{"report_id":"dc9e4023-26c0-4c81-b582-e854f7744a8d","version":0,"status":"done","tags":[],"date":"2026-08-25T21:05:17Z","url":{"schema":"http","addr":"poppyplaytimeplay.ru/","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"title":"Poppy Playtime скачать на ПК бесплатно — все главы на русском","dom":{"size":16678,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1256)","md5":"4c3420f4e0b0b8e43ec3b67aa5a1bc0c","sha1":"60d10e60b4f76f2e1f79673f969916b93bec14fe","sha256":"2d8121bea6f102f1693dadb6207197ea05f227e773ceff4b5994f76a592d86b7","sha512":"2b00611cb5256ac02270e00d4d8f0cd9c60457a951667914606d0c9b75476e5178ba5e17be6be5bba985d5905614c6d9afdb3c98fd1e3f6584f58f33dbf40b2e","ssdeep":"384:TRH/IcTqhvogwwmThfyXHrjcpFnj6Iw/kPopdIJXqQ8h9e:oogw5haXrjU16Iw/kPop2h6h9e","tlshash":"2e72422294e8607f4103d199ea147b8d7aa741bffa4a1601717c2ead3ff3d54ca2f609","dom_hash":"domhashc84f4922ae34c328db05b80fd5cd35b5","first_seen":"2026-08-25T20:53:33.366882Z","last_seen":"2026-08-25T21:05:18.439514Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"poppyplaytimeplay.ru/","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:05:17Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"poppyplaytimeplay.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-10","domain_rank":0,"first_seen":"2026-08-25T20:53:30.012191Z","last_seen":"2026-08-25T20:53:30.012191Z","alert_count":36,"request_count":9,"received_data":432241,"sent_data":4523,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"94163314fc55574254e9b0909ad12adc","sha1":"c2d0906918bc6d869eccb75d30b97e5c541e1be5","sha256":"7be300e23d24f7f95657b3e8fb451a4b3f4324ca2e24e8315467f599ea2c9269","sha512":"7deb390a58d869879e785275db225cb097c0adef797d6a114b428a0c6ba7186a749266a025f0e79cbcbfb3e334aac0b615ca669237334c893cbb6bc003e07864","ssdeep":"","tlshash":"66f041e73cc94038c3a312e53b73924c307a243f340ebc52b40d18523fa0ea514a750c","size":615,"data":"","first_seen":"2026-08-25T20:53:33.391092Z","last_seen":"2026-08-25T21:05:18.444968Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/app.js","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"e5eae34e9a846d811ac93c2f128a4542","sha1":"0ff1f911def263e841baf8e3a335072b1108194a","sha256":"471b5de467e53029277ae0f020ad47e6789dab9511f760483da55b51ed190e55","sha512":"5e70fe84da4b3e616d38029ac6986e119ac985b78aae83fc2fb4667c9c78698a044ca137dad78fae53e2bf06e6a99cb72d65451bf29197109e9b2781d8e22054","ssdeep":"96:OMPVtC/AHU2NnhAz4XVHvGjvTXBvr6/KdBi3qlP1/aqO:BtOAHU2Nn+zIhv8vzBvacZa","tlshash":"6bc145a8693972b540fb23beaf878658fb310493700552093dbc8e842fb5d65c6f2dd9","size":5767,"data":"","first_seen":"2026-08-25T20:53:33.370998Z","last_seen":"2026-08-25T21:05:18.440883Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:04:49.015Z","timestamp":1787691889015,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.poppyplaytimeplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:14:07 GMT","end":"Sun, 08 Nov 2026 19:14:06 GMT"},"fingerprint":{"sha1":"96:29:BF:8E:6F:16:60:ED:10:EA:7F:8C:F3:A7:64:51:CA:4C:7A:3B","sha256":"7B:77:1D:59:6B:8C:1E:35:F4:F5:01:52:1C:B3:FA:4C:65:66:3B:EB:6B:85:7D:70:A3:F4:6E:B1:9E:BB:67:0A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: poppyplaytimeplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:04:49 GMT\r\ncontent-type: text/html\r\ncontent-length: 5369\r\nlast-modified: Sat, 22 Aug 2026 13:53:34 GMT\r\netag: \"416e-659a314449e14-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":16750,"size_decoded":5830,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (1244)","md5":"1e934d60a16faff812e5c7ab1a27d7e3","sha1":"d03e892eda637437c87d4a8e4b00d27c1d578cec","sha256":"7f240ab0924c2486c305f29e9a2e345aa9526f04b48af71358dbbea0edb915fe","sha512":"d03bd23009afd612821925b9fe15b6f9f598ef71fb1ea8fec7e351d0494b91dcad7ad78c704f7b572b27ad8d1a439ea6a0372138e7d0c75b9c2fc74ddcfea914","ssdeep":"384:RRH/IcTqhvo0RmThIyXHrjcpFnj6Iw6kPopdDbuOQ8h92:mo0uhRXrjU16Iw6kPop9q2h92","tlshash":"5872422194e8607f4103d199ea147b8d7aa741bffa4a061171bc2ead3ff3d54ca2f609","first_seen":"2026-08-25T20:53:33.388946Z","last_seen":"2026-08-25T21:05:18.440256Z","times_seen":2,"resource_available":false,"data":null}},"time_used":297,"timings":{"blocked":-1,"dns":114,"connect":54,"send":0,"wait":71,"receive":0,"ssl":58},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/app.js","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://poppyplaytimeplay.ru/","date":"2026-08-25T21:04:49.513Z","timestamp":1787691889513,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.poppyplaytimeplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:14:07 GMT","end":"Sun, 08 Nov 2026 19:14:06 GMT"},"fingerprint":{"sha1":"96:29:BF:8E:6F:16:60:ED:10:EA:7F:8C:F3:A7:64:51:CA:4C:7A:3B","sha256":"7B:77:1D:59:6B:8C:1E:35:F4:F5:01:52:1C:B3:FA:4C:65:66:3B:EB:6B:85:7D:70:A3:F4:6E:B1:9E:BB:67:0A"}}},"request":{"raw":"GET /app.js HTTP/1.1\r\nHost: poppyplaytimeplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://poppyplaytimeplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:04:49 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 13:53:32 GMT\r\netag: W/\"1687-659a31423f9fb\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":5767,"size_decoded":2227,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"e5eae34e9a846d811ac93c2f128a4542","sha1":"0ff1f911def263e841baf8e3a335072b1108194a","sha256":"471b5de467e53029277ae0f020ad47e6789dab9511f760483da55b51ed190e55","sha512":"5e70fe84da4b3e616d38029ac6986e119ac985b78aae83fc2fb4667c9c78698a044ca137dad78fae53e2bf06e6a99cb72d65451bf29197109e9b2781d8e22054","ssdeep":"96:OMPVtC/AHU2NnhAz4XVHvGjvTXBvr6/KdBi3qlP1/aqO:BtOAHU2Nn+zIhv8vzBvacZa","tlshash":"6bc145a8693972b540fb23beaf878658fb310493700552093dbc8e842fb5d65c6f2dd9","first_seen":"2026-08-25T20:53:33.370998Z","last_seen":"2026-08-25T21:05:18.440883Z","times_seen":2,"resource_available":true,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/favicon.svg","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://poppyplaytimeplay.ru/","date":"2026-08-25T21:04:49.518Z","timestamp":1787691889518,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.poppyplaytimeplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:14:07 GMT","end":"Sun, 08 Nov 2026 19:14:06 GMT"},"fingerprint":{"sha1":"96:29:BF:8E:6F:16:60:ED:10:EA:7F:8C:F3:A7:64:51:CA:4C:7A:3B","sha256":"7B:77:1D:59:6B:8C:1E:35:F4:F5:01:52:1C:B3:FA:4C:65:66:3B:EB:6B:85:7D:70:A3:F4:6E:B1:9E:BB:67:0A"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: poppyplaytimeplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://poppyplaytimeplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:04:49 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 7343\r\nlast-modified: Tue, 11 Aug 2026 19:01:36 GMT\r\netag: \"25ba-658ca199cecb2-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9658,"size_decoded":7757,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c4b0f5e8075236065ea6191de1b9d6a0","sha1":"a69f1a0cd7c1acd6cb8b81573e52ef9c86eac65e","sha256":"ffe968b3574cb3b28d81514f15e74f973340d4c3aa460c8043f1bb046ebaf9ed","sha512":"4f6515930a44dfc40020c2cc1512f587dc9a5a93751ce6d36c2cca28e67b5db2f19733408e96b0a4bf6a94d5319e5be5d5a0ea5ddb7e888aa69ea14bdf85c5d6","ssdeep":"192:rBUuLNIxEepiS6YYjCK/BnGAqJE5iyi+5pOHsjOLEcI:rB5LNipk1BG+5ij+AQOLEcI","tlshash":"3112d0bdc191f9393d3890beedc7845518c3759d8241b93acfd4650a3949ad3470a7ec","first_seen":"2026-08-25T20:53:33.384303Z","last_seen":"2026-08-25T21:05:18.441699Z","times_seen":2,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":172,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/assets/poppy-hero.webp","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://poppyplaytimeplay.ru/","date":"2026-08-25T21:04:49.519Z","timestamp":1787691889519,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.poppyplaytimeplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:14:07 