1275.ru Open in urlscan Pro
2606:4700:3032::ac43:8c54 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/
Submission: On October 10 via manual (October 10th 2024, 9:03:48 am UTC) from IT — Scanned from NL

Summary HTTP 40 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 6 domains to perform 40 HTTP transactions. The main IP is 2606:4700:3032::ac43:8c54, located in United States and belongs to CLOUDFLARENET, US. The main domain is 1275.ru.
TLS certificate: Issued by WE1 on September 13th 2024. Valid for: 3 months.

This is the only time 1275.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3032::ac43:8c54	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 21	172.67.140.84 172.67.140.84	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a02:6b8:a::a 2a02:6b8:a::a	13238 (YANDEX) (YANDEX)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:303... 2606:4700:3032::ac43:beaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a02:6b8:20::215 2a02:6b8:20::215	13238 (YANDEX) (YANDEX)
3 9	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
40	8

2 2606:4700:3032::ac43:8c54 (United States)

ASN13335 (CLOUDFLARENET, US)

1275.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 172.67.140.84 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

1275.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:6b8:a::a (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)

yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3032::ac43:beaf (United States)

ASN13335 (CLOUDFLARENET, US)

waos-soft.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:6b8:20::215 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)

yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:6b8::1:119 (Moscow, Russian Federation) 3 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	1275.ru 1 redirects 1275.ru	238 KB
7	yandex.com 2 redirects mc.yandex.com — Cisco Umbrella Rank: 9307	3 KB
6	yastatic.net yastatic.net — Cisco Umbrella Rank: 7378	194 KB
5	yandex.ru 1 redirects yandex.ru — Cisco Umbrella Rank: 1971 mc.yandex.ru — Cisco Umbrella Rank: 4610	163 KB
2	waos-soft.ru waos-soft.ru	23 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 683	7 KB
40	6

	Domain	Requested by
23	1275.ru	1 redirects 1275.ru static.cloudflareinsights.com
7	mc.yandex.com	2 redirects mc.yandex.ru
6	yastatic.net	yandex.ru
3	yandex.ru	1275.ru yandex.ru
2	mc.yandex.ru	1 redirects yandex.ru
2	waos-soft.ru	1275.ru waos-soft.ru
1	static.cloudflareinsights.com	1275.ru
40	7

This site contains links to these domains. Also see Links.

Domain
g-soft.info

Subject Issuer	Validity	Valid
1275.ru WE1	`2024-09-13` - `2024-12-12`	3 months	crt.sh
*.xn--d1acpjx3f.xn--p1ai GlobalSign ECC OV SSL CA 2018	`2024-07-12` - `2025-01-09`	6 months	crt.sh
cloudflareinsights.com WE1	`2024-09-03` - `2024-12-02`	3 months	crt.sh
waos-soft.ru WE1	`2024-09-01` - `2024-11-30`	3 months	crt.sh
*.yastatic-net.ru GlobalSign ECC OV SSL CA 2018	`2024-05-20` - `2024-11-17`	6 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2024-05-23` - `2024-11-02`	5 months	crt.sh

This page contains 3 frames:

Primary Page: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/
Frame ID: 4E866CF54FB33C86B1EA8E24BCCE2BD2
Requests: 46 HTTP requests in this frame

Frame: https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js
Frame ID: 8D4D3F816FEE4AD8634FDF86B494F690
Requests: 2 HTTP requests in this frame

Frame: https://mc.yandex.com/metrika/metrika_match.html
Frame ID: EF1321B405ABD982FFEE1107FBBEED75
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Mamba 2FA PhaaS IOCs - SEC-1275-1

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Page Statistics

40
Requests

93 %
HTTPS

86 %
IPv6

6
Domains

7
Subdomains

8
IPs

2
Countries

626 kB
Transfer

2119 kB
Size

19
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://g-soft.info/
Title: General Software

Search URL Search Domain Scan URL

URL: https://g-soft.info/feedback/
Title: Обратная связь

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 28

https://1275.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js

Request Chain 43

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10518.Ad4v23-YQrQT99rN_HAKOcQWdsOpM2wnwLE91gxLkj2oo0b_60qNypEC0dOZWRRj.fB0ialyuZANYVYhe9fl07fPtrI0%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10518.0n5dSFfuckL9gznxbIRT4bSMYvxZwRj0Mfs4bauSTxI6HqLBWPZgdeGmPPBuev5pn28VJaNo10vIdnRKUlCH9sK3y7KLbOq7ckPjDMhb8XM7JJH3w7MAD11ulJQd7EUY5tn9ttJhl6hHoY77dYYZ0gambRYC8NNGe1LE9FxTaxIU-Tx7GwqC1vMHF6ozNHVnROSwBCxhRsaqOGFN71zLaS1mhaieXbsiBk6ld205jKg%2C.J2fg2yPDf9uGIjjkoC-7wIEWlQ0%2C

Request Chain 45

https://mc.yandex.com/watch/1788970?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Anl-NL%3Av%3A1470%3Acn%3A1%3Adp%3A0%3Als%3A107373584730%3Ahid%3A1010239012%3Az%3A120%3Ai%3A20241010110344%3Aet%3A1728551024%3Ac%3A1%3Arn%3A1049785346%3Au%3A1728551024918848431%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1728551021420%3Arqnl%3A1%3Ast%3A1728551025%3At%3AMamba%202FA%20PhaaS%20IOCs%20-%20SEC-1275-1&t=clc(0-0-0)aw(1)rcm(1)cdl(na)eco(565312)ti(1) HTTP 302
https://mc.yandex.com/watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Anl-NL%3Av%3A1470%3Acn%3A1%3Adp%3A0%3Als%3A107373584730%3Ahid%3A1010239012%3Az%3A120%3Ai%3A20241010110344%3Aet%3A1728551024%3Ac%3A1%3Arn%3A1049785346%3Au%3A1728551024918848431%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1728551021420%3Arqnl%3A1%3Ast%3A1728551025%3At%3AMamba%202FA%20PhaaS%20IOCs%20-%20SEC-1275-1&t=clc%280-0-0%29aw%281%29rcm%281%29cdl%28na%29eco%28565312%29ti%281%29

40 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
1275.ru/ioc/4072/mamba-2fa-phaas-iocs/ 48 KB
14 KB 834ms
724ms Document
text/html 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efea4bb3ae07d4c1b7042c9c254f55e0696e3cb0a5ea6bc5ad6c4b44fad37f4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-edge-cache: cache,platform=wordpress
cf-ray: 8d05704ca862656d-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 10 Oct 2024 09:03:42 GMT
last-modified: Thu, 10 Oct 2024 12:03:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n0GwbaIAIWxuRWXNCkDd8x2KfKOWZqcMy4I6z41Seije%2BnLsli2%2ByU8fSuv6ZonHzDi1x7LJBKNrLs2xEpzAS97Ybuz5X%2FijWfiyElgse2PvwH%2BipaYoEXLTr%2FmIGMkYesckFRLX"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
strict-transport-security: max-age=15552000; includeSubDomains; preload
wpo-cache-status: saving to cache
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H2 200 speculation
1275.ru/cdn-cgi/ 128 B
460 B 38ms
35ms Other
application/speculationrules+json 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/speculation

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PT4VIvHfD%2BY%2BJ7KJs8ZZwtf%2BDhAA3y17Vb6bMUSu8l%2FOBeARk2ymMkHn8XV2m6mVR5wPZzrAkUKy26W26%2FzoeXytwWfPryHRpj5LXxaTs7d4My80SmOetw98W%2F3x5P3bjYiyGD2F"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d0570514eb1656d-AMS
access-control-allow-origin: https://1275.ru
alt-svc: h3=":443"; ma=86400
content-length: 128
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H3 200 cleantalk-public.min.css
1275.ru/wp-content/plugins/cleantalk-spam-protect/css/ 3 KB
2 KB 44ms
41ms Stylesheet
text/css 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/plugins/cleantalk-spam-protect/css/cleantalk-public.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4415d5193e5df707aad724ec670c445ae2d32471f8bef689b382a6314bb6b0e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o4PyWHGvGmcF%2BqX01UzSeS2SdmMZA6YdY13CiGthIXh1QZWwrOVR0Dvz1W8z8DUO7AmLQOpWVhjM9ylk7JtHqavUDXm47gXGlFWLdKgJ75AvTDidcTYVQ%2Bd%2B"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: text/css
last-modified: Fri, 04 Oct 2024 05:44:42 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d0570518cc10a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H3 200 screen.min.css
1275.ru/wp-content/plugins/easy-table-of-contents/assets/css/ 6 KB
2 KB 63ms
49ms Stylesheet
text/css 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6ae8dbff96469621efbc79f5d44c1f6d6c13460ed12e34e826af9b0308424aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lo6sxzJawG7bnGFWy5aVlt%2BXdyUtR6wyojxkWndgIn2mPLfVwZs8HxLE8jmeUHV4hIgCJ%2FRF%2B7Z53kqCvWE9N0cgs41ZKo923TfLsvSbqVX02%2FRPDMQYNGyf"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: text/css
last-modified: Wed, 11 Sep 2024 05:23:25 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057051ace00a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H3 200 a3_lazy_load.min.css
1275.ru/wp-content/uploads/sass/ 127 B
600 B 62ms
48ms Stylesheet
text/css 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/uploads/sass/a3_lazy_load.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2f1b190e5d5a3063c35b75b1a00c039b13e171eb7b099299dcb67e9e4fe65cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WQ5ADDjRsYmmrjFg7GYFz1z5EKPZqFNpaEi7d5YkHF%2FVpkujS9P3o3wLHtHJ3i%2BtDbOEOROTBTVdmUBm8WeSLdBBihaQ6xdIx7T6YFngw0JElSRtyzJlaRUL"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: text/css
last-modified: Thu, 23 Mar 2023 18:32:44 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057051ace10a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H3 200 wpo-minify-header-df171ca3.min.css
1275.ru/wp-content/cache/wpo-minify/1728481682/assets/ 260 KB
49 KB 64ms
50ms Stylesheet
text/css 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1728481682/assets/wpo-minify-header-df171ca3.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d73c2f35cf104b9eec6c97b351fd1bb05bc19c11a253d8f9cd191671d45460af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FkzyxR7BrA%2BYSOJ8BxEy5EqFx20BrtMuX2qYBXSR63CWtQbXG9PH748D%2FyTf%2F94biy9dqm3IhjnI62zwwD8n015asK8wf6Y%2BTvk1%2Flh6AwXKzkOBIld9qiQ9"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: text/css
last-modified: Wed, 09 Oct 2024 13:48:11 GMT
vary: Accept-Encoding
priority: u=0,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057051ace40a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H3 200 wpo-minify-header-14a32408.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1728481682/assets/ 185 KB
59 KB 58ms
49ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1728481682/assets/wpo-minify-header-14a32408.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

