1275.ru Open in urlscan Pro
2606:4700:3032::ac43:8c54 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://1275.ru/ioc/2158/pony-stealer-iocs-2/
Submission: On October 18 via manual (October 18th 2024, 2:58:06 pm UTC) from US — Scanned from DE

Summary HTTP 39 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 6 domains to perform 39 HTTP transactions. The main IP is 2606:4700:3032::ac43:8c54, located in United States and belongs to CLOUDFLARENET, US. The main domain is 1275.ru.
TLS certificate: Issued by WE1 on September 13th 2024. Valid for: 3 months.

This is the only time 1275.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	2606:4700:303... 2606:4700:3032::ac43:8c54	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a02:6b8:a::a 2a02:6b8:a::a	13238 (YANDEX) (YANDEX)
1 14	172.67.140.84 172.67.140.84	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:4f49	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.190.175 172.67.190.175	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a02:6b8:20::215 2a02:6b8:20::215	13238 (YANDEX) (YANDEX)
3 9	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
39	8

8 2606:4700:3032::ac43:8c54 (United States)

ASN13335 (CLOUDFLARENET, US)

1275.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:6b8:a::a (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)

yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 172.67.140.84 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

1275.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:4f49 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.190.175 (United States)

ASN13335 (CLOUDFLARENET, US)

waos-soft.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:6b8:20::215 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)

yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a02:6b8::1:119 (Moscow, Russian Federation) 3 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	1275.ru 1 redirects 1275.ru	251 KB
7	yandex.com 2 redirects mc.yandex.com — Cisco Umbrella Rank: 9307	3 KB
6	yastatic.net yastatic.net — Cisco Umbrella Rank: 7378	192 KB
5	yandex.ru 1 redirects yandex.ru — Cisco Umbrella Rank: 1971 mc.yandex.ru — Cisco Umbrella Rank: 4610	164 KB
2	waos-soft.ru waos-soft.ru	24 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 683	7 KB
39	6

	Domain	Requested by
22	1275.ru	1 redirects 1275.ru static.cloudflareinsights.com
7	mc.yandex.com	2 redirects mc.yandex.ru
6	yastatic.net	yandex.ru
3	yandex.ru	1275.ru yandex.ru
2	mc.yandex.ru	1 redirects yandex.ru
2	waos-soft.ru	1275.ru waos-soft.ru
1	static.cloudflareinsights.com	1275.ru
39	7

This site contains links to these domains. Also see Links.

Domain
g-soft.info

Subject Issuer	Validity	Valid
1275.ru WE1	`2024-09-13` - `2024-12-12`	3 months	crt.sh
*.xn--d1acpjx3f.xn--p1ai GlobalSign ECC OV SSL CA 2018	`2024-07-12` - `2025-01-09`	6 months	crt.sh
cloudflareinsights.com WE1	`2024-09-03` - `2024-12-02`	3 months	crt.sh
waos-soft.ru WE1	`2024-09-01` - `2024-11-30`	3 months	crt.sh
*.yastatic-net.ru GlobalSign ECC OV SSL CA 2018	`2024-07-09` - `2025-02-08`	7 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2024-05-23` - `2024-11-02`	5 months	crt.sh

This page contains 3 frames:

Primary Page: https://1275.ru/ioc/2158/pony-stealer-iocs-2/
Frame ID: 20AC0011D21934964AE51E42CB06467F
Requests: 45 HTTP requests in this frame

Frame: https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js
Frame ID: 8411AD34A850A7DEE6A29C1D93D80235
Requests: 2 HTTP requests in this frame

Frame: https://mc.yandex.com/metrika/metrika_match.html
Frame ID: 0FEFEA93F75EC9D3EB7E92C067458AD5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Pony Stealer IOCs - Part 2 - SEC-1275-1

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Page Statistics

39
Requests

92 %
HTTPS

71 %
IPv6

6
Domains

7
Subdomains

8
IPs

2
Countries

638 kB
Transfer

2106 kB
Size

20
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://g-soft.info/
Title: General Software

Search URL Search Domain Scan URL

URL: https://g-soft.info/feedback/
Title: Обратная связь

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

https://1275.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js

Request Chain 42

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10526.y_wb1hu6ykpOClbOfdnbrInTBNhZf0VX4SsJRu2D2bhnmgP3er5ciAAAQxTUgAG2.ibMW9PlCRn3hS9ceLVjjnz3dKYw%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10526.iAIJSK1txwLJvgdPqB8HHMvHE_IDiA90vUZGIRvgeA-S1W_cCOWxA7Iln_Fyla8Okry8w7dFOqiJZ13kOas5nvAW3x0Z1N5ATGx-cEQlQ_SUe4ViNQxsDpLjceLtdmGhOg-2_uTYaoh30xfkRhmWIU2AcvzS_Y682Uj0GilziIxAczoEbr1QEyZr8dufVzXNrIVRLOsia8phBdFcOHWaAFFrLFu_aLeHML-YmQgLTIA%2C.6pDiTebIhiQNZyfQEHkFxTVCp_Y%2C

Request Chain 44

https://mc.yandex.com/watch/1788970?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1480%3Acn%3A1%3Adp%3A0%3Als%3A536620673865%3Ahid%3A24456900%3Az%3A120%3Ai%3A20241018165803%3Aet%3A1729263483%3Ac%3A1%3Arn%3A835610695%3Au%3A1729263483328232931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1729263480347%3Arqnl%3A1%3Ast%3A1729263484%3At%3APony%20Stealer%20IOCs%20-%20Part%202%20-%20SEC-1275-1&t=clc(0-0-0)aw(1)rcm(1)cdl(na)eco(565312)ti(1) HTTP 302
https://mc.yandex.com/watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1480%3Acn%3A1%3Adp%3A0%3Als%3A536620673865%3Ahid%3A24456900%3Az%3A120%3Ai%3A20241018165803%3Aet%3A1729263483%3Ac%3A1%3Arn%3A835610695%3Au%3A1729263483328232931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1729263480347%3Arqnl%3A1%3Ast%3A1729263484%3At%3APony%20Stealer%20IOCs%20-%20Part%202%20-%20SEC-1275-1&t=clc%280-0-0%29aw%281%29rcm%281%29cdl%28na%29eco%28565312%29ti%281%29

39 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
1275.ru/ioc/2158/pony-stealer-iocs-2/ 49 KB
15 KB 1068ms
655ms Document
text/html 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6c09741e43f1617562fd9c756ae4a0a49c031b32fba87faa1a48a86577df11d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-edge-cache: cache,platform=wordpress
cf-ray: 8d496252ea87161a-DUS
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Fri, 18 Oct 2024 14:58:01 GMT
last-modified: Fri, 18 Oct 2024 17:58:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z64yy%2Fbuq0xofxq6QXCgEcNwq2QTiqNc0pJEe2jMiqnmgjwdtvNZiv6DgPANr3C%2BUJEhsFGKqY%2FasfRIfa13YRzz3hPaZZJlJOLK7dweV%2BcvkBHHrMePaXOs2GOUt4L8a9%2FBwv%2Bh"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
strict-transport-security: max-age=15552000; includeSubDomains; preload
wpo-cache-status: saving to cache
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H2 200 cleantalk-public.min.css
1275.ru/wp-content/plugins/cleantalk-spam-protect/css/ 4 KB
2 KB 105ms
103ms Stylesheet
text/css 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/plugins/cleantalk-spam-protect/css/cleantalk-public.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ec58cb4a348452b2adb64330901dc3ed98b3bf4f049f7e3e1f88f9256d9434c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 5475
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NeXSjPEKxX%2BPe%2FfZb7kBIBsRFiDILYrIxuSAHINWe5sBa3C9uBln5zVrAwxFmJsD85OuLFfWdOHo7aaSaMXB83hYxao2ni2iluvYobXIIjDX%2BKYThB0dl5X5Y4j80XPcAhCOZUaU"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: text/css
last-modified: Thu, 17 Oct 2024 09:12:58 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d4962574897161a-DUS
x-xss-protection: 1
server: cloudflare

GET
H2 200 screen.min.css
1275.ru/wp-content/plugins/easy-table-of-contents/assets/css/ 6 KB
2 KB 105ms
104ms Stylesheet
text/css 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2fdf5f9a856940c379e8cc777e289f5b58d179a3edb5ef3e1e0cff46f7dd670c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 5475
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UY%2FkkUcAylZUEdfGTbCVTZPoTCvgjqoK4wHSqBOoe8J%2FrX4psEzcWzxva4UkxITnKrcnbe6ARjjEn1NH6bhuBCM83MF2Pr3nPgomaKglEdRoovVP0Iy6nryQpRnue575ykB1y0E8"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: text/css
last-modified: Thu, 17 Oct 2024 15:50:54 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d4962574898161a-DUS
x-xss-protection: 1
server: cloudflare

GET
H2 200 a3_lazy_load.min.css
1275.ru/wp-content/uploads/sass/ 127 B
444 B 104ms
103ms Stylesheet
text/css 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/uploads/sass/a3_lazy_load.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2f1b190e5d5a3063c35b75b1a00c039b13e171eb7b099299dcb67e9e4fe65cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 5475
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q049FSIapFkOsTNiZtECOMjU5jYWnPVDHI7bDIgNIFKRf2s8rXgoZwkpXULahKUAC%2FWwUUDir%2Bx7Jpl6NnuGEeYHHzQ2NWd8T7lOu4N1BS1BSFsaTMf0jdEBIvKPiuy00qgblUTH"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: text/css
last-modified: Thu, 23 Mar 2023 18:32:44 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d496257489c161a-DUS
x-xss-protection: 1
server: cloudflare

GET
H2 200 wpo-minify-header-df171ca3.min.css
1275.ru/wp-content/cache/wpo-minify/1729180256/assets/ 260 KB
49 KB 106ms
105ms Stylesheet
text/css 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1729180256/assets/wpo-minify-header-df171ca3.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d73c2f35cf104b9eec6c97b351fd1bb05bc19c11a253d8f9cd191671d45460af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 5475
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Ni3douB%2BIkZ27C8DgUFPKQ%2FQwcLDyJuahfgClAfpki5s7SCxYjftluBx7qXwEqHOagS2i9lSwYgTJ954UJfroadM3ENylYyDua2l56jnOVPBuoUuyJrckDzlD7Y%2BiGi8seahBYj"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: text/css
last-modified: Thu, 17 Oct 2024 15:50:59 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d496257489f161a-DUS
x-xss-protection: 1
server: cloudflare

GET
H2 200 wpo-minify-header-14d22415.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1729180256/assets/ 191 KB
60 KB 108ms
107ms Script
application/javascript 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1729180256/assets/wpo-minify-header-14d22415.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2bbabc3fc5cb35e72ae28b9ba540bcacfe239d8cb2ed3ed98fe5a91ede61cda9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 5475
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VPvhleGWqK0Tvvm4KZAHI%2B4zGKlljC9DA%2FyCCGMNbyO20UNImyYFeRH7mzEY%2BSuuJ8a%2FJBtACLWaoWcAaktH5MPT7zwmVfaL7gW9OWq3c%2BnOPUQf94iP9Cj8OBCY1EGMZtRjgObF"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: application/javascript
last-modified: Thu, 17 Oct 2024 15:50:59 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d49625748a1161a-DUS
x-xss-protection: 1
server: cloudflare

