{"report_id":"df58dcaf-e15e-4679-bb3b-aaec735f4a6a","version":0,"status":"done","tags":[],"date":"2026-08-25T21:01:42Z","url":{"schema":"http","addr":"getrecuva.ru/","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"getrecuva.ru/","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"title":"Скачать Recuva для Windows бесплатно на русском — восстановление удалённых файлов","dom":{"size":16762,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"954f8bc6d2e9bd8fd2013692aa75f5f9","sha1":"eaa050dec8477b30253027f96c7a4ce2b17b93da","sha256":"2f37f67dcf46c0621db1e3cba4ec0f1ba183cb898394c1e28dbacf30a5b3692b","sha512":"46c226dbc46b359ceeedf64781c57f02962438a2dd3fbb281bf65eb33ce54e65e2f484dae1b72c7c383f5157ea1124e7d1a94cdb2d7d67781b0969439219a9c1","ssdeep":"192:zRv1/ri7Al7HLpWgxHV94DKIIU1QJJTVpk9iVns6X9TH7/tBFQCydM:zRv1/ruAl7Lx3IIU6Ji9kDTHLtUCyG","tlshash":"1672546155f8a4ef0142a146ea156b0d2edac1fffe59562032bc1ead2fe3c51cc1724e","dom_hash":"domhashf813a87151f0da365c656b0b04285612","first_seen":"2026-08-25T20:57:40.172432Z","last_seen":"2026-08-25T21:01:43.384941Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"getrecuva.ru/","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:01:42Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"getrecuva.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-13","domain_rank":0,"first_seen":"2026-08-25T20:57:36.367489Z","last_seen":"2026-08-25T20:57:36.367489Z","alert_count":22,"request_count":11,"received_data":1196117,"sent_data":5364,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"getrecuva.ru/","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"8699d0e52265620581fddaaf63e90c6a","sha1":"8822d84c951a2ddd7595c651b0552c3de1cd14a6","sha256":"4f9c832c4e882b832a84ef5421b87c85e0aaffbeb9af4a3f60b4c5f1e6040426","sha512":"7542602da7271506ee41f94a65f15c8998a409949e512d9dc8db32b17935ce5b1ec0913ae0f38a77510cab2ea952bdc64da6dceebd260776b6d2024644ebb261","ssdeep":"","tlshash":"05f0e177b88492b5d2f63136932ba34c715718b920896c34854dcc813a7ac6d102f96c","size":576,"data":"","first_seen":"2026-08-25T20:57:40.200557Z","last_seen":"2026-08-25T21:01:43.393473Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/js/download-studio.js","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"8db5b6dfe2a87cc68995f91cd4d0a2db","sha1":"0c8b9c019380a1280c1baa33472e02b8584859dd","sha256":"628c0aac77df09d8220ae202a374e1777904f0c5da858699fc5faac6c306e0ed","sha512":"421c1072e6faeaa5b0c6727d8a94ced72b4bbac5dba787e5e1580a4cdff18123b6dbc3c2908f9bab8cad5263f5e6b9a5e8d97e2d78830cf3e83217c8db1e2880","ssdeep":"192:0/kGQa9yQumQ5H0F7mNJp590pzna2ucEnpv9FTbcBneEyc:QkQROgznaJc2pFFTbYneO","tlshash":"4a02a824b9ef30f5106391afee9b654cb5b08167a049c8003d6c9b8a2fd4e7543fe9e5","size":8454,"data":"","first_seen":"2026-08-25T20:57:40.195835Z","last_seen":"2026-08-25T21:01:43.387288Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/js/main.js","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"06929270a0b740303d8e16c79d4368af","sha1":"d7594d33735bc18888c58af2f2f691ddddf76e45","sha256":"4426ed5a5fb7ee0d9ddd24fc0b4890651b43072eab213cb7c4d66509cddfae75","sha512":"c2aea59ac445ed3894633edd709a1eff165794956d41a7763b61a03bace953829f05c74040c9bfb34b469ae1b247080ef2febd246afd99462c1adf71302b4ff8","ssdeep":"","tlshash":"7001263fa5441677c17733e9569842a8f6e1007b6503ca223eddc6412f74865253ecf8","size":673,"data":"","first_seen":"2026-08-25T20:57:40.197557Z","last_seen":"2026-08-25T21:01:43.387938Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"getrecuva.ru/css/style.css","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.160Z","timestamp":1787691674160,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /css/style.css HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: text/css\r\ncontent-length: 3845\r\nlast-modified: Thu, 13 Aug 2026 21:52:04 GMT\r\netag: \"3de8-658f4b6efa97f-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":15848,"size_decoded":4306,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"2bd6b7292c0c5224f8d46fdd52ed2bab","sha1":"b20223f2b5efc43b7b3bc7e6eb6704fb79ddc6d9","sha256":"1c4946a70e15cfa56a70023ba04f3a4116261c0dad2a135d52a96e8ef6adc122","sha512":"68682156ff46a652427a9397948fd01bf21bba2ba64d8b025ba80c7f6790bdeca1344170acec4bc18aa5b7c1a4e11b45ca5f9d25181d0f4663951d82e271d5fe","ssdeep":"192:20aj5m+6eHItJwyxGtb1nTRI79ixVXPKJEJLvSLcWDcB6N:qokyxGtb1TRIpixVXvsncc","tlshash":"c26251a22f242174b977f375fbdbeb8de668b111950902bd7cd50008828d3ba54bdb9c","first_seen":"2026-08-25T20:57:40.192766Z","last_seen":"2026-08-25T21:01:43.385797Z","times_seen":2,"resource_available":false,"data":null}},"time_used":183,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/assets/hero.jpg","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.162Z","timestamp":1787691674162,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /assets/hero.jpg HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: image/jpeg\r\ncontent-length: 140530\r\nlast-modified: Thu, 13 Aug 2026 21:52:03 GMT\r\netag: \"224f2-658f4b6e0d83d\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":140530,"size_decoded":140944,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x853, components 3","md5":"dfa092a50a2bd03c94475558676e3dcc","sha1":"5bfb29c935fccccbbd26309407ce517ec2b9da43","sha256":"3cd8c74377c669db00fdb64ece721e26c2b11cfe3df2a3bb6eb1dc0304a009fb","sha512":"fc64c81f66208f2b1859fa261ef128a8fa98f9332cc15d9a4c3d116f12101dcefa654926817e03ee6ab3b22964383bedb0119356acd26494c92a31a2eb7fbd3b","ssdeep":"3072:rl2a6YaThF/5MvauBGMbwV/lcYMulNAA7VLiy+rTaX/HDUqJYc4Huc//GQe:rlW11b0JmNKLuoAJJjvHQqv4Hn/e","tlshash":"75d31207910ce18afd711f971d0e2ce32021a661b986bbab2c9bc85f11a295c5fc6d71","first_seen":"2026-08-25T20:57:40.194265Z","last_seen":"2026-08-25T21:01:43.386662Z","times_seen":2,"resource_available":false,"data":null}},"time_used":234,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":166,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/js/download-studio.js","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.163Z","timestamp":1787691674163,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /js/download-studio.js HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:00:38 GMT\r\netag: W/\"2106-659a32d7dec2b\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":8454,"size_decoded":3322,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text","md5":"8db5b6dfe2a87cc68995f91cd4d0a2db","sha1":"0c8b9c019380a1280c1baa33472e02b8584859dd","sha256":"628c0aac77df09d8220ae202a374e1777904f0c5da858699fc5faac6c306e0ed","sha512":"421c1072e6faeaa5b0c6727d8a94ced72b4bbac5dba787e5e1580a4cdff18123b6dbc3c2908f9bab8cad5263f5e6b9a5e8d97e2d78830cf3e83217c8db1e2880","ssdeep":"192:0/kGQa9yQumQ5H0F7mNJp590pzna2ucEnpv9FTbcBneEyc:QkQROgznaJc2pFFTbYneO","tlshash":"4a02a824b9ef30f5106391afee9b654cb5b08167a049c8003d6c9b8a2fd4e7543fe9e5","first_seen":"2026-08-25T20:57:40.195835Z","last_seen":"2026-08-25T21:01:43.387288Z","times_seen":2,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":67,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/js/main.js","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.165Z","timestamp":1787691674165,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /js/main.js HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: text/javascript\r\ncontent-length: 673\r\nlast-modified: Thu, 13 Aug 2026 21:52:05 GMT\r\netag: \"2a1-658f4b6f7fe78\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":673,"size_decoded":1087,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"06929270a0b740303d8e16c79d4368af","sha1":"d7594d33735bc18888c58af2f2f691ddddf76e45","sha256":"4426ed5a5fb7ee0d9ddd24fc0b4890651b43072eab213cb7c4d66509cddfae75","sha512":"c2aea59ac445ed3894633edd709a1eff165794956d41a7763b61a03bace953829f05c74040c9bfb34b469ae1b247080ef2febd246afd99462c1adf71302b4ff8","ssdeep":"","tlshash":"7001263fa5441677c17733e9569842a8f6e1007b6503ca223eddc6412f74865253ecf8","first_seen":"2026-08-25T20:57:40.197557Z","last_seen":"2026-08-25T21:01:43.387938Z","times_seen":2,"resource_available":true,"data":null}},"time_used":179,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":178,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/assets/logo-192.png","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.169Z","timestamp":1787691674169,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /assets/logo-192.png HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: image/png\r\ncontent-length: 36338\r\nlast-modified: Thu, 13 Aug 2026 21:52:04 GMT\r\netag: \"8df2-658f4b6e5319b\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":36338,"size_decoded":36749,"mime_type":"image/png","magic":"PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced","md5":"00737b456fd5477d097c0acee8d86a94","sha1":"929c002b9382054f090802feb8e4c0635bbc9d69","sha256":"cff558dc98129167c2d7dcbc992bddf30cc2eff5cc865389d514a1bef7561642","sha512":"da2d97a78db25c8a89081d16809b166baddf7129d090108ba2b40b8c17a0ce30d0a8578afbaf91aa308e9f4246ea2fb78d29ec996e3e7d2219c4befe635434d5","ssdeep":"768:nWr123mHkdC/GJz1nk3QYnmxyKnbbDGrmuzeL9NWceRHrWFmewbafXIEPV4jT8xe:Wr123I8sGJxnHEmHnbbCrmBL9NWcWoml","tlshash":"e5f2f0075348de78f51ad49ee632b9ec20c549ac430f404bba0ef4d492b716252ef36b","first_seen":"2026-08-25T20:57:40.19901Z","last_seen":"2026-08-25T21:01:43.38874Z","times_seen":2,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":174,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/assets/card-recovery.png","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.633Z","timestamp":1787691674633,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /assets/card-recovery.png HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: image/png\r\ncontent-length: 338778\r\nlast-modified: Thu, 13 Aug 2026 21:52:02 GMT\r\netag: \"52b5a-658f4b6c70e2d\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":338778,"size_decoded":339191,"mime_type":"image/png","magic":"PNG image data, 360 x 720, 8-bit/color RGBA, non-interlaced","md5":"04e585c74468e4f8c2ebd24f75dcbb2a","sha1":"82b3f83b83b9371438ca40ee6d973972cc35eebd","sha256":"cb95d1b0c54fdf9bbb2a31c5f4626e5369431fcfdd34d0dc1a774ebb204b243b","sha512":"87338dc952972df98ccd968aff20a7ec7202a97161be742868e911914a3e793f4d267e2d1384dbfaf710379460cd66806c79310265c3b281def0aaa3331e65cf","ssdeep":"6144:S4oUuCmrv+7neLiDTrw8DXWKEg+rGMPERA6proP+vrYeH4F60EMQ2Mg:S4lu8Dn1DBmtYA6pcG0ekMg","tlshash":"c17423c48d39d4d1f3e3c04984b00af6962ff4282710658ae9ef5eca4b2b6a16dd3d85","first_seen":"2026-08-25T20:57:40.18773Z","last_seen":"2026-08-25T21:01:43.389365Z","times_seen":2,"resource_available":false,"data":null}},"time_used":175,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":68,"receive":107,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/assets/card-windows.png","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.635Z","timestamp":1787691674635,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /assets/card-windows.png HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: image/png\r\ncontent-length: 280182\r\nlast-modified: Thu, 13 Aug 2026 21:52:02 GMT\r\netag: \"44676-658f4b6cda1e6\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":280182,"size_decoded":280595,"mime_type":"image/png","magic":"PNG image data, 360 x 720, 8-bit/color RGBA, non-interlaced","md5":"0eac7a39a21fbfd307a09d934cbf6a7b","sha1":"76bd12204cd6edeef8f82c2917f9e041caa05db2","sha256":"dc3da6e53b2c221e6eb6d928da08da45268576269b7fdc64425a359ced069395","sha512":"334e924c0faa516ace56cca1dc9f474e91f02f243e5a5abcb2e2f83d481131c983a8001c62cb623df26e6a2e6f200d7bcbfaad592adc0f903ffba92c4709fb65","ssdeep":"6144:4ozxKGTgXAZzzh5Jen3aViSQ0Mzft1ybU/e:dzxK+gwdXJe3+iSQ71Gn","tlshash":"9c54235ff0744fd81e6112e3957a8ee50ed42e6018706c61deb8febf6241740298af8b","first_seen":"2026-08-25T20:57:40.179994Z","last_seen":"2026-08-25T21:01:43.389981Z","times_seen":2,"resource_available":false,"data":null}},"time_used":227,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":66,"receive":161,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:01:13.733Z","timestamp":1787691673733,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:13 GMT\r\ncontent-type: text/html\r\ncontent-length: 5053\r\nlast-modified: Thu, 13 Aug 2026 21:51:58 GMT\r\netag: \"4398-658f4b69619fa-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17304,"size_decoded":5514,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"6401593bcf9f22a6a1fdfa9ea1a619c1","sha1":"0df853f3d0204bd9e9965d7ca6d607e5de4e86f3","sha256":"c4b093a437556a0a78b3668dcad64a4d2397ad1836202c866161e304ef60734d","sha512":"5a47a13079df6d245bb939ba662d4e061c88bdacc74dab9e04aa94767ba39e9682a3ea73a272066e3d4f71932b43c4313da1dce5f1f210e8b430c362f781ca31","ssdeep":"192:ghvMUkQDvZ794DaIIyQTJ9OVn+Y1Vns5X9rVEA7/tBFjvnyym:gNHDvrIIyKJ1YXCrVEALtnvni","tlshash":"0a72116155c8a4af0172914aea156b4dfd9a81ffbb59462132bc2faf2ff3810cc1724d","first_seen":"2026-08-25T20:57:40.185638Z","last_seen":"2026-08-25T21:01:43.390927Z","times_seen":2,"resource_available":false,"data":null}},"time_used":236,"timings":{"blocked":-1,"dns":3,"connect":51,"send":0,"wait":77,"receive":0,"ssl":105},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/assets/card-media.png","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"lazy-img","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.639Z","timestamp":1787691674639,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /assets/card-media.png HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: image/png\r\ncontent-length: 319535\r\nlast-modified: Thu, 13 Aug 2026 21:52:01 GMT\r\netag: \"4e02f-658f4b6c07a75\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":319535,"size_decoded":319948,"mime_type":"image/png","magic":"PNG image data, 360 x 720, 8-bit/color