617b6d1a50f97d83c2c1a2f5a55d696c02e591c10676785921f131af446feca4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cm4Zie07hF38Q7ifgv%2Fsxp5UOokZbsaDs8iYL5XUc0Hps36s03kaEpL%2Fi9eRPj5BvvYS1nfnmiLs2BikByXGOUVH%2BYtjU2HkFEzqmTFIS5QjWCCWZK1ulo3h"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:48:11 GMT
vary: Accept-Encoding
priority: u=1,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057051ace80a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H2 200 context.js Show response
yandex.ru/ads/system/ 372 KB
106 KB 265ms
124ms Script
text/javascript 2a02:6b8:a::a
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

07071b35f73d7766d54723cf3459878ea3d978a11e08bfbed3d5f33379e1a543

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
x-yandex-req-id: 1728551022690858-10763300110465203059-balancer-l7leveler-kubr-yp-vla-263-BAL
cache-control: private, max-age=3600
timing-allow-origin: *
content-encoding: br
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT, Width
etag: "5b4b203f42e75c2b1a728a9d73a6bf1b-1132747"
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 10:03:42 GMT
access-control-allow-origin: *
content-type: text/javascript; charset=utf-8

GET
H3 200 wpshop-core.ttf
1275.ru/wp-content/themes/reboot/assets/fonts/ 57 KB
27 KB 127ms
118ms Font
font/ttf 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/themes/reboot/assets/fonts/wpshop-core.ttf

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

973408bd1a1da181c7eaa9293c0cd095f3836a76b626bc76af21e1cd96b5dcde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=reWW6XYpno%2F%2Fvp5PtFmsVremPLiWC8wPwFx4VAeNPdTqzGH3w%2BVEOIArWMevqRNCFhG7oHRiE7hNJvaAdcmHGjX7PP6Vyx6LQ9p6x07JWq9cYkNoB55lg8iU"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: font/ttf
last-modified: Tue, 13 Aug 2024 05:01:08 GMT
vary: Accept-Encoding
priority: u=1,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057051ace90a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H3 200 cropped-54925859_transparent.png.webp
1275.ru/wp-content/uploads/2024/06/ 16 KB
16 KB 97ms
92ms Image
image/webp 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/uploads/2024/06/cropped-54925859_transparent.png.webp

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6898945c1cd627102a395524e84b7b9a80cdce29286005498fd9710c69764df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mbXiJK4BFbQyyTqVmvolFsvcAyakZOBktLgbI4tY88QogiWm8UH1ny0Q2SwNI6gWuNxgPIXp2kPiX1Q9IK5m4EBtttn5nrPI6h5azSrVoeGwUkTuyQHr1U8c"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: image/webp
last-modified: Thu, 06 Jun 2024 09:30:54 GMT
vary: Accept-Encoding
priority: u=2,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057051aceb0a61-AMS
accept-ranges: bytes
content-length: 16060
x-xss-protection: 1
server: cloudflare

GET
H3 200 phishing-700x400.jpg.webp
1275.ru/wp-content/uploads/2022/12/ 4 KB
5 KB 123ms
118ms Image
image/webp 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/uploads/2022/12/phishing-700x400.jpg.webp

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e54223a75a848b7ff480834d8b50bb240326eb41a2e1cfd53c76de4b05219f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IWu930Cr8aUfpijrwOe7UGaXFNdRl0RKURV63ERwhtl6F7etn5leOFahUtsFUClekTH3OwwFq0bNdBPpiG%2BnoIQhToSniyMS%2FStoY6tepwuaXWPcQjdVL%2BfZ"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: image/webp
last-modified: Thu, 23 Mar 2023 18:32:44 GMT
vary: Accept-Encoding
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057051acef0a61-AMS
accept-ranges: bytes
content-length: 4470
x-xss-protection: 1
server: cloudflare

GET
H3 200 lazy_placeholder.gif
1275.ru/wp-content/plugins/a3-lazy-load/assets/images/ 42 B
528 B 113ms
110ms Image
image/gif 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/plugins/a3-lazy-load/assets/images/lazy_placeholder.gif

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z4X7Zdi4ofTCr79txrUqDPhnEJiMQpYfUQvLA00uBpe3A61Esw0SbiStZn32l7XUW8gfh6rqvWIRov6lrwzfMdIAjfv7tjuwVv%2BhSmM8hu67Z%2B3qNMy0Sd97"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: image/gif
last-modified: Mon, 15 Jul 2024 15:29:45 GMT
vary: Accept-Encoding
priority: u=2,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057051bcf60a61-AMS
accept-ranges: bytes
content-length: 42
x-xss-protection: 1
server: cloudflare

GET
H3 200 wpo-minify-footer-98ce323d.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1728481682/assets/ 64 KB
14 KB 31ms
30ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1728481682/assets/wpo-minify-footer-98ce323d.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd057d7db4c5263a87501a7d8a59729dcaa1496e669def1f418cae4c817a1a8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vPsxfFi3pdynY1auCMgEphps940WLIMwt14oi0%2BVEyJ9xyEGmMk1oCBPRAYXe2ek7EYUs09IHcwKnvFksJJF4xfbp0%2BLn4QU3URrsvr8HU3%2BbZoXyw%2BVAhUQ"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:48:11 GMT
vary: Accept-Encoding
priority: u=2,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d0570526e070a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H3 200 wpo-minify-footer-65360760.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1728481682/assets/ 3 KB
2 KB 36ms
35ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1728481682/assets/wpo-minify-footer-65360760.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c420f32b3ac8ca4dad29c471fd2149bf221ac03740c7816154c9703b38f6907c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4WmrGZXcImg6xehGCZ8isMSz1TY%2F8mqZi6os4NWqF06sq0TuwLFpzxsiwp%2Ftav3IEmTu3qSqXN%2BYYKsG2N92oq0Mbv4lUBiZnphfXCg%2B0XplsVURP%2FVmvrbl"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:48:11 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057052de850a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H3 200 wpo-minify-footer-3c86297b.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1728481682/assets/ 28 KB
8 KB 44ms
42ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1728481682/assets/wpo-minify-footer-3c86297b.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9387807e98875575d1c4f5c12d5b0088c30f9f16cd72d63306db0d841e3a8609

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 2229
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s7fmRXHB2EIsqINhLIvQT3Hi%2B7K9qfb1BXvJsQ7HzdA6zSBoKfIBDy7NmDkV3GJcE9mBU7hcCM1ehPp%2Bnj7caNe8431i4CFo3xX6lmI5dsN5zI9LClxp0%2F1E"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: application/javascript
last-modified: Wed, 09 Oct 2024 13:48:11 GMT
vary: Accept-Encoding
priority: u=2,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d0570527e100a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 110ms
62ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 8d0570531bc39706-AMS
access-control-allow-origin: *
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 phishing.jpg
1275.ru/wp-content/uploads/2022/12/ 0
25 KB 86ms
85ms Other
image/jpeg 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/uploads/2022/12/phishing.jpg

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LEPf2DCN%2F5s1r6YQ4pStd2GOL4Y8rLrxxytbQ80yWA%2B7E9%2FCvLAiRAcqgIG768rnLQM6v4TUTneF61W%2BTsojZXysrcvr%2BOtT9CJrHy48lNpTEyPOCupDqTuc"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: image/jpeg
last-modified: Thu, 23 Mar 2023 18:32:44 GMT
vary: Accept-Encoding
priority: u=4,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
link: <https://1275.ru/wp-content/uploads/2022/12/phishing.jpg>; rel="canonical"
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d057052de890a61-AMS
accept-ranges: bytes
content-length: 25510
x-xss-protection: 1
server: cloudflare

GET
H2 200 matomo.js Show response
waos-soft.ru/ 68 KB
23 KB 293ms
21ms Script
application/javascript 2606:4700:3032::ac43:beaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://waos-soft.ru/matomo.js
Requested by: Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:beaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3861cea1444a813c2b0a77ecd0dfbc51eb6bd05bb70774020251035b015f4d8c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
age: 5094
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xTjeUdfOG6%2FpTHuqarhARiYlNCgqMblT%2FXKzJMFgM70ySBE10gBEarXzrLwwnfauZ%2B7BomsaCQZ5sQwjEODEzvC%2Fj1GAiRycB7VKCnqPgHZow6vsC2awzsYjZmq%2BwCx4TID5zkkU1NolWis%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d0570549a449fcc-AMS
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 04:39:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
DATA 200
OK truncated
/ 969 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 401503518894f575673732c689a7885c78bb615900c0c3f726765eb4ce6aa799

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 290 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5aab9ecebd2bc2f003980fdde59b97aad0fd105312d99fa50fcab580099aaf3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17df1f2891553baf6c74c4eef8cd0dd9fb73a5669f9f89d67183a8bfe41acfd2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 626 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e9cca040634f071c068f7f483dfeef82d8589b4082c8cbdc5301951647ba71b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 544 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 255df06063ef8b4f994c1ae9d232d7c4f27c95b853a68fd9c03e31f4dd6b0031

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4192547933c47032776c86cc04805a86655e4580d0c82b46787a120fcd96c146

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3f3db2e6ac9e2b19172879a80a8605f4db7a179745be21a0828e3c1e49510ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 624 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b5acb20b58ca9f25a996cd5f44fcbde42154bb94cd95666197a59d4b539f07d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a9501cc809fac65ba3bc7fdc1686f8cc6651018b290308eddd1e46454063bf5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

POST
H3 200 admin-ajax.php Show response
1275.ru/wp-admin/ 1 B
635 B 456ms
449ms XHR
text/html 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-admin/admin-ajax.php

Requested by

Host: 1275.ru
URL: https://1275.ru/wp-content/cache/wpo-minify/1728481682/assets/wpo-minify-header-14a32408.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryhxYnfHVaBaVY4skb
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

x-robots-tag: noindex
cf-edge-cache: cache,platform=wordpress
content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JYG7s%2FfS15bzfDl2KkMzigWK5d375ABR8wXgce0T8yAXGtFK2vq2dyQC7eGbPsGvSSAlrhVpNe6QzgHkEdX%2BN5ZBjToTxA2%2BuTvS7MK2QOyfmHV5z2SeKUfb"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 11 Jan 1984 05:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: text/html; charset=UTF-8
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: no-cache, must-revalidate, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d057054082d0a61-AMS
access-control-allow-origin: https://1275.ru
x-xss-protection: 1
server: cloudflare

POST
H3 200 admin-ajax.php Show response
1275.ru/wp-admin/ 0
628 B 430ms
423ms Fetch
text/html 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-admin/admin-ajax.php

Requested by

Host: 1275.ru
URL: https://1275.ru/wp-content/cache/wpo-minify/1728481682/assets/wpo-minify-footer-98ce323d.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Cache-Control: no-cache
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-robots-tag: noindex
cf-edge-cache: cache,platform=wordpress
content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LtM0%2FGWe4t%2BVmLQ84yGjU%2BlWaEt1HSOr33Odn9evSG26Fvy2MDT3AV9LEpw1KIXetty5SK99C7vBj1WncBh8xpll32zEWsPr91ZiZW5eEWHmAdIJFcKAVgbz"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 11 Jan 1984 05:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: text/html; charset=UTF-8
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: no-cache, must-revalidate, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d05705408300a61-AMS
access-control-allow-origin: https://1275.ru
x-xss-protection: 1
server: cloudflare

GET
H3

200

main.js Show response
1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/ Frame 8D4D
Redirect Chain

https://1275.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?