GET
H2 200 context.js Show response
yandex.ru/ads/system/ 373 KB
107 KB 282ms
100ms Script
text/javascript 2a02:6b8:a::a
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

fb14a624ac86d57c77560f41fef4a027f1c97625fe7a59500346f6a5eb63ebd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
x-yandex-req-id: 1729263481910279-9374866066647500253-balancer-l7leveler-kubr-yp-sas-206-BAL
cache-control: private, max-age=3600
timing-allow-origin: *
content-encoding: br
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT, Width
etag: "b65061f89c1e10938ea14232ee7c034a-1139290"
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 15:58:01 GMT
access-control-allow-origin: *
content-type: text/javascript; charset=utf-8

GET
H2 200 wpshop-core.ttf
1275.ru/wp-content/themes/reboot/assets/fonts/ 57 KB
27 KB 113ms
112ms Font
font/ttf 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/themes/reboot/assets/fonts/wpshop-core.ttf

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

973408bd1a1da181c7eaa9293c0cd095f3836a76b626bc76af21e1cd96b5dcde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 5475
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J589D9fk4MhmICo0aFuECdYcaKb3kXxmW%2FtoLfW3oor6JQ1qmuKjctStvSmU8%2FiwkywHClU1GBYRt%2F4EtQUrQ0fuBiYzbAZ6W599EGYb9Fd%2FmJXCyI5eMc1StQtArbkS%2FnKprj76"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: font/ttf
last-modified: Tue, 13 Aug 2024 05:01:08 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d49625748a3161a-DUS
x-xss-protection: 1
server: cloudflare

GET
H2 200 cropped-54925859_transparent.png.webp
1275.ru/wp-content/uploads/2024/06/ 16 KB
16 KB 113ms
113ms Image
image/webp 2606:4700:3032::ac43:8c54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/uploads/2024/06/cropped-54925859_transparent.png.webp

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::ac43:8c54 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6898945c1cd627102a395524e84b7b9a80cdce29286005498fd9710c69764df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

cf-cache-status: HIT
age: 5475
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2Bh6Hpzax%2FzqQisxM5Rk5D7U5wp4VSCDT7k1hjuDB1hSHr1QCJDEgeUMufGTjwo7eIFiazuw6yB4v0mjHazEgIJRbV1P5cwmAhw2PyEksReivChM296QuLzBi%2FfdY7UbPH%2FINFxV"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: image/webp
last-modified: Thu, 06 Jun 2024 09:30:54 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d49625748a8161a-DUS
accept-ranges: bytes
content-length: 16060
x-xss-protection: 1
server: cloudflare

GET
H3 200 backdoor.jpg.webp
1275.ru/wp-content/uploads/2022/07/ 10 KB
11 KB 55ms
55ms Image
image/webp 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/uploads/2022/07/backdoor.jpg.webp

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45a39f3672038dcd48e688162ad8b57642f4a9dd841d09fc4cbbc8af34753013

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

cf-cache-status: HIT
age: 3565
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SUW3NuUFY%2FEMWRhAiuTjJ4wnlgJ4tImsMw4kjqYHNdCluaeHUZTqfwAvZMSHX%2BeqpuKNcGH4nqej7dgjrrUqXGVlnsUuCUfnQ%2FO9sUoqIGuL0zhdBaHAfXRH"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: image/webp
last-modified: Thu, 23 Mar 2023 18:32:44 GMT
vary: Accept-Encoding
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d4962579a409223-FRA
accept-ranges: bytes
content-length: 10312
x-xss-protection: 1
server: cloudflare

GET
H3 200 lazy_placeholder.gif
1275.ru/wp-content/plugins/a3-lazy-load/assets/images/ 42 B
550 B 79ms
79ms Image
image/gif 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/plugins/a3-lazy-load/assets/images/lazy_placeholder.gif

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

cf-cache-status: HIT
age: 1921
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BgXquhmOAIxgftVMQ6MTMT4l%2FrdXA4xwZCC5WdBFe3IXMiCb8WoLodikhFqJl%2F98g1Eu3rpW3JdD7DyutY82psh1R9E9dlTpqAEnvXatfgKU%2BpAwOdH23iM2"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: image/gif
last-modified: Mon, 15 Jul 2024 15:29:45 GMT
vary: Accept-Encoding
priority: u=3,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d496257aa429223-FRA
accept-ranges: bytes
content-length: 42
x-xss-protection: 1
server: cloudflare

GET
H3 200 wpo-minify-footer-9fa63269.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1729180256/assets/ 64 KB
14 KB 60ms
60ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1729180256/assets/wpo-minify-footer-9fa63269.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd057d7db4c5263a87501a7d8a59729dcaa1496e669def1f418cae4c817a1a8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 1921
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FdgH54oOZJl5WOguo4PVlSoaVVnSg9pXPJ%2FeII%2F3uNgZW3l%2BXTEIdcCN2zXP4k3oE3sQKZuoxUcW%2BiGE3V%2BlOmGQgkAzMzvzjXDyW%2Bmfh8fZLBXqYRDR6RG2"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: application/javascript
last-modified: Thu, 17 Oct 2024 15:52:10 GMT
vary: Accept-Encoding
priority: u=2,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d4962582ac49223-FRA
x-xss-protection: 1
server: cloudflare

GET
H3 200 wpo-minify-footer-65360760.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1729180256/assets/ 3 KB
2 KB 57ms
56ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1729180256/assets/wpo-minify-footer-65360760.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c420f32b3ac8ca4dad29c471fd2149bf221ac03740c7816154c9703b38f6907c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 834
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E%2BK4DOtGEN58EvJsmLUncQ1yeEy1kvKRtdadWg3NJ4nMV8Jbu8MCUEHHWB0mq3IK4zqFGTcWiRyxUEvdl7jdHDfxzdkKgcLGBPtpp1a3%2B7CHCUfg2%2BM3j%2FaS"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: application/javascript
last-modified: Thu, 17 Oct 2024 15:51:00 GMT
vary: Accept-Encoding
priority: u=3,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d496258ab499223-FRA
x-xss-protection: 1
server: cloudflare

GET
H3 200 wpo-minify-footer-f85f20d7.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1729180256/assets/ 5 KB
3 KB 57ms
55ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1729180256/assets/wpo-minify-footer-f85f20d7.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d913cbed84d37080dc6aa446c41f76b3a230ac810af1199d6350779882807edf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 1921
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F8jaaOeAWk1gCW39kJ%2Fm2ZsbqB6qSizkmlbx3naKlWMxDX5ebgkGPUfVWn84N0X0amdWNottzGSVfCAjwZbMh9gDdyvDy5W7rfMGpqW3xjGn%2B8Sqyd%2BEaUG%2B"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: application/javascript
last-modified: Thu, 17 Oct 2024 15:51:00 GMT
vary: Accept-Encoding
priority: u=2,i=?0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d496258ab489223-FRA
x-xss-protection: 1
server: cloudflare

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 165ms
66ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 8d4962594d0e19b3-FRA
access-control-allow-origin: *
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 backdoor.jpg
1275.ru/wp-content/uploads/2022/07/ 0
39 KB 87ms
86ms Other
image/jpeg 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/uploads/2022/07/backdoor.jpg

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=McQHwLlXbEHqSAQjMHvGv02UjPeaf99D6NPyw9EsLIIWmG0UbU0TM%2B2Dxxivw%2BpELICLBwfoyBXfUH%2FOwYPEGar2CdcFc%2Fd3PsGIISf0%2FFRM5bQy2weM7TPc"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: image/jpeg
last-modified: Thu, 23 Mar 2023 18:32:44 GMT
vary: Accept-Encoding
priority: u=4,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
link: <https://1275.ru/wp-content/uploads/2022/07/backdoor.jpg>; rel="canonical"
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d496258ab4a9223-FRA
accept-ranges: bytes
content-length: 39297
x-xss-protection: 1
server: cloudflare

GET
H3 200 matomo.js Show response
waos-soft.ru/ 68 KB
24 KB 446ms
61ms Script
application/javascript 172.67.190.175
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://waos-soft.ru/matomo.js
Requested by: Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.175 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3861cea1444a813c2b0a77ecd0dfbc51eb6bd05bb70774020251035b015f4d8c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: HIT
age: 1499
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3dbt0Oh%2B%2BzY2SfojSEciYE6W%2F10oqwDHUrJcuBo6gfdtXTPJOYJC41xjc1%2Foe41eNKMgm9l6nnor%2FA%2BiC62nBzEovse3aTEnNJT2%2FAfQtlwnlUgum5LHmIr3wC%2FQe5w%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d49625b1c0ed9dc-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:02 GMT
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 04:39:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
DATA 200
OK truncated
/ 969 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 401503518894f575673732c689a7885c78bb615900c0c3f726765eb4ce6aa799

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 290 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5aab9ecebd2bc2f003980fdde59b97aad0fd105312d99fa50fcab580099aaf3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17df1f2891553baf6c74c4eef8cd0dd9fb73a5669f9f89d67183a8bfe41acfd2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 626 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e9cca040634f071c068f7f483dfeef82d8589b4082c8cbdc5301951647ba71b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 544 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 255df06063ef8b4f994c1ae9d232d7c4f27c95b853a68fd9c03e31f4dd6b0031

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4192547933c47032776c86cc04805a86655e4580d0c82b46787a120fcd96c146

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3f3db2e6ac9e2b19172879a80a8605f4db7a179745be21a0828e3c1e49510ee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 624 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b5acb20b58ca9f25a996cd5f44fcbde42154bb94cd95666197a59d4b539f07d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a9501cc809fac65ba3bc7fdc1686f8cc6651018b290308eddd1e46454063bf5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

POST
H3 200 admin-ajax.php Show response
1275.ru/wp-admin/ 1 B
654 B 448ms
447ms XHR
text/html 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-admin/admin-ajax.php

Requested by

Host: 1275.ru
URL: https://1275.ru/wp-content/cache/wpo-minify/1729180256/assets/wpo-minify-header-14d22415.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary4ZV1t543E6yfnH9X
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

x-robots-tag: noindex
cf-edge-cache: cache,platform=wordpress
content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KTIseWobWsv%2B9k4a7ka2HP1zedOpppw4QLeO9cJEdoXIzfyCeIoS1LwHf7dH8z%2FKU3OR7liej9FBakyY4xzdDeB4X9Ruq4k0Q1%2Flx0P04Di3h1soFX%2FpHEJq"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 11 Jan 1984 05:00:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:02 GMT
content-type: text/html; charset=UTF-8
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: no-cache, must-revalidate, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d496259bc879223-FRA
access-control-allow-origin: https://1275.ru
x-xss-protection: 1
server: cloudflare

POST
H3 200 admin-ajax.php Show response
1275.ru/wp-admin/ 0
647 B 401ms
400ms Fetch
text/html 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-admin/admin-ajax.php

Requested by

Host: 1275.ru
URL: https://1275.ru/wp-content/cache/wpo-minify/1729180256/assets/wpo-minify-footer-9fa63269.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Cache-Control: no-cache
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-robots-tag: noindex
cf-edge-cache: cache,platform=wordpress
content-encoding: zstd
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=owG03p%2Fmg7vI%2BE3qhDy7adKQ9mfJxnmVzEr35ehIePMvmku9yG91oXfCHiizPOzb%2BrOEkg45U9IiYP4Ch8sEpmud488r9sepRXAkbjhC3D5fFbDcQRaCeob9"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 11 Jan 1984 05:00:00 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:02 GMT
content-type: text/html; charset=UTF-8
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: no-cache, must-revalidate, max-age=0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d496259bc899223-FRA
access-control-allow-origin: https://1275.ru
x-xss-protection: 1
server: cloudflare

GET
H3

200

main.js Show response
1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/ Frame 8411
Redirect Chain

https://1275.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?

