{"report_id":"ee372c65-a4a3-42d0-a442-2d8a33de85c3","version":0,"status":"done","tags":[],"date":"2026-09-06T20:10:48Z","url":{"schema":"http","addr":"bonusmega.ru/","fqdn":"bonusmega.ru","domain":"bonusmega.ru","tld":"ru"},"ip":{"addr":"5.101.159.26","port":0,"asn":198610,"as":"Beget LLC","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"http","addr":"bonusmega.ru/","fqdn":"bonusmega.ru","domain":"bonusmega.ru","tld":"ru"},"title":"Истёк срок регистрации домена","dom":{"size":4470,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"787be6fae61fe385ebd2e817bc044901","sha1":"a98cfccedf3f18e86d44ba366e6ac640b3c21ae5","sha256":"e6c757914434e6223090acfe878ee4183303a89eba7c2ec88d393637e3fc88b7","sha512":"4be3568fd28f024112c32224529b978036de0cc3f06654558ce68174460a91b74370edb5ddec338a71f28d78085fcb05a9f0d5291cd50814852d4c2625bc309d","ssdeep":"96:nelAG7eqG9IrZTlPzG7sHt2KK+Eedi6ijfakWR:elAG7eqG98lq7szzijxE","tlshash":"239124b2c4f540371292e4c2a7566b2dbce3447fda868502baec07985fcec96f61f408","dom_hash":"domhash211e926cc45e81fdf3e3c92ec2c35213","first_seen":"2026-09-06T20:11:00.359647Z","last_seen":"2026-09-06T20:11:00.359647Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"bonusmega.ru/","fqdn":"bonusmega.ru","domain":"bonusmega.ru","tld":"ru"},"ip":{"addr":"5.101.159.26","port":0,"asn":198610,"as":"Beget LLC","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-11T20:10:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"bonusmega.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"fonts.gstatic.com","ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2008-02-11","domain_rank":0,"first_seen":"2014-04-02T10:51:04Z","last_seen":"2026-08-30T22:22:21.72184Z","alert_count":0,"request_count":5,"received_data":169503,"sent_data":2786,"comment":"","tags":null,"fingerprints":null},{"fqdn":"bonusmega.ru","ip":{"addr":"5.101.159.26","port":80,"asn":198610,"as":"Beget LLC","country":"Russia","country_code":"RU"},"domain_registered":"2025-08-27","domain_rank":0,"first_seen":"2026-09-06T20:10:49.03799Z","last_seen":"2026-09-06T20:10:49.03799Z","alert_count":4,"request_count":4,"received_data":10303,"sent_data":1650,"comment":"","tags":null,"fingerprints":[{"name":"punycode","description":"A robust Punycode converter that fully complies to RFC 3492 and RFC 5891, and works on nearly all JavaScript platforms.","website":"https://github.com/mathiasbynens/punycode.js","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-08-30T22:24:29.229878Z","alert_count":0,"request_count":1,"received_data":3491,"sent_data":510,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cdnjs.cloudflare.com","ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2009-02-17","domain_rank":1222,"first_seen":"2012-05-23T12:49:49Z","last_seen":"2026-08-30T23:05:19.421151Z","alert_count":0,"request_count":1,"received_data":3820,"sent_data":502,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"cp.beget.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"1999-12-29","domain_rank":3126579,"first_seen":"2016-03-24T06:31:11Z","last_seen":"2026-09-03T22:58:18.05993Z","alert_count":0,"request_count":2,"received_data":0,"sent_data":1079,"comment":"","tags":null,"fingerprints":null},{"fqdn":"beget.com","ip":{"addr":"178.248.236.146","port":443,"asn":51115,"as":"HLL LLC","country":"Russia","country_code":"RU"},"domain_registered":"1999-12-29","domain_rank":3387,"first_seen":"2016-04-02T10:31:02Z","last_seen":"2026-09-05T06:10:56.145578Z","alert_count":0,"request_count":1,"received_data":789,"sent_data":479,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/punycode/1.4.1/punycode.