8 KB
4 KB

46ms
37ms

Script
application/javascript

172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e9e460b95080583ea0e38469b14a1e82862cd51aa20486eab06e517b756e8f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QBIcw%2B%2FFN7CiFBHkAKlG1%2BXcyjoT8i%2Frx4gOzyqSyNbC2kwQ18v3nguyGG0iH%2Bh%2BiSVbtHGgV%2BzHqeEWu9KHE4gsvUC9S7vGAu188q%2BEMLP12hWwTgomfXDZ"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d057054a8f20a61-AMS
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jiKnjj9ngbGJLdhmhnpUOH779bv6qbotpooc9nltXjk5v30Xe1o1Ex1IV3Qg6gkywCSrRqWIDlhJvhg6cO%2FcxLsvT%2F7YsuF%2FRIMsQl8lXf2ErKWrXnBh%2F%2FhV"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d05705418370a61-AMS
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 10 Oct 2024 09:03:42 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H3 200 rss.png.webp
1275.ru/wp-content/uploads/2024/07/ 3 KB
4 KB 56ms
41ms Image
image/webp 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/uploads/2024/07/rss.png.webp

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57b706ad8e6cf27d0734cf87efeef7e4151e6ceb6eb92c854e719e1baf7c5e8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

cf-cache-status: HIT
age: 2225
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hfb36dXuYksdw%2FfvVw4dmVWiXpPp87guxV9TytnvTXKIl6j%2FTuYGCe5a0VJe2w1ZVN1VEW06AoPO8X%2BG8Wb6DqGl9ITF9wdwGnR7mpHjVBW4qcPlWBG41iam"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:42 GMT
content-type: image/webp
last-modified: Tue, 23 Jul 2024 07:42:12 GMT
vary: Accept-Encoding
priority: u=3,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d05705498e50a61-AMS
accept-ranges: bytes
content-length: 3248
x-xss-protection: 1
server: cloudflare

POST
H3 200 8d05704ca862656d Show response
1275.ru/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 8D4D 0
974 B 38ms
31ms XHR
text/plain 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/challenge-platform/h/b/jsd/r/8d05704ca862656d

Requested by

Host: 1275.ru
URL: https://1275.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PIUqRbLr%2BNuAdmUcYA1KA%2FC168FVTWvh4N1pWY3RdCdGWigp4FWbIrFRcQF5C1n%2B2Ml%2BzzJwccD%2FacH7s6Ffe%2Fe5hf0XipBrsEk6v0sXgq%2FbVJNwc6T9OfYZ"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d0570566b220a61-AMS
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ 25 KB
26 KB 427ms
87ms Font
font/woff2 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

etag: "7f0cdaf91230f9789ca4162aedff612e"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Fri, 10 Oct 2025 14:50:12 GMT
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: font/woff2
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
vary: Accept-Encoding
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=31556952
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
x-nginx-request-id: 9dbcaef5dd2180ed
accept-ranges: bytes
access-control-allow-origin: *
content-length: 26004
server: nginx/1.17.9

GET
H2 200 9fde960bdbec6f8bb4c5.js Show response
yastatic.net/partner-code-bundles/1132747/ 44 KB
13 KB 504ms
173ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1132747/9fde960bdbec6f8bb4c5.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

46150dade4041996f3eedf0900142e03348c60171e4eaa8a2e5aa9abc785dd9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "150e0777d57b32ee0164523a38ea63aa"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sat, 10 Oct 2054 15:38:23 GMT
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 09 Oct 2024 12:07:30 GMT
vary: Accept-Encoding
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=946708560
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12695
server: nginx/1.17.9

GET
H2 200 ab392781bbfcf8385ea1.js Show response
yastatic.net/partner-code-bundles/1132747/ 24 KB
8 KB 504ms
174ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1132747/ab392781bbfcf8385ea1.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

0fd076ef10f12354eaa7a55dc3b6fe71a4b3619bf5ec973159048c31e88e51ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "d7bd3a0b8dcacdfb613af37aa5c2df76"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sat, 10 Oct 2054 15:38:23 GMT
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 09 Oct 2024 12:07:30 GMT
vary: Accept-Encoding
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=946708560
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7947
server: nginx/1.17.9

GET
H2 200 f96feafc836f9667b679.js Show response
yastatic.net/partner-code-bundles/1132747/ 572 KB
113 KB 499ms
169ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1132747/f96feafc836f9667b679.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e8aaf18acba51dfbf4b936da5f4d4969ee7d4c66d4527b688b5f7e4ab95e0284

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "83d4427d044a60f7c39936e582ea8daa"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sat, 10 Oct 2054 15:38:23 GMT
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 09 Oct 2024 12:07:31 GMT
vary: Accept-Encoding
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=946708560
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 114995
server: nginx/1.17.9

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ 33 KB
9 KB 501ms
172ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "f80882bf67cf261aa08d636da095149a"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sat, 10 Oct 2054 15:38:43 GMT
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
vary: Accept-Encoding
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=946708560
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8878
server: nginx/1.17.9

GET
H2 200 4cf0db049a99b9ce4b09.js Show response
yastatic.net/partner-code-bundles/1132747/ 112 KB
24 KB 461ms
133ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1132747/4cf0db049a99b9ce4b09.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

5a618cf99e5ed2e9cb5494b72ba5865d74608ac937d18b50eff2416635bff114

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "a2b531fdf5511a3fe8596208397edb1e"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sat, 10 Oct 2054 15:38:23 GMT
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 09 Oct 2024 12:07:30 GMT
vary: Accept-Encoding
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=946708560
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24228
server: nginx/1.17.9