8 KB
4 KB

61ms
61ms

Script
application/javascript

172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f54390b0c1c749338331697a88951d7ea5c699dce8c54e1fade8cf6769a88f36

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jp4OiU7uo0OxYyeL7xLCrNRn%2BPSQ3f5WTBxD6GQRdLMtwVc84s4QAurI3dm1czEi1dV82llDmvaxhKAgicvO5PnVDRFjAvJQYRO9rlnoa4Q13nw4e8i9OSmG"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d49625a1d199223-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

Redirect headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ggGtZL3zOMojBsCYIrZx5zKot%2Fze07XP%2FAUyqfS3eHI%2FYutTz7jhtgfd2X2djQLIeid%2BWk0AsInchQIn9HHR9EjmMQrtJIUDuTofZN%2Fhad4BsaXqy%2BLOP8p"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d496259bc8b9223-FRA
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:01 GMT
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H3 200 rss_25.png.webp
1275.ru/wp-content/uploads/2024/10/ 612 B
1 KB 64ms
64ms Image
image/webp 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/uploads/2024/10/rss_25.png.webp

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fde30968056d44b85605ca3f68a6c1a82cd3b4458570a1ba225e33dcad1c34cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

cf-cache-status: HIT
age: 858
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YeB4g%2B5c%2FNv%2BJ8dIdFM9nrLybSs5sFL4GTFI%2B8pF%2Blj771tgOwKbjvCWgxWGO6NHD7%2FL7d9VTJYmBy8Dgmq7ZMOhKsBiIJgq05LRtDNY6AXOw9ujkRfnMHx8"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:01 GMT
content-type: image/webp
last-modified: Mon, 14 Oct 2024 14:57:12 GMT
vary: Accept-Encoding
priority: u=3,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d496259ecc29223-FRA
accept-ranges: bytes
content-length: 612
x-xss-protection: 1
server: cloudflare

POST
H3 200 8d496252ea87161a Show response
1275.ru/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 8411 0
989 B 63ms
57ms XHR
text/plain 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/challenge-platform/h/b/jsd/r/8d496252ea87161a

Requested by

Host: 1275.ru
URL: https://1275.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json
Referer

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p79%2FxbRyB9bnOmPqac71GBYnO1i0GOXYBHIOUXegZSeESyoL8F5rBcgB5DTGqlpmjQIle%2FkLZcN1Zx7aurhHqivDG8YG5qhjLKG57LJwE4tonCXanJsbg%2BX1"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d49625b1e4b9223-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Fri, 18 Oct 2024 14:58:02 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
priority: u=1,i

POST
H3 204 matomo.php
waos-soft.ru/ 0
399 B 201ms
200ms Ping
text/plain 172.67.190.175
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://waos-soft.ru/matomo.php?action_name=Pony%20Stealer%20IOCs%20-%20Part%202%20-%20SEC-1275-1&idsite=97eED41Ee1b3d80&rec=1&r=800353&h=16&m=58&s=2&url=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&_id=f775001380cc80a9&_idn=1&send_image=0&_refts=0&pv_id=ohQpFJ&webgl=1&pf_net=415&pf_srv=654&pf_tfr=103&pf_dm1=348&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200
Requested by: Host: waos-soft.ru
URL: https://waos-soft.ru/matomo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.175 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://1275.ru/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: none
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ChSlUIRXms9bAfvgL2hHoFw5Omr6ZDkpZ1%2FSU%2FEvWcyyD3JcJtwlw5P9NlV%2BXpX53CQHfqwW6CsxYtA5SlSx6eiL%2F5uDh4sLYMm53j3m0qhNBB%2BkiXUAcEDZo1fqrUg%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d49625bde71d9dc-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:02 GMT
server: cloudflare

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ 25 KB
26 KB 345ms
163ms Font
font/woff2 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

etag: "7f0cdaf91230f9789ca4162aedff612e"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sat, 18 Oct 2025 20:47:14 GMT
date: Fri, 18 Oct 2024 14:58:02 GMT
content-type: font/woff2
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
vary: Accept-Encoding
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=31556952
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
x-nginx-request-id: ec20561482e33472
accept-ranges: bytes
access-control-allow-origin: *
content-length: 26004

GET
H2 200 7b23e792595ae06191fa.js Show response
yastatic.net/partner-code-bundles/1139290/ 44 KB
13 KB 390ms
212ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1139290/7b23e792595ae06191fa.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

b52b9d2d403536398c9a51e98b4614c1394b1657b66403a1848d9a9f543ab772

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "30d2910b7f56bc367311ecf6539ceafd"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sun, 18 Oct 2054 21:34:02 GMT
date: Fri, 18 Oct 2024 14:57:55 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Thu, 17 Oct 2024 18:23:00 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=946708560
timing-allow-origin: *
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12652

GET
H2 200 05cd81f89d3895feda67.js Show response
yastatic.net/partner-code-bundles/1139290/ 24 KB
8 KB 581ms
403ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1139290/05cd81f89d3895feda67.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

d66395613fd6f42b17472b2c1b98444f569d0cd638001781bd7f989f2a092ebd

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "9dd0ae26471467331644d8e9e0cc140d"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sun, 18 Oct 2054 21:34:02 GMT
date: Fri, 18 Oct 2024 14:57:55 GMT
last-modified: Thu, 17 Oct 2024 18:22:59 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=946708560
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7955

GET
H2 200 9e7b2afc15ec89516a17.js Show response
yastatic.net/partner-code-bundles/1139290/ 571 KB
113 KB 477ms
300ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1139290/9e7b2afc15ec89516a17.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

07aaa9bdc0704502910c4cb27c3341071dabb77a24321040ff3176d240c11d3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "ad919a5cead3b8bb064c2e0eb7c61d91"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sun, 18 Oct 2054 21:34:02 GMT
date: Fri, 18 Oct 2024 14:57:55 GMT
last-modified: Thu, 17 Oct 2024 18:23:00 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
access-control-allow-origin: *
content-length: 115163

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ 33 KB
9 KB 580ms
403ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "f80882bf67cf261aa08d636da095149a"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sun, 18 Oct 2054 21:34:02 GMT
date: Fri, 18 Oct 2024 14:57:55 GMT
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=43200000; includeSubDomains;
cache-control: public, max-age=946708560
timing-allow-origin: *
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8878

GET
H2 200 4b4c1b93ea2002ab98a1.js Show response
yastatic.net/partner-code-bundles/1139290/ 111 KB
24 KB 435ms
259ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1139290/4b4c1b93ea2002ab98a1.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

8301b3e2dfc5d2b692fa51d5170d81e93c92c5e0c7fc6b5276e976f9b6cd4e84

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

x-robots-tag: noindex, noarchive, nofollow
content-encoding: br
etag: "8c702e7e8cd96f99945bdb3ce33fb63c"
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
expires: Sun, 18 Oct 2054 21:34:02 GMT
date: Fri, 18 Oct 2024 14:57:55 GMT
last-modified: Thu, 17 Oct 2024 18:23:00 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
timing-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24134

