1275.ru Open in urlscan Pro
2606:4700:3030::6815:5ed7 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
Submission: On August 20 via api (August 20th 2024, 3:08:38 pm UTC) from US — Scanned from US

Summary HTTP 40 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 6 domains to perform 40 HTTP transactions. The main IP is 2606:4700:3030::6815:5ed7, located in United States and belongs to CLOUDFLARENET, US. The main domain is 1275.ru.
TLS certificate: Issued by WE1 on July 15th 2024. Valid for: 3 months.

This is the only time 1275.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	2606:4700:303... 2606:4700:3030::6815:5ed7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a02:6b8:a::a 2a02:6b8:a::a	13238 (YANDEX) (YANDEX)
1 12	172.67.140.84 172.67.140.84	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.190.175 172.67.190.175	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a02:6b8:20::215 2a02:6b8:20::215	13238 (YANDEX) (YANDEX)
3 10	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
40	8

10 2606:4700:3030::6815:5ed7 (United States)

ASN13335 (CLOUDFLARENET, US)

1275.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:6b8:a::a (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)

yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.67.140.84 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

1275.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.190.175 (United States)

ASN13335 (CLOUDFLARENET, US)

waos-soft.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:6b8:20::215 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)

yastatic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a02:6b8::1:119 (Moscow, Russian Federation) 3 redirects

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	1275.ru 1 redirects 1275.ru	315 KB
8	yandex.com 2 redirects mc.yandex.com — Cisco Umbrella Rank: 6787	4 KB
6	yastatic.net yastatic.net — Cisco Umbrella Rank: 4613	190 KB
5	yandex.ru 1 redirects yandex.ru — Cisco Umbrella Rank: 1074 mc.yandex.ru — Cisco Umbrella Rank: 2503	163 KB
2	waos-soft.ru waos-soft.ru	23 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1223	7 KB
40	6

	Domain	Requested by
22	1275.ru	1 redirects 1275.ru static.cloudflareinsights.com
8	mc.yandex.com	2 redirects 1275.ru mc.yandex.ru
6	yastatic.net	yandex.ru
3	yandex.ru	1275.ru yandex.ru
2	mc.yandex.ru	1 redirects yandex.ru
2	waos-soft.ru	1275.ru waos-soft.ru
1	static.cloudflareinsights.com	1275.ru
40	7

This site contains links to these domains. Also see Links.

Domain
g-soft.info

Subject Issuer	Validity	Valid
1275.ru WE1	`2024-07-15` - `2024-10-13`	3 months	crt.sh
*.xn--d1acpjx3f.xn--p1ai GlobalSign ECC OV SSL CA 2018	`2024-07-12` - `2025-01-09`	6 months	crt.sh
cloudflareinsights.com WE1	`2024-07-06` - `2024-10-04`	3 months	crt.sh
waos-soft.ru WE1	`2024-07-04` - `2024-10-02`	3 months	crt.sh
*.yastatic-net.ru GlobalSign ECC OV SSL CA 2018	`2024-07-09` - `2025-02-08`	7 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2024-05-23` - `2024-11-02`	5 months	crt.sh

This page contains 3 frames:

Primary Page: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
Frame ID: 0DF75ACD724D059E6AFDC44745B2BA67
Requests: 46 HTTP requests in this frame

Frame: https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/6790c32b9fc9/main.js
Frame ID: 474264E9EE362BC1B67D94A9FF375B2F
Requests: 2 HTTP requests in this frame

Frame: https://mc.yandex.com/metrika/metrika_match.html
Frame ID: C659593FAD127AC642BF68E4E83B9F43
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Lifting Zmiy APT IOCs - SEC-1275-1

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Page Statistics

40
Requests

93 %
HTTPS

71 %
IPv6

6
Domains

7
Subdomains

8
IPs

2
Countries

700 kB
Transfer

2212 kB
Size

19
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://g-soft.info/
Title: General Software

Search URL Search Domain Scan URL

URL: https://g-soft.info/feedback/
Title: Обратная связь

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

https://1275.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/6790c32b9fc9/main.js

Request Chain 40

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10467.x3zl4kFCZV7tGTtMcPN5n6ij9duLE_XttvSjM-8_jLi3pNl1kpacf_uLtNutiOQt.p2k3Ss42eeEhnDhpQvom7rhArnw%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10467.p_xgF5ktivuASxc_YNWR51Qj_cJzlbPsq2Pnk1RbtqzSVhjl8SNFRRZ-AL3gt-7tNWca8kpYyzI72T7ze4xlP8NepNHM6_Rhk9_pf3mnmjaRaRF5nMFWo4a3St4TKeGf4CiIleHv7-Ay6G_EZRWMqJSDPbBnkY9uEZ5QAn44Cx1Ce8eS6FVvv-HSQUw-mLvJquTPpPHlm712qf16qzURCxTfo08MmNkQzt6g_68u_34%2C.p__8Fg-ca8oqeOCoeRnJedgB6zI%2C