GET
H2 200 1788970 Show response
yandex.ru/ads/meta/ 438 B
1 KB 90ms
88ms XHR
application/json 2a02:6b8:a::a
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/1788970?target-ref=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&pcode-version=1132747&pcodever=1132747&comboblock-unencoded-vast=1&ad-session-id=2694391728551023186&target-id=22827093&pcode-test-ids=1111484%2C0%2C30%3B1066210%2C0%2C16%3B1094008%2C0%2C50%3B1125730%2C0%2C0%3B1114587%2C0%2C55%3B1126989%2C0%2C80%3B1106679%2C0%2C82%3B1094980%2C0%2C59%3B1126191%2C0%2C69%3B1131255%2C0%2C86%3B1112583%2C0%2C37%3B1127809%2C0%2C74%3B1128623%2C0%2C35%3B1085919%2C0%2C58%3B1127211%2C0%2C19%3B1132747%2C0%2C10&pcode-flags-map=eJy1WWlz08gW%2FS%2F%2BjBntC9%2FaUkvusrZpteyYKarLEA9kJsRUEpYXiv%2F%2BTkvyItmRYN48vjha%2Buju99zL90nISjJLqAzyKhOS05BxGgjJMlIUk1d%2FfJ982dx%2B3k5eTQSv6OTF5HH78Miuce0ammUZkx9vXkyWpJRVSWVaJYLxPEmAlgn1B%2BVyRUQwp6EULKUyj6KSimFc09Bc94DLqeBrmWcyo2KV84WknOd8GMF2LNevEdRH80rIgtNarqOESxbSXLbPO3C6hn8dPN%2F0XW0Eb1ZFEbSlaSHWMmEp64P%2BMuKyICz89yWMKvz9T1EzOOLflvQZzP%2FJP5cx%2F38W%2BKfeVxEeczKTCc1iMe8cQn55p8c8zdNc63CsnOdVEqqflSSBYJBrVgmBHwYJSbDAk64U22%2BfTvF0zbQ8%2BwhIgzyVgSA4H3BKkM8tXsle0w7Q7fsujm273rES0KwuKEkOjejViAiO5ThOfVQVkDWRvJJhnhLoEOVckhAF4PeKlqIcTHkAeY7mHWRoIfIsWStzQKthMVxP905rTpovoT6LoUUsQ6KMImhaDoN4juEf3VqQslSRgrio7QFVlCGlyOUyJcUIlOcZjVk4oioL8hAAaUF5SbJQaYQviCZHgoTB18Nwvmdq9jFyKr6kaxTUFeTLY04h6IzwEQjbtpzzWCFhuDd2mUCcERBfOwGJ2FWNkVDCM5nmfPi0Dhc55lELUZt1CZsg9rvpphum51vd04YDL3faVcQ4jBhxgsb0miJaKlEKRH46LAb6k9WIUef%2FjGQZUr%2FKWMSo8o2gPCLBoC627xltj1OCzBZ1aJR1yDeFTwVtns7yIRTH9S3N3UeJcieaZQVTkggyyDowpJjzvIrnww1T1zWraZhlSriQyLiKSnpVyFmCSoKKVnby%2BI%2FJx83N7cv7z0D5z%2BbuevsNf%2F9283HzfvvQufV%2B87G%2Bc%2F20vWte33y5edw1f358eXJxfXfT3lXIBwTcuN883e6ePrSPn%2B6b38%2F3m5d3268PZy%2F8tdl9vGmP7v5Wv286qtowfaMqFTKkEYETkawxlVmVzuhgGri2braVe40EJIIFMqLw%2BizJYSY0wdUcheKCvfiUTQ3L1xE7Ux2Qp9dG79rsXVv1NZkaNhqUa7TnydT2PMvRp0iM%2FQ0H6rnqA286fcN39CbrohIFLS9U5g2p6dmmqTchnkFHlEI0mIokKj5TIhQbUwQPxV2mNKuGoSzfaCymAjQuhCwDzorBtuCBA%2FrWXuKQlgsBofdMFRaWdcFRThuE8VFI%2FT0MpyvCQ0VE18XgMd8wtLaVHMhxnUrQGSUDBujXmzMA2%2FTMQ3bvQfYMQiV5mAcVTAdjCE4EjcFwZyVFWR4MP9%2Bw7FayZ8pGBPeqrjkinq43ZunWmpoYwTsUtVDhI8B57ewlK9mMJUwcxBzER6%2FxmngLX%2B%2BhFjShYsxsumc0cu3T8lCRaxCSoKy1AXki0sGE9CpIKjTKlIOODkvoWLrd6QVz9FVFWli2aL3d0A9RZSPKuobduKRUfWQNHHrVtsTBg67mOn4nyvKCZlzMFGkokFjojLMqWQyC%2BLbV9hG8Hss5JeFwCKGCeLaj10dIuc6CptafHvk%2Bedg%2Bqpp18lwquWoelOSIrhfdZxQ611HXvd8%2B6N1VdPc5gGc%2FwTIkfXODhFF%2B1XsMY3G2IM0Qe%2FbFIM8XDC%2BpQZRl8TNvgQqlrKRnH65bg1K%2FlbLOmd5bvTyqOThGANj4w%2B7h8UEZc3N7O3nzo%2BMJ8Bm%2F7bpl0TC6FPM3kSsm5qpSHKbxmseqF4Zda7gYEZp6Jw5lB3N8ki8hG8sVNw8DVMERGFTsY3YccEo0zNNao4aEOhfxG8xrodXLQUJQ6EaC0MAIdFRdEcErRmD%2Fy2z%2FfHAxbNc%2BHA%2BqUoCOKqrOItLtu5a93Wze6s7U327%2BnFruxpy%2BdZ3r6ebPt46Fe%2Fa1bXS6pZqKfM%2B7BA76HaBmn35Ae6lp9s%2BdDqK4m2W%2BDt7l%2Bsbklf5iYmog6Yal6bj68Qygyos9322SYdhKFgpMY6Wg5CpS%2BVrGLE1HSDoadjuSHY81vWlajjJ8WzNarnGI6ZogPceLHBMjgWvaPR%2FYpmU0oq84QTFUrBqFI5EkK1djwWX7tn4yjtajCgELLmmCZoHaih6HoX1kMHVMozG7Sp20LgIUVITFavjijHQDYfL15vHD9MvN9XZ3Npea9mWcEQHODxaqgslkxO2Ot28sh7IkYnLa3FtG1YH59I2Bct89PvTA%2FP2KQPmT56uflN413LbLqHON4OjTwQLh240AU9MNBJxtT1QW6I4Fz%2FfDwbO8NqpUBhxbP%2FIqRkm%2BkJh67%2Fw%2Bh3gKjkTisUned9t1QFnQoBnsMOD9rhpCWJfAenjGbETT3ocvTc5OG8sxJo7lAuZP83ZimK0l%2BnaXrXyf6LaNAvxq8vDw6TcF1MTV9Mvf0%2B31zd1u21y%2F%2FOthdzfpFgvf0XSrQyrCqgCdAUGC3GXz1WHl4Tv44JA%2BasAvCGbkUm0uampU8eSkDYh4cEjVlVDtzJQX4MBqBxLMKZQ%2FiPYTLgGMbjZS1YuVtqdDpNkgQ8JBw7OO3ezXD7fsrtfi67UbhuUkQbfab1TwlISkqJtimiNGu8Xyk9nbSGieflw6tWszMUdItYvEdq1XkIwmv7gbALruaWbX7IpThuXw6kk3HLsNocO5uJ6UEbRNIIycd%2F2TLU2rVbcSlQ2h4WmhZirw9yoQ%2BXBR1w1fb3eMKiLr9Guisg7JsbP7%2FSQFickC2oo1sufR%2FfZ%2FES4tjDgGmiVRE5yyUKE2dB24d4%2B3vVCy7JMVo4JLCEdRj8iSBcOTkXKK7x1lYdnJVBSSco4GCZHOBtt3u7vH%2B11PDnS2n1Zr%2F6FBzTQf1fW496wbtmr0VK3FZur%2FbnrLsLPlLdTT%2FXYmCctw0R%2BDlS%2BMukF03KNunewo5hVZUSYNTwqkT4K6MpbbttdZcjRNFtwAhINcXewqWi%2FUPc1%2FBoFejeXZwOFUbTcusM2fBgjypJdQ73a3u%2FuvN0%2FPCaHadLvKbJI1j6LhgDY8xzgm%2Bgm9aGfpAL%2BQJ%2BcMapwvTc7CyLP9di0xUx2mntLU9mdWxSOCuIbeRE%2Bdhheix3Att7%2FEVbd%2BvPnxX3VYbig%3D&pcode-icookie=IQGS8L3scFIjvmmd4UlMOTiq6mHsN0hUFUSWSyyvPENGIJLOOVRe%2B5LzWKDuR7ixvR9hes%2B9Zh9ZreRk9xByjFE9qiI%3D&imp-id=1&ecma-version=es2017&charset=utf-8&test-tag=111600430219266&tga-with-creatives=1&top-ancestor=https%3A%2F%2F1275.ru&top-ancestor-undetermined=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1050%2C%22top%22%3A303%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A0%7D&grab-orig-len=4468&grab=eyJncmFiX3ZlcnNpb24iOjJ9ClLlorDcuA1QSwNrt3NO8slP3Wk3kU04mjZdemOLxWKvhCM54plZGJk5TzHs9GST3Qk9PCK86yJ4ESGwffITDZ4f0HMALqqqCCfMHH4ydbeXD6uKqCiIqKgwnciNYhmdqA-JjM5tbtxl1COSjqkEg3ZSicagnDSw4HkznZRgwktVSkZFqqJjKfzoou6OGY6og62VdC_xW-C2GmpnUkO3hy7YWght1bLI6FgKHdIqEcwkHp4Htjaonpu6PQri4fZU0sVDGLvTayFZ3DPA9DjPgzdJyqRmVNoPcfWj4aaeO0LJ8CWTOEh7JO2S1O9eUEOvkdx2SZcOP_UbmcjVyugkjcSmxWtu__fgQpC2II1bSDq_v97D3zwk3f8RYTwzByAOFo_IwXIweIQO5nTQJw-6g-Jg7wuSg-ugOpg84OhYRqlO9y00p_krbjC6hG30fElbGB5fYRzrc5b639n3Ua4ZPmSWnD4lLPuxwBYujO2lUQ-Fvz1uy6YnQr-5gsLqnuXxKTR8SYTxzzikLdbn4DWycLjCL4ThTD1i4uF3wwcuHFrD1wHQVo3vYDqoPHzOiUUYW7u2O8_l9PrwE5HW2Ei5sVUvhxRSmc-HknjTwb5-0-PP0WihmdX-h--25OMs-ZC7MC1QNkf7xI2YEjML5QqCfP-QcYVeGgilcfNE0xAcouGlxZlFwkgajvZ5ejcmq74gbTWZ7iBLA9Ez-7BeaK-T1jbsWPaCEdqwrwYgHbQPI8gfRLg8vI8XHuGnv0QNiA5uSb6JNTfMy98GuDtEKrurL-sPvEZcq2eaP7kqc4EK8xYNsl6KfMXjACUn5zakRWJmQ2yXXWdEM1vTXTLW_rPd4yHtT7EDUAeZR-DgfG0xHfT3CchbZBSbQrdFXaZm0KjUGqVayXQ27f8QHjnH7VMUyBxgfhd_d2E7uJNyszodZAdl_h1nM03040N6S7wWep4ZxvzEQv9hsZ6tPewdnx_Qn0EUB6KBCeZlZvKgPU8QzkMdoI8dj-D2oT8D_tPGXQ19qb_ZHTQeFAcih_Knjj-BSEENO_032j_yoA4G6zM-Nzord5TxgOMB_0BBMkYrD38-TSCtJcN9YJO6JX71qtidzHKFho4lMNUT5NStSUqiJFeTy-nJP0Sr8Gvop6L2ZvcdQTAz73y3ocj8br2G7jvZM5U0vydLkupSvTHF4XIJ1uU-tTKKIX0AVTzhlax5O0jJSDjWJmVjady_hHQGctb1vesJOo6DG80dUGei1Mponqx_8199r0wbBX6NmlfMEXiPzfxLqUiYwGN2pmUnBw92Cq0Mbj075hlMAgfo1itbaKWlqg957gvAJXLYowTfwdIPQt1AQTsWBDy8_0Pe2EE5hueY_HOKW_grcB30_6H8xntizPdSgv9_BGw0QFv7jvu2DPOZgUsNBi0467fI6yAoPOB5UN5LgTBIBuUqsel7GGa20yi7GP0ZUtaEtLsaGljzHRzt7c0zKMr4ezQP6g2LvR0_AfdO-muw3vuweQTz3O4dkfC73xGf29uKm25ZoK5r8U-dvoWQF_ZjamZWlY8l6lKOuzX-3q6CUNddrrhXayiskwf1Sj95gLqPwYgf-f1VuLLdH_fKb8hzmRD5DO4PCW3Lxd8fhSCpNbwkvc0-CraGEK_Ns-X4PLxfgbpW0zTzW-5_vKJ5mfv-N4NvI79Pwl27EY-hG9wYd8D9xP_kT-HV-jK25N3na6fPxbzkHyusCS5to6AGh3XmsD3KnvmuyQshcuzZ5IZTMZEBJ3pYM3WbrGOPdaT-peIqhc5WWpP5sHn-_NBv8u8Vd4K7xBM42eJgbfWBqpPr2I_jR7T9flx9Y6iZUQ7mI3fxOcbj030xjb4M84iwwg7XP8XjIkT0OixVbaHLOouDLvF90xHl1BNuP1DWifl3zRX-MSd1DnOs7WavGLkI-Mv_am5tikewEYLyBDLm94xVHLmwgLpLChTHWQ_6Nn_NzuO2sSOVzll2RuSdC_I52deX8G-fUogbbgQO_4MLhCVpikeuj8-l9SL4yZrS3md_UvS4k_kj-vEAxo2_5Ym-6ia_pP5GK3RzWOdIvoA7bkAXNZIb-2fzkW0Xxn7YGUP0a_NdbSoV6rmqPNoGKdHOfID87QqPByLrFUGfcHhP-VlZOdb24sJUcOBL9Fpt7iyWXyf-ntnjWnn4X3xgvwTQbmmJtCvAAyC4N8d_z1p-iZ_eM63rI5A3uQ7OlRd7rdLZG_z0UvlUo23mLm1EW7YNiK0r3poVFE60W-3c-jx6yepB5iIW6_XT2Xkwdsp_pqssZ1teFEzUVX2zxomy1coVuw_OzoZZZsApVSvd20Ye_SIwNU1oE_GLAUO_97oS3lxKaajS34u93UDnJgjSlgx1jQbu0YI4AVrM6hNQSGjpRwaJmLNC_8BtvVzFqNQwyF_fYdKoGBm4Kr_1w8ys-5Izsb0UGgW97otRyfaSa-jZ18uZNEoVOyf656Fk0H8xsO-nZ9So5Ar9l7VNJbNGKX8V4B_0xh-zQiNn5D6ZHlKlUTGrNSqV4Sen1zBZnk-1gul2WX70GpWC-btSWlXckn25OftKuZoRvkKhVsNnVj9clQwpfPicyhsvzCol4ifGoUD0JE0QPw0GRE9SlRzxk7gP7snui6vWWSJSLenJ4wq8qIeapEacpKpd__WCLhB2Bs8zXVXSPiKyWmPDIxE8FsN7_Ej3XNM16p7XvFA8_Mh8V0Y1bMLwT9VEAfOIA9Hj3VxQhsB8Z_Juaw2jamSuCGrcRzhikYm93PX7NzhOHmq-M0b1MM1_9ob5zsBwz0Kz6S6tX7xQ8l2YH_TJeGxWDUNxMzWSJJW0de-jl7R7umflDVp1jszu0-my32rQxbVKNDAEIJt_sdBz_XHtmq_iV-Kf7kRkmOXu_uPcaxp2YukwJVpchf4yFT7ejv3sira-PklLTNUSCYIOQ9zCZ9aGicZI5TYvHUF73epaNN2U4o7EjTkaSN3Cx5XR_8j6sfghpHMP4muz_-O777756HWSftEOipA9oPeaVv_TaZzda64oETWp1PiC8Xvdd2oTl8cOdVfoa9wasD8taXRFzZdsREaDpBmXiz5WLveiGpjuxBdeF5DmD0mN3REF38x4_AOJ6Ub8pt5TPz7i8QiaJG4Jqfnq_pQM6vBMv1hitdYGEXMkIudImY0CLJuzYPhBMBeW-v3EKRITZErcpSfxyy-uoCRu3m2SyrK-hbKy5qynF-USEz4di1RGV2OuwAuYVXuRV4_nr5ILwuonOLZE0YBJ5eLhLZjNU9OzNPpVhFNdDHIoUEGDp1Qw0GdBo1HuQwUG5aSyBXZ63N-MT4pG1v1VZY-Sgkdb7YSrOc3FZRKme8I0i3Afb9uiZlgEs0pbOMEaIanHnT89t02zF9l44kn11TnJllV2X2OjuCcLofQFju4g8yxI_9yXVmbTtHt0-VOCCTosGlqrIIJ9hVfPamv1Dx890clwbXEN2zWjnEuQvAUxVzrlAIKrv2Eu_jVnnZ_VQ9ytBcbMk19JDQvvaZGFWh7pELqiesLOFXNx5SC6KNvAPr4Xb5plVX4HtLD5K46whVy7WFZwO3rUvYVfqRCE6APz-CGAwgwNVLsDRrdIOpTvEk8ojdpa6hPs3dcYYqcm29DjkFNtFsRNQtZd_ej2PmJIP0ILEukExUtNby2bfbwZysKZPJlUo_TQ-9LyRcIY3pDpoeXOzKYAJPd78gUlv8h4otI0Yp6koDx_PQF8uGh9a5ip5IrWZICFQ5m-5geYN_f-aBOseiZEzxKDJRS9Qh9MmLQUegfY_ZVMuMKEdGbkVz2uFH4LmyuYMJ_QrRFSPGEPn2SkSia1mmHSUunQBw92SklBe3wnvCdURyML9ThSjbhO2titSMsWVsr-uEWiKyoqF0NjMhSHmVusAdJiBR5wEy5olOnhXVbkjrUYNQzD0IBvsTcm5ZMN8VsQ3ZEAJ_wCI8Z9s8lEj1g2TaiHiEX1E3CLFn2YCyJb1mwi2ixIZWV0G8HXbPrdwA3Js4FDdLZs3q0ot3aPENr0Zt9IJl2ui9w8S-w4gkkb9Xj_KDy8FXLbcqGV_38qVjaEidBZS1MMQEpT1K8998erwgYN9EJEo1pkykV-Cr1INrOw_SSNBUm1aOCo5Y--0CfPRujAQIQFE9TXsv3qviJYffgntrR13yzzhHSkHSIZx0Po8JRHS3DW12KbZzppaBC6iJb41Z9wwm6komq1xwgOK4Dr6m8WeRyqjgYHp9YD7XwvIGbDvXGEegg8CB8XSDN8CJ1b1zrqbLRaTh2bCd6kk61nHXmCFBm0YOk_hubQwriobFN76uM99XlOC-vX9QVxT8n8IUASVO3MLYOGzQaiez5Iq_sd613b4620sqlUK5XpoXzMrwmcfiB1x5Oyil0uGODj0Ctw1uMIuaDjF_RcHhSkwaFmKXQbfwf-7oEZfuDLAuA%3D&uniformat=true&callback=Ya%5B4897007509190%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