RGBA, non-interlaced","md5":"e676ba7160ae75110b35f0644a91d1e0","sha1":"c96c25409705f82e9db3455ed48b0ffaa5ec081d","sha256":"e57f8d79b0c3da4167770b83dd47a4a2a01899413c43d471d274140288fe8441","sha512":"b00712ad1db4191516d744044ccc6f4e9718e2095fe12405849cd995a79f57c44ed8a1e7a39503f7467642d23e1445ad63785c2f78242dafe13f1f24c513cd3c","ssdeep":"6144:2C7z7fLiWjxcwuA6jQzhkJbOf5NDOKce6DROSDx89IYAQLqxNLew:2Gz7fLiaGwZ6OebuD9BUBDxQAQgNP","tlshash":"a66423fe6c9caf2c48be97c4cd89067e8099f199551d13affb02f491c36194ab2d710a","first_seen":"2026-08-25T20:57:40.182818Z","last_seen":"2026-08-25T21:01:43.391799Z","times_seen":2,"resource_available":false,"data":null}},"time_used":278,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":223,"receive":55,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/assets/apple-touch-icon.png","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.924Z","timestamp":1787691674924,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /assets/apple-touch-icon.png HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: image/png\r\ncontent-length: 32190\r\nlast-modified: Thu, 13 Aug 2026 21:52:00 GMT\r\netag: \"7dbe-658f4b6b500bc\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32190,"size_decoded":32601,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"badd5e8a23115f718a70e6a2e626f03d","sha1":"c3180586847dc174ca60c6b8c13b9a64900880d1","sha256":"8ebe69f1d1d5a6d4675cbec9e6317eb3eff32e4dc7313a064c5a2ff8d5f71b8a","sha512":"47a879722802f07e9a360da5f6e051bfe879dce240b65b84b96b4f2f41b860f81761c26f83e08ca9be4342a9fccff4de7a855871dd5f3320c9e13e1864061232","ssdeep":"768:TTnUG0q8+QyOfns+dFEHN3ipveUq6HhwE1iA/LK7BvXiMTRPqIJj/gz:XU5q8b3fsIEt3idqih51iA/LKtt8sjQ","tlshash":"09e2e1f8ea45a4cbda1acfd0aa12e1824f4bb317137eaf1de14e503d683a9454ce7521","first_seen":"2026-08-25T20:57:40.189579Z","last_seen":"2026-08-25T21:01:43.392401Z","times_seen":2,"resource_available":false,"data":null}},"time_used":78,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":76,"receive":2,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getrecuva.ru/assets/favicon-32.png","fqdn":"getrecuva.ru","domain":"getrecuva.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getrecuva.ru/","date":"2026-08-25T21:01:14.925Z","timestamp":1787691674925,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"getrecuva.ru","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 13 Aug 2026 19:44:17 GMT","end":"Wed, 11 Nov 2026 19:44:16 GMT"},"fingerprint":{"sha1":"A1:57:2C:9F:13:33:87:D3:C2:09:BB:E3:DF:F5:7C:71:9D:D4:D9:6A","sha256":"39:41:14:99:C9:A2:CC:CB:82:8C:8B:D4:58:47:50:B1:04:95:33:26:2E:7C:1D:46:20:EF:10:0A:F0:87:D3:89"}}},"request":{"raw":"GET /assets/favicon-32.png HTTP/1.1\r\nHost: getrecuva.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getrecuva.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:14 GMT\r\ncontent-type: image/png\r\ncontent-length: 1644\r\nlast-modified: Thu, 13 Aug 2026 21:52:03 GMT\r\netag: \"66c-658f4b6d6e914\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1644,"size_decoded":2053,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"c37593825e3fa1367ec52f47c567bacc","sha1":"676e2b90f4ecf929e32966d5d10542db7f1ec397","sha256":"209faf0a476930242f8fda9a8b2e4115bced17d2b4ae2f2ba9b757520d67c501","sha512":"e14e329c0ef5ab5e647394115d544c3576819038d18c9c18d3f16e0edbb8adca85055097934a03c7be634a98fcea00ef69aa1e38a31837384342170799d32898","ssdeep":"","tlshash":"c7313a42fabc8dc48c2c5d4d8926c3522bda45b500c49c0dde42b51f010113cc2a079f","first_seen":"2026-08-25T20:57:40.191304Z","last_seen":"2026-08-25T21:01:43.392887Z","times_seen":2,"resource_available":false,"data":null}},"time_used":75,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":75,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getrecuva.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}