Request Chain 42

https://mc.yandex.com/watch/1788970?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A5hhtndq4m7gdrr9ncc0y4hs3h7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1410%3Acn%3A1%3Adp%3A0%3Als%3A1653917653514%3Ahid%3A549223940%3Az%3A-600%3Ai%3A20240820050834%3Aet%3A1724166514%3Ac%3A1%3Arn%3A240842279%3Au%3A1724166514884118485%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1724166508538%3Arqnl%3A1%3Ast%3A1724166515%3At%3ALifting%20Zmiy%20APT%20IOCs%20-%20SEC-1275-1&t=clc(0-0-0)aw(1)rcm(1)cdl(na)eco(565312)ti(1) HTTP 302
https://mc.yandex.com/watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A5hhtndq4m7gdrr9ncc0y4hs3h7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1410%3Acn%3A1%3Adp%3A0%3Als%3A1653917653514%3Ahid%3A549223940%3Az%3A-600%3Ai%3A20240820050834%3Aet%3A1724166514%3Ac%3A1%3Arn%3A240842279%3Au%3A1724166514884118485%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1724166508538%3Arqnl%3A1%3Ast%3A1724166515%3At%3ALifting%20Zmiy%20APT%20IOCs%20-%20SEC-1275-1&t=clc%280-0-0%29aw%281%29rcm%281%29cdl%28na%29eco%28565312%29ti%281%29

40 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
1275.ru/ioc/3619/lifting-zmiy-apt-iocs/ 51 KB
16 KB 757ms
515ms Document
text/html 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

81f7a0f38e6f900023a1d75f0b1417721e1ee06ea456d7975de4dc1f0d814011

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8b634c87fe4b8dee-MIA
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Tue, 20 Aug 2024 15:08:29 GMT
last-modified: Tue, 20 Aug 2024 08:31:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tQKQJm1LNtZmgmv4KM87fjbuvL4czCPDt%2FFtaSrbt1s3fii%2B6JcNZj4yYKTfyF6b%2BzxVoe%2Fz0b416xLKkO7eO1wZ%2BS45T4q96tnVn6QG0XnvIJrZ32c5k9MAlexF7BhiB9wW68io"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
wpo-cache-status: cached
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H2 200 cleantalk-public.min.css
1275.ru/wp-content/plugins/cleantalk-spam-protect/css/ 3 KB
1 KB 124ms
106ms Stylesheet
text/css 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/plugins/cleantalk-spam-protect/css/cleantalk-public.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49681cf629185b67be2aa28ab7a821f4fbd9dad0d38e19928401818aa2914f0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
content-encoding: zstd
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Thu, 08 Aug 2024 05:55:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VMPtGC88xLEOroeFb09iMUlpuzHLn3kSRctslJ0mE33QjZIlTgB6KY%2BUVH7UhMwQVu4Jm2huKf5pY9cP9YZ0xP0lZ4nCj3mwIrsXCXFa7PTus0KduOAE2fPlS0Gx8mMa7cthM7v%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634c8d9c1c8dee-MIA

GET
H2 200 screen.min.css
1275.ru/wp-content/plugins/easy-table-of-contents/assets/css/ 6 KB
2 KB 125ms
108ms Stylesheet
text/css 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6ae8dbff96469621efbc79f5d44c1f6d6c13460ed12e34e826af9b0308424aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
content-encoding: zstd
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Sun, 21 Jul 2024 07:33:21 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8kwMGjMlKxQPE8XEkZPIHA8GXkxGcDhibaA2Cv4khg3n6fv5Yr9PtO5ncmkFVu%2BGmkFQYywnraBP5U%2FUlXvaTb1sBGeV2bsPqp5182mPNEjjLi7Ii8oaDljx%2FRWjmsngtf5bZFZf"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634c8d9c1d8dee-MIA

GET
H2 200 a3_lazy_load.min.css
1275.ru/wp-content/uploads/sass/ 127 B
386 B 122ms
106ms Stylesheet
text/css 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/uploads/sass/a3_lazy_load.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2f1b190e5d5a3063c35b75b1a00c039b13e171eb7b099299dcb67e9e4fe65cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
content-encoding: zstd
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Thu, 23 Mar 2023 18:32:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JDiUmqqcpUzoi88JzHjUJMx6MVRS%2B1vJmAZDjqYZWYcgzSIVWgVSkwL%2Fj1zpRBMkf4nouQepkxIh1nN14zoI8fkQ2ed5AWIz%2BPSRWFmpLgftdwLBiAdYQ%2BsWdusLxp2rLKVhdGi%2B"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634c8d9c1f8dee-MIA

GET
H2 200 wpo-minify-header-df171ca3.min.css
1275.ru/wp-content/cache/wpo-minify/1723525318/assets/ 260 KB
49 KB 124ms
107ms Stylesheet
text/css 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1723525318/assets/wpo-minify-header-df171ca3.min.css

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d73c2f35cf104b9eec6c97b351fd1bb05bc19c11a253d8f9cd191671d45460af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
content-encoding: zstd
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Tue, 13 Aug 2024 05:03:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SpASdZP%2BGgvNN6NL6nlxo00qvpAP1S42kuo6eE83%2FqIAfngQm%2B3T7sKLIfypkGPRkssb8fvGajHmmtcpwB%2BGEQZYU3LaCmSQH4olbxI8bWQh4xYVfq4jp4lEjMx3UvmpqOWLs7Ig"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634c8d9c228dee-MIA

GET
H2 200 wpo-minify-header-14b4240f.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1723525318/assets/ 182 KB
58 KB 123ms
107ms Script
application/javascript 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1723525318/assets/wpo-minify-header-14b4240f.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00685798a2be74d85eb048b2ad280413434fe055a0d61cc0673cd06b5a414f32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
content-encoding: zstd
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Tue, 13 Aug 2024 05:03:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y9I2bAno6F50c%2B1AdACFLp7Wn2EqitGZs5hfTym%2B%2B%2BAywEY8HCnBLkg3NFj5JqGoftT6PIVzo667lCnNvULjNzRK8UgV8qpWegfhOaMLHnz%2BpeeG1%2Bf8g7ydYPw2W9DxirO7Kenb"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634c8d9c238dee-MIA

