{"report_id":"b1c930bc-0926-43d8-b91d-e2cdbc38b1c8","version":0,"status":"done","tags":[],"date":"2026-08-25T21:14:01Z","url":{"schema":"http","addr":"rdrplay.ru/","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"rdrplay.ru/","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"title":"Red Dead Redemption — скачать на ПК и узнать всё об играх серии","dom":{"size":9703,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1213)","md5":"c01f0a7e92ef68606b78b9202df663c8","sha1":"f4fbc29b9fdc57e2e00505dafe666d1098e8b0b1","sha256":"edd69ef41c1620fce91c0a98178e4d38f26924d112230c785bfb29460e02b001","sha512":"312bef6bfeebc8ca8987ae58d88302bb62a6128a793f945bb979d9dc3c80786edae060b8b03efe056784e43644ef08c561cc0319409bed2ad0580b8523a7de9f","ssdeep":"192:wKvubcjHL0WU4o3xiChQ5HARuoiFVNL79g9IW6:NkCiiQQ5gUoM79r","tlshash":"b112952250c5586f1323628fe611375c70fa42fedb5a1a0155b82dff3af6c94ce1b64a","dom_hash":"domhash90ffa0ba01c5a76ba0a7447215dd87f7","first_seen":"2026-08-25T20:53:48.570908Z","last_seen":"2026-08-25T21:14:04.678238Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"rdrplay.ru/","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:14:01Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-23T22:20:52.902616Z","alert_count":0,"request_count":6,"received_data":132338,"sent_data":3445,"comment":"","tags":null,"fingerprints":null},{"fqdn":"rdrplay.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-10","domain_rank":0,"first_seen":"2026-08-25T20:53:41.662097Z","last_seen":"2026-08-25T20:53:41.662097Z","alert_count":28,"request_count":7,"received_data":428246,"sent_data":3396,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-23T22:23:59.870946Z","alert_count":0,"request_count":1,"received_data":16980,"sent_data":565,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"rdrplay.ru/","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"1e3ee11093dc14dfaaab2490967a56b6","sha1":"8297de1715d5e5a2c516c0f85c123007eb9d8a64","sha256":"d3acf7bb004efb225d4f012383a93b5b27b07160e9a383e063800e1a8f71fbef","sha512":"96c0bbf1f48d1694faf653068eb21ab4858866941692711d21289ad4cff5713a1a0bde464f3155827bbf77cca970ba6efc116491fcb9ce55bec1f4659f5a09de","ssdeep":"","tlshash":"79f041e73c894138c3a302a13b73a24c3039243f340eac12f40d1c523fa0e6514a750c","size":615,"data":"","first_seen":"2026-08-25T20:53:48.601096Z","last_seen":"2026-08-25T21:14:04.704132Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rdrplay.ru/assets/app.js","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"3f69039a5f1b06e1d04a8705617a9507","sha1":"c2d27aa565da56ef3dafe75368a8065af7e89d31","sha256":"e635da941ad02b8844392a436e5cfeba83b4a0ce98f308c04d0451ec2e589ca2","sha512":"04e6fdb76e0a69a72f59db31da7f028ab663e0fcb1f3c538edd134d926521b0c16045042ac9120f9f564cbeb5b3385f34d2ab028f08b9891401b08f75ce33ffc","ssdeep":"192:BtMKtW/IP7F0t9kuQrkPMYXkJdXSgxJTJetR8+i4PHeF:MzQRFuQQPVodCgr1ewm+F","tlshash":"b722b7686165257a447713beeb875a68ffb1007b640681057dac4e483ff086243bfeed","size":10068,"data":"","first_seen":"2026-08-25T20:53:48.596743Z","last_seen":"2026-08-25T21:14:04.700337Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.gstatic.com/s/oswald/v57/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlSHYjedg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.314Z","timestamp":1787692414314,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/oswald/v57/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlSHYjedg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rdrplay.