e4921b046cc3c2e9022709b8777452240a7356dc9344f536b911982132be6d95

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech .maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net .captcha.yandex.net yastatic.net .maps.yandex.net .yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://1275.ru/

Response headers

x-yandex-req-id: 1728551023252244-2747003971759445618-balancer-l7leveler-kubr-yp-vla-263-BAL
content-encoding: gzip
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 09:03:43 GMT
date: Thu, 10 Oct 2024 09:03:43 GMT
last-modified: Thu, 10 Oct 2024 09:03:43 GMT
content-type: application/json; charset=utf-8
content-security-policy: upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
timing-allow-origin: *
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT, Width
access-control-allow-credentials: true
access-control-allow-origin: https://1275.ru
x-xss-protection: 1; mode=block

POST
H2 204 matomo.php
waos-soft.ru/ 0
287 B 163ms
161ms Ping
text/plain 2606:4700:3032::ac43:beaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://waos-soft.ru/matomo.php?action_name=Mamba%202FA%20PhaaS%20IOCs%20-%20SEC-1275-1&idsite=97eED41Ee1b3d80&rec=1&r=743954&h=11&m=3&s=43&url=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&_id=67f8022771578bb4&_idn=1&send_image=0&_refts=0&pv_id=EpJZE6&webgl=1&pf_net=108&pf_srv=724&pf_tfr=124&pf_dm1=343&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200
Requested by: Host: waos-soft.ru
URL: https://waos-soft.ru/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:beaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://1275.ru/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: none
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bHhEA4MwRfBZL223V3DrPa2BL1ZbqZ69ukULth9vz%2BjK7tGCR0A9yR3j6C4824YjXMlecg5bZ3iOW7Vy2BGEc6SK2tCWiJpGd7Fi76T%2FxoMGIt69jfi4r6wlBBBssqaW0g0PkIxIKDih2N4%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d0570573e549fcc-AMS
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:43 GMT
server: cloudflare

POST
H3 204 rum Show response
1275.ru/cdn-cgi/ 0
135 B 36ms
35ms XHR
text/plain 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 8d05705a38610a61-AMS
access-control-allow-origin: https://1275.ru
date: Thu, 10 Oct 2024 09:03:43 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ 152 KB
55 KB 441ms
138ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

881fa1017deeca8f6a575bee465828a21bf1517f39b39b9f02ec927f0a2f0d6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=3600
timing-allow-origin: *
content-encoding: br
etag: "67053c0b-d7aa"
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 10 Oct 2024 10:03:44 GMT
access-control-allow-origin: *
content-length: 55210
date: Thu, 10 Oct 2024 09:03:44 GMT
last-modified: Tue, 08 Oct 2024 14:04:59 GMT
content-type: application/javascript