GET
H2 200 context.js Show response
yandex.ru/ads/system/ 367 KB
105 KB 1254ms
205ms Script
text/javascript 2a02:6b8:a::a
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/system/context.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

43b2d78c3171c07f14fdcf811e1bb5857e7969f545bec24405d16e2b374f5654

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: br
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
etag: "0c5c3f95f4c00adddceb8e8bbb1c4078-1090447"
x-yandex-req-id: 1724166511198542-13799972441155770971-balancer-l7leveler-kubr-yp-vla-247-BAL
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Tue, 20 Aug 2024 16:08:31 GMT

GET
H2 200 wpshop-core.ttf
1275.ru/wp-content/themes/reboot/assets/fonts/ 57 KB
27 KB 122ms
106ms Font
font/ttf 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/themes/reboot/assets/fonts/wpshop-core.ttf

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

973408bd1a1da181c7eaa9293c0cd095f3836a76b626bc76af21e1cd96b5dcde

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
content-encoding: zstd
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Tue, 13 Aug 2024 05:01:08 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RfFkZnNr%2BGBCkBMVgLliPoCNacqM6IhpOoHN4ND2t%2B%2Bc2JQHZ2KuuiBpJu4AKI3yh1SpmvyU%2Bgi1qaofSBXu%2BSZCwpQQ%2BhYU0YZHwYS1tj8sSZNHEE7mk1Cgl4R7Sa%2FiJ46JFlZw"}],"group":"cf-nel","max_age":604800}
content-type: font/ttf
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634c8d9c248dee-MIA

GET
H2 200 cropped-54925859_transparent.png.webp
1275.ru/wp-content/uploads/2024/06/ 16 KB
16 KB 123ms
108ms Image
image/webp 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/uploads/2024/06/cropped-54925859_transparent.png.webp

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6898945c1cd627102a395524e84b7b9a80cdce29286005498fd9710c69764df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
alt-svc: h3=":443"; ma=86400
content-length: 16060
x-xss-protection: 1
last-modified: Thu, 06 Jun 2024 09:30:54 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KQy%2Fd8trQvOCdZ2dpOAeezn8bBRsLKHpf4xz07rcItdzL0I9sed050aiQjuh%2BGx4qSmohXpnMiIBy%2F7uSUDw13QKBeFRD04P4eudVdYEuPT%2Bi%2FyRZ2dZLJx1OWIkQC563n2Ts1AK"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8b634c8d9c278dee-MIA

GET
H2 200 security.jpg.webp
1275.ru/wp-content/uploads/2022/07/ 52 KB
52 KB 123ms
108ms Image
image/webp 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/uploads/2022/07/security.jpg.webp

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5178676c00ad6f11e9f3a1dff9d68ae2151b96036ba549e77eda6b236e903870

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
alt-svc: h3=":443"; ma=86400
content-length: 52882
x-xss-protection: 1
last-modified: Thu, 23 Mar 2023 18:32:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9pn3X%2BoRWqStRYrOTfI96wF9VSu4LtmV0f87DjKBlLO9SDBWjRMy095OiKDqRlh9at2O2MGPpomnLXprIyMSdnQDXKjFVimdyE8rnCNKZsocAsf%2B8ZNH4VaFJcNGxydqVEAW1yWn"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8b634c8d9c268dee-MIA

GET
H2 200 lazy_placeholder.gif
1275.ru/wp-content/plugins/a3-lazy-load/assets/images/ 42 B
372 B 122ms
107ms Image
image/gif 2606:4700:3030::6815:5ed7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/plugins/a3-lazy-load/assets/images/lazy_placeholder.gif

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:5ed7 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
alt-svc: h3=":443"; ma=86400
content-length: 42
x-xss-protection: 1
last-modified: Mon, 15 Jul 2024 15:29:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iPCBEuImbPga8ehLn7wLzAE8vBfGkEaR7Fr%2FkhJm3qBqb1AIGGywoueCNQz3VGcax%2BmhrTHjFYPP07buRBiO8ORQ1w63gGQNEi5QMtVgjjFZ94uOj45W6Bb5Asm7Bge14E76Bjit"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8b634c8d9c298dee-MIA

GET
H3 200 wpo-minify-footer-9ad13251.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1723525318/assets/ 64 KB
14 KB 75ms
67ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1723525318/assets/wpo-minify-footer-9ad13251.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd057d7db4c5263a87501a7d8a59729dcaa1496e669def1f418cae4c817a1a8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Tue, 13 Aug 2024 05:03:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MaF6XIE8hXCBNBND%2FpUwH90fgUME7uGMjVN9nOyg22tQDikDzsk9ZKeTdSW9uEugSzAuRO6rlyFklNAkxC9MmA0ytQwwJe21Z4c4E2J7qhSM892O7AzTJWBf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634c8e6efda4f4-MIA
priority: u=2,i=?0

GET
H3 200 wpo-minify-footer-65360760.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1723525318/assets/ 3 KB
2 KB 60ms
48ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1723525318/assets/wpo-minify-footer-65360760.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c420f32b3ac8ca4dad29c471fd2149bf221ac03740c7816154c9703b38f6907c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:30 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4967
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Tue, 13 Aug 2024 05:03:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dOcFnK5DmM6gENo2aH%2BXUM2cORYtV%2BPPH%2FWggiNy26qQG4Y8wjKkdMbAJ4U1Nel1fhGlwaNUDiqGhMQ%2BK1wNWH8Q7UsY4gNe9RFKd4%2FjCxcFWF8zyPdYmcNq"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634c9029e2a4f4-MIA
priority: u=3,i=?0