GMT","end":"Sun, 08 Nov 2026 19:14:06 GMT"},"fingerprint":{"sha1":"96:29:BF:8E:6F:16:60:ED:10:EA:7F:8C:F3:A7:64:51:CA:4C:7A:3B","sha256":"7B:77:1D:59:6B:8C:1E:35:F4:F5:01:52:1C:B3:FA:4C:65:66:3B:EB:6B:85:7D:70:A3:F4:6E:B1:9E:BB:67:0A"}}},"request":{"raw":"GET /assets/poppy-hero.webp HTTP/1.1\r\nHost: poppyplaytimeplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://poppyplaytimeplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:04:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 101518\r\nlast-modified: Tue, 11 Aug 2026 19:01:37 GMT\r\netag: \"18c8e-658ca19b18e58\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":101518,"size_decoded":101932,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"48e0257dce80d540cf605138969e00f1","sha1":"2f5ed118e9f86e384a5b49630b45c47032c651d9","sha256":"929fbfcf905684195a14e531cdc4b6e714372d06f374435cbadde3eac43707be","sha512":"449d26dfb65c14a5edacfd602384302d695dc1f385b67251493edd0ea450720c49a8d2600a4760e044aeb2451973e1950ecf8c5679873c04251bea5264e810f5","ssdeep":"3072:hGEmp/bv0FuR3/vTI3LrnPexyBihMgmWyj9:hGJzwuBTI3PzBiVY9","tlshash":"3ea313d22d6a02b9b21dcd92b5a9ca6b161673efcd4842f4edc14e0e7723f1fa014275","first_seen":"2026-08-25T20:53:33.375075Z","last_seen":"2026-08-25T21:05:18.442343Z","times_seen":2,"resource_available":false,"data":null}},"time_used":174,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":70,"receive":104,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/favicon.svg","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://poppyplaytimeplay.ru/","date":"2026-08-25T21:04:49.985Z","timestamp":1787691889985,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.poppyplaytimeplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:14:07 GMT","end":"Sun, 08 Nov 2026 19:14:06 GMT"},"fingerprint":{"sha1":"96:29:BF:8E:6F:16:60:ED:10:EA:7F:8C:F3:A7:64:51:CA:4C:7A:3B","sha256":"7B:77:1D:59:6B:8C:1E:35:F4:F5:01:52:1C:B3:FA:4C:65:66:3B:EB:6B:85:7D:70:A3:F4:6E:B1:9E:BB:67:0A"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: poppyplaytimeplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://poppyplaytimeplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:04:50 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 7343\r\nlast-modified: Tue, 11 Aug 2026 19:01:36 GMT\r\netag: \"25ba-658ca199cecb2-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":9658,"size_decoded":7757,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c4b0f5e8075236065ea6191de1b9d6a0","sha1":"a69f1a0cd7c1acd6cb8b81573e52ef9c86eac65e","sha256":"ffe968b3574cb3b28d81514f15e74f973340d4c3aa460c8043f1bb046ebaf9ed","sha512":"4f6515930a44dfc40020c2cc1512f587dc9a5a93751ce6d36c2cca28e67b5db2f19733408e96b0a4bf6a94d5319e5be5d5a0ea5ddb7e888aa69ea14bdf85c5d6","ssdeep":"192:rBUuLNIxEepiS6YYjCK/BnGAqJE5iyi+5pOHsjOLEcI:rB5LNipk1BG+5ij+AQOLEcI","tlshash":"3112d0bdc191f9393d3890beedc7845518c3759d8241b93acfd4650a3949ad3470a7ec","first_seen":"2026-08-25T20:53:33.384303Z","last_seen":"2026-08-25T21:05:18.441699Z","times_seen":2,"resource_available":false,"data":null}},"time_used":71,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":71,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/favicon.svg","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://poppyplaytimeplay.ru/","date":"2026-08-25T21:04:49.986Z","timestamp":1787691889986,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.poppyplaytimeplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:14:07 