GET
H2 200 1788970 Show response
yandex.ru/ads/meta/ 438 B
1 KB 139ms
138ms XHR
application/json 2a02:6b8:a::a
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/1788970?target-ref=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&pcode-version=1139290&pcodever=1139290&comboblock-unencoded-vast=1&ad-session-id=2562601729263482277&target-id=47211184&pcode-test-ids=1111484%2C0%2C30%3B1066210%2C0%2C58%3B918196%2C0%2C41%3B1094008%2C0%2C64%3B1138328%2C0%2C35%3B1115221%2C0%2C60%3B1131242%2C0%2C20%3B1098499%2C0%2C42%3B1106679%2C0%2C8%3B1099660%2C0%2C34%3B1139181%2C0%2C10%3B1134579%2C0%2C67%3B1128136%2C0%2C54%3B1135840%2C0%2C61%3B1135836%2C0%2C29%3B1070607%2C0%2C57%3B1138108%2C0%2C14%3B1127212%2C0%2C76%3B1132173%2C0%2C99%3B1134547%2C0%2C0%3B1137135%2C0%2C18%3B1138219%2C0%2C90%3B1137782%2C0%2C22%3B1138114%2C0%2C24%3B852182%2C0%2C18%3B1139290%2C0%2C68%3B681842%2C0%2C45&pcode-flags-map=eJylWFtz2zYT%2FS96jlzeL36DSFBCRRIsAMp2Oh6MUjOOW1vyyHKaLxn%2F928BUhdSMplMXyzzsoeLxe6es%2FgxWiAupwxNZIrzqZiNLv%2F8Mfq6fHytRpcjy3CC0YfRtnrZkju4DozA8J3R2%2B0HbcZntExj9XMlUSQIzeWkFAJ%2BSC4LFM3hiWgBVt%2Bej%2FFMw3YC9wCII5rJSCCwjxhGHO%2FwOPmIW0CP920c1%2FUD64CTo0mKZUphRfh6wAXP8TxvbxrTDIH3NE9v1CrAmX5rPzADf29dIA5%2FGE4w0x6gWLsuBZWLDBX9UEEQWAdHeMkW%2BEbm%2BAoA6ZRhQJ4g1g8Ruq7jnYYTxfFuYTwlMR4ACY0jkIRca4wUI5bLjLJ%2BaxPC4dmHVWSICbEAD0SZD1jatu0cQnnFUCFTwgXOMZOTG9iSqA0gWIk7CI7nWsfpeXXYT4mvmWA4g30Fp9JUbwxvAW7Xz%2FJ%2BU1Ur%2Bbp57CC7vnuISQmZmSI2xTJBCxLRfGBhfhAeFsaFTo0FZpx0LOFVL3ScjnXghmHr0wlhXMiEoQxLhlO8QLmo84zkHNaIsgF%2FAtewfhKxiOhAvmg4U8NlZSrIBOVqx8qcJATH4JLALEFRL4gbBpZfh0i5M5nXuyMTyuQCEpbqWqTZhPaheH7oGDUKY7pyGBYlZC1KwAcZpSSaSzFjtJzOejPJN03DqWOuE1j%2BUeISQwYVcpJCX9N5eYzw5%2Bhp%2BfB4sXkFlP8tV3fVN%2Fj%2Ft4en5X310rp1v3zSd%2B6%2BV6v69eXXh%2B26%2Fvfp4ujibvXQ3FXIewS4sVl%2Bf1x%2F%2F9I8%2Fr6pf183y4tV9e%2FLyQt%2FL9dPD43p%2Bh%2F1e9taqguhr5eKhYxxgmAToZFBcudlNsG9Hcd3IbkNbX2DILEFiWSCYdcnKYUwkVhezYjAZ%2BLFxmRsOaEJFDM2AfL42upc251rR1%2BjseWahuFbjT0au0HgeOYYetDuhgfL89UHblssFnpmXcwJB5KghWpyfcsMXNs266aWwxoXWNFdiVKVnxkSqrtAE1BUIzOcl%2F1QTmjVEVMJOi2gziJGil6SCnzbCp2dxzHmcwFOx4TrTgIRlrrJqU3rhQmBZMIdDMNXiMWwV%2BKm6DULLcswAm22%2B2RdSrBmaBwQgG4fOwFw7aAOX%2FwR57rj8Dm0GTFkZwZWu%2FXNUB4rZif5vHFCtYhhdglt33LrNXDV5G4AB1837NBr6Bu%2BF7YWTwucMzFRPF%2FAfgM3Tsp03gsSuk7T3uD1qZxhFPcXFiR24Hp1V0X8Jo%2FqFnRs8mP0Um1VKR09l8qvGCm6pigefWg%2Fw7BmFazO%2FeZB567ShO8BvPsJkkMu1jdQnNDrzmMIFiNzBIlTKlboPI0onRN4CYloRvLpO2%2BBGMoIxycf1h1LLb%2FxUtNG5602lUgtVIlQzeHL%2BmX7ooK5fHwc3b61dgIUTUPAnBcSMlFVeUyQvCICFLCAL8aE4UjUqlG90L%2B1lg86ui5Dsa9iVBQpXYBvhCoBG0dQnAMw0Ejcg3Dd4XDo48fMqZS07lnwG8200%2BrlKEUkG0pCK7SPlq6k4DVBEH%2FAgohywfvNbQtk0948KrkAQZrSqSQJatOB41bL5SfTG4fV8vPY8Zf2%2BJPv3Y2Xnz95Dtxz70DY3bbBnTAIzoEXmEU4b%2B2BcWEY7s9ZR8m0XWWhCXLAD63RpflhZBsGSBUH9M6l%2BfYOoKqLnbyri6E%2FSg40mDpKEWcqU9mNnJIsG5DpwCPN3HIw4xiGBjbmgxofBGBDgfuc1rz9Hl17NgwFvu129sC1Hat2Xcv1TIk9aBypRDm%2FGkouN3TNo5lNDysIxBnHIM4F9FYgRpqmA9ObZ1t12FXpZLoJYGBIMs1hWYygdiKM%2Fn3Yfhl%2Ffbir1h2cwLPd8zgDDpwaFqqDyXRg271gRyz7tiSmSCZlmsLCMfBkQ%2FQtmOdvBJTgavvSAQt3c7TaT0avftJ73%2FIbllF2teOCgcSF9G1ngG2YFiSc645UFZieAzvfTYfACZqsYplMUjQd6A8wFjXDMy9wVM8LMDf8oRp6rFuYHn9BcuOsU9HnZl%2BvycUpCNnFHMKX0UaIwvgIvEvidmWbrgsN9HL08vL8mwKq82L89Z9xdfewWlf19cXfL%2BvVqF3soWeYh2MLNV4XCIYnrgZ9LUtKlh61YDHtnVtMBdjIaFoIkqnBK5phcDwuC4BDUJPD4QQYmIA1ij6HaPgUXJr0qhMwtALnwCS%2Fbtwoqw696vlbz9rAFLvzDHiKYlRoQsrohKTtRvVst8EtIzAPo3NzriNmkA4SZ4W42Z07FSjH6S%2BOi4BuBobdDrvSczHvP6kxLc9ttn9vN9XDEyRcnQgD9n54dEbSrKrdBXgtJlhWKJkNU30ZCdrfUE0rNJtDMD4nhcq6OtYDjRiSxvWt4%2BlmVqIrTKQVSAFRTiH9BgBgLmu6DywGL6TZev%2Bv9Wq7WbdOVMBTM%2FT2A39GQbKpXWRwAbXTMk9QyrsHPfC9A3Wo2DcMrk7ZJGwJVrpsgdK2ZAZVbRjtQg6co8MVksNgoSQmPiWe1fLTYzX%2BUi3vqs1Ys8jD%2FWq9qcab6nO12VSbUS9wfS6jZ5gY8RlQJaTwyeR1JlKm4jj%2FDFHwuB6kNLDSy7UoTaCk%2BAnlrV%2B38nNV3XVP%2BjyvbjuQ8%2FF80UkUvbGBebLXgXmcLDXnAVUD%2F6Prs%2BrrJNvCdwDwdbvy%2Ftp2z%2BF6jDM1Av%2BXr0c07ZRYz%2FeBWinDagtSdTQLKaPnjqHKD0zbO9pLGEMlhX7Gmt2bUUY%2B0lygdMAPN3CMHhzYSgG80S%2BeFEqvN%2BcE1ONyc1%2BNH57u34Pay6Djk7wBFWJ4zbmdblwMxkSaECFUVque%2FjvKi3IgIIHZnFFMFPfq2VEdlUzK6VAvthoVulfC0PFuQIpmAyxgW6Zvn7Ek%2FXPbkR1CE0k4VQ0WZIOi3Rxl6tgTZlyY0ZJEJZWoNQwfTEzHP9v7oaiitIxVLPWMTOK2srtt4%2FhmI2c1Tj1QyN2p1xk2ObMTllmXCL6Gl3OYBoBQlarMeUEZKIHuRHQK4fvvENkvpIN50MOYMTCD6a43DwPX2vGnPvU%2B1w6t0Oi2Q3Xr7fbt%2F5F980A%3D&pcode-icookie=DchmAMKXSuiaU2jHpRRLQFjqddBmPitrIJIIGbq1UCXFRIn%2BftV16oSqcW%2Bv4QZ%2FwBe4jQHCGUM43PQtjx5LHKD4u1Q%3D&disable-base64=1&imp-id=1&ecma-version=es2017&charset=utf-8&test-tag=330952999960578&tga-with-creatives=1&top-ancestor=https%3A%2F%2F1275.ru&top-ancestor-undetermined=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1050%2C%22top%22%3A304%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A0%7D&grab-orig-len=4748&grab=eyJncmFiX3ZlcnNpb24iOjJ9CkqlkHAjSWYA1T1DRfyxpW1dt1Yn02-MHSu_deWKL_2CTF-3lagm5pbVlpOQoRptCS09RkWXhD9e0KWjjuA_jk0yObETUM8MchG4lcsAiSl2TtFDYW7hwYMBwPA2eIyHJbI5uHhYqWZcPFETOQkXkaJi-AjFVDlJ9hEDC6nkez6iKov-PDxCiJB6azbbW3j4wgUeO4nVVys7QcrNSSqyxhI1ReX6RVHFpIqQcoHfPi4-Lh6-0LehZAy_cKokQcplKZLoiYnN4lQxeTnplckRfUlTsTmJBurFYz-Ca9mby7b4h67I7Cp6kljVXOXsw2d5iW2k7MlJYimqpCGI23MyquzJGjaWyMXFyxoCfoqkienvSoXA1FgeR1Mx_VeWkvrNNSf5LcI7MwYgGeh0cBjoDJDpYDPQfAZMnw7gDOgMUMML4AzYDBAZaHQg4OFXISNPOvlkj_bVNXgpo2qdxuNpqhpvmRwO4WNDfmWvQ-ClgVdcsmh-CH74kIEFcCaHX8pOKvPbOVpgkwpT1kQMgVV8Co9HjuiLgMl5j9XQOIQPkAIDIqKvpGGrVWQ-6kTcwK4c-FVORB-IIYSE6MsAREgRSAw0Boh0uBQufCaHvES-TFrupFTlgsUlzrrAhypVNM9BKcw0DiHKJBw874uu52ZXTSVlFf63e63cqcr9K_qkAMUf8lxU9xAcJECJGCwa__1DZEoei2lwNAnLJ_IErCp5guViMdmGWrUH5TaLrcgYnqYUX6zY57htRXhJsCvedyVWVXmwJwSwDBh3G1h3Gth0OPcPOtjPgOAlAMaALcSfhDXVrYU_Dxp2YC2-sGf2PQd1zYW6-n1kF2l2BIYau2InIcMxcxRYHBxqNVwUuiVybGFXVJQ0tiT8uQZNj4qfU430wQxAMaDRwWKA_qyiMWBe-8MK6YXODxQ1dsJdw93dnXs6UW_9D8It05z2g1ifIsqKih2rjlmlFS08n1U6gF7_QvcZsILKBfX9f8aVrhDMNwnOv6CFQIJ0gLAfOf-XsN4MSPFeOIqd3Fijkfp0oJwTRAbMBweNDid8vevHsP1q0g8WCJSzi1YHO55G_XdAUH4Pery8W8OlJR6Nge7HpgMXbTv6_3HmueN-IAkG81bp4HwMaB8F5Bd80EMFVQUr9hLYgBIzQweT2lQYBup3gxkKRHP9BxzEUNoZAfEK_b4UakKngx1Xz72W_-FRq8AOrTybUYmEWdBiqf63woyqIrjBswT70PEr7I63DBh0MD4lxOR86G_11P578RkAEsIO_afoYQPg32lUpdHH0V08fBZJRMD1RKV4CCbOxukmzs1bYT4KsoelXUVdj2L4tGsaPw-FLSdyXlW8jj7TrMmpBPqG4Ohgj5ST6KIEz7m44FfjulbRfaSC40mhE8Gp1BoocJqyIWYQaDQaTNROp2BPK-AiPrV65avIkrCLzZIVtiYJygCKl84vRYRgENPzwJ-dw8WFWInqR4ICRoOLixA4kEy7E1HHFNiQa5pqnFCv6Hx4WA6t-MPzNaw93GW5a7trWtQWl-0us7lrTHc1h_yzfrbcv2yT8rJsdzrb7c75GqFPW-Sfj7yq_QbyPeZ_P_imz7JJH3Y8OIBO2TJ3c-d443O4k_JyomL8sEVy88_8TMt1JuFfp4x0XHO4g4SJ89q37fblkv_s6bbl2s-vNai__ryZQkVrkb3mtF1zueSJa3bMnvWuyJ9XLTOmL6SS-rFixyHXrtXJ4_DoUT2VPGJV5FSgukVhU_dXBJia6CoyNvVdsurqCrygENwCLvWRMnaSkoxAK0lyjTsg6eKEySyqCw-DcqDfun7HVFUMV00i5SGnE481TMyTWRLpcs3F0sDlXK1LGpuEn43tnp5mSSLph13BY3JI31LV07v8k_LN1dUxNArEq08yJ0mSZyS1YLGrjCl5MlNYwmKevMvSiPuUmGr35naZZ1NZGikngpMjFBdTxASPzSLlhw9_udiPPvEPvls0xdXUQvKUa8F8ssrJUqjZZwy1ZkVE_cA6tVQpSeLjwCt78kDsZVilrOHY2Vh23rk4Vt5L70Y2qmHq1bZM2xmzGE42m22voutp6Ubf02jNoDjkzm05xUx5pzHsvtLquu2snZ2228jJbmWnqvf04JhzjzwsvVvzd6U3s5Gr-mkXyyq7OuNmUq3a361R7dTy6KuUYhtmtuqqpVjNaqv2ZRUnLbs400iDYlWrOE5butlL6q3lLytmzVbSLbPvYZ7HMI0-nLVaGnnmJ98ozdDNPNeyR6Xs1ZP1LCe762kU60N3fuKM1K8cW819rL5yK6bVnF3bGOMD7VL0N9yyo1N0eLWHuT9p5VxWH7usZo3RrO7sVWpdr81-wcbOva3R9WU4qdrmtJNV9JQoe423Vx27p2HUaT_rvY3-BL_XmmeyLbubxanmSua2hrGdXmepuT72v6YolFlSi-yznrJp6HtXO-vbNo0yk-XkkWz7Eex2XiU5hr2mOXt9YuqwLWMZnaIRczG7_d62Y5amOzlZ_XmoxV6vJjll6Ma2tn7vz7vpzU45O-bZPn9265m6d9h30GVm22i5OfVuNsbJv9MsO2cj772mY77BbDSnWLXdd5tlb-cZ7aT-Nsy87opPz_NRW9rJOuC8s9ljODlna62ebD3rtVu6Xdow7PmUW45-XeZQTM_eq7bX8Lvd5-vTn7V3ZlrbqqPu3bOzyyy5Os6cZez3sMYes6VypuQqYDl2061dhnlHz32Z5l3ufu8YfenLao_OfbU4bdzJ7Oibvyv2rkl3VqfkpDfdsNO_zrT0adl3gFbTtgy9tf7y7W3Udvvq5VD3v3tjreZI1dJTv7tT95pTr_puH3mT77nPaa7nfxv2aMO8a5a-9q1lzLHfSeujdGfpbVp3I5vclr7mPvA0zZ7tsq_I2y39hmQexzd3Hs3p-_o7lfSs6EZ6xJalFz2vOnSdQmXWzzTNPLZV5tDtbDntW7ZZinMj67oztuOs1te6C685jHEj1m2jWla1WqEk1zDOdOrGbehF69tod7qe9b6L7sximo5dzWKNx3w-8LXrudwWrm2rMe8FFKrw4e83SyfP2_2H9nb9r9ep73nXnXfG6-nTQMvKJ__3Yd6k9W5WR9ebvihVXlNtc-xuBY-63qs9Oma7p5uOnuYydacOY6Z-3VOMUdNspVl15qvSaZDRHUS4TzYWDgUDSizF5o8xqsxi-QHMk1OUqWYSSA9-MiJOgPaiSkuPm4ibjCi_hU4H8vH1ABcwtxHfDO1Y72O7gYuHb-DiKTxBBxX2BpX0-qQy8nsiDiRIIJYVLYpjoX4LtFN0Cs9BkzUTGolYVRWUO8ZXOMRyaZq0nDDmSKzYEplAkvriUjBGBPloY8glpKi3SErRKodLmKMyRSxF9gwFHpfgQ1N1hYsyexyciqBCZRkOThSaQX1_gOHi-hCqUYIm-VDZSSafIig1RM3mxGh2xFHywldUvDShV0aRj8WhCpoZgLmPgR4EwGh0sOlg-EFEHoX3x0BE7E7AK4HMFx8lr0QL45MMa0b28Pic4wW5NVWqSVAoBcBBqk4qfJYTUJknPcW6eal1WIwbcFUExiW2IOYFoXkQxTtkDKRBA9_qAE0wSQSGhyUS02BrQb9GbEb8Ejt5xGrz0DVKQngW8LVjz0XC3n13K5i3YUG64YMneSRvLiqtRlsqiKy4uMBEiBCVr8X6hEO_nASgsL2I9O4J36j_cTUeQxNxNIVExE8usyGSnUD5cJQNOibXi-IPn8ZGAMWRT02pIk7U2VqSuFCthgFAN3B0wrqDNpIqIo-FH488h7e33YAbBaugBwUAqn_TRA8iW2hRiikIEAWkelg--EkNMmfE-S0fK-1DBI-lSMxrGYCOsTjuFIM_dmsGKMJiB2HW3L3NOOp7YEa5ZZCp3j4-DwYdrFA_L06EXHN2H_2DABllmnS4dCAFEWDIKbTgG1fRQYQJWtDZn4MU6xFIPrAQQn3bWpBnW7dWg1zbHO8EQOvbAEeHK4jzvo90F_TDgfI9gswuSp9AizI5mLyUDZYPgWaAjxgJEpTG29OxbYDB9A4wm343m8uCUjcDOsK5HWAgRgpsFLadsMRH7NvpYFKaiX1GEQpaRFU8bBShwKY2ATLKMhJCs0hQYqGm22PfEWkfBh3O99CEICTEQTI0RqFeHv2clOIVWaKKQ6NeEJeEKEVCHiSIwKeRO2m0LDmKOJ9hEFrJAARVEPLI-0g5VwJINHjIXQYcDbxaMCFQApIYGWGNRxweyOwGMAz0pyvIH4TwBcTVk6rRBHTVJwmmICaI6PjQA2J4NBEYAuI7j5wchAURPKAWXdUESQEdLD9qDuQ3SFGnZlCnyDddxGpUPMhMKeAFhPPoLwG5OSKJgxmRcKMyfNdPacw_rAhGh-sDU2GquTCNFFBzo2MRI4ML5TNAQmarAPgtAfU3IDULbQuG_rE3PoD0wy-iDQOBDsSQzNjXFTycYLwBlfVhgiYYKnJ7hqCKspJTEZmSDxB3o6woVMQ2EzJ7_bFZq0OxRoyIz7LCgUDB1uD5UXwLeRt3-hzIdDaIIUHkrWMdUOyXXL8hgyTJY9gimQsl8mJAl9AVJSJfUhFGfW7EYscn4UufjPXJQxic5GHLFQNFYKLTzmjAMkcF1H4ah6GIr5gQr4A58x_7GcLuP6IQpgicdY6PUNFFKnDeK24g3IETUOd41IcbPRwGKHQwUAaKOL4wm_gXsVoRuPARKMAA8A%3D%3D&uniformat=true&callback=Ya%5B4627309529226%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

