false,"md5":"7688ca9eb3ca1c878821b1e3fe2c23d7","sha1":"2c41fd7e9f8312d6fed18b21e1a0589413e35553","sha256":"793bae9539499e6e02187febbd2e20fd17dd40260033f5175dbfc2f294440d9a","sha512":"2c8eb7f338f85c2fb760cf69c062669cf5b75609e12799b55dfa6994bc9be6fb16695c8d6ad5fb53ca45ea30285b37ef17beadf62bb41480a61dc0fe5339032a","ssdeep":"","tlshash":"9480002888308020000bc30c0203c8c202320c0f02cc2202ac02800802e03200802c23","size":27,"data":"","first_seen":"2023-04-10T15:53:31Z","last_seen":"2026-07-22T04:32:28.210864Z","times_seen":91754,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"69b448910449c176093e31b420120873","sha1":"f47223933c2d4c3313fa4d7e506dab06469335d8","sha256":"512fca9d6671313a187ccfde6f39f95275cbf919b04c30d07b1472cc3c01f949","sha512":"4b95501ed7962b7da92d1576e2417e47cfeff2920afbe93b441269efe4c062bbbfc45d31d55116c6729f6adab16fb007d5822f0de860fb0e9f765b44f6ccd06a","ssdeep":"","tlshash":"32a0026321117919e1bc00886752b7b03c5900080f460ce01f0114713032e0788905cb","size":61,"data":"","first_seen":"2023-03-10T14:29:33Z","last_seen":"2026-07-05T04:47:03.334338Z","times_seen":40,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"08df840386e3005c4e2c11681c674e2a","sha1":"13a3e656033d956c7f5c3311e4d21bf5cdef1a4a","sha256":"7d46565eda8e914877d33b22705de74f50c0591014e91af3dff29549ec397246","sha512":"32dedd8213dc3f706cecb8e2bdfbe9c5049f7d0137884e07887a2f763a64c36ec6a9ff9619ff5e3e50207930512237f2d86d2f02d941926c1f11c5d90c0dde2f","ssdeep":"","tlshash":"23d0c9ab32d235302ad7292a872451a9306e0c83785899e1bd0d65714f16ee813f75b8","size":257,"data":"","first_seen":"2026-05-16T14:09:26.646065Z","last_seen":"2026-05-16T14:09:26.646065Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"5edb810b3886e65adbd7c93f001443bf","sha1":"b6bb8eb16793951b835373a1c0bd6e72f505a9bb","sha256":"bebd94b0c3135e3ff18151c090916e31f70a89fcf3fc84f3d1232521d9898250","sha512":"88643616d78cbfb9355c3be213b1506696edadbb9074cf7c6663c8179cb9f665dbb4ffaef699fdbf7683d50b630adc88f75dad3286e26674533b16bca953ee07","ssdeep":"","tlshash":"bac048353c0a59ba93b08a460ab974b339800b2a42e5a8745699732576e3b93182eb20","size":149,"data":"","first_seen":"2026-05-16T14:09:26.648176Z","last_seen":"2026-05-16T14:09:26.648176Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/7c428f63a00e5bd025fa159e8c94389f.svg","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:58.807Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/7c428f63a00e5bd025fa159e8c94389f.svg HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 537\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\netag: \"6a074c09-219\"\r\nexpires: Mon, 15 Jun 2026 14:08:58 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":537,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"7c428f63a00e5bd025fa159e8c94389f","sha1":"edb555549cbd96f27715260a7afee8e17296acc7","sha256":"51bf40e3535dee036bec3df6d4b279b4373fb22cdd40632535932d6999f7e37e","sha512":"ae80b071a2e01e795fefe0c404f4d52218660cd367e672fdb42598e53183ab0d8ee6103e958c3b2b3ec43f830b20ea71d447e340b8d1db677409682062b07da2","ssdeep":"","tlshash":"5bf08bc68e05cc78a4574674fb30f2a5a03a51a0a60e1e94f871a835b3127f91877894","first_seen":"2023-08-04T12:21:26Z","last_seen":"2026-06-12T18:13:26.111319Z","times_seen":292,"resource_available":false,"data":null}},"time_used":235,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":59,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/AppMeasurement_Module_ActivityMap.min.js.download","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:58.806Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/AppMeasurement_Module_ActivityMap.min.js.download HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 Internal Server Error\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a5da1a5f49f0028589d3737f86eff1fa","sha1":"c1be39784d5cbf462d9ec8676d42f0c9d6d992b8","sha256":"51a5180aafabf1ea494f4854e78e7dc226432a7652166960648989cc10da7539","sha512":"cecb386317121668a1bbf7abd34e9a4ea1a9635728ce7d0231aeae1d7cd99b242f4f5bdd69c03970547415d1723ee3265077699f26e0d0e0b60893d8e0bd974b","ssdeep":"","tlshash":"02f0e1ff8306237314317a8d688220c43b1120b551b9d8481649d8bb73c66d99f3e6ec","first_seen":"2026-05-16T14:09:26.617463Z","last_seen":"2026-05-16T14:09:26.617463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/launch-edbf66c903b6.min.js.download","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:58.803Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/launch-edbf66c903b6.min.js.download HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 Internal Server Error\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a5da1a5f49f0028589d3737f86eff1fa","sha1":"c1be39784d5cbf462d9ec8676d42f0c9d6d992b8","sha256":"51a5180aafabf1ea494f4854e78e7dc226432a7652166960648989cc10da7539","sha512":"cecb386317121668a1bbf7abd34e9a4ea1a9635728ce7d0231aeae1d7cd99b242f4f5bdd69c03970547415d1723ee3265077699f26e0d0e0b60893d8e0bd974b","ssdeep":"","tlshash":"02f0e1ff8306237314317a8d688220c43b1120b551b9d8481649d8bb73c66d99f3e6ec","first_seen":"2026-05-16T14:09:26.617463Z","last_seen":"2026-05-16T14:09:26.617463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":181,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":180,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/resource-loader.js.download","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:58.807Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/resource-loader.js.download HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 Internal Server Error\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a5da1a5f49f0028589d3737f86eff1fa","sha1":"c1be39784d5cbf462d9ec8676d42f0c9d6d992b8","sha256":"51a5180aafabf1ea494f4854e78e7dc226432a7652166960648989cc10da7539","sha512":"cecb386317121668a1bbf7abd34e9a4ea1a9635728ce7d0231aeae1d7cd99b242f4f5bdd69c03970547415d1723ee3265077699f26e0d0e0b60893d8e0bd974b","ssdeep":"","tlshash":"02f0e1ff8306237314317a8d688220c43b1120b551b9d8481649d8bb73c66d99f3e6ec","first_seen":"2026-05-16T14:09:26.617463Z","last_seen":"2026-05-16T14:09:26.617463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/assets/fd1c0f449fc8540f82c47e1629cbd5dd.woff2","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.093Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/assets/fd1c0f449fc8540f82c47e1629cbd5dd.woff2 HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/styles.0ca29881ee3dd9dda70e.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-type: font/woff2\r\ncontent-length: 23716\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\netag: \"6a074c09-5ca4\"\r\nexpires: Mon, 15 Jun 2026 14:08:59 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":23716,"size_decoded":0,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 23716, version 1.13107","md5":"fd1c0f449fc8540f82c47e1629cbd5dd","sha1":"147b4ddff7e0110b1185f0e35ca2e11fc09d9fa0","sha256":"e1f8e67d54b287369f8fb000d14af4ea5ea2da8519ffae2e04f4be83d3af9141","sha512":"981b11b1752d322d0e5f507cf82c5de60b51c151a777de752dea7151fdba51b347032574e63315b03930656ae800da80ba6547aa0dec696ec20a180471dd6899","ssdeep":"384:cLUdM7dIA9ti2XGKKpQ6GeSCTJdMHtgfrvKr9Kl9/OOtgcW3OBK2z3tjuWSVNWMD:l27dIANh69LCgfrQKl5HeGBDjiM3be","tlshash":"32b2e11c43bfcb57ac608ea6b237e122a376d0c36782e7ee65110751f589820d118fb7","first_seen":"2023-12-14T02:08:24Z","last_seen":"2026-07-01T11:03:26.369104Z","times_seen":14,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/68616afacfrn1728d4c9b6745b72d773","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.254Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/68616afacfrn1728d4c9b6745b72d773 HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-length: 78590\r\nvary: HTTPS\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\netag: \"132fe-651ddd7fa9538\"\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/x-unknown-content-type","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T04:24:29.374999Z","times_seen":17440528,"resource_available":true,"data":null}},"time_used":62,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":60,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-16T14:08:58.513Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/ HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding, HTTPS\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\netag: W/\"1530a-651ddd7faa0f0\"\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":86794,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (65068)","md5":"8a64ea15b7f30fb478efd18c03fa479f","sha1":"a70c033d7a9d5d0eb86fa1d10beef281ee24acde","sha256":"ac70ec62235c8599a72e5481ff47c5c0623912d5a6f497ebbb9663aa472e4bbd","sha512":"d47e5bf7ef66beb54f90d16ed39486144b278620eb3e99ddd0cbebfd4b87f4d9cc26b7e811d5e99e2a34100a526d66eb005aa551a7909b48da395f8609a6512c","ssdeep":"768:4dBIiIz77GM2GeJKAmchq303eQAOSKDL8:4dYcqhtKDL8","tlshash":"3e83b76b3e18102de1630b1a93d1e68c3e26ad63c177d8f37b03ed51dbc5b938662615","first_seen":"2026-05-16T14:09:26.6256Z","last_seen":"2026-05-16T14:09:26.6256Z","times_seen":1,"resource_available":false,"data":null}},"time_used":120,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":120,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/AppMeasurement.min.js.download","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:58.805Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/AppMeasurement.min.js.download HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 Internal Server Error\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a5da1a5f49f0028589d3737f86eff1fa","sha1":"c1be39784d5cbf462d9ec8676d42f0c9d6d992b8","sha256":"51a5180aafabf1ea494f4854e78e7dc226432a7652166960648989cc10da7539","sha512":"cecb386317121668a1bbf7abd34e9a4ea1a9635728ce7d0231aeae1d7cd99b242f4f5bdd69c03970547415d1723ee3265077699f26e0d0e0b60893d8e0bd974b","ssdeep":"","tlshash":"02f0e1ff8306237314317a8d688220c43b1120b551b9d8481649d8bb73c66d99f3e6ec","first_seen":"2026-05-16T14:09:26.617463Z","last_seen":"2026-05-16T14:09:26.617463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":180,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":179,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/runtime.d73826009269fd019023.js.download","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:58.808Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/runtime.d73826009269fd019023.js.download HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 Internal Server Error\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a5da1a5f49f0028589d3737f86eff1fa","sha1":"c1be39784d5cbf462d9ec8676d42f0c9d6d992b8","sha256":"51a5180aafabf1ea494f4854e78e7dc226432a7652166960648989cc10da7539","sha512":"cecb386317121668a1bbf7abd34e9a4ea1a9635728ce7d0231aeae1d7cd99b242f4f5bdd69c03970547415d1723ee3265077699f26e0d0e0b60893d8e0bd974b","ssdeep":"","tlshash":"02f0e1ff8306237314317a8d688220c43b1120b551b9d8481649d8bb73c66d99f3e6ec","first_seen":"2026-05-16T14:09:26.617463Z","last_seen":"2026-05-16T14:09:26.617463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/AppMeasurement.min.js.download","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.000Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/AppMeasurement.min.js.download HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 Internal Server Error\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a5da1a5f49f0028589d3737f86eff1fa","sha1":"c1be39784d5cbf462d9ec8676d42f0c9d6d992b8","sha256":"51a5180aafabf1ea494f4854e78e7dc226432a7652166960648989cc10da7539","sha512":"cecb386317121668a1bbf7abd34e9a4ea1a9635728ce7d0231aeae1d7cd99b242f4f5bdd69c03970547415d1723ee3265077699f26e0d0e0b60893d8e0bd974b","ssdeep":"","tlshash":"02f0e1ff8306237314317a8d688220c43b1120b551b9d8481649d8bb73c66d99f3e6ec","first_seen":"2026-05-16T14:09:26.617463Z","last_seen":"2026-05-16T14:09:26.617463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/assets/79cc1505bcf15f59a89c759511622c04.svg","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.086Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/assets/79cc1505bcf15f59a89c759511622c04.svg HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/styles.0ca29881ee3dd9dda70e.css\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 231\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\netag: \"6a074c09-e7\"\r\nexpires: Mon, 15 Jun 2026 14:08:59 