{"report_id":"ad4f21e8-3dcd-4ea9-833a-44fbf209043b","version":0,"status":"done","tags":[],"date":"2026-08-25T21:03:36Z","url":{"schema":"http","addr":"memuemulator.ru/","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"memuemulator.ru/","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"title":"MEmu — скачать эмулятор Android для ПК на Windows","dom":{"size":19414,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"4d48ecd232f03b52dfa4a5ccdad266e2","sha1":"368979ad312642c5d1e6456691ff8cb8ea724d99","sha256":"f448439a8e3379d749e091bbdfa8ec14a8f85be1ea6967f4548bef66abd60528","sha512":"023dba588379e3c97b90429438e4492bc15fdce4761da03dcd019d6f9a3dd3b55ac73bfe033157d2e3e05679eafc198a96a0ed41ff55fd6a3e708789352b949d","ssdeep":"384:7xvEU3rK2II3ZS0sy10uAc5DOhcCP5+Y0kt87DM6omjF:7xvEU3rK2II3ZS0zCJcdOhcCP5+Y0kt4","tlshash":"5c92642196f8649b0105d14bea147b0d7da285bfea9a1611317c1daf3ff3c60cd2bb1a","dom_hash":"domhashf8a87745753a64b6decc3e36f82c40b7","first_seen":"2026-08-25T20:54:57.586494Z","last_seen":"2026-08-25T21:03:38.336847Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"memuemulator.ru/","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:03:36Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"memuemulator.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-16","domain_rank":0,"first_seen":"2026-08-25T20:54:54.068717Z","last_seen":"2026-08-25T20:54:54.068717Z","alert_count":14,"request_count":7,"received_data":2044820,"sent_data":3422,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"memuemulator.ru/","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"f91aeb0008872e65da9bf8475188b762","sha1":"ba13984daff250460d0db6013a551cb56a924258","sha256":"a003f621dc63a7dfabfe934ae06f46017d2a76f79f34baa02116be19284c79a3","sha512":"0d1ddd80ac516946e33875e330fb478df0aeb6733498c38bdd0a283b8b977abd4ed178edf7a2411823ff4169fe862f3fd9f5961d7c9fefe708dc0909b2f86348","ssdeep":"","tlshash":"8bf0e1b7b88492b5c3f63171532ba31d711718be20896c34c54dc881397bc69102f9ad","size":576,"data":"","first_seen":"2026-08-25T20:54:57.60867Z","last_seen":"2026-08-25T21:03:38.34505Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"memuemulator.ru/js/main.js","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"843c45fea0fb0236098bf3fdc91fc427","sha1":"b62481c99d7ad51cbdc94130b3418054361ecd1d","sha256":"908c72b89aabd77d3ad7c8373df2420a2ec0649d1698d03524d1ab1ec28f123e","sha512":"39aa82b2016c97219eff01b247017beff94c80f67884985c3e6a68c2a53cce5b952417b3251a161e4e7e59562c2402e0b4d5a50ffc0c6da2ef4e5ed4d2a90917","ssdeep":"96:GJH2npjCzEDcPkTBuqtipvuiv885uXWSqKWokfgMCov+wPSBiC3JBrXYNfSk:GJH2pjCzaYq0vD8QOWSqQkflCN5xX0qk","tlshash":"20e171a5995a36bb40ba233ebf4a590cff7100a7500582123dbc9d853fb8f644379de9","size":7020,"data":"","first_seen":"2026-08-25T20:54:57.590164Z","last_seen":"2026-08-25T21:03:38.339474Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"memuemulator.ru/assets/hero.png","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://memuemulator.ru/","date":"2026-08-25T21:03:09.982Z","timestamp":1787691789982,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.memuemulator.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:07:58 GMT","end":"Mon, 16 Nov 2026 20:07:57 GMT"},"fingerprint":{"sha1":"64:1C:A4:17:09:61:5F:42:5A:CF:50:5A:F8:3B:E5:6D:20:C8:1B:4B","sha256":"D5:41:D9:4E:CA:9F:5B:9C:9A:38:E4:8E:CC:FE:13:31:B1:6A:B6:F4:13:B3:36:02:0A:14:35:00:40:B6:57:35"}}},"request":{"raw":"GET /assets/hero.png HTTP/1.1\r\nHost: memuemulator.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://memuemulator.