GMT","end":"Sun, 08 Nov 2026 19:14:06 GMT"},"fingerprint":{"sha1":"96:29:BF:8E:6F:16:60:ED:10:EA:7F:8C:F3:A7:64:51:CA:4C:7A:3B","sha256":"7B:77:1D:59:6B:8C:1E:35:F4:F5:01:52:1C:B3:FA:4C:65:66:3B:EB:6B:85:7D:70:A3:F4:6E:B1:9E:BB:67:0A"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: poppyplaytimeplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://poppyplaytimeplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:04:50 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 7343\r\nlast-modified: Tue, 11 Aug 2026 19:01:36 GMT\r\netag: \"25ba-658ca199cecb2-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9658,"size_decoded":7757,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c4b0f5e8075236065ea6191de1b9d6a0","sha1":"a69f1a0cd7c1acd6cb8b81573e52ef9c86eac65e","sha256":"ffe968b3574cb3b28d81514f15e74f973340d4c3aa460c8043f1bb046ebaf9ed","sha512":"4f6515930a44dfc40020c2cc1512f587dc9a5a93751ce6d36c2cca28e67b5db2f19733408e96b0a4bf6a94d5319e5be5d5a0ea5ddb7e888aa69ea14bdf85c5d6","ssdeep":"192:rBUuLNIxEepiS6YYjCK/BnGAqJE5iyi+5pOHsjOLEcI:rB5LNipk1BG+5ij+AQOLEcI","tlshash":"3112d0bdc191f9393d3890beedc7845518c3759d8241b93acfd4650a3949ad3470a7ec","first_seen":"2026-08-25T20:53:33.384303Z","last_seen":"2026-08-25T21:05:18.441699Z","times_seen":2,"resource_available":false,"data":null}},"time_used":69,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":69,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/styles.css","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://poppyplaytimeplay.ru/","date":"2026-08-25T21:04:49.511Z","timestamp":1787691889511,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.poppyplaytimeplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:14:07 GMT","end":"Sun, 08 Nov 2026 19:14:06 GMT"},"fingerprint":{"sha1":"96:29:BF:8E:6F:16:60:ED:10:EA:7F:8C:F3:A7:64:51:CA:4C:7A:3B","sha256":"7B:77:1D:59:6B:8C:1E:35:F4:F5:01:52:1C:B3:FA:4C:65:66:3B:EB:6B:85:7D:70:A3:F4:6E:B1:9E:BB:67:0A"}}},"request":{"raw":"GET /styles.css HTTP/1.1\r\nHost: poppyplaytimeplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://poppyplaytimeplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:04:49 GMT\r\ncontent-type: text/css\r\ncontent-length: 4707\r\nlast-modified: Tue, 11 Aug 2026 19:01:36 GMT\r\netag: \"47f9-658ca19a23c2c-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":18425,"size_decoded":5168,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (325)","md5":"ba1b4db6c5ae127ff7a238e4982cceb0","sha1":"a789c178878a93ddc54b25454a4372193435ea29","sha256":"ad1ed8de2021974b8fcbff48c454ee5901cdbaa66584bd71e7e245e1fc3893fe","sha512":"9bcd2942f88ec6a7d2d596da65b7b7d50184716895b21a5d4a7bba165fe47ba27395ab732cdc65a58b2a4183a4af3740e61d54ce750be261fe9e964f47f6d534","ssdeep":"192:mqO3s53NvCnEsSJueSqM1/RiFI/05sbxOPBA5XsAXXIG9E5LyLDOZXTqeseY:4Yv6neSviFIc5A8BStnN7etY","tlshash":"9482975723201338f93bea99bad6a719b32591039506c9bc9de9004cc7ce2fd51b7b85","first_seen":"2026-08-25T20:53:33.386827Z","last_seen":"2026-08-25T21:05:18.442983Z","times_seen":2,"resource_available":false,"data":null}},"time_used":74,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":74,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/assets/chapter-5.webp","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://poppyplaytimeplay.ru/","date":"2026-08-25T21:04:49.865Z","timestamp":1787691889865,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.poppyplaytimeplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:14:07 