GET
H3 200 wpo-minify-footer-3c86297b.min.js Show response
1275.ru/wp-content/cache/wpo-minify/1723525318/assets/ 28 KB
8 KB 72ms
68ms Script
application/javascript 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/cache/wpo-minify/1723525318/assets/wpo-minify-footer-3c86297b.min.js

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9387807e98875575d1c4f5c12d5b0088c30f9f16cd72d63306db0d841e3a8609

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4966
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Tue, 13 Aug 2024 05:03:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CfuDgK%2FC2s45OtW3yXJt2qwSd4T6Ek1jG5Q%2Bt4MiyEhaP8EJMXBaj9US2Ien9vNOJofqz%2B9sUGLz5PhBYsOwgkoh9Lx6MXuIGJTLoICMS2fqCrKp4m%2Faw1no"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634c8f284fa4f4-MIA
priority: u=2,i=?0

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ 19 KB
7 KB 381ms
139ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

Referer: https://1275.ru/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:30 GMT
content-encoding: gzip
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
server: cloudflare
etag: W/"2024.6.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8b634c91ef35a576-MIA

GET
H3 200 security.jpg
1275.ru/wp-content/uploads/2022/07/ 0
57 KB 168ms
166ms Other
image/jpeg 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-content/uploads/2022/07/security.jpg

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:30 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4967
alt-svc: h3=":443"; ma=86400
content-length: 58020
x-xss-protection: 1
last-modified: Thu, 23 Mar 2023 18:32:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y5%2F7ln1JxnkU%2Ft8krtvYe71R%2F8H9UkPQGXL7MXdjK5olhQRpUFTs79GjCnnm393bkK7yQNg2OJcD32nsbq8oiOHyyeio%2BVnpWMZSoQ1loQvYDRJ0HbwySFtl"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8b634c90eae9a4f4-MIA
link: <https://1275.ru/wp-content/uploads/2022/07/security.jpg>; rel="canonical"
priority: u=4,i

GET
H3 200 matomo.js Show response
waos-soft.ru/ 67 KB
23 KB 276ms
51ms Script
application/javascript 172.67.190.175
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://waos-soft.ru/matomo.js
Requested by: Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.175 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a77ab6376bf1e6fa1182199bec8be63db1cd7cd0fdf0ec8dfcd3ba28f9845c5

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:30 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 16 Aug 2024 05:35:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4966
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SYoAjIVgK9eZap%2F92%2BmpQvGEbgdEFpCvppm%2BPU1DC7YEFUe9DKKLvECe5Gij28Dgck6B4S1kUVz%2BnNcRnaH74i%2BgIbKbb804NJ4Wk5PbdPr3q9jPjcu8y3dMyJJyGSU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 8b634c91dca6a689-MIA
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 969 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 401503518894f575673732c689a7885c78bb615900c0c3f726765eb4ce6aa799

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 290 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5aab9ecebd2bc2f003980fdde59b97aad0fd105312d99fa50fcab580099aaf3

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17df1f2891553baf6c74c4eef8cd0dd9fb73a5669f9f89d67183a8bfe41acfd2

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 626 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6e9cca040634f071c068f7f483dfeef82d8589b4082c8cbdc5301951647ba71b

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 544 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 255df06063ef8b4f994c1ae9d232d7c4f27c95b853a68fd9c03e31f4dd6b0031

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4192547933c47032776c86cc04805a86655e4580d0c82b46787a120fcd96c146

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b3f3db2e6ac9e2b19172879a80a8605f4db7a179745be21a0828e3c1e49510ee

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 624 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b5acb20b58ca9f25a996cd5f44fcbde42154bb94cd95666197a59d4b539f07d

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a9501cc809fac65ba3bc7fdc1686f8cc6651018b290308eddd1e46454063bf5f

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H3 200 admin-ajax.php Show response
1275.ru/wp-admin/ 1 B
623 B 740ms
735ms XHR
text/html 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/wp-admin/admin-ajax.php

Requested by

Host: 1275.ru
URL: https://1275.ru/wp-content/cache/wpo-minify/1723525318/assets/wpo-minify-header-14b4240f.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryRt26TTi2aPMAuT5K

Response headers

cf-edge-cache: cache,platform=wordpress
date: Tue, 20 Aug 2024 15:08:31 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jaMwM%2BAYq%2FiBGaCOKy6xNZXO03uHGrk%2BtCZA0K1FJtzuW1zK5vgVBcW6I7ONpXo%2FOB%2FPvfVIdM4F9H53IvTEpJvsgJ4XQb8xJp2G66RJq8yd6Bru45kkNUI1"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://1275.ru
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
cf-ray: 8b634c930dfda4f4-MIA
priority: u=1,i
expires: Wed, 11 Jan 1984 05:00:00 GMT

POST
H3 204 / Show response
1275.ru/ 0
480 B 698ms
693ms Fetch 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/

Requested by

Host: 1275.ru
URL: https://1275.ru/wp-content/cache/wpo-minify/1723525318/assets/wpo-minify-footer-9ad13251.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Cache-Control: no-cache
Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

cf-edge-cache: cache,platform=wordpress
date: Tue, 20 Aug 2024 15:08:31 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gV43%2BW7d27aRq9JdgqLsL4Gojb0P4BGaKYD0DJLhEv6OKxF9XbAV%2Bj%2BOW%2B1iw%2Fpx%2FlLZx5rAB8bRmn4VOGfmMGbMUsek1WWVL0zpUfPJrEh9zLJBTCwSezZr"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=15, s-maxage=0
cf-ray: 8b634c930dfea4f4-MIA
alt-svc: h3=":443"; ma=86400
priority: u=1,i
x-xss-protection: 1

GET
H3

200

main.js Show response
1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/6790c32b9fc9/ Frame 4742
Redirect Chain

https://1275.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/6790c32b9fc9/main.js?