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:10 GMT\r\ncontent-type: image/png\r\ncontent-length: 1925739\r\nlast-modified: Sun, 16 Aug 2026 17:00:37 GMT\r\netag: \"1d626b-6592cfe1f9a0c\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1925739,"size_decoded":1926154,"mime_type":"image/png","magic":"PNG image data, 1536 x 1024, 8-bit/color RGB, non-interlaced","md5":"b43002bbd83323c0090dd4fcc0d97ba7","sha1":"3be75be1d33d459dcb108279e4859bc5d63d217f","sha256":"7442d6e7f5704f15b17160f3f808881ae2a3b1bbc370bd890ae065675e4800f1","sha512":"7588eb0488fcca9ec332ef207110adda4d342fa9041a098c32ee22bc3b1954bd65748fce628474c0ffc003d1962c809deaf2bfdb754e4f565202915be9f3c6f3","ssdeep":"24576:QLcBfq+Gshz+KM+igZ6vCMAQfsyY5agUlW3F:t8sNsvt8R","tlshash":"812523fbac902659c8e504f8ab52826c8d6fc79cb52137a03bf7e321d9095b4137f199","first_seen":"2026-08-25T20:54:57.601992Z","last_seen":"2026-08-25T21:03:38.338054Z","times_seen":2,"resource_available":false,"data":null}},"time_used":393,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":51,"receive":342,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"memuemulator.ru/js/main.js","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://memuemulator.ru/","date":"2026-08-25T21:03:09.983Z","timestamp":1787691789983,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.memuemulator.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:07:58 GMT","end":"Mon, 16 Nov 2026 20:07:57 GMT"},"fingerprint":{"sha1":"64:1C:A4:17:09:61:5F:42:5A:CF:50:5A:F8:3B:E5:6D:20:C8:1B:4B","sha256":"D5:41:D9:4E:CA:9F:5B:9C:9A:38:E4:8E:CC:FE:13:31:B1:6A:B6:F4:13:B3:36:02:0A:14:35:00:40:B6:57:35"}}},"request":{"raw":"GET /js/main.js HTTP/1.1\r\nHost: memuemulator.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://memuemulator.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:10 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:01:18 GMT\r\netag: W/\"1b6c-659a32fe776af\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":7020,"size_decoded":2893,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"843c45fea0fb0236098bf3fdc91fc427","sha1":"b62481c99d7ad51cbdc94130b3418054361ecd1d","sha256":"908c72b89aabd77d3ad7c8373df2420a2ec0649d1698d03524d1ab1ec28f123e","sha512":"39aa82b2016c97219eff01b247017beff94c80f67884985c3e6a68c2a53cce5b952417b3251a161e4e7e59562c2402e0b4d5a50ffc0c6da2ef4e5ed4d2a90917","ssdeep":"96:GJH2npjCzEDcPkTBuqtipvuiv885uXWSqKWokfgMCov+wPSBiC3JBrXYNfSk:GJH2pjCzaYq0vD8QOWSqQkflCN5xX0qk","tlshash":"20e171a5995a36bb40ba233ebf4a590cff7100a7500582123dbc9d853fb8f644379de9","first_seen":"2026-08-25T20:54:57.590164Z","last_seen":"2026-08-25T21:03:38.339474Z","times_seen":2,"resource_available":true,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"memuemulator.ru/assets/memu-logo.png","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://memuemulator.ru/","date":"2026-08-25T21:03:09.989Z","timestamp":1787691789989,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.memuemulator.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:07:58 GMT","end":"Mon, 16 Nov 2026 20:07:57 GMT"},"fingerprint":{"sha1":"64:1C:A4:17:09:61:5F:42:5A:CF:50:5A:F8:3B:E5:6D:20:C8:1B:4B","sha256":"D5:41:D9:4E:CA:9F:5B:9C:9A:38:E4:8E:CC:FE:13:31:B1:6A:B6:F4:13:B3:36:02:0A:14:35:00:40:B6:57:35"}}},"request":{"raw":"GET /assets/memu-logo.png HTTP/1.1\r\nHost: memuemulator.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://memuemulator.