78f67c3bbdda3b2949c65332c159112791cac70da89703ca80cfe2ecb89c6156

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech .maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net .captcha.yandex.net yastatic.net .maps.yandex.net .yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://1275.ru/

Response headers

x-yandex-req-id: 1729263482374540-11409796111892515022-balancer-l7leveler-kubr-yp-sas-206-BAL
content-encoding: gzip
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 14:58:02 GMT
date: Fri, 18 Oct 2024 14:58:02 GMT
last-modified: Fri, 18 Oct 2024 14:58:02 GMT
content-type: application/json; charset=utf-8
content-security-policy: upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT, Width
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-origin: https://1275.ru
x-xss-protection: 1; mode=block

POST
H3 204 rum Show response
1275.ru/cdn-cgi/ 0
154 B 54ms
53ms XHR
text/plain 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
content-type: application/json
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 8d49625ffb859223-FRA
access-control-allow-origin: https://1275.ru
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:02 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H3 200 1275.svg
1275.ru/ 2 KB
2 KB 76ms
75ms Other
image/svg+xml 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/1275.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30d219fdd2c143bf6199edb608a596f51e3bb692e5cd8803057a0c478a9140a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/ioc/2158/pony-stealer-iocs-2/

Response headers

content-encoding: zstd
cf-cache-status: HIT
age: 1921
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zTLpyLc1%2Flo4wBJf4TaP6I78W%2Bil0uD6W5YXwysImeo8tQEsekp8ek6eY6C98eQwOmsV9PoUQo9je3gjThoX31cOBY1a%2FCYMIYfNKcWL%2FUd4OZu6%2BwsVThh9"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 18 Oct 2024 14:58:02 GMT
content-type: image/svg+xml
last-modified: Sun, 17 Jul 2022 14:47:18 GMT
vary: Accept-Encoding
priority: u=1,i
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8d49625ffb879223-FRA
x-xss-protection: 1
server: cloudflare

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ 152 KB
55 KB 331ms
161ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

7aaae88378467fa7bd1c36beb6c3066dad69411f082e4b98e85c3ddef7953e51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://1275.ru
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=3600
timing-allow-origin: *
content-encoding: br
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "6707cb5e-d818"
expires: Fri, 18 Oct 2024 15:58:03 GMT
access-control-allow-origin: *
content-length: 55320
date: Fri, 18 Oct 2024 14:58:03 GMT
content-type: application/javascript
last-modified: Thu, 10 Oct 2024 12:41:02 GMT