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"5d8e12f365a0622c9396d92e6092bdbb","sha1":"c61614fea035ecb1a59e1beb03d1c44fb0ab8115","sha256":"2395ce599bba81b7b031207d511f3ccb41a68898bd02c41c0b352903f3013670","sha512":"619957109f5d3879c89f72d7492dd1a5b840b534195b0d953b2c1a32c0bca7bff40f21aed2011fd29161910b44fe2e2942980650363b72271be34d537ffe6c44","ssdeep":"","tlshash":"4c5177ca3497a8174bd61da81adf504fe9bc582348cc0805935892ed39f98f485abe2c","size":2796,"data":"","first_seen":"2023-03-07T16:23:54Z","last_seen":"2026-09-07T03:49:56.97238Z","times_seen":297,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"bonusmega.ru/","fqdn":"bonusmega.ru","domain":"bonusmega.ru","tld":"ru"},"ip":{"addr":"5.101.159.26","port":80,"asn":198610,"as":"Beget LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"d881ebfba14c67db3b045fcc7f9c21b2","sha1":"747e96742b767a20a674ba2c425f0d2249b46f5f","sha256":"3ba9a8b8dafc181113b6bbce1c31dc22068f3cba4a8836c5024b379ada4ff00a","sha512":"e1d364bfb930522d954d09ce1b4712b708374d64957ef598c078dfff9db79d3ba2098f9c3ceadc2b57bede97ea8dc43997f6e4c2899c9e5b9f55baff50545d68","ssdeep":"","tlshash":"74d05ea99231ab7067a3b2137f1e634135364a9b1440a806790c56062f54a1a4fb9d9e","size":253,"data":"","first_seen":"2026-06-09T01:50:35.683906Z","last_seen":"2026-09-07T03:49:56.976856Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"bonusmega.ru/","fqdn":"bonusmega.ru","domain":"bonusmega.ru","tld":"ru"},"ip":{"addr":"5.101.159.26","port":80,"asn":198610,"as":"Beget LLC","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"611af5e5dcd8aa3da0a7ad4e83354270","sha1":"e90c23a07a87bfe26e5ea055de56fb877d7e8f27","sha256":"3f402f0db367ba4305cb7b61f5e259dcf6799a67e309605c54438efc55cd6ab0","sha512":"6bea93d91cf327b2c2d7826ad4535c231241d5cefa55cabc5cf2a5161db8f9cf540dc8c568eea417604bf5cb38353f1fd6adfba314e75548074888adaa7d8b6e","ssdeep":"","tlshash":"eed022de6896130423ea800164144302203800065b0a9480393c1250af20cceaeb5689","size":214,"data":"","first_seen":"2026-06-09T01:50:35.684743Z","last_seen":"2026-09-07T03:49:56.977566Z","times_seen":43,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.gstatic.com/s/ptsans/v18/jizaRExUiTo99u79D0KExQ.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:35.029Z","timestamp":1788725435029,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/ptsans/v18/jizaRExUiTo99u79D0KExQ.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://bonusmega.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 45532\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 06 Sep 2026 10:10:48 GMT\r\nexpires: Mon, 06 Sep 2027 10:10:48 GMT\r\ncache-control: public, max-age=31536000\r\nage: 35987\r\nlast-modified: Thu, 04 Sep 2025 17:27:33 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":45532,"size_decoded":46344,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 45532, version 1.0","md5":"3f66ddcf744f9d3144a164781c1c8d12","sha1":"a922c0987319ee73a9645918566d35cb90196b3d","sha256":"2dea6190c113af617923c6b71f7f10ffbdf72074556f79963610254fe40e49be","sha512":"ab44f6e75fdef3596d5aad958e14b1b2bedd4132aebe0b136b8f4ae466d2594a68baa1c4dd047e70ac03116dda521934e13445e85ef0f2d56bd341c46d116d86","ssdeep":"768:fYn3iesPbiNr4ew9DQrVPgxlpWLCbyByd2YVi15T85aavJWo0xB6tkKCEg9sJ29:AnSbbzsfuYXYU38MYJWo0xB6yKCEg2Ju","tlshash":"b613f174e6421cb77b86260a76dcfa805c77486536fc2a27baffc02b52ca02045995bd","first_seen":"2025-09-05T01:58:17.133494Z","last_seen":"2026-09-12T19:36:01.490435Z","times_seen":20166,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":-1,"dns":3,"connect":32,"send":0,"wait":19,"receive":43,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/ptsanscaption/v20/0FlMVP6Hrxmt7-fsUFhlFXNIlpcaeg_x.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:35.031Z","timestamp":1788725435031,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/ptsanscaption/v20/0FlMVP6Hrxmt7-fsUFhlFXNIlpcaeg_x.