GET
H2 200 1788970 Show response
yandex.ru/ads/meta/ 438 B
375 B 95ms
95ms XHR
application/json 2a02:6b8:a::a
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/1788970?target-ref=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&pcode-version=1132747&pcodever=1132747&comboblock-unencoded-vast=1&ad-session-id=2694391728551023186&target-id=75702402&pcode-test-ids=1111484%2C0%2C30%3B1066210%2C0%2C16%3B1094008%2C0%2C50%3B1125730%2C0%2C0%3B1114587%2C0%2C55%3B1126989%2C0%2C80%3B1106679%2C0%2C82%3B1094980%2C0%2C59%3B1126191%2C0%2C69%3B1131255%2C0%2C86%3B1112583%2C0%2C37%3B1127809%2C0%2C74%3B1128623%2C0%2C35%3B1085919%2C0%2C58%3B1127211%2C0%2C19%3B1132747%2C0%2C10&pcode-flags-map=eJy1WWlz08gW%2FS%2F%2BjBntC9%2FaUkvusrZpteyYKarLEA9kJsRUEpYXiv%2F%2BTkvyItmRYN48vjha%2Buju99zL90nISjJLqAzyKhOS05BxGgjJMlIUk1d%2FfJ982dx%2B3k5eTQSv6OTF5HH78Miuce0ammUZkx9vXkyWpJRVSWVaJYLxPEmAlgn1B%2BVyRUQwp6EULKUyj6KSimFc09Bc94DLqeBrmWcyo2KV84WknOd8GMF2LNevEdRH80rIgtNarqOESxbSXLbPO3C6hn8dPN%2F0XW0Eb1ZFEbSlaSHWMmEp64P%2BMuKyICz89yWMKvz9T1EzOOLflvQZzP%2FJP5cx%2F38W%2BKfeVxEeczKTCc1iMe8cQn55p8c8zdNc63CsnOdVEqqflSSBYJBrVgmBHwYJSbDAk64U22%2BfTvF0zbQ8%2BwhIgzyVgSA4H3BKkM8tXsle0w7Q7fsujm273rES0KwuKEkOjejViAiO5ThOfVQVkDWRvJJhnhLoEOVckhAF4PeKlqIcTHkAeY7mHWRoIfIsWStzQKthMVxP905rTpovoT6LoUUsQ6KMImhaDoN4juEf3VqQslSRgrio7QFVlCGlyOUyJcUIlOcZjVk4oioL8hAAaUF5SbJQaYQviCZHgoTB18Nwvmdq9jFyKr6kaxTUFeTLY04h6IzwEQjbtpzzWCFhuDd2mUCcERBfOwGJ2FWNkVDCM5nmfPi0Dhc55lELUZt1CZsg9rvpphum51vd04YDL3faVcQ4jBhxgsb0miJaKlEKRH46LAb6k9WIUef%2FjGQZUr%2FKWMSo8o2gPCLBoC627xltj1OCzBZ1aJR1yDeFTwVtns7yIRTH9S3N3UeJcieaZQVTkggyyDowpJjzvIrnww1T1zWraZhlSriQyLiKSnpVyFmCSoKKVnby%2BI%2FJx83N7cv7z0D5z%2BbuevsNf%2F9283HzfvvQufV%2B87G%2Bc%2F20vWte33y5edw1f358eXJxfXfT3lXIBwTcuN883e6ePrSPn%2B6b38%2F3m5d3268PZy%2F8tdl9vGmP7v5Wv286qtowfaMqFTKkEYETkawxlVmVzuhgGri2braVe40EJIIFMqLw%2BizJYSY0wdUcheKCvfiUTQ3L1xE7Ux2Qp9dG79rsXVv1NZkaNhqUa7TnydT2PMvRp0iM%2FQ0H6rnqA286fcN39CbrohIFLS9U5g2p6dmmqTchnkFHlEI0mIokKj5TIhQbUwQPxV2mNKuGoSzfaCymAjQuhCwDzorBtuCBA%2FrWXuKQlgsBofdMFRaWdcFRThuE8VFI%2FT0MpyvCQ0VE18XgMd8wtLaVHMhxnUrQGSUDBujXmzMA2%2FTMQ3bvQfYMQiV5mAcVTAdjCE4EjcFwZyVFWR4MP9%2Bw7FayZ8pGBPeqrjkinq43ZunWmpoYwTsUtVDhI8B57ewlK9mMJUwcxBzER6%2FxmngLX%2B%2BhFjShYsxsumc0cu3T8lCRaxCSoKy1AXki0sGE9CpIKjTKlIOODkvoWLrd6QVz9FVFWli2aL3d0A9RZSPKuobduKRUfWQNHHrVtsTBg67mOn4nyvKCZlzMFGkokFjojLMqWQyC%2BLbV9hG8Hss5JeFwCKGCeLaj10dIuc6CptafHvk%2Bedg%2Bqpp18lwquWoelOSIrhfdZxQ611HXvd8%2B6N1VdPc5gGc%2FwTIkfXODhFF%2B1XsMY3G2IM0Qe%2FbFIM8XDC%2BpQZRl8TNvgQqlrKRnH65bg1K%2FlbLOmd5bvTyqOThGANj4w%2B7h8UEZc3N7O3nzo%2BMJ8Bm%2F7bpl0TC6FPM3kSsm5qpSHKbxmseqF4Zda7gYEZp6Jw5lB3N8ki8hG8sVNw8DVMERGFTsY3YccEo0zNNao4aEOhfxG8xrodXLQUJQ6EaC0MAIdFRdEcErRmD%2Fy2z%2FfHAxbNc%2BHA%2BqUoCOKqrOItLtu5a93Wze6s7U327%2BnFruxpy%2BdZ3r6ebPt46Fe%2Fa1bXS6pZqKfM%2B7BA76HaBmn35Ae6lp9s%2BdDqK4m2W%2BDt7l%2Bsbklf5iYmog6Yal6bj68Qygyos9322SYdhKFgpMY6Wg5CpS%2BVrGLE1HSDoadjuSHY81vWlajjJ8WzNarnGI6ZogPceLHBMjgWvaPR%2FYpmU0oq84QTFUrBqFI5EkK1djwWX7tn4yjtajCgELLmmCZoHaih6HoX1kMHVMozG7Sp20LgIUVITFavjijHQDYfL15vHD9MvN9XZ3Npea9mWcEQHODxaqgslkxO2Ot28sh7IkYnLa3FtG1YH59I2Bct89PvTA%2FP2KQPmT56uflN413LbLqHON4OjTwQLh240AU9MNBJxtT1QW6I4Fz%2FfDwbO8NqpUBhxbP%2FIqRkm%2BkJh67%2Fw%2Bh3gKjkTisUned9t1QFnQoBnsMOD9rhpCWJfAenjGbETT3ocvTc5OG8sxJo7lAuZP83ZimK0l%2BnaXrXyf6LaNAvxq8vDw6TcF1MTV9Mvf0%2B31zd1u21y%2F%2FOthdzfpFgvf0XSrQyrCqgCdAUGC3GXz1WHl4Tv44JA%2BasAvCGbkUm0uampU8eSkDYh4cEjVlVDtzJQX4MBqBxLMKZQ%2FiPYTLgGMbjZS1YuVtqdDpNkgQ8JBw7OO3ezXD7fsrtfi67UbhuUkQbfab1TwlISkqJtimiNGu8Xyk9nbSGieflw6tWszMUdItYvEdq1XkIwmv7gbALruaWbX7IpThuXw6kk3HLsNocO5uJ6UEbRNIIycd%2F2TLU2rVbcSlQ2h4WmhZirw9yoQ%2BXBR1w1fb3eMKiLr9Guisg7JsbP7%2FSQFickC2oo1sufR%2FfZ%2FES4tjDgGmiVRE5yyUKE2dB24d4%2B3vVCy7JMVo4JLCEdRj8iSBcOTkXKK7x1lYdnJVBSSco4GCZHOBtt3u7vH%2B11PDnS2n1Zr%2F6FBzTQf1fW496wbtmr0VK3FZur%2FbnrLsLPlLdTT%2FXYmCctw0R%2BDlS%2BMukF03KNunewo5hVZUSYNTwqkT4K6MpbbttdZcjRNFtwAhINcXewqWi%2FUPc1%2FBoFejeXZwOFUbTcusM2fBgjypJdQ73a3u%2FuvN0%2FPCaHadLvKbJI1j6LhgDY8xzgm%2Bgm9aGfpAL%2BQJ%2BcMapwvTc7CyLP9di0xUx2mntLU9mdWxSOCuIbeRE%2Bdhheix3Att7%2FEVbd%2BvPnxX3VYbig%3D&pcode-icookie=IQGS8L3scFIjvmmd4UlMOTiq6mHsN0hUFUSWSyyvPENGIJLOOVRe%2B5LzWKDuR7ixvR9hes%2B9Zh9ZreRk9xByjFE9qiI%3D&imp-id=3&ecma-version=es2017&charset=utf-8&test-tag=111600430219266&tga-with-creatives=1&top-ancestor=https%3A%2F%2F1275.ru&top-ancestor-undetermined=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A0%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1050%2C%22top%22%3A1309%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A1%7D&grab-orig-len=4468&grab=eyJncmFiX3ZlcnNpb24iOjJ9ClLlorDcuA1QSwNrt3NO8slP3Wk3kU04mjZdemOLxWKvhCM54plZGJk5TzHs9GST3Qk9PCK86yJ4ESGwffITDZ4f0HMALqqqCCfMHH4ydbeXD6uKqCiIqKgwnciNYhmdqA-JjM5tbtxl1COSjqkEg3ZSicagnDSw4HkznZRgwktVSkZFqqJjKfzoou6OGY6og62VdC_xW-C2GmpnUkO3hy7YWght1bLI6FgKHdIqEcwkHp4Htjaonpu6PQri4fZU0sVDGLvTayFZ3DPA9DjPgzdJyqRmVNoPcfWj4aaeO0LJ8CWTOEh7JO2S1O9eUEOvkdx2SZcOP_UbmcjVyugkjcSmxWtu__fgQpC2II1bSDq_v97D3zwk3f8RYTwzByAOFo_IwXIweIQO5nTQJw-6g-Jg7wuSg-ugOpg84OhYRqlO9y00p_krbjC6hG30fElbGB5fYRzrc5b639n3Ua4ZPmSWnD4lLPuxwBYujO2lUQ-Fvz1uy6YnQr-5gsLqnuXxKTR8SYTxzzikLdbn4DWycLjCL4ThTD1i4uF3wwcuHFrD1wHQVo3vYDqoPHzOiUUYW7u2O8_l9PrwE5HW2Ei5sVUvhxRSmc-HknjTwb5-0-PP0WihmdX-h--25OMs-ZC7MC1QNkf7xI2YEjML5QqCfP-QcYVeGgilcfNE0xAcouGlxZlFwkgajvZ5ejcmq74gbTWZ7iBLA9Ez-7BeaK-T1jbsWPaCEdqwrwYgHbQPI8gfRLg8vI8XHuGnv0QNiA5uSb6JNTfMy98GuDtEKrurL-sPvEZcq2eaP7kqc4EK8xYNsl6KfMXjACUn5zakRWJmQ2yXXWdEM1vTXTLW_rPd4yHtT7EDUAeZR-DgfG0xHfT3CchbZBSbQrdFXaZm0KjUGqVayXQ27f8QHjnH7VMUyBxgfhd_d2E7uJNyszodZAdl_h1nM03040N6S7wWep4ZxvzEQv9hsZ6tPewdnx_Qn0EUB6KBCeZlZvKgPU8QzkMdoI8dj-D2oT8D_tPGXQ19qb_ZHTQeFAcih_Knjj-BSEENO_032j_yoA4G6zM-Nzord5TxgOMB_0BBMkYrD38-TSCtJcN9YJO6JX71qtidzHKFho4lMNUT5NStSUqiJFeTy-nJP0Sr8Gvop6L2ZvcdQTAz73y3ocj8br2G7jvZM5U0vydLkupSvTHF4XIJ1uU-tTKKIX0AVTzhlax5O0jJSDjWJmVjady_hHQGctb1vesJOo6DG80dUGei1Mponqx_8199r0wbBX6NmlfMEXiPzfxLqUiYwGN2pmUnBw92Cq0Mbj075hlMAgfo1itbaKWlqg957gvAJXLYowTfwdIPQt1AQTsWBDy8_0Pe2EE5hueY_HOKW_grcB30_6H8xntizPdSgv9_BGw0QFv7jvu2DPOZgUsNBi0467fI6yAoPOB5UN5LgTBIBuUqsel7GGa20yi7GP0ZUtaEtLsaGljzHRzt7c0zKMr4ezQP6g2LvR0_AfdO-muw3vuweQTz3O4dkfC73xGf29uKm25ZoK5r8U-dvoWQF_ZjamZWlY8l6lKOuzX-3q6CUNddrrhXayiskwf1Sj95gLqPwYgf-f1VuLLdH_fKb8hzmRD5DO4PCW3Lxd8fhSCpNbwkvc0-CraGEK_Ns-X4PLxfgbpW0zTzW-5_vKJ5mfv-N4NvI79Pwl27EY-hG9wYd8D9xP_kT-HV-jK25N3na6fPxbzkHyusCS5to6AGh3XmsD3KnvmuyQshcuzZ5IZTMZEBJ3pYM3WbrGOPdaT-peIqhc5WWpP5sHn-_NBv8u8Vd4K7xBM42eJgbfWBqpPr2I_jR7T9flx9Y6iZUQ7mI3fxOcbj030xjb4M84iwwg7XP8XjIkT0OixVbaHLOouDLvF90xHl1BNuP1DWifl3zRX-MSd1DnOs7WavGLkI-Mv_am5tikewEYLyBDLm94xVHLmwgLpLChTHWQ_6Nn_NzuO2sSOVzll2RuSdC_I52deX8G-fUogbbgQO_4MLhCVpikeuj8-l9SL4yZrS3md_UvS4k_kj-vEAxo2_5Ym-6ia_pP5GK3RzWOdIvoA7bkAXNZIb-2fzkW0Xxn7YGUP0a_NdbSoV6rmqPNoGKdHOfID87QqPByLrFUGfcHhP-VlZOdb24sJUcOBL9Fpt7iyWXyf-ntnjWnn4X3xgvwTQbmmJtCvAAyC4N8d_z1p-iZ_eM63rI5A3uQ7OlRd7rdLZG_z0UvlUo23mLm1EW7YNiK0r3poVFE60W-3c-jx6yepB5iIW6_XT2Xkwdsp_pqssZ1teFEzUVX2zxomy1coVuw_OzoZZZsApVSvd20Ye_SIwNU1oE_GLAUO_97oS3lxKaajS34u93UDnJgjSlgx1jQbu0YI4AVrM6hNQSGjpRwaJmLNC_8BtvVzFqNQwyF_fYdKoGBm4Kr_1w8ys-5Izsb0UGgW97otRyfaSa-jZ18uZNEoVOyf656Fk0H8xsO-nZ9So5Ar9l7VNJbNGKX8V4B_0xh-zQiNn5D6ZHlKlUTGrNSqV4Sen1zBZnk-1gul2WX70GpWC-btSWlXckn25OftKuZoRvkKhVsNnVj9clQwpfPicyhsvzCol4ifGoUD0JE0QPw0GRE9SlRzxk7gP7snui6vWWSJSLenJ4wq8qIeapEacpKpd__WCLhB2Bs8zXVXSPiKyWmPDIxE8FsN7_Ej3XNM16p7XvFA8_Mh8V0Y1bMLwT9VEAfOIA9Hj3VxQhsB8Z_Juaw2jamSuCGrcRzhikYm93PX7NzhOHmq-M0b1MM1_9ob5zsBwz0Kz6S6tX7xQ8l2YH_TJeGxWDUNxMzWSJJW0de-jl7R7umflDVp1jszu0-my32rQxbVKNDAEIJt_sdBz_XHtmq_iV-Kf7kRkmOXu_uPcaxp2YukwJVpchf4yFT7ejv3sira-PklLTNUSCYIOQ9zCZ9aGicZI5TYvHUF73epaNN2U4o7EjTkaSN3Cx5XR_8j6sfghpHMP4muz_-O777756HWSftEOipA9oPeaVv_TaZzda64oETWp1PiC8Xvdd2oTl8cOdVfoa9wasD8taXRFzZdsREaDpBmXiz5WLveiGpjuxBdeF5DmD0mN3REF38x4_AOJ6Ub8pt5TPz7i8QiaJG4Jqfnq_pQM6vBMv1hitdYGEXMkIudImY0CLJuzYPhBMBeW-v3EKRITZErcpSfxyy-uoCRu3m2SyrK-hbKy5qynF-USEz4di1RGV2OuwAuYVXuRV4_nr5ILwuonOLZE0YBJ5eLhLZjNU9OzNPpVhFNdDHIoUEGDp1Qw0GdBo1HuQwUG5aSyBXZ63N-MT4pG1v1VZY-Sgkdb7YSrOc3FZRKme8I0i3Afb9uiZlgEs0pbOMEaIanHnT89t02zF9l44kn11TnJllV2X2OjuCcLofQFju4g8yxI_9yXVmbTtHt0-VOCCTosGlqrIIJ9hVfPamv1Dx890clwbXEN2zWjnEuQvAUxVzrlAIKrv2Eu_jVnnZ_VQ9ytBcbMk19JDQvvaZGFWh7pELqiesLOFXNx5SC6KNvAPr4Xb5plVX4HtLD5K46whVy7WFZwO3rUvYVfqRCE6APz-CGAwgwNVLsDRrdIOpTvEk8ojdpa6hPs3dcYYqcm29DjkFNtFsRNQtZd_ej2PmJIP0ILEukExUtNby2bfbwZysKZPJlUo_TQ-9LyRcIY3pDpoeXOzKYAJPd78gUlv8h4otI0Yp6koDx_PQF8uGh9a5ip5IrWZICFQ5m-5geYN_f-aBOseiZEzxKDJRS9Qh9MmLQUegfY_ZVMuMKEdGbkVz2uFH4LmyuYMJ_QrRFSPGEPn2SkSia1mmHSUunQBw92SklBe3wnvCdURyML9ThSjbhO2titSMsWVsr-uEWiKyoqF0NjMhSHmVusAdJiBR5wEy5olOnhXVbkjrUYNQzD0IBvsTcm5ZMN8VsQ3ZEAJ_wCI8Z9s8lEj1g2TaiHiEX1E3CLFn2YCyJb1mwi2ixIZWV0G8HXbPrdwA3Js4FDdLZs3q0ot3aPENr0Zt9IJl2ui9w8S-w4gkkb9Xj_KDy8FXLbcqGV_38qVjaEidBZS1MMQEpT1K8998erwgYN9EJEo1pkykV-Cr1INrOw_SSNBUm1aOCo5Y--0CfPRujAQIQFE9TXsv3qviJYffgntrR13yzzhHSkHSIZx0Po8JRHS3DW12KbZzppaBC6iJb41Z9wwm6komq1xwgOK4Dr6m8WeRyqjgYHp9YD7XwvIGbDvXGEegg8CB8XSDN8CJ1b1zrqbLRaTh2bCd6kk61nHXmCFBm0YOk_hubQwriobFN76uM99XlOC-vX9QVxT8n8IUASVO3MLYOGzQaiez5Iq_sd613b4620sqlUK5XpoXzMrwmcfiB1x5Oyil0uGODj0Ctw1uMIuaDjF_RcHhSkwaFmKXQbfwf-7oEZfuDLAuA%3D&uniformat=true&callback=Ya%5B5485651945467%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