GET
H2 200 1788970 Show response
yandex.ru/ads/meta/ 438 B
377 B 136ms
136ms XHR
application/json 2a02:6b8:a::a
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/1788970?target-ref=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&pcode-version=1139290&pcodever=1139290&comboblock-unencoded-vast=1&ad-session-id=2562601729263482277&target-id=72794732&pcode-test-ids=1111484%2C0%2C30%3B1066210%2C0%2C58%3B918196%2C0%2C41%3B1094008%2C0%2C64%3B1138328%2C0%2C35%3B1115221%2C0%2C60%3B1131242%2C0%2C20%3B1098499%2C0%2C42%3B1106679%2C0%2C8%3B1099660%2C0%2C34%3B1139181%2C0%2C10%3B1134579%2C0%2C67%3B1128136%2C0%2C54%3B1135840%2C0%2C61%3B1135836%2C0%2C29%3B1070607%2C0%2C57%3B1138108%2C0%2C14%3B1127212%2C0%2C76%3B1132173%2C0%2C99%3B1134547%2C0%2C0%3B1137135%2C0%2C18%3B1138219%2C0%2C90%3B1137782%2C0%2C22%3B1138114%2C0%2C24%3B852182%2C0%2C18%3B1139290%2C0%2C68%3B681842%2C0%2C45&pcode-flags-map=eJylWFtz2zYT%2FS96jlzeL36DSFBCRRIsAMp2Oh6MUjOOW1vyyHKaLxn%2F928BUhdSMplMXyzzsoeLxe6es%2FgxWiAupwxNZIrzqZiNLv%2F8Mfq6fHytRpcjy3CC0YfRtnrZkju4DozA8J3R2%2B0HbcZntExj9XMlUSQIzeWkFAJ%2BSC4LFM3hiWgBVt%2Bej%2FFMw3YC9wCII5rJSCCwjxhGHO%2FwOPmIW0CP920c1%2FUD64CTo0mKZUphRfh6wAXP8TxvbxrTDIH3NE9v1CrAmX5rPzADf29dIA5%2FGE4w0x6gWLsuBZWLDBX9UEEQWAdHeMkW%2BEbm%2BAoA6ZRhQJ4g1g8Ruq7jnYYTxfFuYTwlMR4ACY0jkIRca4wUI5bLjLJ%2BaxPC4dmHVWSICbEAD0SZD1jatu0cQnnFUCFTwgXOMZOTG9iSqA0gWIk7CI7nWsfpeXXYT4mvmWA4g30Fp9JUbwxvAW7Xz%2FJ%2BU1Ur%2Bbp57CC7vnuISQmZmSI2xTJBCxLRfGBhfhAeFsaFTo0FZpx0LOFVL3ScjnXghmHr0wlhXMiEoQxLhlO8QLmo84zkHNaIsgF%2FAtewfhKxiOhAvmg4U8NlZSrIBOVqx8qcJATH4JLALEFRL4gbBpZfh0i5M5nXuyMTyuQCEpbqWqTZhPaheH7oGDUKY7pyGBYlZC1KwAcZpSSaSzFjtJzOejPJN03DqWOuE1j%2BUeISQwYVcpJCX9N5eYzw5%2Bhp%2BfB4sXkFlP8tV3fVN%2Fj%2Ft4en5X310rp1v3zSd%2B6%2BV6v69eXXh%2B26%2Fvfp4ujibvXQ3FXIewS4sVl%2Bf1x%2F%2F9I8%2Fr6pf183y4tV9e%2FLyQt%2FL9dPD43p%2Bh%2F1e9taqguhr5eKhYxxgmAToZFBcudlNsG9Hcd3IbkNbX2DILEFiWSCYdcnKYUwkVhezYjAZ%2BLFxmRsOaEJFDM2AfL42upc251rR1%2BjseWahuFbjT0au0HgeOYYetDuhgfL89UHblssFnpmXcwJB5KghWpyfcsMXNs266aWwxoXWNFdiVKVnxkSqrtAE1BUIzOcl%2F1QTmjVEVMJOi2gziJGil6SCnzbCp2dxzHmcwFOx4TrTgIRlrrJqU3rhQmBZMIdDMNXiMWwV%2BKm6DULLcswAm22%2B2RdSrBmaBwQgG4fOwFw7aAOX%2FwR57rj8Dm0GTFkZwZWu%2FXNUB4rZif5vHFCtYhhdglt33LrNXDV5G4AB1837NBr6Bu%2BF7YWTwucMzFRPF%2FAfgM3Tsp03gsSuk7T3uD1qZxhFPcXFiR24Hp1V0X8Jo%2FqFnRs8mP0Um1VKR09l8qvGCm6pigefWg%2Fw7BmFazO%2FeZB567ShO8BvPsJkkMu1jdQnNDrzmMIFiNzBIlTKlboPI0onRN4CYloRvLpO2%2BBGMoIxycf1h1LLb%2FxUtNG5602lUgtVIlQzeHL%2BmX7ooK5fHwc3b61dgIUTUPAnBcSMlFVeUyQvCICFLCAL8aE4UjUqlG90L%2B1lg86ui5Dsa9iVBQpXYBvhCoBG0dQnAMw0Ejcg3Dd4XDo48fMqZS07lnwG8200%2BrlKEUkG0pCK7SPlq6k4DVBEH%2FAgohywfvNbQtk0948KrkAQZrSqSQJatOB41bL5SfTG4fV8vPY8Zf2%2BJPv3Y2Xnz95Dtxz70DY3bbBnTAIzoEXmEU4b%2B2BcWEY7s9ZR8m0XWWhCXLAD63RpflhZBsGSBUH9M6l%2BfYOoKqLnbyri6E%2FSg40mDpKEWcqU9mNnJIsG5DpwCPN3HIw4xiGBjbmgxofBGBDgfuc1rz9Hl17NgwFvu129sC1Hat2Xcv1TIk9aBypRDm%2FGkouN3TNo5lNDysIxBnHIM4F9FYgRpqmA9ObZ1t12FXpZLoJYGBIMs1hWYygdiKM%2Fn3Yfhl%2Ffbir1h2cwLPd8zgDDpwaFqqDyXRg271gRyz7tiSmSCZlmsLCMfBkQ%2FQtmOdvBJTgavvSAQt3c7TaT0avftJ73%2FIbllF2teOCgcSF9G1ngG2YFiSc645UFZieAzvfTYfACZqsYplMUjQd6A8wFjXDMy9wVM8LMDf8oRp6rFuYHn9BcuOsU9HnZl%2BvycUpCNnFHMKX0UaIwvgIvEvidmWbrgsN9HL08vL8mwKq82L89Z9xdfewWlf19cXfL%2BvVqF3soWeYh2MLNV4XCIYnrgZ9LUtKlh61YDHtnVtMBdjIaFoIkqnBK5phcDwuC4BDUJPD4QQYmIA1ij6HaPgUXJr0qhMwtALnwCS%2Fbtwoqw696vlbz9rAFLvzDHiKYlRoQsrohKTtRvVst8EtIzAPo3NzriNmkA4SZ4W42Z07FSjH6S%2BOi4BuBobdDrvSczHvP6kxLc9ttn9vN9XDEyRcnQgD9n54dEbSrKrdBXgtJlhWKJkNU30ZCdrfUE0rNJtDMD4nhcq6OtYDjRiSxvWt4%2BlmVqIrTKQVSAFRTiH9BgBgLmu6DywGL6TZev%2Bv9Wq7WbdOVMBTM%2FT2A39GQbKpXWRwAbXTMk9QyrsHPfC9A3Wo2DcMrk7ZJGwJVrpsgdK2ZAZVbRjtQg6co8MVksNgoSQmPiWe1fLTYzX%2BUi3vqs1Ys8jD%2FWq9qcab6nO12VSbUS9wfS6jZ5gY8RlQJaTwyeR1JlKm4jj%2FDFHwuB6kNLDSy7UoTaCk%2BAnlrV%2B38nNV3XVP%2BjyvbjuQ8%2FF80UkUvbGBebLXgXmcLDXnAVUD%2F6Prs%2BrrJNvCdwDwdbvy%2Ftp2z%2BF6jDM1Av%2BXr0c07ZRYz%2FeBWinDagtSdTQLKaPnjqHKD0zbO9pLGEMlhX7Gmt2bUUY%2B0lygdMAPN3CMHhzYSgG80S%2BeFEqvN%2BcE1ONyc1%2BNH57u34Pay6Djk7wBFWJ4zbmdblwMxkSaECFUVque%2FjvKi3IgIIHZnFFMFPfq2VEdlUzK6VAvthoVulfC0PFuQIpmAyxgW6Zvn7Ek%2FXPbkR1CE0k4VQ0WZIOi3Rxl6tgTZlyY0ZJEJZWoNQwfTEzHP9v7oaiitIxVLPWMTOK2srtt4%2FhmI2c1Tj1QyN2p1xk2ObMTllmXCL6Gl3OYBoBQlarMeUEZKIHuRHQK4fvvENkvpIN50MOYMTCD6a43DwPX2vGnPvU%2B1w6t0Oi2Q3Xr7fbt%2F5F980A%3D&pcode-active-testids=1131242%2C0%2C20&pcode-icookie=DchmAMKXSuiaU2jHpRRLQFjqddBmPitrIJIIGbq1UCXFRIn%2BftV16oSqcW%2Bv4QZ%2FwBe4jQHCGUM43PQtjx5LHKD4u1Q%3D&disable-base64=1&imp-id=3&ecma-version=es2017&charset=utf-8&test-tag=330952999960578&tga-with-creatives=1&top-ancestor=https%3A%2F%2F1275.ru&top-ancestor-undetermined=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A0%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1050%2C%22top%22%3A1598%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A1%7D&grab-orig-len=4748&grab=eyJncmFiX3ZlcnNpb24iOjJ9CkqlkHAjSWYA1T1DRfyxpW1dt1Yn02-MHSu_deWKL_2CTF-3lagm5pbVlpOQoRptCS09RkWXhD9e0KWjjuA_jk0yObETUM8MchG4lcsAiSl2TtFDYW7hwYMBwPA2eIyHJbI5uHhYqWZcPFETOQkXkaJi-AjFVDlJ9hEDC6nkez6iKov-PDxCiJB6azbbW3j4wgUeO4nVVys7QcrNSSqyxhI1ReX6RVHFpIqQcoHfPi4-Lh6-0LehZAy_cKokQcplKZLoiYnN4lQxeTnplckRfUlTsTmJBurFYz-Ca9mby7b4h67I7Cp6kljVXOXsw2d5iW2k7MlJYimqpCGI23MyquzJGjaWyMXFyxoCfoqkienvSoXA1FgeR1Mx_VeWkvrNNSf5LcI7MwYgGeh0cBjoDJDpYDPQfAZMnw7gDOgMUMML4AzYDBAZaHQg4OFXISNPOvlkj_bVNXgpo2qdxuNpqhpvmRwO4WNDfmWvQ-ClgVdcsmh-CH74kIEFcCaHX8pOKvPbOVpgkwpT1kQMgVV8Co9HjuiLgMl5j9XQOIQPkAIDIqKvpGGrVWQ-6kTcwK4c-FVORB-IIYSE6MsAREgRSAw0Boh0uBQufCaHvES-TFrupFTlgsUlzrrAhypVNM9BKcw0DiHKJBw874uu52ZXTSVlFf63e63cqcr9K_qkAMUf8lxU9xAcJECJGCwa__1DZEoei2lwNAnLJ_IErCp5guViMdmGWrUH5TaLrcgYnqYUX6zY57htRXhJsCvedyVWVXmwJwSwDBh3G1h3Gth0OPcPOtjPgOAlAMaALcSfhDXVrYU_Dxp2YC2-sGf2PQd1zYW6-n1kF2l2BIYau2InIcMxcxRYHBxqNVwUuiVybGFXVJQ0tiT8uQZNj4qfU430wQxAMaDRwWKA_qyiMWBe-8MK6YXODxQ1dsJdw93dnXs6UW_9D8It05z2g1ifIsqKih2rjlmlFS08n1U6gF7_QvcZsILKBfX9f8aVrhDMNwnOv6CFQIJ0gLAfOf-XsN4MSPFeOIqd3Fijkfp0oJwTRAbMBweNDid8vevHsP1q0g8WCJSzi1YHO55G_XdAUH4Pery8W8OlJR6Nge7HpgMXbTv6_3HmueN-IAkG81bp4HwMaB8F5Bd80EMFVQUr9hLYgBIzQweT2lQYBup3gxkKRHP9BxzEUNoZAfEK_b4UakKngx1Xz72W_-FRq8AOrTybUYmEWdBiqf63woyqIrjBswT70PEr7I63DBh0MD4lxOR86G_11P578RkAEsIO_afoYQPg32lUpdHH0V08fBZJRMD1RKV4CCbOxukmzs1bYT4KsoelXUVdj2L4tGsaPw-FLSdyXlW8jj7TrMmpBPqG4Ohgj5ST6KIEz7m44FfjulbRfaSC40mhE8Gp1BoocJqyIWYQaDQaTNROp2BPK-AiPrV65avIkrCLzZIVtiYJygCKl84vRYRgENPzwJ-dw8WFWInqR4ICRoOLixA4kEy7E1HHFNiQa5pqnFCv6Hx4WA6t-MPzNaw93GW5a7trWtQWl-0us7lrTHc1h_yzfrbcv2yT8rJsdzrb7c75GqFPW-Sfj7yq_QbyPeZ_P_imz7JJH3Y8OIBO2TJ3c-d443O4k_JyomL8sEVy88_8TMt1JuFfp4x0XHO4g4SJ89q37fblkv_s6bbl2s-vNai__ryZQkVrkb3mtF1zueSJa3bMnvWuyJ9XLTOmL6SS-rFixyHXrtXJ4_DoUT2VPGJV5FSgukVhU_dXBJia6CoyNvVdsurqCrygENwCLvWRMnaSkoxAK0lyjTsg6eKEySyqCw-DcqDfun7HVFUMV00i5SGnE481TMyTWRLpcs3F0sDlXK1LGpuEn43tnp5mSSLph13BY3JI31LV07v8k_LN1dUxNArEq08yJ0mSZyS1YLGrjCl5MlNYwmKevMvSiPuUmGr35naZZ1NZGikngpMjFBdTxASPzSLlhw9_udiPPvEPvls0xdXUQvKUa8F8ssrJUqjZZwy1ZkVE_cA6tVQpSeLjwCt78kDsZVilrOHY2Vh23rk4Vt5L70Y2qmHq1bZM2xmzGE42m22voutp6Ubf02jNoDjkzm05xUx5pzHsvtLquu2snZ2228jJbmWnqvf04JhzjzwsvVvzd6U3s5Gr-mkXyyq7OuNmUq3a361R7dTy6KuUYhtmtuqqpVjNaqv2ZRUnLbs400iDYlWrOE5butlL6q3lLytmzVbSLbPvYZ7HMI0-nLVaGnnmJ98ozdDNPNeyR6Xs1ZP1LCe762kU60N3fuKM1K8cW819rL5yK6bVnF3bGOMD7VL0N9yyo1N0eLWHuT9p5VxWH7usZo3RrO7sVWpdr81-wcbOva3R9WU4qdrmtJNV9JQoe423Vx27p2HUaT_rvY3-BL_XmmeyLbubxanmSua2hrGdXmepuT72v6YolFlSi-yznrJp6HtXO-vbNo0yk-XkkWz7Eex2XiU5hr2mOXt9YuqwLWMZnaIRczG7_d62Y5amOzlZ_XmoxV6vJjll6Ma2tn7vz7vpzU45O-bZPn9265m6d9h30GVm22i5OfVuNsbJv9MsO2cj772mY77BbDSnWLXdd5tlb-cZ7aT-Nsy87opPz_NRW9rJOuC8s9ljODlna62ebD3rtVu6Xdow7PmUW45-XeZQTM_eq7bX8Lvd5-vTn7V3ZlrbqqPu3bOzyyy5Os6cZez3sMYes6VypuQqYDl2061dhnlHz32Z5l3ufu8YfenLao_OfbU4bdzJ7Oibvyv2rkl3VqfkpDfdsNO_zrT0adl3gFbTtgy9tf7y7W3Udvvq5VD3v3tjreZI1dJTv7tT95pTr_puH3mT77nPaa7nfxv2aMO8a5a-9q1lzLHfSeujdGfpbVp3I5vclr7mPvA0zZ7tsq_I2y39hmQexzd3Hs3p-_o7lfSs6EZ6xJalFz2vOnSdQmXWzzTNPLZV5tDtbDntW7ZZinMj67oztuOs1te6C685jHEj1m2jWla1WqEk1zDOdOrGbehF69tod7qe9b6L7sximo5dzWKNx3w-8LXrudwWrm2rMe8FFKrw4e83SyfP2_2H9nb9r9ep73nXnXfG6-nTQMvKJ__3Yd6k9W5WR9ebvihVXlNtc-xuBY-63qs9Oma7p5uOnuYydacOY6Z-3VOMUdNspVl15qvSaZDRHUS4TzYWDgUDSizF5o8xqsxi-QHMk1OUqWYSSA9-MiJOgPaiSkuPm4ibjCi_hU4H8vH1ABcwtxHfDO1Y72O7gYuHb-DiKTxBBxX2BpX0-qQy8nsiDiRIIJYVLYpjoX4LtFN0Cs9BkzUTGolYVRWUO8ZXOMRyaZq0nDDmSKzYEplAkvriUjBGBPloY8glpKi3SErRKodLmKMyRSxF9gwFHpfgQ1N1hYsyexyciqBCZRkOThSaQX1_gOHi-hCqUYIm-VDZSSafIig1RM3mxGh2xFHywldUvDShV0aRj8WhCpoZgLmPgR4EwGh0sOlg-EFEHoX3x0BE7E7AK4HMFx8lr0QL45MMa0b28Pic4wW5NVWqSVAoBcBBqk4qfJYTUJknPcW6eal1WIwbcFUExiW2IOYFoXkQxTtkDKRBA9_qAE0wSQSGhyUS02BrQb9GbEb8Ejt5xGrz0DVKQngW8LVjz0XC3n13K5i3YUG64YMneSRvLiqtRlsqiKy4uMBEiBCVr8X6hEO_nASgsL2I9O4J36j_cTUeQxNxNIVExE8usyGSnUD5cJQNOibXi-IPn8ZGAMWRT02pIk7U2VqSuFCthgFAN3B0wrqDNpIqIo-FH488h7e33YAbBaugBwUAqn_TRA8iW2hRiikIEAWkelg--EkNMmfE-S0fK-1DBI-lSMxrGYCOsTjuFIM_dmsGKMJiB2HW3L3NOOp7YEa5ZZCp3j4-DwYdrFA_L06EXHN2H_2DABllmnS4dCAFEWDIKbTgG1fRQYQJWtDZn4MU6xFIPrAQQn3bWpBnW7dWg1zbHO8EQOvbAEeHK4jzvo90F_TDgfI9gswuSp9AizI5mLyUDZYPgWaAjxgJEpTG29OxbYDB9A4wm343m8uCUjcDOsK5HWAgRgpsFLadsMRH7NvpYFKaiX1GEQpaRFU8bBShwKY2ATLKMhJCs0hQYqGm22PfEWkfBh3O99CEICTEQTI0RqFeHv2clOIVWaKKQ6NeEJeEKEVCHiSIwKeRO2m0LDmKOJ9hEFrJAARVEPLI-0g5VwJINHjIXQYcDbxaMCFQApIYGWGNRxweyOwGMAz0pyvIH4TwBcTVk6rRBHTVJwmmICaI6PjQA2J4NBEYAuI7j5wchAURPKAWXdUESQEdLD9qDuQ3SFGnZlCnyDddxGpUPMhMKeAFhPPoLwG5OSKJgxmRcKMyfNdPacw_rAhGh-sDU2GquTCNFFBzo2MRI4ML5TNAQmarAPgtAfU3IDULbQuG_rE3PoD0wy-iDQOBDsSQzNjXFTycYLwBlfVhgiYYKnJ7hqCKspJTEZmSDxB3o6woVMQ2EzJ7_bFZq0OxRoyIz7LCgUDB1uD5UXwLeRt3-hzIdDaIIUHkrWMdUOyXXL8hgyTJY9gimQsl8mJAl9AVJSJfUhFGfW7EYscn4UufjPXJQxic5GHLFQNFYKLTzmjAMkcF1H4ah6GIr5gQr4A58x_7GcLuP6IQpgicdY6PUNFFKnDeK24g3IETUOd41IcbPRwGKHQwUAaKOL4wm_gXsVoRuPARKMAA8A%3D%3D&uniformat=true&callback=Ya%5B1594440035433%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