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":231,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"79cc1505bcf15f59a89c759511622c04","sha1":"43ffc0dfbaaed6dc0202f5a0fc2b21cb0eaa7915","sha256":"2e775d1c6abbd0d4e1f77b8281d867790566fcd6897b28389e3f85b4d39f5084","sha512":"6674a58ab71499d4a9d29993a9335b4c2733825e86ea1f988d6ea688993059c65b3d4acec656121d4bab7e7658155588e5511003dfa05b4a844d690de4317cb3","ssdeep":"","tlshash":"23d02365d19c553df214c255f53460bc31df3051824d2c5eda923675a47d8ce38a794d","first_seen":"2026-05-16T14:09:26.627977Z","last_seen":"2026-05-16T14:09:26.627977Z","times_seen":1,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/assets/8fd30bd010d9e2c7677ec339685f958b.woff","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.096Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/assets/8fd30bd010d9e2c7677ec339685f958b.woff HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/styles.0ca29881ee3dd9dda70e.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-type: font/woff\r\ncontent-length: 30656\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\netag: \"6a074c09-77c0\"\r\nexpires: Mon, 15 Jun 2026 14:08:59 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":30656,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 30656, version 1.6554","md5":"8fd30bd010d9e2c7677ec339685f958b","sha1":"52f45de0f527644770f4ca9b9435d593a2359662","sha256":"5f45b253b0621b40b352b1ec52c4b2066bca8e71c5ac54d922459fc8109d9366","sha512":"8219a99926853933920557f7b705c2c47ab5611328811c73c8556bf609bfd3d3950571ea3dd437f864ac2d014d060967b9d708f9f67ff6a03d54c780505bad3b","ssdeep":"768:13T/q9Qjbl0Iv772Lts/wQLNudAP0iApbF4EbgkH:R6QjblNwRakH","tlshash":"3dd2f215a5f81a1ef7f5723e2686b1aa853a2c06614f12f6bd4c093068ce736de43573","first_seen":"2023-06-15T04:32:09Z","last_seen":"2026-07-20T17:45:44.959461Z","times_seen":279,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/styles.0ca29881ee3dd9dda70e.css","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:58.802Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/styles.0ca29881ee3dd9dda70e.css HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: text/css\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a074c09-9c60f\"\r\nexpires: Mon, 15 Jun 2026 14:08:58 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":640527,"size_decoded":0,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (65472), with no line terminators","md5":"baabb47c4514c2586804aaf06ce1b396","sha1":"c3bfe5113ac889155ab90c1cb8248479b646a642","sha256":"d45f0960d5c02ef3ad47d795c25cdbbcd83625ca225d5593b4e2134b5ae4a5fa","sha512":"f68bf82be6e63071fdfc52a0d852a169039d70624e9dc7d5c2a970d861aed8b79ca061332e0b36a54c0a9a9fb7af7b09e99b682b397b94b6c96bfbcbe4ea3506","ssdeep":"6144:uRS8a34IYIQZcC8PpULathJba1iVvjbJFY6OjvkU1FY2t:uRS8a37JQZpUxo6OjvkU1FYU","tlshash":"6ed41a636e28213de5238b2d63d2b7cd232d5521e763c7e7fd03ada0ca8a7910673549","first_seen":"2023-10-05T20:37:30Z","last_seen":"2026-05-16T14:09:26.631226Z","times_seen":56,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/assets/00cecde981e3ef7491eba946f4b95fe0.woff","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.099Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/assets/00cecde981e3ef7491eba946f4b95fe0.woff HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/styles.0ca29881ee3dd9dda70e.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-type: font/woff\r\ncontent-length: 31796\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\netag: \"6a074c09-7c34\"\r\nexpires: Mon, 15 Jun 2026 14:08:59 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31796,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 31796, version 