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:10 GMT\r\ncontent-type: image/png\r\ncontent-length: 42759\r\nlast-modified: Sun, 16 Aug 2026 17:00:38 GMT\r\netag: \"a707-6592cfe308e38\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":42759,"size_decoded":43170,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced","md5":"642aa74bfbb7942fd4a23aecba9289da","sha1":"96886c583cabde8cc112e2dc838c6bf4beeec7f8","sha256":"da4eb12aa5c064a38f1e0621fd4a4c81e75abcb71f5f0955228225b0007a8496","sha512":"f1ba0cef53c425b5ba61b1dfe5fd3cd51eb994d92be48b15a8a5ed1a8a1a40a7900b9a3c14172bee6c6d345d9facad9688affdb1f87f82f6695d0e9c74f9596b","ssdeep":"768:d351gWhy2g0n9DOpcVDVtnVhy/ss49ZidVG2YI9sRMqsY:hy2tOpKw/ssCZiDG2n9sRMc","tlshash":"2413f13e85da0b5c0dade344611fdadf4664b6bee22771b8b7048c8c289ec513e9c325","first_seen":"2026-08-25T20:54:57.593037Z","last_seen":"2026-08-25T21:03:38.340434Z","times_seen":2,"resource_available":false,"data":null}},"time_used":160,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":131,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"memuemulator.ru/assets/icon-180.png","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://memuemulator.ru/","date":"2026-08-25T21:03:10.396Z","timestamp":1787691790396,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.memuemulator.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:07:58 GMT","end":"Mon, 16 Nov 2026 20:07:57 GMT"},"fingerprint":{"sha1":"64:1C:A4:17:09:61:5F:42:5A:CF:50:5A:F8:3B:E5:6D:20:C8:1B:4B","sha256":"D5:41:D9:4E:CA:9F:5B:9C:9A:38:E4:8E:CC:FE:13:31:B1:6A:B6:F4:13:B3:36:02:0A:14:35:00:40:B6:57:35"}}},"request":{"raw":"GET /assets/icon-180.png HTTP/1.1\r\nHost: memuemulator.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://memuemulator.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:10 GMT\r\ncontent-type: image/png\r\ncontent-length: 29698\r\nlast-modified: Sun, 16 Aug 2026 17:00:37 GMT\r\netag: \"7402-6592cfe234f56\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":29698,"size_decoded":30109,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"08c71501ea395178e5253659392ad768","sha1":"690d10020c66ba193392e39f9f9338d346aa0ae2","sha256":"2d5d6297cdf7bd6e230b7e53eeedadaef04cd6119e139002bfd67dc8bf0280cb","sha512":"06bda29ec82c29c15287870e2dd1d22c42eaf64d0fb1bf74907fef1c9b0beeacd5efbb26be743065831cbd6c3ea5fad2760a3d0c63c7b7b5ff80da19a1f7ef29","ssdeep":"384:OBTcEmefCuICt3AG0C8IHIqzHJsY6Dz5A6zWEXYnvfrpFjvm82GNFRT4ujV1bDxE:YcEmef6c3R0jr22YQXqD/i0V1mimbG+","tlshash":"96d2f01b8a611b2692b71052419c73c4de7b8c207dcff28006aa9326f8f56d29cdbccd","first_seen":"2026-08-25T20:54:57.604355Z","last_seen":"2026-08-25T21:03:38.341232Z","times_seen":2,"resource_available":false,"data":null}},"time_used":46,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":46,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"memuemulator.ru/assets/favicon-32.png","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://memuemulator.ru/","date":"2026-08-25T21:03:10.398Z","timestamp":1787691790398,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.memuemulator.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:07:58 GMT","end":"Mon, 16 Nov 2026 20:07:57 GMT"},"fingerprint":{"sha1":"64:1C:A4:17:09:61:5F:42:5A:CF:50:5A:F8:3B:E5:6D:20:C8:1B:4B","sha256":"D5:41:D9:4E:CA:9F:5B:9C:9A:38:E4:8E:CC:FE:13:31:B1:6A:B6:F4:13:B3:36:02:0A:14:35:00:40:B6:57:35"}}},"request":{"raw":"GET /assets/favicon-32.png HTTP/1.1\r\nHost: memuemulator.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://memuemulator.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:10 GMT\r\ncontent-type: image/png\r\ncontent-length: 2049\r\nlast-modified: Sun, 16 Aug 2026 17:00:34 GMT\r\netag: \"801-6592cfdfaeab5\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2049,"size_decoded":2458,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"100a7bf2869b5a77b3feb505fa9869bf","sha1":"75e99d53439d6bc73da6012f3bc26d1d081ce33c","sha256":"24a7aa6f1184934d7fafe40f141516a68697b51acc267f66a77055fc11cbc016","sha512":"45c87645dcea115fc1aba35056f3863eca601658b0e18736c9abc77b903e2dc7caef02691aa778acd9d435a0f6358f5cc4eac72c24ff5ab6ec4d8ffdd587ae44","ssdeep":"","tlshash":"1c413a90da2725e86cc957c633c212748e7acc5b6bf2509c2f52e4a068e1659a5dcb80","first_seen":"2026-08-25T20:54:57.606546Z","last_seen":"2026-08-25T21:03:38.342072Z","times_seen":2,"resource_available":false,"data":null}},"time_used":45,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":45,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"memuemulator.ru/","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:03:09.657Z","timestamp":1787691789657,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.memuemulator.