{"report_id":"c943008a-0a9b-4099-b157-928a4ac2e3c3","version":0,"status":"done","tags":[],"date":"2026-08-25T21:03:33Z","url":{"schema":"http","addr":"halflife-play.ru/","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"halflife-play.ru/","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"title":"Half-Life — скачать для ПК, версии и установка","dom":{"size":12994,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (774)","md5":"abcbadcbce1f69373731c320072da72f","sha1":"374f4c8e90fc2b1e9d537d757da9039747496a7a","sha256":"e0b8a4d715024c411b17af4dba84cd030800036615c3a5ffd48e918197e86b43","sha512":"d7e50422c20479c30815409c6ce86e78626779913096f76e44a9c771cab01a7f5d7fc800ffdfc4edf950c638231bc1167a01b0b89428e6c2cb737f613c4065d0","ssdeep":"384:TRX/743kI2BD2PY1+JEpIIR1I6vo4v/vr6GAVvEEt/vN38v/vT99i:GKjIIrI6g43j6GAVvE2nN383r99i","tlshash":"76426673a0e4547f431265cae511bb1db9a382bfde17562271bc19ae2ff2c408d1b21e","dom_hash":"domhash7e196ac0f7fbb0dbd72dda0e8a76267a","first_seen":"2026-08-25T20:55:08.004335Z","last_seen":"2026-08-25T21:03:35.451883Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"halflife-play.ru/","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:03:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"halflife-play.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-10","domain_rank":0,"first_seen":"2026-08-25T20:55:04.830259Z","last_seen":"2026-08-25T20:55:04.830259Z","alert_count":14,"request_count":7,"received_data":149841,"sent_data":3418,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"halflife-play.ru/","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"0b78ba4edbe55ff6e7ff7ba7ea98256a","sha1":"2123d85e5b6b7dd5539b99af8cc71afc3a87ff7a","sha256":"45b4f9377cf13a2c55801b37b9c28854e2a032e1ab336fcc47bebf94731459dd","sha512":"faefc895603453a8165ded0b0947f387d739076e099cb776cf12c779f110a0e52a5ad939233a6f6c1a4beca0be263614c6be8f8564c9cbd1fa60e6a7bd74c282","ssdeep":"","tlshash":"2bf0e1e73c8d5538c7b712b53b73924c317a253f740eac52b50d68523fa4e6514ab51c","size":615,"data":"","first_seen":"2026-08-25T20:55:08.044523Z","last_seen":"2026-08-25T21:03:35.45869Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"halflife-play.ru/assets/app.js","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"51e398ef29f7775dbba461a064534cae","sha1":"51ed3502f1b54cd6a04ad7b3d6c18f3e394ce6ee","sha256":"63a3ca08c267f0832e015437725aa700da72ee3d9b36476221e0a8fe1f057489","sha512":"1171a5314c649c74295acfd2fc0f271a99c52e010db4d7564de63f5cca75ed69e6ada2d066d4e4203eca0e92cbc5730c1958ca9d7fe58b79646f7dc320fd24e1","ssdeep":"192:qtjkCdU1PqP/wqUU7MoflENvsGv/aMY6Yvvb9WN0l1:Ey3z4lERsGvSZvZbl1","tlshash":"6112b654602225b6407b63beaf83954cff7104a7b40582057eac4f483ff19a282b7eed","size":9530,"data":"","first_seen":"2026-08-25T20:55:08.011442Z","last_seen":"2026-08-25T21:03:35.453063Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"halflife-play.ru/assets/app.js","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://halflife-play.ru/","date":"2026-08-25T21:03:06.922Z","timestamp":1787691786922,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.halflife-play.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:19:30 GMT","end":"Sun, 08 Nov 2026 19:19:29 GMT"},"fingerprint":{"sha1":"AD:FC:F2:CD:9B:EC:F5:DF:AC:37:47:EE:2F:24:02:9E:F3:18:82:61","sha256":"A6:BB:DD:39:42:0B:95:C4:32:3F:55:43:3D:CA:1E:CF:02:88:89:7F:4C:C9:AB:DD:91:55:E7:F5:1E:99:BB:E9"}}},"request":{"raw":"GET /assets/app.js HTTP/1.1\r\nHost: halflife-play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://halflife-play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:06 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:00:56 GMT\r\netag: W/\"253a-659a32e9b121f\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9530,"size_decoded":3648,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"51e398ef29f7775dbba461a064534cae","sha1":"51ed3502f1b54cd6a04ad7b3d6c18f3e394ce6ee","sha256":"63a3ca08c267f0832e015437725aa700da72ee3d9b36476221e0a8fe1f057489","sha512":"1171a5314c649c74295acfd2fc0f271a99c52e010db4d7564de63f5cca75ed69e6ada2d066d4e4203eca0e92cbc5730c1958ca9d7fe58b79646f7dc320fd24e1","ssdeep":"192:qtjkCdU1PqP/wqUU7MoflENvsGv/aMY6Yvvb9WN0l1:Ey3z4lERsGvSZvZbl1","tlshash":"6112b654602225b6407b63beaf83954cff7104a7b40582057eac4f483ff19a282b7eed","first_seen":"2026-08-25T20:55:08.011442Z","last_seen":"2026-08-25T21:03:35.453063Z","times_seen":2,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"halflife-play.ru/assets/half-life-hero.webp","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://halflife-play.ru/","date":"2026-08-25T21:03:06.926Z","timestamp":1787691786926,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.halflife-play.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:19:30 GMT","end":"Sun, 08 Nov 2026 19:19:29 GMT"},"fingerprint":{"sha1":"AD:FC:F2:CD:9B:EC:F5:DF:AC:37:47:EE:2F:24:02:9E:F3:18:82:61","sha256":"A6:BB:DD:39:42:0B:95:C4:32:3F:55:43:3D:CA:1E:CF:02:88:89:7F:4C:C9:AB:DD:91:55:E7:F5:1E:99:BB:E9"}}},"request":{"raw":"GET /assets/half-life-hero.webp HTTP/1.1\r\nHost: halflife-play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://halflife-play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:06 GMT\r\ncontent-type: image/webp\r\ncontent-length: 51298\r\nlast-modified: Tue, 11 Aug 2026 19:48:33 GMT\r\netag: \"c862-658cac1840216\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":51298,"size_decoded":51710,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1400x933, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"971d061a85585271b111fc4a1591a362","sha1":"aad3be0c53fa0d5961bd8f408405b3f57338feb8","sha256":"d56c08ba1b7b917ee7ebe973a4081d43f9dc801b736180eada56ea948624b70c","sha512":"a1ad5f5633e608060790b138d442a1bf120d54321764c4705801cf2fd66da85f6652795bda62b82a52e0a30d7aeff51807d8536d97de8c41357437b761f3fe6a","ssdeep":"1536:kgScRGe06hiY25+SjPWDyEX9/W5WvLZrgcWxD:Awl06h1SjeD39jZcX","tlshash":"9c3301e718a863c82547d3b531e41b8d04e8f9b4a36c2b350b5ed3dd32fb867266804a","first_seen":"2026-08-25T20:55:08.014664Z","last_seen":"2026-08-25T21:03:35.453894Z","times_seen":2,"resource_available":false,"data":null}},"time_used":100,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"halflife-play.ru/assets/black-mesa-corridor.webp","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://halflife-play.ru/","date":"2026-08-25T21:03:06.991Z","timestamp":1787691786991,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.halflife-play.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:19:30 GMT","end":"Sun, 08 Nov 2026 19:19:29 GMT"},"fingerprint":{"sha1":"AD:FC:F2:CD:9B:EC:F5:DF:AC:37:47:EE:2F:24:02:9E:F3:18:82:61","sha256":"A6:BB:DD:39:42:0B:95:C4:32:3F:55:43:3D:CA:1E:CF:02:88:89:7F:4C:C9:AB:DD:91:55:E7:F5:1E:99:BB:E9"}}},"request":{"raw":"GET /assets/black-mesa-corridor.webp HTTP/1.1\r\nHost: halflife-play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://halflife-play.ru/assets/styles.css\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:07 GMT\r\ncontent-type: image/webp\r\ncontent-length: 53312\r\nlast-modified: Tue, 11 Aug 2026 19:48:33 GMT\r\netag: \"d040-658cac18123a7\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":53312,"size_decoded":53724,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1400x933, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"e007ca79d8c77cc6f41b8822afdd7fff","sha1":"780a3dcda1ff872ad874cc555087de2c9fa1cbb9","sha256":"55ad05bfb20a54ad07b6db2ca4c3042f4ba626285cfe903d1796d9e6c88fa4b4","sha512":"f72ed08810df9dceea0a4f2e3d477c88ceef042438be58d559b2199abd97a8f551d78ef7a6a7fa5dcb87c5ff4064ad96157518b99d37ac5f0298082181a9b4f3","ssdeep":"768:TB1/8hF995Zm++GQ+IBuvBCNB6zKBmRVrdRuL9vr3gXKhNq6ENZkG/RdQ8CHtUU1:TB+rMHZNYuWpDuR3gX4Nq3T/Rdy+jw","tlshash":"093301f693c95100815dabb10a171cdbd0efe7394d94c23aea891afe85a6cae4130823","first_seen":"2026-08-25T20:55:08.018234Z","last_seen":"2026-08-25T21:03:35.45476Z","times_seen":2,"resource_available":false,"data":null}},"time_used":79,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":48,"receive":31,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"halflife-play.ru/assets/icons.svg","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://halflife-play.ru/","date":"2026-08-25T21:03:06.993Z","timestamp":1787691786993,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.halflife-play.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:19:30 GMT","end":"Sun, 08 Nov 2026 19:19:29 GMT"},"fingerprint":{"sha1":"AD:FC:F2:CD:9B:EC:F5:DF:AC:37:47:EE:2F:24:02:9E:F3:18:82:61","sha256":"A6:BB:DD:39:42:0B:95:C4:32:3F:55:43:3D:CA:1E:CF:02:88:89:7F:4C:C9:AB:DD:91:55:E7:F5:1E:99:BB:E9"}}},"request":{"raw":"GET /assets/icons.svg HTTP/1.1\r\nHost: halflife-play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://halflife-play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:07 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 910\r\nlast-modified: Tue, 11 Aug 2026 19:48:33 GMT\r\netag: \"a61-658cac184adf9-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2657,"size_decoded":1322,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"3b28b7db948f945073b13a09013653cf","sha1":"b53991deb47d9b212b59710b47b786e764c491f1","sha256":"ee6abf05448a87d42d143f38a5ee69a3c6fbe62f892cb8e30188e1ab78b36aa1","sha512":"143e6339d05a3128dab81ec8bade295e8f5df1102845d81f88c86ff14317493066c33c84ecefa57e8ef428acdc946b114c8abeb14e07e8bf10e0688204178ed9","ssdeep":"","tlshash":"1d51402ad6bc650c44858f775795f5a6212f33db21c900bc78ac67500bae296ec93fa4","first_seen":"2026-08-25T20:55:08.021113Z","last_seen":"2026-08-25T21:03:35.455532Z","times_seen":2,"resource_available":false,"data":null}},"time_used":77,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":77,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"halflife-play.ru/assets/favicon.svg","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://halflife-play.ru/","date":"2026-08-25T21:03:07.213Z","timestamp":1787691787213,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.halflife-play.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:19:30 GMT","end":"Sun, 08 Nov 2026 19:19:29 GMT"},"fingerprint":{"sha1":"AD:FC:F2:CD:9B:EC:F5:DF:AC:37:47:EE:2F:24:02:9E:F3:18:82:61","sha256":"A6:BB:DD:39:42:0B:95:C4:32:3F:55:43:3D:CA:1E:CF:02:88:89:7F:4C:C9:AB:DD:91:55:E7:F5:1E:99:BB:E9"}}},"request":{"raw":"GET /assets/favicon.svg HTTP/1.1\r\nHost: halflife-play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://halflife-play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:07 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 184\r\nlast-modified: Tue, 11 Aug 2026 19:48:33 GMT\r\netag: \"dd-658cac1829e97-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":221,"size_decoded":595,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"68031ba78da7a20c5343fde49fc922c6","sha1":"50a2b96b84efa654b214994704ea0e7acbf51f72","sha256":"d9bc4b0ac1b4e42ddca375178c234400fb2ade2803b366d5ba2a552e08146e5a","sha512":"6be6d6bb563deed23acd436c1772e78f8d6ef9eb76a09d5141ab2ca2a6a08cd838808d7bc9b1f47146fca72f60403830b2fc6287640b563607a0612240e465f0","ssdeep":"","tlshash":"46d0a74961584914b5204725d6a87529502a10e15a8d512dd4e011301545abe783b6ac","first_seen":"2026-08-25T20:55:08.024941Z","last_seen":"2026-08-25T21:03:35.456362Z","times_seen":2,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"halflife-play.ru/","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:03:06.510Z","timestamp":1787691786510,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.halflife-play.