3cd68f12e5e9ab340a08ff52aa617aca85507cac6e56e65ab71a87c486efe854

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech .maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net .captcha.yandex.net yastatic.net .maps.yandex.net .yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://1275.ru/

Response headers

x-yandex-req-id: 1728551023743823-10646304779900098762-balancer-l7leveler-kubr-yp-vla-263-BAL
content-encoding: gzip
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 09:03:43 GMT
date: Thu, 10 Oct 2024 09:03:43 GMT
content-type: application/json; charset=utf-8
last-modified: Thu, 10 Oct 2024 09:03:43 GMT
content-security-policy: upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
timing-allow-origin: *
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT, Width
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://1275.ru
x-xss-protection: 1; mode=block

GET
H3 200 1275.svg
1275.ru/ 2 KB
2 KB 65ms
64ms Other
image/svg+xml 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/1275.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30d219fdd2c143bf6199edb608a596f51e3bb692e5cd8803057a0c478a9140a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/4072/mamba-2fa-phaas-iocs/

Response headers

content-encoding: zstd
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VyvzmybIsP27F5vfj6owoXm107blJarnAF3MV2uzyQtYNmqo0VDNg5cUZ5VcSKtwAPAKOwfcyOxXWET3Jee9YOKSl%2BmBt0iVlMhuYWT0WAkx2Q8M4ADxbe3J"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Thu, 10 Oct 2024 09:03:44 GMT
content-type: image/svg+xml
last-modified: Sun, 17 Jul 2022 14:47:18 GMT
vary: Accept-Encoding
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d05705c1af30a61-AMS
x-xss-protection: 1
server: cloudflare

GET
H2

200

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10518.Ad4v23-YQrQT99rN_HAKOcQWdsOpM2wnwLE91gxLkj2oo0b_60qNypEC0dOZWRRj.fB0ialyuZANYVYhe9fl07fPtrI0%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10518.0n5dSFfuckL9gznxbIRT4bSMYvxZwRj0Mfs4bauSTxI6HqLBWPZgdeGmPPBuev5pn28VJaNo10vIdnRKUlCH9sK3y7KLbOq7ckPjDMhb8XM7JJH3w7MAD11ulJQd7EUY5tn9ttJhl6...

43 B
499 B

82ms
82ms

Image
image/gif

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=10518.0n5dSFfuckL9gznxbIRT4bSMYvxZwRj0Mfs4bauSTxI6HqLBWPZgdeGmPPBuev5pn28VJaNo10vIdnRKUlCH9sK3y7KLbOq7ckPjDMhb8XM7JJH3w7MAD11ulJQd7EUY5tn9ttJhl6hHoY77dYYZ0gambRYC8NNGe1LE9FxTaxIU-Tx7GwqC1vMHF6ozNHVnROSwBCxhRsaqOGFN71zLaS1mhaieXbsiBk6ld205jKg%2C.J2fg2yPDf9uGIjjkoC-7wIEWlQ0%2C

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
date: Thu, 10 Oct 2024 09:03:44 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://mc.yandex.com/sync_cookie_image_decide?token=10518.0n5dSFfuckL9gznxbIRT4bSMYvxZwRj0Mfs4bauSTxI6HqLBWPZgdeGmPPBuev5pn28VJaNo10vIdnRKUlCH9sK3y7KLbOq7ckPjDMhb8XM7JJH3w7MAD11ulJQd7EUY5tn9ttJhl6hHoY77dYYZ0gambRYC8NNGe1LE9FxTaxIU-Tx7GwqC1vMHF6ozNHVnROSwBCxhRsaqOGFN71zLaS1mhaieXbsiBk6ld205jKg%2C.J2fg2yPDf9uGIjjkoC-7wIEWlQ0%2C
x-xss-protection: 1; mode=block
date: Thu, 10 Oct 2024 09:03:44 GMT

GET
H2 200 metrika_match.html
mc.yandex.com/metrika/ Frame EF13 0
0 573ms
453ms Document
text/html 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/metrika/metrika_match.html

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://1275.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: *
cache-control: max-age=3600
content-encoding: br
content-length: 1046
content-type: text/html
date: Thu, 10 Oct 2024 09:03:44 GMT
etag: "67053c0b-416"
expires: Thu, 10 Oct 2024 10:03:44 GMT
last-modified: Tue, 08 Oct 2024 14:04:59 GMT
strict-transport-security: max-age=31536000
timing-allow-origin: *

GET
H2

200

1 Show response
mc.yandex.com/watch/1788970/
Redirect Chain

https://mc.yandex.com/watch/1788970?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalit...
https://mc.yandex.com/watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzal...

547 B
774 B

64ms
64ms

Fetch
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Anl-NL%3Av%3A1470%3Acn%3A1%3Adp%3A0%3Als%3A107373584730%3Ahid%3A1010239012%3Az%3A120%3Ai%3A20241010110344%3Aet%3A1728551024%3Ac%3A1%3Arn%3A1049785346%3Au%3A1728551024918848431%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1728551021420%3Arqnl%3A1%3Ast%3A1728551025%3At%3AMamba%202FA%20PhaaS%20IOCs%20-%20SEC-1275-1&t=clc%280-0-0%29aw%281%29rcm%281%29cdl%28na%29eco%28565312%29ti%281%29

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

40ff1862427263efb58e04182af1bb44f1df3eec0ab2e81214e0417d352beb75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Thu, 10-Oct-2024 09:03:44 GMT
access-control-allow-origin: https://1275.ru
content-length: 547
x-xss-protection: 1; mode=block
date: Thu, 10 Oct 2024 09:03:44 GMT
content-type: application/json; charset=utf-8
last-modified: Thu, 10-Oct-2024 09:03:44 GMT

Redirect headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
location: /watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Anl-NL%3Av%3A1470%3Acn%3A1%3Adp%3A0%3Als%3A107373584730%3Ahid%3A1010239012%3Az%3A120%3Ai%3A20241010110344%3Aet%3A1728551024%3Ac%3A1%3Arn%3A1049785346%3Au%3A1728551024918848431%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1728551021420%3Arqnl%3A1%3Ast%3A1728551025%3At%3AMamba%202FA%20PhaaS%20IOCs%20-%20SEC-1275-1&t=clc%280-0-0%29aw%281%29rcm%281%29cdl%28na%29eco%28565312%29ti%281%29
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
pragma: no-cache
access-control-allow-credentials: true
expires: Thu, 10-Oct-2024 09:03:44 GMT
access-control-allow-origin: https://1275.ru
x-xss-protection: 1; mode=block
date: Thu, 10 Oct 2024 09:03:44 GMT
last-modified: Thu, 10-Oct-2024 09:03:44 GMT