1.6554","md5":"00cecde981e3ef7491eba946f4b95fe0","sha1":"91df089a2eb0665180da53bc86599a065d44b980","sha256":"5037b298c4193baf7e920bee2999d2ab852db7a3b6b09a38c25a78db92baf69b","sha512":"4f1c6e73b88ce0993c1e355380e80e341241d509e3c0de0b316f338401281ec2e4da19f6224d4308e543ea89bfd4045bcbb660735bbce0469bde3f135f0e4c2f","ssdeep":"768:KEuTaZjHnUxjb1k7jmdBpx+UmQ/fwqqKeGq6ZEZX:AIjHUc6IE9q6ZEZX","tlshash":"44e2d12763f816c3f0f1b677b996a62aa3711ddcd08b1b7ff9278660235f2610c09925","first_seen":"2023-06-15T04:32:09Z","last_seen":"2026-07-20T17:45:44.991547Z","times_seen":267,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":59,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/main.d8f82711eaf2cdf19076.chunk.js.download","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.187Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/main.d8f82711eaf2cdf19076.chunk.js.download HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 Internal Server Error\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a5da1a5f49f0028589d3737f86eff1fa","sha1":"c1be39784d5cbf462d9ec8676d42f0c9d6d992b8","sha256":"51a5180aafabf1ea494f4854e78e7dc226432a7652166960648989cc10da7539","sha512":"cecb386317121668a1bbf7abd34e9a4ea1a9635728ce7d0231aeae1d7cd99b242f4f5bdd69c03970547415d1723ee3265077699f26e0d0e0b60893d8e0bd974b","ssdeep":"","tlshash":"02f0e1ff8306237314317a8d688220c43b1120b551b9d8481649d8bb73c66d99f3e6ec","first_seen":"2026-05-16T14:09:26.617463Z","last_seen":"2026-05-16T14:09:26.617463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/assets/15243e297f5364bd59f4088a864abbf7.woff","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.089Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/assets/15243e297f5364bd59f4088a864abbf7.woff HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: identity\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/styles.0ca29881ee3dd9dda70e.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-type: font/woff\r\ncontent-length: 32264\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\netag: \"6a074c09-7e08\"\r\nexpires: Mon, 15 Jun 2026 14:08:59 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32264,"size_decoded":0,"mime_type":"font/woff","magic":"Web Open Font Format, TrueType, length 32264, version 1.6554","md5":"15243e297f5364bd59f4088a864abbf7","sha1":"27b84bd4540518b02ed599e38dc65ed2f3c6a536","sha256":"259699b7407833766a8f4e931644d014f145653439a62fc1a7167f1d3a940e25","sha512":"0ce589dda7ffcb17a7055357817c6b570f22869d272561e0d3216e55dca8ca7b54be9464e6d93d35f2a66a7e76d20d94a1e7d549196e972f827ea3181cffb341","ssdeep":"768:xdQkTdOyC9CNtP3/OkfyF5YS7HhnF+PMy34ibxpaYN3uLebtCyi:PQGdOyC9c3GoOhM3FpaYELebU","tlshash":"e9e2f14f995128faf27a02b24c73771bd0a38de7847986e1f2a340c00b9655ead06e37","first_seen":"2023-06-17T13:38:27Z","last_seen":"2026-07-20T17:45:44.981743Z","times_seen":229,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-05-16T14:08:58.259Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 Moved Permanently\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 348\r\nlocation: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"Moved Permanently","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":86794,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T04:24:29.374999Z","times_seen":17440528,"resource_available":true,"data":null}},"time_used":440,"timings":{"blocked":191,"dns":62,"connect":59,"send":0,"wait":59,"receive":0,"ssl":67},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/main.d8f82711eaf2cdf19076.chunk.js.download","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:58.809Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/main.d8f82711eaf2cdf19076.chunk.js.download HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 Internal Server Error\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a5da1a5f49f0028589d3737f86eff1fa","sha1":"c1be39784d5cbf462d9ec8676d42f0c9d6d992b8","sha256":"51a5180aafabf1ea494f4854e78e7dc226432a7652166960648989cc10da7539","sha512":"cecb386317121668a1bbf7abd34e9a4ea1a9635728ce7d0231aeae1d7cd99b242f4f5bdd69c03970547415d1723ee3265077699f26e0d0e0b60893d8e0bd974b","ssdeep":"","tlshash":"02f0e1ff8306237314317a8d688220c43b1120b551b9d8481649d8bb73c66d99f3e6ec","first_seen":"2026-05-16T14:09:26.617463Z","last_seen":"2026-05-16T14:09:26.617463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":177,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/68616afacfrn1728d4c9b6745b72d773","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:58.810Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/68616afacfrn1728d4c9b6745b72d773 HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:58 GMT\r\ncontent-length: 78590\r\nvary: HTTPS\r\nlast-modified: Fri, 15 May 2026 16:38:33 GMT\r\netag: \"132fe-651ddd7fa9538\"\r\naccept-ranges: bytes\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/x-unknown-content-type","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-22T04:24:29.374999Z","times_seen":17440528,"resource_available":true,"data":null}},"time_used":224,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":176,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/files/runtime.d73826009269fd019023.js.download","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.106Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /specialists/sunbsadman/yattscott/files/runtime.d73826009269fd019023.js.download HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 Internal Server Error\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 605\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":605,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"a5da1a5f49f0028589d3737f86eff1fa","sha1":"c1be39784d5cbf462d9ec8676d42f0c9d6d992b8","sha256":"51a5180aafabf1ea494f4854e78e7dc226432a7652166960648989cc10da7539","sha512":"cecb386317121668a1bbf7abd34e9a4ea1a9635728ce7d0231aeae1d7cd99b242f4f5bdd69c03970547415d1723ee3265077699f26e0d0e0b60893d8e0bd974b","ssdeep":"","tlshash":"02f0e1ff8306237314317a8d688220c43b1120b551b9d8481649d8bb73c66d99f3e6ec","first_seen":"2026-05-16T14:09:26.617463Z","last_seen":"2026-05-16T14:09:26.617463Z","times_seen":1,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"krasnodar-nextrehab.ru/favicon.ico","fqdn":"krasnodar-nextrehab.ru","domain":"krasnodar-nextrehab.ru","tld":"ru"},"ip":{"addr":"92.38.253.58","port":443,"asn":12695,"as":"LLC Digital Network","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/","date":"2026-05-16T14:08:59.362Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"krasnodar-nextrehab.ru","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 12 Mar 2026 03:57:12 GMT","end":"Wed, 10 Jun 2026 03:57:11 GMT"},"fingerprint":{"sha1":"73:89:5E:73:73:AE:8C:4B:B0:32:01:16:05:73:8A:90:53:20:E1:DB","sha256":"9E:AE:95:68:BE:87:3C:49:60:11:C9:AE:50:CF:82:2E:B8:2A:2E:D1:74:DD:BE:9F:11:78:9F:81:DD:40:CD:33"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: krasnodar-nextrehab.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://krasnodar-nextrehab.ru/specialists/sunbsadman/yattscott/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: nginx\r\ndate: Sat, 16 May 2026 14:08:59 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 18531\r\nlast-modified: Sat, 14 Mar 2026 03:30:35 GMT\r\netag: \"69b4d65b-4863\"\r\nexpires: Mon, 15 Jun 2026 14:08:59 GMT\r\ncache-control: max-age=2592000\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":18531,"size_decoded":0,"mime_type":"image/x-icon","magic":"PNG image data, 198 x 198, 8-bit/color RGBA, non-interlaced","md5":"d20bee94a3a2b594a1751bb9e99ab92b","sha1":"5a621d17fac8ebc34d6d84e70e6463a15db7b3da","sha256":"aa00edbd8eb116c136d806d67a9f6964ad4ddcd5cd2226ec28559ef07a99580d","sha512":"90cf100d0468be1fed3ca594e113f0fad22346230b15fe1e11f298095741b4d33a497736b80bee57d4afdac0a9a1b74cfd743aa8226a7abccbe4cba61cde1037","ssdeep":"384:cWnNk71pcJ93mv2+aGlgDKk3m8qWRuIV4+1UZBiTpi7BAlKPQlrEcJSPO45jn:BcpcvEnIFxuIVzq/iTpi7B4Ksqmk","tlshash":"0382e1a564047e4166d4fe7392cf78b7c5699f83c8c845b9e6953832fcc12e6622e620","first_seen":"2026-05-16T14:09:26.635251Z","last_seen":"2026-05-16T14:09:26.635251Z","times_seen":1,"resource_available":false,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-05-16","alert":"Phishing Block","trigger":"krasnodar-nextrehab.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-05-16","alert":"Sinkholed","trigger":"krasnodar-nextrehab.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Scotiabank","verdict":"phishing","severity":"medium","comment":"Asset commenly seen with Scotiabank phishing","tags":["scotiabank","financial","phishing"],"meta":null}]}}]}