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://bonusmega.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 39364\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sun, 06 Sep 2026 13:28:27 GMT\r\nexpires: Mon, 06 Sep 2027 13:28:27 GMT\r\ncache-control: public, max-age=31536000\r\nage: 24128\r\nlast-modified: Thu, 04 Sep 2025 17:05:31 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":39364,"size_decoded":40176,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 39364, version 1.0","md5":"3a8012ec36f9a10b6e08246ab0b2b3bd","sha1":"4c175a2409791b7637cce679653d174f528f81c9","sha256":"c9e8c3d39f75bcfd9c4cb7e4d2fcd5720993fd73e0ccb0bab98adb4ffabf1296","sha512":"414943424bd266bf900c90af458d4ffc29af801021418c3c126f257dbaa52009545499ff28983f6a5790034d01bad8e64d444dd0218120ae59ba97a389202c1f","ssdeep":"768:vglIkANrgZVihqzYjrVs0Jua2ccnv9bGECRfGer4vzcaa:vglIZ2MqMrVVtqnVbGRBt","tlshash":"c90301d893dcb80516a59289d332bf46d00ff58091227806795e3ba58d5cbc22acba7f","first_seen":"2023-05-03T04:22:51Z","last_seen":"2026-09-09T11:13:27.183946Z","times_seen":4494,"resource_available":false,"data":null}},"time_used":95,"timings":{"blocked":-1,"dns":1,"connect":0,"send":0,"wait":30,"receive":32,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/ptsanscaption/v20/0FlMVP6Hrxmt7-fsUFhlFXNIlpcafg_xcy4.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:35.033Z","timestamp":1788725435033,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/ptsanscaption/v20/0FlMVP6Hrxmt7-fsUFhlFXNIlpcafg_xcy4.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://bonusmega.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 25184\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Wed, 02 Sep 2026 12:06:28 GMT\r\nexpires: Thu, 02 Sep 2027 12:06:28 GMT\r\ncache-control: public, max-age=31536000\r\nage: 374647\r\nlast-modified: Thu, 04 Sep 2025 17:05:33 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":25184,"size_decoded":25997,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 25184, version 1.0","md5":"3bf1192150fb754bdb7a441ca523eaa0","sha1":"ef943550e6f293af5d59f30396ab844791c22049","sha256":"fb04a6aaf714a9601239ba135a5edb9cd79d15e04810cf25eb06213fa0a9d6ba","sha512":"bc454313a6c5535a322269c48b5ed928ef03a769e3e34e8dd8a227f3097a61d65657b184230b271c56956fc36b44b42913681f573d090295adc5fd23966049f2","ssdeep":"768:JOzMdRek8xZQdmwb4Qg0IoSF5TnXI4Xn11:kI/fXy0IZnXI4l1","tlshash":"8bb2e12dbe12c091e82c7fb3b0204d4194631b932f77a597595c212f9cc9f2f6069b89","first_seen":"2025-09-06T07:10:55.84971Z","last_seen":"2026-09-09T11:13:27.130619Z","times_seen":1073,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":26,"dns":0,"connect":0,"send":0,"wait":44,"receive":16,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/ptsans/v18/jizaRExUiTo99u79D0aExdGM.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:35.035Z","timestamp":1788725435035,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/ptsans/v18/jizaRExUiTo99u79D0aExdGM.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://bonusmega.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 28548\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 03 Sep 2026 09:40:36 GMT\r\nexpires: Fri, 03 Sep 2027 09:40:36 GMT\r\ncache-control: public, max-age=31536000\r\nage: 296999\r\nlast-modified: Thu, 04 Sep 2025 17:27:31 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":28548,"size_decoded":29361,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 28548, version 