8 KB
4 KB

43ms
43ms

Script
application/javascript

172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/6790c32b9fc9/main.js?

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccbf2f4e5fbf785849fc7574c8e39c72fff9ec545d446bcaab031ccc9abb125f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:31 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cfFT49d8xi6PYFkqDsBanGsh8I7%2ByjWt%2BK%2FvzCEs6vgEMZLBudQ2%2F8ohlOB3GVOvGDWNV0gYdmPYNTm5V8wlKdVhflyisnA6RwWH%2B%2FsXLndG%2Fj4KgEdCoj3o"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray: 8b634c970bd1a4f4-MIA
alt-svc: h3=":443"; ma=86400
priority: u=3,i=?0

Redirect headers

date: Tue, 20 Aug 2024 15:08:30 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=17deBl2d7g6FnzAFLT5E56pfACIVY2mFaMf7XQBXJ0HXZHs0IvYIVRom3JO68PgWkUfsR4S5EKcDtedG3Pie203H5dq8JPadSLHVT5qe0f1CZ1tUZdDlCqW8"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/6790c32b9fc9/main.js?
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray: 8b634c931e03a4f4-MIA
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i=?0

GET
H3 200 rss.png.webp
1275.ru/wp-content/uploads/2024/07/ 3 KB
4 KB 49ms
49ms Image
image/webp 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://1275.ru/wp-content/uploads/2024/07/rss.png.webp

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57b706ad8e6cf27d0734cf87efeef7e4151e6ceb6eb92c854e719e1baf7c5e8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:30 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4967
alt-svc: h3=":443"; ma=86400
content-length: 3248
x-xss-protection: 1
last-modified: Tue, 23 Jul 2024 07:42:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BNdWo2wLUnuw6nuxU83IK2XWwkthHOo%2BLZHVQvKcg719fsI2YTA5UxxBUuh9%2Fkzf1E84PhTjl1xbECcxjjYpD4W1LCWnrJ0x8d8Gyj9%2B8qU17N22E0ZTeT6M"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8b634c937e98a4f4-MIA
priority: u=3,i

POST
H3 204 matomo.php
waos-soft.ru/ 0
379 B 395ms
391ms Ping
text/plain 172.67.190.175
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://waos-soft.ru/matomo.php?action_name=Lifting%20Zmiy%20APT%20IOCs%20-%20SEC-1275-1&idsite=97eED41Ee1b3d80&rec=1&r=294642&h=5&m=8&s=30&url=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&_id=805fc35e7179cbe2&_idn=1&send_image=0&_refts=0&pv_id=QMyVmE&pf_net=242&pf_srv=516&pf_tfr=364&pf_dm1=1173&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200
Requested by: Host: waos-soft.ru
URL: https://waos-soft.ru/matomo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.190.175 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Tue, 20 Aug 2024 15:08:31 GMT
content-encoding: none
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9vydD8zkx7kBw%2BbobM1704AQxLYiSWCgGP8hSyGfaa8JF8O%2BZ0%2BF7yj6WEjnlxaNURBqp%2Fgs8%2FtRddzU4SiEnjmeHfOFyJt3y1XlVk85DspTQhwXsogf5FdHadTAJAk%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8b634c939f23a689-MIA
alt-svc: h3=":443"; ma=86400

POST
H3 200 8b634c87fe4b8dee Show response
1275.ru/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 4742 0
989 B 50ms
44ms XHR
text/plain 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/challenge-platform/h/b/jsd/r/8b634c87fe4b8dee

Requested by

Host: 1275.ru
URL: https://1275.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 20 Aug 2024 15:08:31 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1rPmFBs95ORSV%2B2YWTXh%2BXAUmfAl43i8wFheoKOOVg6%2BvJDWdl4FqwOew8OBZPKlAjEeOYvu%2FMFNGI0%2FFRQ7W16oC2HutMX7F3WVw%2B7yJ9S0N%2Bo2ThV9%2BHmy"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 8b634c990f19a4f4-MIA
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=1,i

GET
H2 200 text-variable-full.woff2
yastatic.net/s3/home/fonts/ys/3/ 25 KB
26 KB 1040ms
371ms Font
font/woff2 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/s3/home/fonts/ys/3/text-variable-full.woff2

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://1275.ru/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 14:54:21 GMT
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 26004
x-amz-meta-owner: {"role":"admin","login":"4eb0da"}
last-modified: Mon, 25 Apr 2022 14:02:39 GMT
etag: "7f0cdaf91230f9789ca4162aedff612e"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: font/woff2
x-nginx-request-id: 2d10866f1f7b13ce
access-control-allow-origin: *
cache-control: public, max-age=31556952
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Aug 2025 20:57:44 GMT

GET
H2 200 d832394ca1a2f9bfd188.js Show response
yastatic.net/partner-code-bundles/1090447/ 43 KB
12 KB 1163ms
494ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1090447/d832394ca1a2f9bfd188.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

9e412b51cdf6a3a40d9b73b08bfc2fb4ed3bac0bd3a675c3fed7df77e6c13908

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://1275.ru/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=43200000; includeSubDomains;
content-encoding: br
date: Tue, 20 Aug 2024 14:14:22 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 12557
last-modified: Fri, 16 Aug 2024 19:44:54 GMT
etag: "5662a05fcb70f12b285535c0c1371cd9"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Thu, 20 Aug 2054 21:44:32 GMT

