{"report_id":"99cdfe3f-8a6d-49c2-91c8-76cc20be265c","version":0,"status":"done","tags":[],"date":"2026-08-31T07:59:59Z","url":{"schema":"http","addr":"slon11.su/","fqdn":"slon11.su","domain":"slon11.su","tld":"su"},"ip":{"addr":"31.31.198.2","port":0,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"slon11.su/","fqdn":"slon11.su","domain":"slon11.su","tld":"su"},"title":"KRAKEN — Вход в аккаунт","dom":{"size":9288,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"19df724a13001ffc4bc5c87cbea05560","sha1":"c4ea2f30f1943198d0d06bbe7a40c281da6098dc","sha256":"ae267dd7074fe569d7b88106e7735b473921f62283543574eb3b0ed05d4318b8","sha512":"275659e9085aa41fd0be418707b03d88bc94b4454f85f11fae14053595cf5bf8d2bb541f02aca0882ca644d1e245a5609d6be40e44fe8e3eb3489aad36e50213","ssdeep":"192:NpTFSFldFGzFUshuPE2GJpn55TmzdS0WzQ/cy2Ktu3Mj:nFSFvFeF/n55Szd4AtuO","tlshash":"941253ab79e304823d43f47d2fa79a863594d013e509ca183e9c63d88f8a9c5d87378c","dom_hash":"domhashc2c54359b70c28a92495f7754319eef0","first_seen":"2026-08-31T08:00:03.492334Z","last_seen":"2026-08-31T08:00:03.492334Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"slon11.su/","fqdn":"slon11.su","domain":"slon11.su","tld":"su"},"ip":{"addr":"31.31.198.2","port":0,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-05T07:59:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"slon11.su","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"slon11.su","ip":{"addr":"31.31.198.2","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-28","domain_rank":0,"first_seen":"2026-08-31T08:00:00.150455Z","last_seen":"2026-08-31T08:00:00.150455Z","alert_count":2,"request_count":2,"received_data":779571,"sent_data":972,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"slon11.su/","fqdn":"slon11.su","domain":"slon11.su","tld":"su"},"ip":{"addr":"31.31.198.2","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"9791b1947809b1cf63bfda9d1c1a0226","sha1":"a46d8642adae9a3560fe53dace39a0505e2bd7aa","sha256":"ad2278465171eeb4ea49d428acebacf539053f358b41be9db871bf8a1fbd9139","sha512":"555b136d862843d5cf8399e8c2db87bb1f3cf3d14e6f2775540807b877bfd72d8fe516f2207176fd0e4bcf3585b33a54b4188a9241e71e351a69b4b05b0ea337","ssdeep":"","tlshash":"6d614e7a78b318a00debb07f076b8584b471a0277c05da04bd1c47159fa2e81e476edd","size":3297,"data":"","first_seen":"2026-08-31T08:00:03.504324Z","last_seen":"2026-08-31T08:00:03.504324Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"slon11.su/","fqdn":"slon11.su","domain":"slon11.su","tld":"su"},"ip":{"addr":"31.31.198.2","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-31T07:59:26.355Z","timestamp":1788163166355,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.slon11.su","organization":""},"issuer":{"commonName":"GlobalSign GCC R46 DV TLS CA 2025","organization":"GlobalSign nv-sa"},"validity":{"start":"Fri, 28 Aug 2026 14:53:18 GMT","end":"Mon, 15 Mar 2027 14:53:18 GMT"},"fingerprint":{"sha1":"A9:8C:29:C2:26:5E:F1:90:1B:BF:7A:BB:A7:33:51:AA:15:F4:8A:0A","sha256":"75:B6:33:35:AB:6E:15:F6:41:5A:C3:D1:84:39:5B:22:42:0F:C2:17:0F:51:7E:46:6C:10:2A:50:A6:04:62:67"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: slon11.su\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:59:30 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nvary: Accept-Encoding\r\nlast-modified: Fri, 28 Aug 2026 11:28:14 GMT\r\netag: W/\"258a-65a19bf889def\"\r\nx-content-type-options: nosniff\r\nx-frame-options: DENY\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9610,"size_decoded":2716,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"b8cab1445f0e1aa881447e86bfddca36","sha1":"a8b77e33180a559b0f65c92f636e92de99f0c19e","sha256":"29f7afa02e068d2511b68a997e018cd8cd4102c9d6b3a11828a89ce6d9ad9f56","sha512":"cdf57c81b0d497bf0d0a55a441f5c384c0d80bc06a8e6f9ad068d9d0a99f568da1ed6634ec27afad485ee62401b2917676ce7ce1bd6387942fda9882e3240048","ssdeep":"96:+syqINLN4E3PTW1asOfzlwErhgFEoko5YUreIFL9ttKk:+zV4oTW1asOfRwErhgi0+U6G9ttF","tlshash":"5d123429f94604822573f77a6f639b89fb854123970183193eec63925fba844c963fdc","first_seen":"2026-08-31T08:00:03.497142Z","last_seen":"2026-08-31T08:00:03.497142Z","times_seen":1,"resource_available":true,"data":null}},"time_used":3831,"timings":{"blocked":-1,"dns":62,"connect":29,"send":0,"wait":1575,"receive":0,"ssl":2165},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"slon11.su","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"slon11.su/favicon.ico","fqdn":"slon11.su","domain":"slon11.su","tld":"su"},"ip":{"addr":"31.31.198.2","port":443,"asn":197695,"as":"Domain names registrar REG.RU, Ltd","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://slon11.su/","date":"2026-08-31T07:59:30.418Z","timestamp":1788163170418,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.slon11.su","organization":""},"issuer":{"commonName":"GlobalSign GCC R46 DV TLS CA 2025","organization":"GlobalSign nv-sa"},"validity":{"start":"Fri, 28 Aug 2026 14:53:18 GMT","end":"Mon, 15 Mar 2027 14:53:18 GMT"},"fingerprint":{"sha1":"A9:8C:29:C2:26:5E:F1:90:1B:BF:7A:BB:A7:33:51:AA:15:F4:8A:0A","sha256":"75:B6:33:35:AB:6E:15:F6:41:5A:C3:D1:84:39:5B:22:42:0F:C2:17:0F:51:7E:46:6C:10:2A:50:A6:04:62:67"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: slon11.su\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://slon11.su/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\nserver: nginx\r\ndate: Mon, 31 Aug 2026 07:59:32 GMT\r\ncontent-type: text/html; charset=utf-8\r\nvary: Accept-Encoding\r\nlast-modified: Wed, 19 Mar 2025 07:22:03 GMT\r\netag: W/\"bbd7c-630ace0c7c779\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":769404,"size_decoded":132168,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (22012)","md5":"c9aecc0ad6ac8ce3f213efbce29e6355","sha1":"7d8bfd41a1339538efebf72732d13d74dc6a3bd6","sha256":"e5f51ad7e6ec5d138cb5a4fa3e38860f5b406031dc02195116772fd3f6c4876e","sha512":"71817628b203d2d7e4dac59153e1b27f663fa6a791b56add08e2c9fa3d91b7b0fd060a2f57d52ab3155d327874317a26156ace75a01d07c93baf3f7d1cb2c622","ssdeep":"6144:Z0T9gq5TgX8gscru33oyBsQ70t6o1ysOAUEPusTCNwPdvgJ:Y3oyBsQ70t6o1yDArdeJ","tlshash":"b4f409c8abf02c5e921b86316c3f89c6f30a76d4b6fc4407694df791e25e116f226678","first_seen":"2025-08-04T06:39:51.729649Z","last_seen":"2026-08-31T08:00:03.500793Z","times_seen":7,"resource_available":true,"data":null}},"time_used":2191,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":2191,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-31","alert":"Sinkholed","trigger":"slon11.su","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}