1.0","md5":"f2664d403038a06d248ccadbf5ca7fb5","sha1":"265519710eb7704c474c7802a11aa9a0022a0088","sha256":"f283e584f001db04b39f339e859454a205c431c576c6a33af9259e54415db1bd","sha512":"90b39729053757e43c61aa9a8f3e97a9802a127b96157da826c9dd314c8ad07342c1c9031257d7d1a789a79abf5a2677a3df59052817655ecc72f77cdaa6ee47","ssdeep":"768:DfT6no4OCJ54TQGaXJzWagukNKXsktoF4aqYwcVayDDI4xru+:Df4o4X5pXd0ukQNeOaqYwcEyDdxF","tlshash":"75d2024dc115ad33ca00f9fadde454074b8f741b962703efcbf6080b8a9d1bca599648","first_seen":"2025-09-05T01:58:17.175008Z","last_seen":"2026-09-11T18:01:11.298376Z","times_seen":3668,"resource_available":false,"data":null}},"time_used":83,"timings":{"blocked":26,"dns":0,"connect":0,"send":0,"wait":24,"receive":33,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"bonusmega.ru/","fqdn":"bonusmega.ru","domain":"bonusmega.ru","tld":"ru"},"ip":{"addr":"5.101.159.26","port":80,"asn":198610,"as":"Beget LLC","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-06T20:10:20.146Z","timestamp":1788725420146,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: bonusmega.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 06 Sep 2026 20:10:20 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nVary: Accept-Encoding\r\nLast-Modified: Tue, 27 Sep 2022 15:58:11 GMT\r\nETag: W/\"63331d93-118b\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"punycode","description":"A robust Punycode converter that fully complies to RFC 3492 and RFC 5891, and works on nearly all JavaScript platforms.","website":"https://github.com/mathiasbynens/punycode.js","common_platform_enumeration":"","icon":"","categories":["JavaScript libraries"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"cdnjs","description":"cdnjs is a free distributed JS library delivery service.","website":"https://cdnjs.com","common_platform_enumeration":"","icon":"cdnjs.svg","categories":["CDN"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4491,"size_decoded":1922,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"d4f23956ba3f0cb442af450939338887","sha1":"1603fee85343e049503a24a2663d3e6828d6e59f","sha256":"3b0d450ae6f209b4e1c01e6e1c18ef92a46d6343fa5a86e2df85967e14bda5d6","sha512":"7a00823bf3d482a12bbce6950be826cadb04d5a04e5644850b858174301d937ee06d2578e57da92903ba81396374281f9c77958852343b980216f9d1437b47fa","ssdeep":"96:0lAG7eqG2rZTlPzG7susLKKTEedi6ijfakW1:0lAG7eqGalq7s/zijxE","tlshash":"9f9114b2d4f650771392e0c2a6566b2dbce3447fda868501b6ec07985fcec96f61f808","first_seen":"2023-04-26T00:01:42Z","last_seen":"2026-09-07T03:49:56.969062Z","times_seen":224,"resource_available":true,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":6,"connect":37,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"bonusmega.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"fonts.googleapis.com/css?family=PT+Sans|PT+Sans+Caption","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:20.494Z","timestamp":1788725420494,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css?family=PT+Sans|PT+Sans+Caption HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://bonusmega.ru/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Sun, 06 Sep 2026 20:10:20 GMT\r\ndate: Sun, 06 Sep 2026 20:10:20 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2807,"size_decoded":1230,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"92933a7f17037e2fbaa23eaed1d5d6bf","sha1":"297ea29c18e6414ed8cd94c31ac23b324842fc33","sha256":"6fd39a60044fc0fed200ec03120cea4419081c9b5fe33d11cbced0c45884ebe4","sha512":"d455e84fcd257e16ae01fb746f483269cd93d98fe6a52e2bb26104a04660eab6312e095700038442580a7d4f0e461626c8083949e54abf5c3cac13428501178f","ssdeep":"","tlshash":"eb511182091ba450ab871cc523cf7d32df1ea25170489836aaff1cd8ed65e2e8371b5d","first_seen":"2025-09-20T07:27:24.872406Z","last_seen":"2026-09-07T03:49:56.976278Z","times_seen":197,"resource_available":false,"data":null}},"time_used":111,"timings":{"blocked":-1,"dns":3,"connect":24,"send":0,"wait":41,"receive":0,"ssl":42},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cdnjs.cloudflare.com/ajax/libs/punycode/1.4.1/punycode.min.js","fqdn":"cdnjs.cloudflare.com","domain":"cloudflare.com","tld":"com"},"ip":{"addr":"104.17.24.14","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:20.501Z","timestamp":1788725420501,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"cdnjs.cloudflare.