GET
H2 200 ae7ea46770da8a10ae1c.js Show response
yastatic.net/partner-code-bundles/1090447/ 24 KB
8 KB 1229ms
561ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1090447/ae7ea46770da8a10ae1c.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

40224b5e5c035530d53cc19a7392ff201afd08733a4bd9b78d7b65ae4086c626

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://1275.ru/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=43200000; includeSubDomains;
content-encoding: br
date: Tue, 20 Aug 2024 14:24:21 GMT
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 7945
last-modified: Fri, 16 Aug 2024 19:44:53 GMT
etag: "cfd8f9668efde98dbd2852e249e18d56"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
x-robots-tag: noindex, noarchive, nofollow
timing-allow-origin: *
expires: Thu, 20 Aug 2054 21:44:32 GMT

GET
H2 200 44513cae6a8d81775e51.js Show response
yastatic.net/partner-code-bundles/1090447/ 610 KB
111 KB 1298ms
629ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1090447/44513cae6a8d81775e51.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

73b97bfdfe358a9f5b3a0f58ebc73b0551f82ec1b1ce8544795b0b93bc45021f

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://1275.ru/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 14:24:21 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 113544
last-modified: Fri, 16 Aug 2024 19:44:53 GMT
etag: "a93fbd064796293240cf7fbcaee4d952"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Thu, 20 Aug 2054 21:44:32 GMT

GET
H2 200 host.js Show response
yastatic.net/safeframe-bundles/0.83/ 33 KB
9 KB 1565ms
897ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/safeframe-bundles/0.83/host.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://1275.ru/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 14:14:22 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 8878
last-modified: Wed, 03 Nov 2021 13:42:58 GMT
etag: "f80882bf67cf261aa08d636da095149a"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Thu, 20 Aug 2054 21:44:32 GMT

GET
H2 200 92a10f63d9aaad7bcd24.js Show response
yastatic.net/partner-code-bundles/1090447/ 122 KB
24 KB 1565ms
897ms Script
text/javascript 2a02:6b8:20::215
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yastatic.net/partner-code-bundles/1090447/92a10f63d9aaad7bcd24.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:20::215 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

df75746a57ad1c39a4e5661b2ea445bbf16b9100724361672d67553465d93e71

Security Headers

Name	Value
Strict-Transport-Security	max-age=43200000; includeSubDomains;

Request headers

Referer: https://1275.ru/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 14:34:21 GMT
content-encoding: br
strict-transport-security: max-age=43200000; includeSubDomains;
nel: {"report_to": "network-errors", "max_age": 7200, "success_fraction": 0.001, "failure_fraction": 0.01}
content-length: 24438
last-modified: Fri, 16 Aug 2024 19:44:53 GMT
etag: "8b7c03465f259dc91ba99b6e5f27ce1a"
vary: Accept-Encoding
report-to: { "group": "network-errors", "max_age": 7200, "endpoints": [ { "url": "https://dr.yandex.net/nel"}]}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=946708560
accept-ranges: bytes
timing-allow-origin: *
x-robots-tag: noindex, noarchive, nofollow
expires: Thu, 20 Aug 2054 21:44:32 GMT