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:07:58 GMT","end":"Mon, 16 Nov 2026 20:07:57 GMT"},"fingerprint":{"sha1":"64:1C:A4:17:09:61:5F:42:5A:CF:50:5A:F8:3B:E5:6D:20:C8:1B:4B","sha256":"D5:41:D9:4E:CA:9F:5B:9C:9A:38:E4:8E:CC:FE:13:31:B1:6A:B6:F4:13:B3:36:02:0A:14:35:00:40:B6:57:35"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: memuemulator.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:09 GMT\r\ncontent-type: text/html\r\ncontent-length: 5793\r\nlast-modified: Sun, 16 Aug 2026 17:17:33 GMT\r\netag: \"4d7a-6592d3ab7b76b-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":19834,"size_decoded":6254,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"09232a640b135a2956911559c854d9cb","sha1":"79570ce6282e95a7a34584057eb81cc7eb821a20","sha256":"e6fde29cdb96ca5dd954925687c00cbab724013b9657631f51dbf9e05e17ccd9","sha512":"b0999f3a901ae07759a50f25073460fd76b516acb243cc76fbcade558fcdbe469464e8677e7d6fea9af7de0df6636598b3b34b1fb3922fcdb9e566da125751a4","ssdeep":"384:2V+yq2EOwIIfvjx/n+xaRhk/OhjzI5PYGaQr7De63Vl:2V+yq2E7IIfvjx/6qhSOhjzI5PYGaQrH","tlshash":"7192442156c9689b0131d05bda14774cfca241bfab9a161231bd2eaf3ff3c60cd1ba56","first_seen":"2026-08-25T20:54:57.595681Z","last_seen":"2026-08-25T21:03:38.343144Z","times_seen":2,"resource_available":false,"data":null}},"time_used":133,"timings":{"blocked":-1,"dns":20,"connect":29,"send":0,"wait":48,"receive":0,"ssl":36},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"memuemulator.ru/css/style.css","fqdn":"memuemulator.ru","domain":"memuemulator.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://memuemulator.ru/","date":"2026-08-25T21:03:09.980Z","timestamp":1787691789980,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.memuemulator.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:07:58 GMT","end":"Mon, 16 Nov 2026 20:07:57 GMT"},"fingerprint":{"sha1":"64:1C:A4:17:09:61:5F:42:5A:CF:50:5A:F8:3B:E5:6D:20:C8:1B:4B","sha256":"D5:41:D9:4E:CA:9F:5B:9C:9A:38:E4:8E:CC:FE:13:31:B1:6A:B6:F4:13:B3:36:02:0A:14:35:00:40:B6:57:35"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: memuemulator.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://memuemulator.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:10 GMT\r\ncontent-type: text/css\r\ncontent-length: 3548\r\nlast-modified: Sun, 16 Aug 2026 17:00:40 GMT\r\netag: \"398c-6592cfe550ac5-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14732,"size_decoded":4009,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"1ea49ebd9c306bb83306cbe1a1cf04a2","sha1":"4dc15784c9ad669235856a15a4afb7dd90088db5","sha256":"e3087131d9ceec16cb532884264d58851de46ada08ac640686eef9c94a101853","sha512":"412eb1ded2872e9704ebf24c384f8c9ca2c0bd6e6b9c4e99e35c42bd7f3540f7a3d856621324745f2227e6cf10914e49254bd92131953b7448e976b0d9644f53","ssdeep":"192:d0euUyrlv6eHsRtZtAubkSD4N+bBAZ97s0IJBkh49olziRA:90SZ9bkGLs3NiW","tlshash":"946212a66f285130a633f7a5fbd7d789e69872525904037e7de5000892cb2be906df8c","first_seen":"2026-08-25T20:54:57.598992Z","last_seen":"2026-08-25T21:03:38.344123Z","times_seen":2,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":140,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"memuemulator.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}