b7b3eb8264265e07709f4030c4755849823311c6da4d43ffc4c32e828c8aec04

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech .maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net .captcha.yandex.net yastatic.net .maps.yandex.net .yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://1275.ru/

Response headers

x-yandex-req-id: 1729263482915049-4226825936874200928-balancer-l7leveler-kubr-yp-sas-206-BAL
content-encoding: gzip
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
x-content-type-options: nosniff
expires: Fri, 18 Oct 2024 14:58:02 GMT
date: Fri, 18 Oct 2024 14:58:02 GMT
content-type: application/json; charset=utf-8
last-modified: Fri, 18 Oct 2024 14:58:02 GMT
content-security-policy: upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
pragma: no-cache
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT, Width
access-control-allow-credentials: true
access-control-allow-origin: https://1275.ru
x-xss-protection: 1; mode=block

GET
H2

200

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10526.y_wb1hu6ykpOClbOfdnbrInTBNhZf0VX4SsJRu2D2bhnmgP3er5ciAAAQxTUgAG2.ibMW9PlCRn3hS9ceLVjjnz3dKYw%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10526.iAIJSK1txwLJvgdPqB8HHMvHE_IDiA90vUZGIRvgeA-S1W_cCOWxA7Iln_Fyla8Okry8w7dFOqiJZ13kOas5nvAW3x0Z1N5ATGx-cEQlQ_SUe4ViNQxsDpLjceLtdmGhOg-2_uTYao...

43 B
718 B

82ms
82ms

Image
image/gif

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=10526.iAIJSK1txwLJvgdPqB8HHMvHE_IDiA90vUZGIRvgeA-S1W_cCOWxA7Iln_Fyla8Okry8w7dFOqiJZ13kOas5nvAW3x0Z1N5ATGx-cEQlQ_SUe4ViNQxsDpLjceLtdmGhOg-2_uTYaoh30xfkRhmWIU2AcvzS_Y682Uj0GilziIxAczoEbr1QEyZr8dufVzXNrIVRLOsia8phBdFcOHWaAFFrLFu_aLeHML-YmQgLTIA%2C.6pDiTebIhiQNZyfQEHkFxTVCp_Y%2C

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
date: Fri, 18 Oct 2024 14:58:04 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://mc.yandex.com/sync_cookie_image_decide?token=10526.iAIJSK1txwLJvgdPqB8HHMvHE_IDiA90vUZGIRvgeA-S1W_cCOWxA7Iln_Fyla8Okry8w7dFOqiJZ13kOas5nvAW3x0Z1N5ATGx-cEQlQ_SUe4ViNQxsDpLjceLtdmGhOg-2_uTYaoh30xfkRhmWIU2AcvzS_Y682Uj0GilziIxAczoEbr1QEyZr8dufVzXNrIVRLOsia8phBdFcOHWaAFFrLFu_aLeHML-YmQgLTIA%2C.6pDiTebIhiQNZyfQEHkFxTVCp_Y%2C
date: Fri, 18 Oct 2024 14:58:03 GMT
x-xss-protection: 1; mode=block

GET
H2 200 metrika_match.html
mc.yandex.com/metrika/ Frame 0FEF 0
0 506ms
86ms Document
text/html 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/metrika/metrika_match.html

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://1275.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: *
cache-control: max-age=3600
content-encoding: br
content-length: 1046
content-type: text/html
date: Fri, 18 Oct 2024 14:58:03 GMT
etag: "6707cb5e-416"
expires: Fri, 18 Oct 2024 15:58:03 GMT
last-modified: Thu, 10 Oct 2024 12:41:02 GMT
strict-transport-security: max-age=31536000
timing-allow-origin: *

GET
H2

200

1 Show response
mc.yandex.com/watch/1788970/
Redirect Chain

https://mc.yandex.com/watch/1788970?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalitz...
https://mc.yandex.com/watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzali...

547 B
747 B

81ms
80ms

Fetch
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1480%3Acn%3A1%3Adp%3A0%3Als%3A536620673865%3Ahid%3A24456900%3Az%3A120%3Ai%3A20241018165803%3Aet%3A1729263483%3Ac%3A1%3Arn%3A835610695%3Au%3A1729263483328232931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1729263480347%3Arqnl%3A1%3Ast%3A1729263484%3At%3APony%20Stealer%20IOCs%20-%20Part%202%20-%20SEC-1275-1&t=clc%280-0-0%29aw%281%29rcm%281%29cdl%28na%29eco%28565312%29ti%281%29

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

bfdd0e2fcc611551ef6666080caca9d06e90980a5fdbe76ccd1662786021d6a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
pragma: no-cache
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 18-Oct-2024 14:58:04 GMT
access-control-allow-origin: https://1275.ru
content-length: 547
x-xss-protection: 1; mode=block
date: Fri, 18 Oct 2024 14:58:04 GMT
last-modified: Fri, 18-Oct-2024 14:58:04 GMT
content-type: application/json; charset=utf-8

Redirect headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
location: /watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1480%3Acn%3A1%3Adp%3A0%3Als%3A536620673865%3Ahid%3A24456900%3Az%3A120%3Ai%3A20241018165803%3Aet%3A1729263483%3Ac%3A1%3Arn%3A835610695%3Au%3A1729263483328232931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1729263480347%3Arqnl%3A1%3Ast%3A1729263484%3At%3APony%20Stealer%20IOCs%20-%20Part%202%20-%20SEC-1275-1&t=clc%280-0-0%29aw%281%29rcm%281%29cdl%28na%29eco%28565312%29ti%281%29
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
pragma: no-cache
access-control-allow-credentials: true
expires: Fri, 18-Oct-2024 14:58:04 GMT
access-control-allow-origin: https://1275.ru
x-xss-protection: 1; mode=block
date: Fri, 18 Oct 2024 14:58:04 GMT
last-modified: Fri, 18-Oct-2024 14:58:04 GMT