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Fri, 10 Jul 2026 07:07:58 GMT","end":"Thu, 08 Oct 2026 08:07:45 GMT"},"fingerprint":{"sha1":"DF:66:97:F5:13:A2:C0:81:D3:5B:60:C4:B0:7F:CD:78:F5:91:14:D5","sha256":"3C:F2:95:73:83:BA:4D:D9:CC:85:8F:BC:7D:2C:22:CF:F3:49:9A:3A:E4:1D:FC:AE:CB:07:3D:66:89:74:0E:C5"}}},"request":{"raw":"GET /ajax/libs/punycode/1.4.1/punycode.min.js HTTP/1.1\r\nHost: cdnjs.cloudflare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://bonusmega.ru/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ndate: Sun, 06 Sep 2026 20:10:20 GMT\r\ncontent-type: application/javascript; charset=utf-8\r\ncontent-length: 1365\r\ncf-cache-status: BYPASS\r\naccess-control-allow-origin: *\r\nage: 3172600\r\ncache-control: no-transform, public, s-maxage=30672000, max-age=30672000, immutable\r\ncontent-encoding: br\r\nlast-modified: Mon, 04 May 2020 16:15:40 GMT\r\nvary: Accept-Encoding\r\ncross-origin-resource-policy: cross-origin\r\ntiming-allow-origin: *\r\nx-content-type-options: nosniff\r\ncf-cdnjs-via: cfworker/r2\r\nx-cdnjs-cache: HIT\r\nstrict-transport-security: max-age=15780000\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8F42ZU18uxys%2FBTAxvza%2F33pnQIEZF1dmHOM2KM9BjD7kMQp1xNCPVa3v8MfPdMrx%2BmQYIjyMDxr6TPVAqhHp%2BJ7JvvKXvXSDkPDgRGv9%2B0hjuIRfJLJipUMNKcSnS%2FV7hCsXI0N\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.01,\"max_age\":604800}\r\npriority: u=2,i=?0\r\nserver: cloudflare\r\ncf-ray: a3701dd65d3b0883-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2796,"size_decoded":2389,"mime_type":"application/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (2753)","md5":"5d8e12f365a0622c9396d92e6092bdbb","sha1":"c61614fea035ecb1a59e1beb03d1c44fb0ab8115","sha256":"2395ce599bba81b7b031207d511f3ccb41a68898bd02c41c0b352903f3013670","sha512":"619957109f5d3879c89f72d7492dd1a5b840b534195b0d953b2c1a32c0bca7bff40f21aed2011fd29161910b44fe2e2942980650363b72271be34d537ffe6c44","ssdeep":"","tlshash":"4c5177ca3497a8174bd61da81adf504fe9bc582348cc0805935892ed39f98f485abe2c","first_seen":"2023-03-07T16:23:54Z","last_seen":"2026-09-07T03:49:56.97238Z","times_seen":297,"resource_available":true,"data":null}},"time_used":61,"timings":{"blocked":-1,"dns":10,"connect":22,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"cp.beget.com/img/octo/octo_expired.png","fqdn":"cp.beget.com","domain":"beget.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:20.509Z","timestamp":1788725420509,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /img/octo/octo_expired.png HTTP/1.1\r\nHost: cp.beget.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://bonusmega.ru/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T06:24:37.687585Z","times_seen":18438043,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"fonts.gstatic.com/s/ptsans/v18/jizaRExUiTo99u79D0yExdGM.woff2","fqdn":"fonts.gstatic.com","domain":"gstatic.com","tld":"com"},"ip":{"addr":"142.250.178.35","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"font","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:35.038Z","timestamp":1788725435038,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.gstatic.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:10 GMT","end":"Mon, 02 Nov 2026 08:39:09 GMT"},"fingerprint":{"sha1":"AB:CB:A4:4C:A5:65:CD:AE:7D:49:56:A1:8A:F1:7C:FB:63:84:AE:13","sha256":"61:13:42:1F:BA:E8:AE:1B:A2:FC:89:02:B5:BE:EF:3C:35:FC:AE:06:22:3C:B0:DF:74:48:AD:42:E0:4A:30:A5"}}},"request":{"raw":"GET /s/ptsans/v18/jizaRExUiTo99u79D0yExdGM.woff2 HTTP/1.1\r\nHost: fonts.gstatic.