POST
H2 200 1
mc.yandex.com/watch/1788970/ 43 B
74 B 65ms
64ms Ping
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/1788970/1?page-url=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1728551024_52de9c31e7bcc58f49d98ef4d3e45f9bd026c1f1f66e3c81fc52d5f0a8dbe15c&browser-info=pa%3A1%3Aar%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Anl-NL%3Av%3A1470%3Acn%3A1%3Adp%3A1%3Als%3A107373584730%3Ahid%3A1010239012%3Az%3A120%3Ai%3A20241010110344%3Aet%3A1728551025%3Ac%3A1%3Arn%3A927265106%3Arqn%3A1%3Au%3A1728551024918848431%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A1478%3Ads%3A60%2C46%2C723%2C125%2C0%2C0%2C%2C224%2C81%2C2284%2C2284%2C0%2C1218%3Aco%3A0%3Acpf%3A1%3Ans%3A1728551021420%3Arqnl%3A1%3Ast%3A1728551025&t=mc(p-1-h-1)clc(0-0-0)rqnt(1)lt(31600)aw(1)rcm(1)cdl(na)eco(565312)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22adSessionID%22%3A%222694391728551023186%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-credentials: true
expires: Thu, 10-Oct-2024 09:03:44 GMT
access-control-allow-origin: https://1275.ru
content-length: 43
x-xss-protection: 1; mode=block
date: Thu, 10 Oct 2024 09:03:44 GMT
content-type: image/gif
last-modified: Thu, 10-Oct-2024 09:03:44 GMT

POST
H2 200 1788970
mc.yandex.com/watch/ 43 B
216 B 61ms
61ms Ping
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/1788970?page-url=https%3A%2F%2F1275.ru%2Fioc%2F4072%2Fmamba-2fa-phaas-iocs%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1728551024_52de9c31e7bcc58f49d98ef4d3e45f9bd026c1f1f66e3c81fc52d5f0a8dbe15c&browser-info=pv%3A1%3Aar%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Anl-NL%3Av%3A1470%3Acn%3A1%3Adp%3A1%3Als%3A107373584730%3Ahid%3A1010239012%3Az%3A120%3Ai%3A20241010110344%3Aet%3A1728551025%3Ac%3A1%3Arn%3A798907842%3Arqn%3A2%3Au%3A1728551024918848431%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1728551021420%3Arqnl%3A1%3Ast%3A1728551025%3At%3AMamba%202FA%20PhaaS%20IOCs%20-%20SEC-1275-1&t=mc(p-1-h-1)clc(0-0-0)rqnt(2)lt(31600)aw(1)rcm(1)cdl(na)eco(565312)ti(0)&force-urlencoded=1

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
pragma: no-cache
access-control-allow-credentials: true
expires: Thu, 10-Oct-2024 09:03:44 GMT
access-control-allow-origin: https://1275.ru
content-length: 43
date: Thu, 10 Oct 2024 09:03:44 GMT
x-xss-protection: 1; mode=block
last-modified: Thu, 10-Oct-2024 09:03:44 GMT
content-type: image/gif

Verdicts & Comments Add Verdict or Comment

215 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.yandex.ru/	1970-01-21 09:45:11	Name: i Value: 9rXHizFRKm0IzYW4qsM41qHRFTeWWl1cYPRJ8ON473t5jSMqdv5u+v94hIl8c8pYH96nYIi2efemoOytAO5u9EoUZ1U=
.yandex.ru/	1970-01-21 09:45:11	Name: yandexuid Value: 9652030591728551022
.yandex.ru/	1970-01-21 08:54:47	Name: yashr Value: 9155208231728551022
.yandex.ru/	1970-01-21 08:54:47	Name: receive-cookie-deprecation Value: 1
.yandex.ru/	1970-01-21 09:45:11	Name: bh Value: YO6wnrgGahncyumIDvKst6UL+/rw5w3r//32D7WWzYcI
1275.ru/	1970-01-21 09:35:06	Name: _pk_id.97eED41Ee1b3d80.a7b8 Value: 67f8022771578bb4.1728551023.
1275.ru/	1970-01-21 00:09:12	Name: _pk_ses.97eED41Ee1b3d80.a7b8 Value: 1
.1275.ru/	1970-01-21 08:54:47	Name: cf_clearance Value: xrI8cNqJqvCOvQ_6lDOqDCQXrpcaq414S1.xaFBdqxk-1728551023-1.2.1.1-nY5iod9OHxuCkANNoxpRNlQrZZslfhKpj8WNLMlL.qbJoLOXkG0yUH0JOEJLeIWHaM8zAURgd5xkqzAvF0ZQ2PtU5u7OBOy3V9.n.hUSCbtgOSfPOudkbsI96fg1n7r1u4iNcNElE5orvsi2UJ3gaiq.vhWHWIS4bY63iGa43VFJU6gg6U94FVRv1.hlLB2EsnCdJHMz3L6YK3Cgcy6WO_p.BwVRcbWIB5qfd3tFbEmDhhcLZC69..yelCJTePHzLX7OyLVOrgXF7WLbMvh_TxJ2Z8iaYP63AC2O_hwFDSTVP.Ca.DSPLrZaK2RzA988JbTVUumRBUxTI1ZGk0AzaXNr4zr73zAU4MarVQQi0UKXR462dKb7_.94AV1l8VAg
.mc.yandex.com/	1970-01-21 00:09:11	Name: sync_cookie_csrf Value: 2677783537fake
.mc.yandex.ru/	1970-01-21 00:09:11	Name: sync_cookie_csrf Value: 3969720387fake
.yandex.com/	1970-01-21 08:54:47	Name: yuidss Value: 9652030591728551022
.mc.yandex.com/	1970-01-21 00:10:37	Name: sync_cookie_ok Value: synced
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 1061889741728551024
.yandex.com/	1970-01-21 08:54:47	Name: ymex Value: 1760087024.yrts.1728551024
.yandex.com/	1970-01-21 08:54:47	Name: receive-cookie-deprecation Value: 1
.yandex.com/	1970-01-21 09:45:11	Name: bh Value: KgI/MGDwsJ64Bg==
.yandex.com/	1970-01-21 09:45:11	Name: i Value: gI8J7VhLMEcQBUJjlsyON+yKT2juo2/wy7g6+TsDZFwdovEiv3SrmbRg0D1h5rzE07FAUp/QCXz+TJt/eHIG/MCrCuw=
.yandex.com/	1970-01-21 09:45:11	Name: yandexuid Value: 8636079661728551024
.yandex.com/	1970-01-21 08:54:47	Name: yashr Value: 8114450461728551024

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1275.ru
mc.yandex.com
mc.yandex.ru
static.cloudflareinsights.com
waos-soft.ru
yandex.ru
yastatic.net
172.67.140.84
2606:4700:3032::ac43:8c54
2606:4700:3032::ac43:beaf
2606:4700::6810:5049
2a02:6b8:20::215
2a02:6b8::1:119
2a02:6b8:a::a
033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9
07071b35f73d7766d54723cf3459878ea3d978a11e08bfbed3d5f33379e1a543
0fd076ef10f12354eaa7a55dc3b6fe71a4b3619bf5ec973159048c31e88e51ac
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
17df1f2891553baf6c74c4eef8cd0dd9fb73a5669f9f89d67183a8bfe41acfd2
255df06063ef8b4f994c1ae9d232d7c4f27c95b853a68fd9c03e31f4dd6b0031
30d219fdd2c143bf6199edb608a596f51e3bb692e5cd8803057a0c478a9140a3
34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55
3861cea1444a813c2b0a77ecd0dfbc51eb6bd05bb70774020251035b015f4d8c
3cd68f12e5e9ab340a08ff52aa617aca85507cac6e56e65ab71a87c486efe854
3e9e460b95080583ea0e38469b14a1e82862cd51aa20486eab06e517b756e8f1
401503518894f575673732c689a7885c78bb615900c0c3f726765eb4ce6aa799
40ff1862427263efb58e04182af1bb44f1df3eec0ab2e81214e0417d352beb75
4192547933c47032776c86cc04805a86655e4580d0c82b46787a120fcd96c146
4415d5193e5df707aad724ec670c445ae2d32471f8bef689b382a6314bb6b0e9
46150dade4041996f3eedf0900142e03348c60171e4eaa8a2e5aa9abc785dd9c
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
57b706ad8e6cf27d0734cf87efeef7e4151e6ceb6eb92c854e719e1baf7c5e8e
5a618cf99e5ed2e9cb5494b72ba5865d74608ac937d18b50eff2416635bff114
5e54223a75a848b7ff480834d8b50bb240326eb41a2e1cfd53c76de4b05219f9
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
617b6d1a50f97d83c2c1a2f5a55d696c02e591c10676785921f131af446feca4
6b5acb20b58ca9f25a996cd5f44fcbde42154bb94cd95666197a59d4b539f07d
6e9cca040634f071c068f7f483dfeef82d8589b4082c8cbdc5301951647ba71b
881fa1017deeca8f6a575bee465828a21bf1517f39b39b9f02ec927f0a2f0d6a
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
9387807e98875575d1c4f5c12d5b0088c30f9f16cd72d63306db0d841e3a8609
973408bd1a1da181c7eaa9293c0cd095f3836a76b626bc76af21e1cd96b5dcde
a2f1b190e5d5a3063c35b75b1a00c039b13e171eb7b099299dcb67e9e4fe65cd
a9501cc809fac65ba3bc7fdc1686f8cc6651018b290308eddd1e46454063bf5f
b3f3db2e6ac9e2b19172879a80a8605f4db7a179745be21a0828e3c1e49510ee
b6898945c1cd627102a395524e84b7b9a80cdce29286005498fd9710c69764df
c420f32b3ac8ca4dad29c471fd2149bf221ac03740c7816154c9703b38f6907c
d5aab9ecebd2bc2f003980fdde59b97aad0fd105312d99fa50fcab580099aaf3
d6ae8dbff96469621efbc79f5d44c1f6d6c13460ed12e34e826af9b0308424aa
d73c2f35cf104b9eec6c97b351fd1bb05bc19c11a253d8f9cd191671d45460af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4921b046cc3c2e9022709b8777452240a7356dc9344f536b911982132be6d95
e8aaf18acba51dfbf4b936da5f4d4969ee7d4c66d4527b688b5f7e4ab95e0284
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efea4bb3ae07d4c1b7042c9c254f55e0696e3cb0a5ea6bc5ad6c4b44fad37f4c
fd057d7db4c5263a87501a7d8a59729dcaa1496e669def1f418cae4c817a1a8f

1275.ru Open in urlscan Pro 2606:4700:3032::ac43:8c54 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

40 Requests

93 %HTTPS

86 %IPv6

6 Domains

7 Subdomains

8 IPs

2 Countries

626 kBTransfer

2119 kBSize

19 Cookies

2 Outgoing links

Redirected requests

40 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

1275.ru Open in urlscan Pro
2606:4700:3032::ac43:8c54 Public Scan

Screenshot
Live screenshot

Full Image

40
Requests

93 %
HTTPS

86 %
IPv6

6
Domains

7
Subdomains

8
IPs

2
Countries

626 kB
Transfer

2119 kB
Size

19
Cookies

40 HTTP transactions
9 data transactions