POST
H2 200 1
mc.yandex.com/watch/1788970/ 43 B
74 B 85ms
85ms Ping
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/1788970/1?page-url=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1729263484_ffd00ff62929dcd3a08db4da45a2e4042cc0a165c2246359bff8ff290850b004&browser-info=pa%3A1%3Aar%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1480%3Acn%3A1%3Adp%3A1%3Als%3A536620673865%3Ahid%3A24456900%3Az%3A120%3Ai%3A20241018165804%3Aet%3A1729263484%3Ac%3A1%3Arn%3A570194508%3Arqn%3A1%3Au%3A1729263483328232931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A1417%3Ads%3A62%2C352%2C654%2C103%2C0%2C0%2C%2C251%2C6%2C2496%2C2496%2C0%2C1507%3Aco%3A0%3Acpf%3A1%3Ans%3A1729263480347%3Arqnl%3A1%3Ast%3A1729263484&t=mc(p-1-h-1)clc(0-0-0)rqnt(1)lt(9000)aw(1)rcm(1)cdl(na)eco(565312)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22adSessionID%22%3A%222562601729263482277%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-credentials: true
expires: Fri, 18-Oct-2024 14:58:04 GMT
access-control-allow-origin: https://1275.ru
content-length: 43
x-xss-protection: 1; mode=block
date: Fri, 18 Oct 2024 14:58:04 GMT
last-modified: Fri, 18-Oct-2024 14:58:04 GMT
content-type: image/gif

POST
H2 200 1788970
mc.yandex.com/watch/ 43 B
75 B 80ms
80ms Ping
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/1788970?page-url=https%3A%2F%2F1275.ru%2Fioc%2F2158%2Fpony-stealer-iocs-2%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1729263484_ffd00ff62929dcd3a08db4da45a2e4042cc0a165c2246359bff8ff290850b004&browser-info=pv%3A1%3Aar%3A1%3Avf%3Alxzalitzueo8p9865yapkilbx7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Ade-DE%3Av%3A1480%3Acn%3A1%3Adp%3A1%3Als%3A536620673865%3Ahid%3A24456900%3Az%3A120%3Ai%3A20241018165804%3Aet%3A1729263484%3Ac%3A1%3Arn%3A820410320%3Arqn%3A2%3Au%3A1729263483328232931%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1729263480347%3Arqnl%3A1%3Ast%3A1729263484%3At%3APony%20Stealer%20IOCs%20-%20Part%202%20-%20SEC-1275-1&t=mc(p-1-h-1)clc(0-0-0)rqnt(2)lt(9000)aw(1)rcm(1)cdl(na)eco(565312)ti(0)&force-urlencoded=1

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://1275.ru/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
pragma: no-cache
access-control-allow-credentials: true
expires: Fri, 18-Oct-2024 14:58:04 GMT
access-control-allow-origin: https://1275.ru
content-length: 43
x-xss-protection: 1; mode=block
date: Fri, 18 Oct 2024 14:58:04 GMT
content-type: image/gif
last-modified: Fri, 18-Oct-2024 14:58:04 GMT

Verdicts & Comments Add Verdict or Comment

199 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

20 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.yandex.ru/	1970-01-21 09:57:03	Name: i Value: /JtNV8uYebAgnmK9ogoKNK5eK2qxvLk4U5Jo7upBMnBSgbKS9tPFNDKTtPanzztTy6g5NhWgW3TZrEm5KiiTP4Yu30s=
.yandex.ru/	1970-01-21 09:57:03	Name: yandexuid Value: 8475002531729263481
.yandex.ru/	1970-01-21 09:06:39	Name: yashr Value: 5643170421729263481
.yandex.ru/	1970-01-21 09:06:39	Name: receive-cookie-deprecation Value: 1
.yandex.ru/	1970-01-21 09:57:03	Name: bh Value: YPnuybgGahncyumIDvKst6UL+/rw5w3r//32D7WWzYcI
.1275.ru/	1970-01-21 09:06:39	Name: cf_clearance Value: 1pZk5oQLOnXvDdyJKZs7WXcHLI_AZTlauLOYsv7e8mc-1729263482-1.2.1.1-55bOA2HhGEUsXfxaCEoVc_g6w5E6QmBkvUGdTYK30hS.icYBpAH9RztwTVjL5E1YHvdzwXTyk6QrKNBM7T48IQII0zpGaePO_6JAYtgQ1XVnwzm16N_rS_uzGOJDmO8selCNDquYeji2pznnmCxOSnC_S.v5fhCy.SAheufGjFiBZrXO8zezblk_Cof2upQS8cUwf8iV.Qq5x7AZjOzhrdNEsyq69L2lXqHu4b7lXLOaCaTTIKDDlVesEU1aztVU0wgNt86UQbjH.8pUDxISeCkfHaaBjdX9Rc.QiIh8IXO3uhfFKKluJwepKOHJnF0NpRhe9gS.SryhYaD2leEsvkRKRWcC8.g_mRMOWdWmPJh927MGNbGf9zZNMWJWKL2G
1275.ru/	1970-01-21 09:46:58	Name: _pk_id.97eED41Ee1b3d80.a7b8 Value: f775001380cc80a9.1729263482.
1275.ru/	1970-01-21 00:21:05	Name: _pk_ses.97eED41Ee1b3d80.a7b8 Value: 1
.yandex.com/	1970-01-21 09:06:39	Name: yashr Value: 3464949061729263483
.mc.yandex.com/	1970-01-21 00:21:04	Name: sync_cookie_csrf Value: 1824322278fake
.mc.yandex.ru/	1970-01-21 00:21:04	Name: sync_cookie_csrf Value: 1852156593fake
.yandex.com/	1970-01-21 09:06:39	Name: yandexuid Value: 8475002531729263481
.yandex.com/	1970-01-21 09:06:39	Name: yuidss Value: 8475002531729263481
.yandex.com/	1970-01-21 09:57:03	Name: i Value: /JtNV8uYebAgnmK9ogoKNK5eK2qxvLk4U5Jo7upBMnBSgbKS9tPFNDKTtPanzztTy6g5NhWgW3TZrEm5KiiTP4Yu30s=
.yandex.com/	1970-01-21 09:57:03	Name: yp Value: 1729349884.yu.1808501381729263483
.mc.yandex.com/	1970-01-21 00:22:29	Name: sync_cookie_ok Value: synced
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 765825701729263484
.yandex.com/	1970-01-21 09:06:39	Name: ymex Value: 1731855484.oyu.1808501381729263483#1760799484.yrts.1729263484
.yandex.com/	1970-01-21 09:06:39	Name: receive-cookie-deprecation Value: 1
.yandex.com/	1970-01-21 09:57:03	Name: bh Value: KgI/MGD87sm4Bg==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1275.ru
mc.yandex.com
mc.yandex.ru
static.cloudflareinsights.com
waos-soft.ru
yandex.ru
yastatic.net
172.67.140.84
172.67.190.175
2606:4700:3032::ac43:8c54
2606:4700::6810:4f49
2a02:6b8:20::215
2a02:6b8::1:119
2a02:6b8:a::a
033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9
07aaa9bdc0704502910c4cb27c3341071dabb77a24321040ff3176d240c11d3c
17df1f2891553baf6c74c4eef8cd0dd9fb73a5669f9f89d67183a8bfe41acfd2
255df06063ef8b4f994c1ae9d232d7c4f27c95b853a68fd9c03e31f4dd6b0031
2bbabc3fc5cb35e72ae28b9ba540bcacfe239d8cb2ed3ed98fe5a91ede61cda9
2ec58cb4a348452b2adb64330901dc3ed98b3bf4f049f7e3e1f88f9256d9434c
2fdf5f9a856940c379e8cc777e289f5b58d179a3edb5ef3e1e0cff46f7dd670c
30d219fdd2c143bf6199edb608a596f51e3bb692e5cd8803057a0c478a9140a3
34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55
3861cea1444a813c2b0a77ecd0dfbc51eb6bd05bb70774020251035b015f4d8c
401503518894f575673732c689a7885c78bb615900c0c3f726765eb4ce6aa799
4192547933c47032776c86cc04805a86655e4580d0c82b46787a120fcd96c146
45a39f3672038dcd48e688162ad8b57642f4a9dd841d09fc4cbbc8af34753013
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
6b5acb20b58ca9f25a996cd5f44fcbde42154bb94cd95666197a59d4b539f07d
6e9cca040634f071c068f7f483dfeef82d8589b4082c8cbdc5301951647ba71b
78f67c3bbdda3b2949c65332c159112791cac70da89703ca80cfe2ecb89c6156
7aaae88378467fa7bd1c36beb6c3066dad69411f082e4b98e85c3ddef7953e51
8301b3e2dfc5d2b692fa51d5170d81e93c92c5e0c7fc6b5276e976f9b6cd4e84
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
973408bd1a1da181c7eaa9293c0cd095f3836a76b626bc76af21e1cd96b5dcde
a2f1b190e5d5a3063c35b75b1a00c039b13e171eb7b099299dcb67e9e4fe65cd
a6c09741e43f1617562fd9c756ae4a0a49c031b32fba87faa1a48a86577df11d
a9501cc809fac65ba3bc7fdc1686f8cc6651018b290308eddd1e46454063bf5f
b3f3db2e6ac9e2b19172879a80a8605f4db7a179745be21a0828e3c1e49510ee
b52b9d2d403536398c9a51e98b4614c1394b1657b66403a1848d9a9f543ab772
b6898945c1cd627102a395524e84b7b9a80cdce29286005498fd9710c69764df
b7b3eb8264265e07709f4030c4755849823311c6da4d43ffc4c32e828c8aec04
bfdd0e2fcc611551ef6666080caca9d06e90980a5fdbe76ccd1662786021d6a3
c420f32b3ac8ca4dad29c471fd2149bf221ac03740c7816154c9703b38f6907c
d5aab9ecebd2bc2f003980fdde59b97aad0fd105312d99fa50fcab580099aaf3
d66395613fd6f42b17472b2c1b98444f569d0cd638001781bd7f989f2a092ebd
d73c2f35cf104b9eec6c97b351fd1bb05bc19c11a253d8f9cd191671d45460af
d913cbed84d37080dc6aa446c41f76b3a230ac810af1199d6350779882807edf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f54390b0c1c749338331697a88951d7ea5c699dce8c54e1fade8cf6769a88f36
fb14a624ac86d57c77560f41fef4a027f1c97625fe7a59500346f6a5eb63ebd1
fd057d7db4c5263a87501a7d8a59729dcaa1496e669def1f418cae4c817a1a8f
fde30968056d44b85605ca3f68a6c1a82cd3b4458570a1ba225e33dcad1c34cb

1275.ru Open in urlscan Pro 2606:4700:3032::ac43:8c54 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

39 Requests

92 %HTTPS

71 %IPv6

6 Domains

7 Subdomains

8 IPs

2 Countries

638 kBTransfer

2106 kBSize

20 Cookies

2 Outgoing links

Redirected requests

39 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

1275.ru Open in urlscan Pro
2606:4700:3032::ac43:8c54 Public Scan

Screenshot
Live screenshot

Full Image

39
Requests

92 %
HTTPS

71 %
IPv6

6
Domains

7
Subdomains

8
IPs

2
Countries

638 kB
Transfer

2106 kB
Size

20
Cookies

39 HTTP transactions
9 data transactions