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nOrigin: http://bonusmega.ru\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://fonts.googleapis.com/\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\naccept-ranges: bytes\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"apps-themes\"\r\nreport-to: {\"group\":\"apps-themes\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/apps-themes\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 26812\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Thu, 03 Sep 2026 15:24:50 GMT\r\nexpires: Fri, 03 Sep 2027 15:24:50 GMT\r\ncache-control: public, max-age=31536000\r\nage: 276345\r\nlast-modified: Thu, 04 Sep 2025 17:27:33 GMT\r\ncontent-type: font/woff2\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":26812,"size_decoded":27625,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 26812, version 1.0","md5":"c7e801bf7cc49f698d5914e2f37b886d","sha1":"cb16efd6256cdaad8f7290fdb8bfb700e8c687e6","sha256":"94dc178a50c462bb9b38f4927cdbb17834993053c9d491690d72c3f2092c00e1","sha512":"344341e88753975ca2f29136acba1e613b92dfdaecfb4e254e52228e6d4011d371c511758c0c88d3e0c2455d3058f5602b9f79a074ac8afb9bd6964f5c037e30","ssdeep":"768:C0lkhUdO7qGTY9fYD2B/Eb1l3k9QQtdLe+:C0lyUm9TY9wSM1l3kOQts+","tlshash":"eec2e0c5a0e3e16fa77824a40c122c3a8bc590497af79513d564fedd37646cd90c1fa3","first_seen":"2025-09-05T01:58:17.22842Z","last_seen":"2026-09-11T18:01:11.237793Z","times_seen":1155,"resource_available":false,"data":null}},"time_used":84,"timings":{"blocked":26,"dns":0,"connect":0,"send":0,"wait":38,"receive":20,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"bonusmega.ru/favicon.ico","fqdn":"bonusmega.ru","domain":"bonusmega.ru","tld":"ru"},"ip":{"addr":"5.101.159.26","port":80,"asn":198610,"as":"Beget LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:35.359Z","timestamp":1788725435359,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: bonusmega.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://bonusmega.ru/\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Sun, 06 Sep 2026 20:10:35 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":170,"size_decoded":359,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF line terminators","md5":"6c41daf040690d9b41dc6193f3fa232b","sha1":"104248db660dbfece658dee7f45d65ffd0369163","sha256":"4e1b3b07da7f7a68b07042a78ca7c18e9e2738ebb24832a4bd6673729a7833ed","sha512":"e959f0dbf6664d7a23a25392c3a613803652f8e452f4023eb40f5eb99a6f687462c188def6d4383a70eb5b5c9242d68426d164946d23c010934c2888c5888610","ssdeep":"","tlshash":"ebc0805d6513bc4dc553217456c3a480c1d6d327a5ed45110580514371cb15945c1396","first_seen":"2023-04-26T00:01:42Z","last_seen":"2026-09-13T04:35:33.009631Z","times_seen":280,"resource_available":false,"data":null}},"time_used":39,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"bonusmega.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"bonusmega.ru/","fqdn":"bonusmega.ru","domain":"bonusmega.ru","tld":"ru"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-06T20:10:19.687Z","timestamp":1788725419687,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET / HTTP/1.1\r\nHost: bonusmega.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T06:24:37.687585Z","times_seen":18438043,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"bonusmega.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"beget.com/css/prices.css","fqdn":"beget.com","domain":"beget.com","tld":"com"},"ip":{"addr":"178.248.236.146","port":443,"asn":51115,"as":"HLL LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:20.497Z","timestamp":1788725420497,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.beget.