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:19:30 GMT","end":"Sun, 08 Nov 2026 19:19:29 GMT"},"fingerprint":{"sha1":"AD:FC:F2:CD:9B:EC:F5:DF:AC:37:47:EE:2F:24:02:9E:F3:18:82:61","sha256":"A6:BB:DD:39:42:0B:95:C4:32:3F:55:43:3D:CA:1E:CF:02:88:89:7F:4C:C9:AB:DD:91:55:E7:F5:1E:99:BB:E9"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: halflife-play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:06 GMT\r\ncontent-type: text/html\r\ncontent-length: 3971\r\nlast-modified: Tue, 11 Aug 2026 19:52:56 GMT\r\netag: \"33b4-658cad137998a-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":13236,"size_decoded":4432,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (693)","md5":"8f69e78c3aec13d94b03c32a83e0e13d","sha1":"f2d1e3dedcc9022640c138e60105aeccbc2cc383","sha256":"9920a4e0f618bbfd26a49d391c8c7e5b92da623f99f9aa10395c69932f91a589","sha512":"59979bf5087d55216542c5505c4991848ebdbdd64059f76848df2e414b857dfad897a882eed89ec074a9b2fc2b6bbbfedecedad3d1f9d5e0c65f9c64feaad00e","ssdeep":"384:xRX/743kI2B5l2PYM+kE6IIR1I6vo4v/vr6GAVvEEt/vN38v/vT99K:QxzIIrI6g43j6GAVvE2nN383r99K","tlshash":"a442557390e4547f431265cae511bb1db9a382bfde1b562271bc19ae2ff2c408d1b21e","first_seen":"2026-08-25T20:55:08.041285Z","last_seen":"2026-08-25T21:03:35.457391Z","times_seen":2,"resource_available":false,"data":null}},"time_used":244,"timings":{"blocked":-1,"dns":58,"connect":54,"send":0,"wait":73,"receive":0,"ssl":59},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"halflife-play.ru/assets/styles.css","fqdn":"halflife-play.ru","domain":"halflife-play.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://halflife-play.ru/","date":"2026-08-25T21:03:06.921Z","timestamp":1787691786921,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.halflife-play.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:19:30 GMT","end":"Sun, 08 Nov 2026 19:19:29 GMT"},"fingerprint":{"sha1":"AD:FC:F2:CD:9B:EC:F5:DF:AC:37:47:EE:2F:24:02:9E:F3:18:82:61","sha256":"A6:BB:DD:39:42:0B:95:C4:32:3F:55:43:3D:CA:1E:CF:02:88:89:7F:4C:C9:AB:DD:91:55:E7:F5:1E:99:BB:E9"}}},"request":{"raw":"GET /assets/styles.css HTTP/1.1\r\nHost: halflife-play.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://halflife-play.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:03:06 GMT\r\ncontent-type: text/css\r\ncontent-length: 4672\r\nlast-modified: Tue, 11 Aug 2026 19:48:33 GMT\r\netag: \"40d5-658cac186e084-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16597,"size_decoded":5133,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (1633)","md5":"e5142b842a97b4045f8a963814e49302","sha1":"3957eb51daf34fd15c426eb3ce26d847e9b63f16","sha256":"04606f425896b66e9dbbfe943f97a7637dfab3c6e600204929ed57b1809b6734","sha512":"6427d289a98b86d694a25702399a395654ab323529d5b7cd91bba88e8f2796537097d379b91c44b3e6a68c934f2ea70848d9ff4dab749d8ab6d16a68ed6b82a8","ssdeep":"384:VrJTTzwvBq05wWLEEQdcPb3x8f7lazdh+N3sg/X:VrhzwaTSPb3YB3x/X","tlshash":"0f72a432a260713cf53be655d6d0a69eb220e113e8278bfdfe81d31585c71f35a3660a","first_seen":"2026-08-25T20:55:08.008489Z","last_seen":"2026-08-25T21:03:35.45807Z","times_seen":2,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"halflife-play.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}