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 11748\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 19 Aug 2026 13:41:06 GMT\r\nexpires: Thu, 19 Aug 2027 13:41:06 GMT\r\ncache-control: public, max-age=31536000\r\nage: 545548\r\nlast-modified: Wed, 10 Sep 2025 16:47:19 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":11748,"size_decoded":12561,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 11748, version 1.0","md5":"e4645718d3b4aa628932452fafba025f","sha1":"d8672733e96a06383567981c1a74a89d80bc8c68","sha256":"95c3d8d1db01b5ecd85b0d90aa81d39d24231f74de28c7418cfd8c08261fe929","sha512":"52544b7428ab155ed540775682aecd0dcbe574369e21e0040fab858687753f90875463044ad46bb795da88dc54ab15b23e38c7aa80b28e8989da72b36d841dcb","ssdeep":"192:7Bs/tBdFZ+UCJT9L7F/ja62rASMmRIOczccChUDO6+s8ZTGSheiGbhm0lE8Wxn:1s/h+UCJ5Fa3APeIdc5sE+iGFC8Wh","tlshash":"c732c0c6462c995684af3678d29bd79f1801884d232493229f9431f26b2ff25b632e13","first_seen":"2025-09-24T01:57:15.577329Z","last_seen":"2026-08-25T21:14:04.681714Z","times_seen":238,"resource_available":false,"data":null}},"time_used":58,"timings":{"blocked":12,"dns":0,"connect":0,"send":0,"wait":44,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/oswald/v57/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.308Z","timestamp":1787692414308,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/oswald/v57/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rdrplay.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 21472\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 20 Aug 2026 02:51:17 GMT\r\nexpires: Fri, 20 Aug 2027 02:51:17 GMT\r\ncache-control: public, max-age=31536000\r\nage: 498137\r\nlast-modified: Wed, 10 Sep 2025 16:45:39 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":21472,"size_decoded":22285,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 21472, version 1.0","md5":"5f49329007f1e2c86462fd68a5f3affe","sha1":"aabe123b52750eaf9e6fe604204c2687222b0c54","sha256":"571f3457dab507b6f2ce5394d593ca015251b69fea81ab7a546bd2368e9fc3ed","sha512":"59b693cf63d3bc706adc09d289f51f3be1ed2cec80a6e1ebfaf35a5b569ed006e5785cf1faa884e133ab83eb7a0fce9c4545c512c9e7fed63e94264fb13c4937","ssdeep":"384:89cq4KprqBvQGNLahU+kaK7dWYQmQp48QMg9syZ/0TxUAWKymEIetG0pLlZxeH:8iq4cmvfNLahDK7QVmQqhw1EjLLMH","tlshash":"4da2f1a25a83d949fb68403e3b80287d963a03c733967a63575225ebbae1c53305a4c9","first_seen":"2025-09-11T17:19:09.761048Z","last_seen":"2026-08-25T23:41:32.481131Z","times_seen":13610,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":18,"dns":0,"connect":0,"send":0,"wait":38,"receive":15,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rdrplay.ru/assets/rdr2-cover.webp","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.319Z","timestamp":1787692414319,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.rdrplay.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:23:06 GMT","end":"Sun, 08 Nov 2026 19:23:05 GMT"},"fingerprint":{"sha1":"12:10:78:88:14:BC:83:01:91:31:68:DA:D7:61:3E:3D:AE:F1:99:FD","sha256":"9F:C6:9C:4A:53:A5:5A:A1:57:E5:39:2F:AE:6F:6C:5E:83:AF:1F:EA:1A:B4:C7:44:B8:67:24:74:70:E2:3B:2C"}}},"request":{"raw":"GET /assets/rdr2-cover.webp HTTP/1.1\r\nHost: rdrplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rdrplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:13:34 GMT\r\ncontent-type: image/webp\r\ncontent-length: 110450\r\nlast-modified: Tue, 11 Aug 2026 19:12:59 GMT\r\netag: \"1af72-658ca42508939\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":110450,"size_decoded":110864,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 