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 04 Aug 2026 23:26:41 GMT","end":"Mon, 02 Nov 2026 23:26:40 GMT"},"fingerprint":{"sha1":"45:64:9E:F8:7A:EC:12:1E:32:2F:98:04:CD:0E:9A:33:F4:82:81:F2","sha256":"C3:B2:C1:EC:83:2B:17:E5:D3:B2:5C:4C:75:87:FA:66:D2:04:1D:3F:AA:ED:A6:4D:73:D0:69:D8:AD:5B:F2:1C"}}},"request":{"raw":"GET /css/prices.css HTTP/1.1\r\nHost: beget.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://bonusmega.ru/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: QRATOR\r\nDate: Sun, 06 Sep 2026 20:10:34 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=15\r\nVary: Accept-Encoding\r\nLast-Modified: Thu, 03 Sep 2026 13:03:36 GMT\r\nETag: W/\"6a997028-1d7\"\r\nX-Frame-Options: SAMEORIGIN\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":471,"size_decoded":488,"mime_type":"text/css","magic":"ASCII text","md5":"81b3e863dc9cb6ccd42ae694763fd8b3","sha1":"5b4eb51eab193fbb26c8fa48988839eedad573a1","sha256":"111867956967834b08884ebd7dde81a50b9e377432ab5b94f2d523fd685e4621","sha512":"de1d2d211074cf9455c894cfce25d67261172ce26c1312242245de556e73112825d73fdc711c156a21682285e20ff76708b2baddd44b3d79dbab9d2572f35b76","ssdeep":"","tlshash":"05f0fe70e1b81c50c358c0c4690bb354b79cb55e8a283de4d25ab5cc6ec162cc5e96cc","first_seen":"2026-02-27T06:39:50.084189Z","last_seen":"2026-09-07T03:49:56.970089Z","times_seen":60,"resource_available":false,"data":null}},"time_used":28701,"timings":{"blocked":-1,"dns":14282,"connect":14280,"send":0,"wait":83,"receive":0,"ssl":56},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"http","addr":"bonusmega.ru/styles.css","fqdn":"bonusmega.ru","domain":"bonusmega.ru","tld":"ru"},"ip":{"addr":"5.101.159.26","port":80,"asn":198610,"as":"Beget LLC","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:20.498Z","timestamp":1788725420498,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /styles.css HTTP/1.1\r\nHost: bonusmega.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://bonusmega.ru/\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Sun, 06 Sep 2026 20:10:20 GMT\r\nContent-Type: text/css\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nVary: Accept-Encoding\r\nLast-Modified: Tue, 27 Sep 2022 15:58:11 GMT\r\nETag: W/\"63331d93-12e5\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":4837,"size_decoded":1691,"mime_type":"text/css","magic":"ASCII text","md5":"d1b3e2424568eefe93a93809d2527450","sha1":"40b90475499c2d7890db69c2ab2d46e3cc55262e","sha256":"c763110c212e06586b4a68106eec05b94acad68051963ae616c6bbb12e91da1f","sha512":"fcb35fcb47ba3652ec79f2f47e7596c0643fb230b52b49bcd7b1f44ef635bf252d60895cb891e91cad572ce778b7f52f4359060cff572c8d2ac8c54d024ba3bd","ssdeep":"96:JxbxC98XB0bbeKufrX6I6nHweb8rif2g9XBbupFUvtBsoVxVFpWwtXEsDMoDDX:TxBx0Cr6ICHweb8rZg9xqpFUvtBlVxX3","tlshash":"b0a1fe5f56b31a4aa80794686ffe8712326d8047558fedb93f8ca2cccf4a1d09572b4c","first_seen":"2023-04-26T00:01:42Z","last_seen":"2026-09-07T03:49:56.971018Z","times_seen":223,"resource_available":false,"data":null}},"time_used":49,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":49,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-06","alert":"Phishing Block","trigger":"bonusmega.ru","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"cp.beget.com/i/logo.png","fqdn":"cp.beget.com","domain":"beget.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://bonusmega.ru/","date":"2026-09-06T20:10:20.507Z","timestamp":1788725420507,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /i/logo.png HTTP/1.1\r\nHost: cp.beget.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://bonusmega.ru/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-09-13T06:24:37.687585Z","times_seen":18438043,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}