GMT","end":"Sun, 08 Nov 2026 19:14:06 GMT"},"fingerprint":{"sha1":"96:29:BF:8E:6F:16:60:ED:10:EA:7F:8C:F3:A7:64:51:CA:4C:7A:3B","sha256":"7B:77:1D:59:6B:8C:1E:35:F4:F5:01:52:1C:B3:FA:4C:65:66:3B:EB:6B:85:7D:70:A3:F4:6E:B1:9E:BB:67:0A"}}},"request":{"raw":"GET /assets/chapter-5.webp HTTP/1.1\r\nHost: poppyplaytimeplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://poppyplaytimeplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:04:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 106902\r\nlast-modified: Tue, 11 Aug 2026 19:01:37 GMT\r\netag: \"1a196-658ca19aea81a\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":106902,"size_decoded":107316,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x1536, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d4d84d8513618786f7a15c563eef0d2f","sha1":"e710952aa433b7d0c15817c3adda1a2b00a40708","sha256":"0689655584859be892a7db8d7a0832fb21e89e98ac88acf6635f00bf32b66a81","sha512":"5bff4b6347d2538245e9168f7188b72a70f7892ccef1e6e1605d8f33b818d02045b15d4c4df5fb0a2b909bc19fcae19e7a6aba2f269231363e4d88d0e63d1499","ssdeep":"1536:esplgJhXVXyMnAejxMMb7wKwhM8zYof9Dym38nKrNUJsZhZUTKbqs61WKXvTHscA:+jXPnuhMEVym35UsZQTKb56YK7H51h8","tlshash":"13a302120033db65e3b23343e757fee955507df361f0ca1e924da298e85b08be83a959","first_seen":"2026-08-25T20:53:33.378143Z","last_seen":"2026-08-25T21:05:18.44359Z","times_seen":2,"resource_available":false,"data":null}},"time_used":64,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"poppyplaytimeplay.ru/assets/chapter-4.webp","fqdn":"poppyplaytimeplay.ru","domain":"poppyplaytimeplay.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://poppyplaytimeplay.ru/","date":"2026-08-25T21:04:49.867Z","timestamp":1787691889867,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.poppyplaytimeplay.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 10 Aug 2026 19:14:07 GMT","end":"Sun, 08 Nov 2026 19:14:06 GMT"},"fingerprint":{"sha1":"96:29:BF:8E:6F:16:60:ED:10:EA:7F:8C:F3:A7:64:51:CA:4C:7A:3B","sha256":"7B:77:1D:59:6B:8C:1E:35:F4:F5:01:52:1C:B3:FA:4C:65:66:3B:EB:6B:85:7D:70:A3:F4:6E:B1:9E:BB:67:0A"}}},"request":{"raw":"GET /assets/chapter-4.webp HTTP/1.1\r\nHost: poppyplaytimeplay.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://poppyplaytimeplay.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:04:49 GMT\r\ncontent-type: image/webp\r\ncontent-length: 150078\r\nlast-modified: Tue, 11 Aug 2026 19:01:37 GMT\r\netag: \"24a3e-658ca19ab96e2\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":150078,"size_decoded":150492,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x1536, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"d03e89a120cfa3b6bd0576f957d11f27","sha1":"cfc0bbb9ed959e1392cc2ff666f2091c814670a7","sha256":"ff630722feeef97396f52627a65702241d6f063dedf2034d1ab079e3eda99d41","sha512":"75da0f96cea8367f3035d603f0ec22aaf53f7094238287d866fe4a99be978a6be830baf7abcd52a9b85768a2373bc4cf2bac88c6ef4cef4232942cdf29a23a66","ssdeep":"3072:lMhKI/tYeTHWjlDPtZbyYzrpO2TF8e8F++E4fmtnNNUKh2D/k:lQ71Yy2JDPtpyYvpNTWQ+EhpNN7hq/k","tlshash":"dde312d197100f6e2ba356b3a9b4b726da7046ac80a9903741b5f745f0ff5373c888e5","first_seen":"2026-08-25T20:53:33.381415Z","last_seen":"2026-08-25T21:05:18.444237Z","times_seen":2,"resource_available":false,"data":null}},"time_used":113,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":63,"receive":50,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"poppyplaytimeplay.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}}]}