{"report_id":"ef25b941-d0bc-4b1a-a7b2-6b581c020262","version":0,"status":"done","tags":[],"date":"2026-08-25T21:12:05Z","url":{"schema":"http","addr":"getvmware.ru/","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"getvmware.ru/","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"title":"VMware Workstation — скачать и настроить виртуальную машину","dom":{"size":12350,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (3996)","md5":"fbd341778f76b530f699f0d865b50563","sha1":"84c473aed321012075048d2d80d677a1e18ae67c","sha256":"0cd059e8fe07fcdfd3011af957c0f083ecfb498979efabb4bee55c3c25aebc41","sha512":"deb14ccb1d443a999dc2c3582c1db0147214f8da34d9a0a5d2bd7c13c7f5fd4dbffc1464ea0ed92fa5ef0b7041f28758a2d8393b843a83e737c9fb18c77dedc8","ssdeep":"192:meiGfQq+0BTV9cKj0hX/2wrujnfNgPyZQ/Mol3zoFNaEm1t22nnfjx:ZiGfQqnBSh/URgPyZQ/Mol3zqTm7B","tlshash":"d842b4b3909874ff431762cbe5167b0d75eb42fed652191546b829ad3af3c00ca2f60a","dom_hash":"domhash1906b0fb38918634d024f8ef5c520cf7","first_seen":"2026-08-25T20:55:43.323505Z","last_seen":"2026-08-25T21:12:06.687682Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"getvmware.ru/","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:12:05Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"getvmware.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-14","domain_rank":0,"first_seen":"2026-08-25T20:55:39.603706Z","last_seen":"2026-08-25T20:55:39.603706Z","alert_count":14,"request_count":7,"received_data":228858,"sent_data":3448,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"getvmware.ru/","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"f396760c7d21f1ac100cc02a51d20c14","sha1":"5fe705e01298b34340fecc7e280600042c37b8fe","sha256":"914009f20561cb436350d1b27059ae6121800358c4f1035a1af62536ece01a96","sha512":"3a41c5f021964a1b3d4a69bf410496d6fcce3cdd54a802b2177c5995222ee818c4161db7188df7f1ca8b50a41ff9ea85d73bdc33fc2c20dd495fc326d9b59798","ssdeep":"","tlshash":"16f02677b88492b5c3f73131532bb71c716718ba20c97c35894d8891397ac69102fd7d","size":576,"data":"","first_seen":"2026-08-25T20:55:43.350806Z","last_seen":"2026-08-25T21:12:06.7026Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"getvmware.ru/assets/js/site.js","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"2df3132748f742aaa92eb7cea1c986f3","sha1":"1954eba878aca61fdb7371d4e2d6b3633ddd7a98","sha256":"caf7d2c7bec4eb619f9041afe7947fd563cecceb51205a725920717e92c2fb14","sha512":"1fe6bade9bd7553f3fa9d9912fa7ee6dc996ee0ad3d09d94874fa38a085d2a87c1b1109930b771e0b8e5f07bdaf14e146aec4b429998d28da68fae5a356bb28a","ssdeep":"192:OtNh9S728L0t+NOcnNRXLudDvejlNUvgjvMEFdhC93yuROtmC:cETVOO9LuNvejlqvEv3dEqYC","tlshash":"0b2295a471a1227640b6537eaf47860cffb20267714a42543dac4f453fb6d6281bfee8","size":10304,"data":"","first_seen":"2026-08-25T20:55:43.340614Z","last_seen":"2026-08-25T21:12:06.690548Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"getvmware.ru/assets/js/site.js","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://getvmware.ru/","date":"2026-08-25T21:11:38.739Z","timestamp":1787692298739,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getvmware.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:25 GMT","end":"Mon, 16 Nov 2026 20:09:24 GMT"},"fingerprint":{"sha1":"16:7C:46:62:EB:B6:8A:63:96:60:85:1D:45:F7:44:CA:1E:CD:27:FB","sha256":"8A:E8:E0:89:7E:34:3E:37:95:07:EF:AB:2C:99:B6:DF:43:8D:BB:E5:90:39:BB:54:D1:35:8F:10:4A:30:33:C8"}}},"request":{"raw":"GET /assets/js/site.js HTTP/1.1\r\nHost: getvmware.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getvmware.