933x1400, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9cce7b35ec00b7ffe4f776b1a731359f","sha1":"c951693a5d9ed479f1016bdf0e803eb9537c64c9","sha256":"d4c36d9d8fd393e916d489bd7895f850a15f699d91855735be25b6fd84b6812f","sha512":"fa4d1f5b68b503ab393af763df28b0f590f30c055f23460f1ffa30a3fef3f44d96b1766200ffec03239bbf06181363d7e8f3e6437a140cb7ac0adda91828e29d","ssdeep":"3072:WYgSICF5RTsWIPKQ9QsCbw864LJcL3doaHqpTCSQdS/1ltmrj7C/NsT/:fvLRsWmT9Qrbb6CJ/LY27GHC/Nsr","tlshash":"54b31212a6e8f979d772e4e455d22881995ff10401212d4a7b37a01effe300e259dddf","first_seen":"2026-08-25T20:53:48.579676Z","last_seen":"2026-08-25T21:14:04.691629Z","times_seen":2,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":126,"receive":91,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rdrplay.ru/assets/rdr1-cover.webp","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.321Z","timestamp":1787692414321,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.rdrplay.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:23:06 GMT","end":"Sun, 08 Nov 2026 19:23:05 GMT"},"fingerprint":{"sha1":"12:10:78:88:14:BC:83:01:91:31:68:DA:D7:61:3E:3D:AE:F1:99:FD","sha256":"9F:C6:9C:4A:53:A5:5A:A1:57:E5:39:2F:AE:6F:6C:5E:83:AF:1F:EA:1A:B4:C7:44:B8:67:24:74:70:E2:3B:2C"}}},"request":{"raw":"GET /assets/rdr1-cover.webp HTTP/1.1\r\nHost: rdrplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rdrplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:13:34 GMT\r\ncontent-type: image/webp\r\ncontent-length: 222316\r\nlast-modified: Tue, 11 Aug 2026 19:12:59 GMT\r\netag: \"3646c-658ca424ffc96\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":222316,"size_decoded":222730,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 933x1400, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"b82d98ff1ca65a4c0339f07aa5690516","sha1":"bf3b6c392c27634737b7cf68a3a5af2f9b5c65e2","sha256":"69d70a932928ef485807e7cee1ba716268ce150a23df685137fd04b29a94d227","sha512":"ceaac0448de68226e1318a5d5cc1fd2a635f74fccf64885cf1ba3f2f05c0bb5f6ca7abe65480e1a49b23c7fb606cce7f8307f311e98a19da9e6bdb461ca7c12b","ssdeep":"6144:vUsK3FzvO9NKavlv3zAO0v3QoBsqInpl/u8swhjWY:ssK3FzGvK6v3zqYoOnpl23c","tlshash":"79242371b826af0d50aff2c1ba2758ce39397e56c45e2e98054c70e922fc375447b68b","first_seen":"2026-08-25T20:53:48.584211Z","last_seen":"2026-08-25T21:14:04.694236Z","times_seen":2,"resource_available":false,"data":null}},"time_used":217,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":170,"receive":47,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rdrplay.ru/assets/rdr-hero.webp","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.296Z","timestamp":1787692414296,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.rdrplay.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:23:06 GMT","end":"Sun, 08 Nov 2026 19:23:05 GMT"},"fingerprint":{"sha1":"12:10:78:88:14:BC:83:01:91:31:68:DA:D7:61:3E:3D:AE:F1:99:FD","sha256":"9F:C6:9C:4A:53:A5:5A:A1:57:E5:39:2F:AE:6F:6C:5E:83:AF:1F:EA:1A:B4:C7:44:B8:67:24:74:70:E2:3B:2C"}}},"request":{"raw":"GET /assets/rdr-hero.webp HTTP/1.1\r\nHost: rdrplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rdrplay.ru/assets/styles.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:13:34 GMT\r\ncontent-type: image/webp\r\ncontent-length: 57646\r\nlast-modified: Tue, 11 Aug 2026 19:12:59 GMT\r\netag: \"e12e-658ca424d7802\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":57646,"size_decoded":58058,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1400x933, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"9b9e65bdce1f812253bb6a2616fa7c41","sha1":"c88cf16ac9f411672d197b74bb689979841767cf","sha256":"7f1f8604c6efbd2531e207d169fc21972f02ba31164bb81a1c184071a08b8432","sha512":"4ffe1d933153e006933ab78ce861447c5314546c8cb568c8e6a3165a11b5e91928280f4134c1c56f3ce2d6a7805926b43bca72dff5537b92d4f2cb001d4b3aa2","ssdeep":"768:mXPldZFl9pakrVLf9bAmvI+3L8SyZPsq13MAc0kDIQOwtL0/U5HS3ja9SYGC4/3M:uvNrU3+3wSr04OhzHrApsdB4L","tlshash":"9e4302759040ded154632dcee23b446744a4e29273a9931ffe49b70f6895e28afcbf04","first_seen":"2026-08-25T20:53:48.588356Z","last_seen":"2026-08-25T21:14:04.696118Z","times_seen":2,"resource_available":false,"data":null}},"time_used":150,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":60,"receive":90,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rdrplay.ru/assets/favicon.svg","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.544Z","timestamp":1787692414544,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.rdrplay.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:23:06 GMT","end":"Sun, 08 Nov 2026 19:23:05 GMT"},"fingerprint":{"sha1":"12:10:78:88:14:BC:83:01:91:31:68:DA:D7:61:3E:3D:AE:F1:99:FD","sha256":"9F:C6:9C:4A:53:A5:5A:A1:57:E5:39:2F:AE:6F:6C:5E:83:AF:1F:EA:1A:B4:C7:44:B8:67:24:74:70:E2:3B:2C"}}},"request":{"raw":"GET /assets/favicon.svg HTTP/1.1\r\nHost: rdrplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rdrplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:13:34 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 227\r\nlast-modified: Tue, 11 Aug 2026 19:12:59 GMT\r\netag: \"146-658ca424aad1c-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":326,"size_decoded":639,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"a35ba3876d8d85e8802fdfb9e6f76e90","sha1":"5cded0d586a1a7500795281e76b3a68d14039c51","sha256":"b44c148ba89e13acad4bd0f50e0f0c88037e21cf4de82d3755ea14a10ad885da","sha512":"6a489e43d6985efcca4270a706640752f9cf6e4b4a7d9b0d20d1efd472d1134b49bf09e4082a5c2da15b25455782a354c447e5a37fd0664994bb5bd8b6eccdfa","ssdeep":"","tlshash":"7de0266852188c18e6208b08e73d752d013a60d22f4c5415a4a01530a61955f783b3dd","first_seen":"2026-08-25T20:53:48.594898Z","last_seen":"2026-08-25T21:14:04.697823Z","times_seen":2,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rdrplay.ru/assets/styles.css","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:33.931Z","timestamp":1787692413931,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.rdrplay.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:23:06 GMT","end":"Sun, 08 Nov 2026 19:23:05 GMT"},"fingerprint":{"sha1":"12:10:78:88:14:BC:83:01:91:31:68:DA:D7:61:3E:3D:AE:F1:99:FD","sha256":"9F:C6:9C:4A:53:A5:5A:A1:57:E5:39:2F:AE:6F:6C:5E:83:AF:1F:EA:1A:B4:C7:44:B8:67:24:74:70:E2:3B:2C"}}},"request":{"raw":"GET /assets/styles.css HTTP/1.1\r\nHost: rdrplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rdrplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:13:33 GMT\r\ncontent-type: text/css\r\ncontent-length: 4215\r\nlast-modified: Tue, 11 Aug 2026 19:12:59 GMT\r\netag: \"3a0c-658ca4251f488-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":14860,"size_decoded":4676,"mime_type":"text/css","magic":"assembler source, Unicode text, UTF-8 text, with very long lines (365)","md5":"24902be8bc624836d652fb6895b07578","sha1":"2e02ea63b5ee69bf8f4292508276e4e0e2c5c183","sha256":"a5ba7a0d56b05b5e25e74a524f8ee58e7be95f7b4fccbd7bfc62b07ed85baf17","sha512":"9b5fcf00c7a3685017be1854420324127dc4c0eed952c0c5fec89b716f13e00f26821fcd6abe975928e74f07cf197b9d4c03b15dcdb43fb4615256b44ab4d892","ssdeep":"192:534K4EiX1Z2YqlscspzxQllq4/5dp5GiJzcM6tgF/rXeeahzuRW6ue:9kEiX1Z256z6lH5Tp/6tgF/78hzqW6ue","tlshash":"a562d7f56110b239f937e995e9c5b29db124f022e96b43fefc42825c82cb1f71a71609","first_seen":"2026-08-25T20:53:48.575069Z","last_seen":"2026-08-25T21:14:04.699175Z","times_seen":2,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"rdrplay.ru/assets/app.js","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:33.932Z","timestamp":1787692413932,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.rdrplay.