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:11:38 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:00:43 GMT\r\netag: W/\"2840-659a32dca0a10\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10304,"size_decoded":3803,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"2df3132748f742aaa92eb7cea1c986f3","sha1":"1954eba878aca61fdb7371d4e2d6b3633ddd7a98","sha256":"caf7d2c7bec4eb619f9041afe7947fd563cecceb51205a725920717e92c2fb14","sha512":"1fe6bade9bd7553f3fa9d9912fa7ee6dc996ee0ad3d09d94874fa38a085d2a87c1b1109930b771e0b8e5f07bdaf14e146aec4b429998d28da68fae5a356bb28a","ssdeep":"192:OtNh9S728L0t+NOcnNRXLudDvejlNUvgjvMEFdhC93yuROtmC:cETVOO9LuNvejlqvEv3dEqYC","tlshash":"0b2295a471a1227640b6537eaf47860cffb20267714a42543dac4f453fb6d6281bfee8","first_seen":"2026-08-25T20:55:43.340614Z","last_seen":"2026-08-25T21:12:06.690548Z","times_seen":2,"resource_available":true,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getvmware.ru/assets/images/vmspace-logo-dark.webp","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getvmware.ru/","date":"2026-08-25T21:11:38.741Z","timestamp":1787692298741,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getvmware.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:25 GMT","end":"Mon, 16 Nov 2026 20:09:24 GMT"},"fingerprint":{"sha1":"16:7C:46:62:EB:B6:8A:63:96:60:85:1D:45:F7:44:CA:1E:CD:27:FB","sha256":"8A:E8:E0:89:7E:34:3E:37:95:07:EF:AB:2C:99:B6:DF:43:8D:BB:E5:90:39:BB:54:D1:35:8F:10:4A:30:33:C8"}}},"request":{"raw":"GET /assets/images/vmspace-logo-dark.webp HTTP/1.1\r\nHost: getvmware.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getvmware.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:11:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 48616\r\nlast-modified: Fri, 14 Aug 2026 08:54:49 GMT\r\netag: \"bde8-658fdf91e195b\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":48616,"size_decoded":49028,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4fd8d977d5759cdbf2d679615231c48c","sha1":"0065c97bf5ffe9f72ccf445e2d1bf35d190a2233","sha256":"f912374f0bc08baa57666f0f203e28c088a56bace83748396310616cac7f407e","sha512":"d641281fc856cfb6c6bc59f8c676678677ba62025eecbc5cb6747dc79994bc3b7bd52f209d6510622217c6da55c9f5a13c72c821ff6167ca939eb1e861b31022","ssdeep":"768:upBsZkLcfuarIO81gepmuRwqmif9UlxZ/TsO3ewP6wBc0XnOW/Ppg/p:uk2LQrIv1gepmuRwR3lsOuYBcenjC/p","tlshash":"5223f1c56215046d21b2dbbf37a12d7f5207cb78386f4eac5a275e18a0453a3eafc871","first_seen":"2026-08-25T20:55:43.343544Z","last_seen":"2026-08-25T21:12:06.697337Z","times_seen":2,"resource_available":false,"data":null}},"time_used":42,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getvmware.ru/assets/images/hero-workstation.webp","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getvmware.ru/","date":"2026-08-25T21:11:38.742Z","timestamp":1787692298742,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getvmware.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:25 GMT","end":"Mon, 16 Nov 2026 20:09:24 GMT"},"fingerprint":{"sha1":"16:7C:46:62:EB:B6:8A:63:96:60:85:1D:45:F7:44:CA:1E:CD:27:FB","sha256":"8A:E8:E0:89:7E:34:3E:37:95:07:EF:AB:2C:99:B6:DF:43:8D:BB:E5:90:39:BB:54:D1:35:8F:10:4A:30:33:C8"}}},"request":{"raw":"GET /assets/images/hero-workstation.webp HTTP/1.1\r\nHost: getvmware.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getvmware.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:11:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 91942\r\nlast-modified: Fri, 14 Aug 2026 08:54:49 GMT\r\netag: \"16726-658fdf919bc16\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":91942,"size_decoded":92355,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1536x1024, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"4ad3c468c2721ddb63c7e0666ab52070","sha1":"46ff71b9128c73397577504b253c80467ffb24bc","sha256":"c1aab6e84ea5d626b495557ffd2aaf24ba9891b40d8cd527fcdf6c526eef0b35","sha512":"330ca43b36aebefb834e9acabc952bc8271405da19df2ebc274e135e93be419bbcb14662ff5667dba3c16a1bab159d2d7c9176cb0404b184bddbb758af01d6c6","ssdeep":"1536:D72wbIfKWwa8YUeL4HAMFjyFy87nMtOSCxAu9E35INgde9EWDGYsGQMU8PX292dj:D7kfKW6QqtFOsqndhY5IKgnyYsfMUeX3","tlshash":"e293127821960a195773c2945b77333318d84d072ba0da13bf9036dc57af1ee2e9ad4e","first_seen":"2026-08-25T20:55:43.345417Z","last_seen":"2026-08-25T21:12:06.698216Z","times_seen":2,"resource_available":false,"data":null}},"time_used":62,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":41,"receive":21,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getvmware.ru/assets/images/vmspace-logo-light.webp","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getvmware.ru/","date":"2026-08-25T21:11:38.743Z","timestamp":1787692298743,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getvmware.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:25 GMT","end":"Mon, 16 Nov 2026 20:09:24 GMT"},"fingerprint":{"sha1":"16:7C:46:62:EB:B6:8A:63:96:60:85:1D:45:F7:44:CA:1E:CD:27:FB","sha256":"8A:E8:E0:89:7E:34:3E:37:95:07:EF:AB:2C:99:B6:DF:43:8D:BB:E5:90:39:BB:54:D1:35:8F:10:4A:30:33:C8"}}},"request":{"raw":"GET /assets/images/vmspace-logo-light.webp HTTP/1.1\r\nHost: getvmware.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getvmware.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:11:38 GMT\r\ncontent-type: image/webp\r\ncontent-length: 31644\r\nlast-modified: Fri, 14 Aug 2026 08:54:49 GMT\r\netag: \"7b9c-658fdf921ede6\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":31644,"size_decoded":32056,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f062904958d18bc902fe9c23f81929c8","sha1":"1a393ba004142b23b898682a99dce8dc39e7f4b1","sha256":"ac5d934ee4dbcc32fcf4bb73508cb612a843dd6ba8a61c4d8aeb89d340cb3e18","sha512":"7fdc98aeecfae991d33725a17e1ac85a749d4e98af3b5018b7d5f7583a498b343140ce4400e565c100e0dfa4411c4b417e2ef67abeaebfc32211418ac4d5b529","ssdeep":"768:GjJm8OrtO6t9jAFQJJIUhwqaFdcBvNYPik7z9z1Ud+:44Nrtz/jAFQn/wqawVY6g18+","tlshash":"6fe2f1c89b35ffb951035db8a0663ad01bdbe6c43ec0885246d7982b71f5dc9282736e","first_seen":"2026-08-25T20:55:43.347081Z","last_seen":"2026-08-25T21:12:06.699088Z","times_seen":2,"resource_available":false,"data":null}},"time_used":60,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":57,"receive":3,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getvmware.ru/favicon.ico","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getvmware.ru/","date":"2026-08-25T21:11:38.971Z","timestamp":1787692298971,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getvmware.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:25 GMT","end":"Mon, 16 Nov 2026 20:09:24 GMT"},"fingerprint":{"sha1":"16:7C:46:62:EB:B6:8A:63:96:60:85:1D:45:F7:44:CA:1E:CD:27:FB","sha256":"8A:E8:E0:89:7E:34:3E:37:95:07:EF:AB:2C:99:B6:DF:43:8D:BB:E5:90:39:BB:54:D1:35:8F:10:4A:30:33:C8"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: getvmware.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getvmware.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:11:38 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 17183\r\nlast-modified: Fri, 14 Aug 2026 08:54:43 GMT\r\netag: \"431f-658fdf8ba6bce\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17183,"size_decoded":17597,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 4 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 32x32 with \n- PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced, 32 bits/pixel","md5":"e859a8ef94980f3676904761487a40ec","sha1":"af09ee04d8cd876d762c2e034aa27e25f6d1eb63","sha256":"6c44b91c5ebc73840fc380c560fd97316aef5a3240f39cc9f6df87624e7a5390","sha512":"be90374aef87e25337d5014f0b4a850d5a52170ed52eb6dd49820fa0e2dfb5f8a2f64935aef07a27eb7ca66076f9401bbeea5fdeef14aa7f5bca10a2c9963b39","ssdeep":"384:h2RgXjJgGvVfa9YMvxIQFEqvg3kkLzL3OpRk9NUi+:oRgXj6Ef+NyqvKD3WRk8t","tlshash":"2972e184313fa61a7c95c863704b9dcd13180eb4e6ca214e183dada5599f11f2ef83cb","first_seen":"2026-08-25T20:55:43.32802Z","last_seen":"2026-08-25T21:12:06.700018Z","times_seen":2,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getvmware.ru/","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:11:38.385Z","timestamp":1787692298385,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getvmware.