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:23:06 GMT","end":"Sun, 08 Nov 2026 19:23:05 GMT"},"fingerprint":{"sha1":"12:10:78:88:14:BC:83:01:91:31:68:DA:D7:61:3E:3D:AE:F1:99:FD","sha256":"9F:C6:9C:4A:53:A5:5A:A1:57:E5:39:2F:AE:6F:6C:5E:83:AF:1F:EA:1A:B4:C7:44:B8:67:24:74:70:E2:3B:2C"}}},"request":{"raw":"GET /assets/app.js HTTP/1.1\r\nHost: rdrplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rdrplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:13:33 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:01:43 GMT\r\netag: W/\"2754-659a331646d93\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":10068,"size_decoded":3754,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"3f69039a5f1b06e1d04a8705617a9507","sha1":"c2d27aa565da56ef3dafe75368a8065af7e89d31","sha256":"e635da941ad02b8844392a436e5cfeba83b4a0ce98f308c04d0451ec2e589ca2","sha512":"04e6fdb76e0a69a72f59db31da7f028ab663e0fcb1f3c538edd134d926521b0c16045042ac9120f9f564cbeb5b3385f34d2ab028f08b9891401b08f75ce33ffc","ssdeep":"192:BtMKtW/IP7F0t9kuQrkPMYXkJdXSgxJTJetR8+i4PHeF:MzQRFuQQPVodCgr1ewm+F","tlshash":"b722b7686165257a447713beeb875a68ffb1007b640681057dac4e483ff086243bfeed","first_seen":"2026-08-25T20:53:48.596743Z","last_seen":"2026-08-25T21:14:04.700337Z","times_seen":2,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Oswald:wght@500;600;700\u0026family=Source+Sans+3:wght@400;500;600;700\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.181Z","timestamp":1787692414181,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:53 GMT","end":"Wed, 28 Oct 2026 20:43:52 GMT"},"fingerprint":{"sha1":"91:24:44:08:3E:65:60:72:3B:18:06:E2:82:7E:C0:8F:97:46:5D:B2","sha256":"71:59:B7:BB:3B:E8:E0:81:C8:B6:24:A3:57:11:62:47:10:A1:3D:E4:38:30:54:27:2E:19:C8:96:02:25:52:DD"}}},"request":{"raw":"GET /css2?family=Oswald:wght@500;600;700\u0026family=Source+Sans+3:wght@400;500;600;700\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://rdrplay.ru/\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Tue, 25 Aug 2026 21:13:34 GMT\r\ndate: Tue, 25 Aug 2026 21:13:34 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16296,"size_decoded":1630,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"1711dcb0599ac0dfc10a98943fec64c8","sha1":"88b8380113b42edb011f7345effcf5acf55c5007","sha256":"43203334e28278a4215099fefda99745d3d8f29b9f2c79b410069471ef4f71a3","sha512":"aa48fcfab25aec6b6ae49cbd4aac7ac58cc13ccb912d55f33ab95999a1ee75799a6212eb96dd7abf0f24e96de2edaad882c668b61b40ee201127939b5e9a2311","ssdeep":"192:4WoKvSs2dWBKSvszeWSKBoss0ogy/M3JIN+hoHh4M3aPN9IoqIRM33yN0PoZPiMG:bJv0F7mG4pEUUv2","tlshash":"9f72eda1441b9484ab871cc237cf3e36ae9e6111b094c23d9ffd289cdcead261355b5e","first_seen":"2026-06-20T19:50:40.871308Z","last_seen":"2026-08-25T21:14:04.701301Z","times_seen":4,"resource_available":false,"data":null}},"time_used":88,"timings":{"blocked":-1,"dns":3,"connect":16,"send":0,"wait":37,"receive":0,"ssl":31},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/sourcesans3/v19/nwpStKy2OAdR1K-IwhWudF-R3w8aZejZ5HZV8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.294Z","timestamp":1787692414294,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/sourcesans3/v19/nwpStKy2OAdR1K-IwhWudF-R3w8aZejZ5HZV8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rdrplay.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28768\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 20 Aug 2026 11:04:32 GMT\r\nexpires: Fri, 20 Aug 2027 11:04:32 GMT\r\ncache-control: public, max-age=31536000\r\nage: 468542\r\nlast-modified: Thu, 04 Sep 2025 17:09:09 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":28768,"size_decoded":29581,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28768, version 1.0","md5":"d0557afb3f0c7a3864f0e3f412bcd8ed","sha1":"b358d67d067e4cd71a3a6e51245fef72cb063c95","sha256":"4ac9b88dc5104c7450eb73bfd416a63dbe4bf6b6acac44b8c953e3567dc4a663","sha512":"596b009234f0f4df076f8f251485b06f7cdb3f0e7458ecb141229f2b3723873c68536d24a5123d55836cc458599da5e0057ce81542400eaede3efdefea4f1bac","ssdeep":"768:kFFnSMWY1gDAuZ0LqnutgJ6keQtlIXoj/fajyA:gnSXqgDARLqb6XQtqXojE","tlshash":"fdd2f2e40b2176e5fbc68c747331715edc714a38c3ef956b125e1ae4202a800b77be84","first_seen":"2025-03-11T05:38:45.137969Z","last_seen":"2026-08-26T00:49:00.698521Z","times_seen":8409,"resource_available":false,"data":null}},"time_used":85,"timings":{"blocked":0,"dns":3,"connect":30,"send":0,"wait":32,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/sourcesans3/v19/nwpStKy2OAdR1K-IwhWudF-R3wsaZejZ5HZV8ZRx.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.311Z","timestamp":1787692414311,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/sourcesans3/v19/nwpStKy2OAdR1K-IwhWudF-R3wsaZejZ5HZV8ZRx.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rdrplay.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18352\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 21 Aug 2026 08:58:33 GMT\r\nexpires: Sat, 21 Aug 2027 08:58:33 GMT\r\ncache-control: public, max-age=31536000\r\nage: 389701\r\nlast-modified: Thu, 04 Sep 2025 17:08:09 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18352,"size_decoded":19165,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18352, version 1.0","md5":"b096746bb639b87495ec3fbcf27670e5","sha1":"38b1164206a027baf3545956c5cb45dd89d755a5","sha256":"ea73ce3e6bebbecfad1062324bcfb344ba829d5b37539326b1c86790a8a729bc","sha512":"a4efcdece003e54ca27a5d727daad564329c6e20296ea081017b96ee3b9e892618380eff76b026c02cdfe6ac299eae37d1997a479b3450ae3a0c68f5ed3a1634","ssdeep":"384:WpHPWuNpziQVn8xAjSJTi+d4BxK8ntes18B76/ZqdmYtJc/gogTg:Wp1ND0AjSc+dH8ntz1+76/ZcmSJc/BCg","tlshash":"3f82d0549b23d09dec6d84b8bdb5ca2f3b89591ad918c700bf762e2dbce24724d4b04c","first_seen":"2025-03-15T08:25:03.107004Z","last_seen":"2026-08-25T21:14:04.702541Z","times_seen":277,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":12,"dns":0,"connect":0,"send":0,"wait":19,"receive":5,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"rdrplay.ru/","fqdn":"rdrplay.ru","domain":"rdrplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:13:33.612Z","timestamp":1787692413612,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.rdrplay.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:23:06 GMT","end":"Sun, 08 Nov 2026 19:23:05 GMT"},"fingerprint":{"sha1":"12:10:78:88:14:BC:83:01:91:31:68:DA:D7:61:3E:3D:AE:F1:99:FD","sha256":"9F:C6:9C:4A:53:A5:5A:A1:57:E5:39:2F:AE:6F:6C:5E:83:AF:1F:EA:1A:B4:C7:44:B8:67:24:74:70:E2:3B:2C"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: rdrplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:13:33 GMT\r\ncontent-type: text/html\r\ncontent-length: 3319\r\nlast-modified: Tue, 11 Aug 2026 19:39:09 GMT\r\netag: \"2571-658ca9fe2d1f6-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9585,"size_decoded":3780,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1207)","md5":"241cc3e5d9eab56c8e4061b3333060ba","sha1":"f62a5f79abad1c266bde08daad6f48d76606f7c7","sha256":"608d7ec40c46f487cd3f3a6ad9c17618b84eb97ce71e80cb02029f4bf8336382","sha512":"77f1a84566cd678931221b625b6bc978fa39399e8e1307b0826df4230537f4ecb54d6d99e6f88ba6d0f70beb55418c7163f5d9ff5d27e33250ed67c76410634f","ssdeep":"192:cKvubc1FK0WUDo3xiChQgHARuNBFVNL79g9IW6:pHpiiQQggUNT79r","tlshash":"0412a66250c5586f2323618be610375d70fb42fe9b1b0a0165b82dff3af6c94ce1b64a","first_seen":"2026-08-25T20:53:48.59193Z","last_seen":"2026-08-25T21:14:04.703124Z","times_seen":2,"resource_available":false,"data":null}},"time_used":170,"timings":{"blocked":-1,"dns":22,"connect":42,"send":0,"wait":59,"receive":0,"ssl":47},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"rdrplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/sourcesans3/v19/nwpStKy2OAdR1K-IwhWudF-R3w8aZejZ5HZV8Q.