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:25 GMT","end":"Mon, 16 Nov 2026 20:09:24 GMT"},"fingerprint":{"sha1":"16:7C:46:62:EB:B6:8A:63:96:60:85:1D:45:F7:44:CA:1E:CD:27:FB","sha256":"8A:E8:E0:89:7E:34:3E:37:95:07:EF:AB:2C:99:B6:DF:43:8D:BB:E5:90:39:BB:54:D1:35:8F:10:4A:30:33:C8"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: getvmware.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:11:38 GMT\r\ncontent-type: text/html\r\ncontent-length: 3780\r\nlast-modified: Fri, 14 Aug 2026 08:54:43 GMT\r\netag: \"311c-658fdf8bd84d5-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12572,"size_decoded":4241,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (3948), with CRLF line terminators","md5":"63ef3717ec75ae3067d7ddb09773583e","sha1":"8620a6d86b585bff33a4d72a13743902d8cc9691","sha256":"56e4cc8b0fc58340ef9a9b1d8fa8dc4602c08d14db578364672f859450a372f3","sha512":"3e36b29361530fdfa788a82e341296188c62b9f1d8a8dd4784ef5580f93aff8414c42990730441bcab786da4981500ca88d44e48b2a99472294e02e44efbc43e","ssdeep":"192:x7UeX/Z79coZ0hE/2wrujnODgP5ZQ/Xol3co1NaE71t2tnnbjz:BfX/Ya/UYgP5ZQ/Xol3caT77y","tlshash":"f542b6b3a0d874ff431361dae606774d71eb42be9652191516f83aae36f3c10ca2f605","first_seen":"2026-08-25T20:55:43.333038Z","last_seen":"2026-08-25T21:12:06.701045Z","times_seen":2,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":58,"connect":20,"send":0,"wait":38,"receive":0,"ssl":43},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getvmware.ru/assets/css/site.css","fqdn":"getvmware.ru","domain":"getvmware.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://getvmware.ru/","date":"2026-08-25T21:11:38.737Z","timestamp":1787692298737,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getvmware.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:25 GMT","end":"Mon, 16 Nov 2026 20:09:24 GMT"},"fingerprint":{"sha1":"16:7C:46:62:EB:B6:8A:63:96:60:85:1D:45:F7:44:CA:1E:CD:27:FB","sha256":"8A:E8:E0:89:7E:34:3E:37:95:07:EF:AB:2C:99:B6:DF:43:8D:BB:E5:90:39:BB:54:D1:35:8F:10:4A:30:33:C8"}}},"request":{"raw":"GET /assets/css/site.css HTTP/1.1\r\nHost: getvmware.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getvmware.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:11:38 GMT\r\ncontent-type: text/css\r\ncontent-length: 3903\r\nlast-modified: Fri, 14 Aug 2026 08:54:45 GMT\r\netag: \"3523-658fdf8e47e26-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":13603,"size_decoded":4364,"mime_type":"text/css","magic":"assembler source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"406c53d9b6da97d7c90f7d647ad69bb4","sha1":"96c4e7ec3c8a053ed59579f76249eac996a4f8b7","sha256":"aa9b2f6ffee17495a86465089eccc3cf1a94a1733cff97911c96a423b64107d4","sha512":"b2a1a8e056614606586796edc093274b90bfaa81dc483edc67657c9914f4067d28f651383e432358173903d8243ded9aaa741bbe1b945593aaee94a9324b92f6","ssdeep":"384:xmAP3I2Nd2Vt308SgSrlLstbmFXn5GAo/FiNl50Eo:xpP3qVrSJCE+MG","tlshash":"b35274657614323cb63bb50ae7d0564dbd3ce012e12707e9fe55e21482c71f21eb6a8d","first_seen":"2026-08-25T20:55:43.337148Z","last_seen":"2026-08-25T21:12:06.701865Z","times_seen":2,"resource_available":false,"data":null}},"time_used":21,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":21,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getvmware.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}