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.309Z","timestamp":1787692414309,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/sourcesans3/v19/nwpStKy2OAdR1K-IwhWudF-R3w8aZejZ5HZV8Q.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rdrplay.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28768\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 20 Aug 2026 11:04:32 GMT\r\nexpires: Fri, 20 Aug 2027 11:04:32 GMT\r\ncache-control: public, max-age=31536000\r\nage: 468542\r\nlast-modified: Thu, 04 Sep 2025 17:09:09 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":28768,"size_decoded":29581,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28768, version 1.0","md5":"d0557afb3f0c7a3864f0e3f412bcd8ed","sha1":"b358d67d067e4cd71a3a6e51245fef72cb063c95","sha256":"4ac9b88dc5104c7450eb73bfd416a63dbe4bf6b6acac44b8c953e3567dc4a663","sha512":"596b009234f0f4df076f8f251485b06f7cdb3f0e7458ecb141229f2b3723873c68536d24a5123d55836cc458599da5e0057ce81542400eaede3efdefea4f1bac","ssdeep":"768:kFFnSMWY1gDAuZ0LqnutgJ6keQtlIXoj/fajyA:gnSXqgDARLqb6XQtqXojE","tlshash":"fdd2f2e40b2176e5fbc68c747331715edc714a38c3ef956b125e1ae4202a800b77be84","first_seen":"2025-03-11T05:38:45.137969Z","last_seen":"2026-08-26T00:49:00.698521Z","times_seen":8409,"resource_available":false,"data":null}},"time_used":66,"timings":{"blocked":16,"dns":0,"connect":0,"send":0,"wait":47,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/sourcesans3/v19/nwpStKy2OAdR1K-IwhWudF-R3wsaZejZ5HZV8ZRx.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.99","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://rdrplay.ru/","date":"2026-08-25T21:13:34.313Z","timestamp":1787692414313,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Wed, 05 Aug 2026 20:43:51 GMT","end":"Wed, 28 Oct 2026 20:43:50 GMT"},"fingerprint":{"sha1":"B9:F7:74:85:7B:1C:5F:E9:C2:86:5A:AA:63:0F:34:84:5F:79:D6:96","sha256":"BA:57:10:D4:7E:A5:7C:C6:22:90:71:24:65:31:49:39:40:E5:C8:EB:E4:74:F7:D9:0B:3E:17:36:DD:31:9D:EB"}}},"request":{"raw":"GET /s/sourcesans3/v19/nwpStKy2OAdR1K-IwhWudF-R3wsaZejZ5HZV8ZRx.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: https://rdrplay.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 18352\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Fri, 21 Aug 2026 08:58:33 GMT\r\nexpires: Sat, 21 Aug 2027 08:58:33 GMT\r\ncache-control: public, max-age=31536000\r\nage: 389701\r\nlast-modified: Thu, 04 Sep 2025 17:08:09 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":18352,"size_decoded":19165,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 18352, version 1.0","md5":"b096746bb639b87495ec3fbcf27670e5","sha1":"38b1164206a027baf3545956c5cb45dd89d755a5","sha256":"ea73ce3e6bebbecfad1062324bcfb344ba829d5b37539326b1c86790a8a729bc","sha512":"a4efcdece003e54ca27a5d727daad564329c6e20296ea081017b96ee3b9e892618380eff76b026c02cdfe6ac299eae37d1997a479b3450ae3a0c68f5ed3a1634","ssdeep":"384:WpHPWuNpziQVn8xAjSJTi+d4BxK8ntes18B76/ZqdmYtJc/gogTg:Wp1ND0AjSc+dH8ntz1+76/ZcmSJc/BCg","tlshash":"3f82d0549b23d09dec6d84b8bdb5ca2f3b89591ad918c700bf762e2dbce24724d4b04c","first_seen":"2025-03-15T08:25:03.107004Z","last_seen":"2026-08-25T21:14:04.702541Z","times_seen":277,"resource_available":false,"data":null}},"time_used":63,"timings":{"blocked":12,"dns":0,"connect":0,"send":0,"wait":26,"receive":25,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}