GET
H2 200 1788970 Show response
yandex.ru/ads/meta/ 438 B
1 KB 231ms
230ms XHR
application/json 2a02:6b8:a::a
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/1788970?target-ref=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&pcode-version=1090447&pcodever=1090447&comboblock-unencoded-vast=1&ad-session-id=1752241724166512110&target-id=41112172&pcode-test-ids=918197%2C0%2C26%3B1071114%2C0%2C66%3B1078666%2C0%2C25%3B1034857%2C0%2C61%3B1076847%2C0%2C6%3B1076432%2C0%2C35%3B1077080%2C0%2C83%3B1065394%2C0%2C82%3B1035460%2C0%2C14%3B1071270%2C0%2C49%3B1083172%2C0%2C78%3B1087331%2C0%2C97%3B1082177%2C0%2C87%3B1059497%2C0%2C2%3B1037228%2C0%2C68%3B1082207%2C0%2C14%3B1078045%2C0%2C14%3B1051946%2C0%2C21%3B1085919%2C0%2C43%3B1090447%2C0%2C86&pcode-flags-map=eJy1WNly27gS%2FRc9R77cl7xBJCihxG1AULIy5UIpYyXxLS9TsZPJTcr%2Ffg9AaiFlk5nNL7JI9mGjl9On9WMSs4rMUiqjos6F5DRmnEZCspyU5eTtrz8mX7e3X3aTtxPBazp5M3naPT6xa3z3LcNxrMnz1ZvJilSyrqjM6lQwXqQp0HKh%2FqFcromIFjSWgmVUFklSUTGMa1uG7x9wORV8I4tc5lSsC76UlPOCDyO4nuOHGkG9tKiFLDnVfh09XLGYFrK934EzDfx18EI79I0RvFmdJDgtzUqxkSnLWB%2F0TyOuSsLif97DpMb%2FfxU1RyL%2BaU9fwfxb%2BXkZ89%2BLwF%2FNvqrwOSczmdJ8LhYdI%2FRXcGoWGIHhO0czKmRUV6LI5Coj5f5AckVStMMpkNc7VeC5tnfs3GpR1GmsPtaSRILhgLNaCHwwHJVES9zpHmf37fdTPNOwncA9ekYj%2BBQJAvuIUwJiaPEq9q7r2e3HLo7r%2BsHRMZprZkoLhIZejrjgOZ7naVPFRBsieS3jIiM4Q1JwSWIwyS81rUQ1yB0ACjwj6NBaTKqFzBR9iU1Je278dvvleie31x8evnVxfMeyjjTWulLk6UaFFdEZPo4fmEFj3UaBi5mckTxHlaUkn9dk3vekhxA4QXjMSSU0yoryCgnuFWfgmI7bs3YDMzwh4axYIY1sjmzMERCVXEGzasQFzwqPdV6SqlKtg0bRviAlqiCkKHQBj0AFgdWkVzddG4k6ZwnDbGG5oDwh0WBI3DCw2sGisjpb6tdXujwatlGJKbJZMYTi%2BaFjNCicYyit1YSqeS5JAh9klLJoKcWCF%2FV8MTylTNNwmhBXGeFCojprKullKWcpug40UnVq%2FtfJ3fbm9uLzF6D8b3t%2FvfuG%2F%2F9zc7f9uHvsXPq4vdNXrr%2Fv7pvHt19vnh6af%2B8uTr5c39%2B0VxXyAQEXPm%2B%2F3z58%2F9Te%2Fv65%2BfzyeXtxv%2Fvj8eyB%2F24f7m606VXniG7Q9gCmvoxpQpA8FMKcyrzOZpQPRdp3TbulyQ1B%2FQoWyYQi27O0QHgwcdYLFOELceJTNrWc0ASDTk1Ann63et%2Ft3ndHfydTy8U08K3WnkzdIHA8c2qahwsejuerF1x1SDr0zKZQkwrNUpQyYZdDxwxc2zZtbZHjjGgzkHBNUlWXGRFK%2Big1BQKUGc3rYSgntJqIqcKcl0JWEWflIHUGEFwtUcDjmFZLAaf3shARlpq5yhHCCUI0abiH4XRNeKxU3zljdsxCyzJO6BYvalu7qrjqhWFb23Eb24OK1e2HeCVMBa9PdWcArh3YB0bYg%2BwnqSKGuIhqhB2BFJwIOocUnVWUr4ZLN7Qctz3VK1SToDTUVBpxz9yTcIeftIJBZinN9YBCc3BdKCtWsRlLmTi4OYhvG27Q1Gr8bg%2B1pCkVY2EzA6vxa9%2FSCBcCREmmQUgKKmyL%2BcSlQwjpZZTWMfYFDt047KHnmG5nGC9IHitRwPJlm%2B1mvIs6Hzmsb7XFUpFMKYQ8ppftXB409A3fCztVVpQ0V%2FMYw6xEU2IYzup0OQgSuk47e%2FD4XC4oiYdLCOwTuJ6pTUi1yaNmPpya%2FJg87p4U353c1zpBz%2Be0QHW96d6jOLOuuu719kbvqtKlrwG8%2BgqWgzCaCyROisvebQSLsyVpts2zN0ZFsWR4SG2MLJ%2B%2F8lTJi4xV9OzFeqyo47de6p7pPdXrI61xodUR408Pj0%2BPKpjb29vJ1XMnE5BiYTupqxICu1JUHDMi10wsFFMc1mat79QDw6m1fGj5hivFgXawcKfFCr6xQmnfOAKDjsCA7Y%2FdccCpMGxPuUaJcN2L%2BIwW2mn1cJQSEN1IEVrYVY5HxyiTl4wg%2Fi%2Br6fPFwHJ992DeritKQrKEdGe24%2B622%2FemNw132w9Tx9%2Fa0%2Fe%2Bdz3dfnjvObjmXrtWZ9KqrSMMgpfAS8ojcPbpC4wLw3B%2FzjpK5t0uC01oNT%2B0Jm%2FNNxPbMKAjHcPEt%2BdXAFVf7KV20wzDUXJAME2UIkw9xJVv5Jxl2YjCx7BvV56jWTObphUSP2zsGlarU9TxlVzQwlqybESJu6bnGN1m0KrsNTHm2SEOaLu95Lm2YzVnXnNsr5mS8GCcVJK8Wo9VpRu6pnUqmVimmn9EaWG3s32%2Fv6cSSPWKpphOIHMMVazzIyCebTV5Vr2qX4z%2BpxWbYwATzki38iZ%2F3Dx9mn69ud49nC2atvsyzogD54alokyZjtSZF%2Bwn2YEHxZycqolW%2FnVgfv%2FGsBfcPz32wML9zq%2FqgBfrn%2FTet%2Fx2rCm7xnEIg2iJfulWjm2YFircVasp%2FvccVEy%2FjLDltmWsWu6oNdDIc8yAF5jA7Nnvm5ZnEGVkPrbShn6w32hyQlfSHBz7JrZov1dwGJwkjve%2FCFRpv1V%2Fe7o9%2F3XlCIKTqTW6mJH2qLpvy5T1msa4MHuB9wLnCFPVIIqNbnyAzTnFcj4jI33ne47d6btFTdaUSSuQgmZlCnk3fBT%2FMPh6k1j%2F%2BoQ9OE0xVPbO4S6JSanflBU47gi659r7nzw0eleVcprglIsxbrFdxzNeBDkAHDaEZudvp2yBANBuACz1g%2BKfRs%2FI5WG8Nhro9fo94iGBNI%2BQkoKzd1gYQaXNKjWSEdNql%2BwDifGs1JQ%2B0gm26Te1EOkexoKqRH8qYzVOlTKv5Moafjl2T9vsSGuWcKXOExTCjLTifuDHmXNEyzz5jackG7286f2V98TKx8%2Fb6xvwWn%2B0OG3HqiZVieZyprcNUWjpOeIA1ox2OhztX7Q8L7yD5T6VqPh0VkAGvpTJ84RglfY79tUvNeH0p4z9wHDcg9va26iIWzGp41dUutatkclsho53IJmTydLubRE%2BMa9Qo8jL%2BYJ%2Bnk83bFfgUvnT37tNA%2BICrNaxaS49Xz3%2FH9fdy98%3D&pcode-icookie=ZNfbLhdRmGeH1rJAF4PRGQlmKIesOEMZHubNMcIcHc8VDDk6QPjj8jUTnLff9kl6L%2FL0xsaNnRjr4Zwmuhet6LikVik%3D&imp-id=1&charset=utf-8&test-tag=500827546451970&tga-with-creatives=1&top-ancestor=https%3A%2F%2F1275.ru&top-ancestor-undetermined=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A1%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1050%2C%22top%22%3A303%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A0%7D&grab-orig-len=5120&grab=eyJncmFiX3ZlcnNpb24iOjJ9ClKlkowjuY0B1NeBTVRL1J9_Pv-oy1SXpU6iTpw4iyZoW61VPjN_O5ag59OpyQI2aRNMUAOJajR4K1qd2Ab6y9qla9qugJ4I4BoW5p_-02hNqkVtR9DCzMLCIrDAwnRmEjyVwyUmwcutEJOousrNxJDqhqqz8UOA4eg4IRFEEISQQUzIDPkhAXJCvj_74PskKKIwEk5WW8hunAw1acnMqum4qs5ik4aVxVYzW4WaFCiKkqIgJkERWTBZBSes3MZkQk2Ky2KqfDVzcLlNzfySjcbgqiHzRblZgeSv4HCh9cL3HN-SGwZL4zSVz1QbuzSthODi8jPHzIWvZSYui83UkWz1ks2m8TUdH08lJSYpOhKZFaau5rcbFQRSHZfP1dlIw1MvZ_Yrt5K1pwjOudGBo2PSwKJj0uHRENMxQjrQIQ1MOjodQWoBQ8emw6Zj0EAkQdFibLImYpmvdA0dnFzQpK7I8HU2e8UyuFzygk3tNDs9oqwC3YhFLj0jKFJHBJWgGVy5KCezGa_O1ROfXBmaruJEXtuMjbuQoouEwX2OzdS55AUwdXx2UxkPBIU0JI0LbtMyRQdKKIgounQATFGDQ8egw6aBIkmhYHDFtJZproSTmZtW8UgpKRLl0ERPeRRqnlckouMFErLsKd0uzWk6W8gr9Zum6vU_q7_c3jSCkgXKUtTHxM8kUCoOriL_y6gMJh-XYXJ1Jl5IcQ68xuRHY8ZjcEx20--nmzE-S8Ph66waqg2f33DVBMGNtsYHe21t-0wW91bvag2HKV-XidvYMtSdD2g63L8G65_BpoHwe9AQ39vxJICjY0dfC3hTXx37MmSqgefLlHgUn1-abFIyO3xX-sJwRN46p-HnGNINlQQWGTJq-ElRSZniybHWLqbCVyBfWlp7NPLcZuYzTAeeDouGiA7sQ4tBB_oWgJVijC4zqOqcTBxYvKDzZjDdHbD3gTpl5aVnCJeYYN0buhASASxBuGG4-8E8u9h0-DRQEpuYdzeY9zIdfQd47RljJxf7W4v9sV0_Lj_0xA_jm7o8MOiYIR1h6iH6nGLTwFo3vSDmBdwmVwYjpIGWGEQst9FfGGH0AR3-ZQG3rKKMS4i1rNBAlevTQH-B9xHRYR0gOh0eyjDxXZGp3DbDRG-gQ5EHeCEdQFbwLQF9T7nUTLQHkwb6OQMTOdBADs8E5kOBuZVPIVhLuX9NFokgpY2RzhTSEaSsEUa2hImGCRJBYjslGGmISYcTEuDlUuREUQpT26AjXmdsdCXvn4VUES4N5BdFF5ZM05ks-GzA2RRf_qJTglsS6EuDcglQkhiF3ghSEOCE6aQIDggnUQmdDuyDgnHKJJntwk_UT7RJ_XVJisqyAanOZoDDI0GBK7gk2HyVVflIJrIAmWMju5GxGL-hxsfTvxNfLpxQEa3Iy6DwtSyWZatfxXMtupZrIvmTZTpZhSRkP0JWeEhKDEEzD8EyQsJo-MyUSDRqdktKVNHulPWTVlHA7BzsKvqCiaZUzkC-_iQlhuya6WPF0pgxVQ6uxuLozKg8YThn70UhQuLCQO4uKTGUrFXXTBjgNEiJIYFywABHh5SYAHIiHwb49cRvDodCm0hgk-cUbT8p_fv-h5AOaKpp3QbSaK4NkDFOuCsYUbLKneuVhU1DRAMx2iIYypBFKwT6EIgW7OcW6yLg0kBMwwgiDbCRN9YrwY1mGbcaYVKHcNZUU_nba9zHFYowjT9mnKrtrV3BTqrtye2-JrBYIbQQQUoIDUrKBEQlsYTW9HRBDwkIiaAkQpmK7abvvj_6G-mULdZrg_A8EIdpdcGIex0H_fOe-CNKUy7eXR7lbmJRlQUGNWhxkoXsUhfrBeGmqXoL_a1vVQg-RBCH0C7Rhw5r6y1ZZ5mCvfo5rcKKPYEGeGgSzUCK5Bng6ABKB9Q1OGgpEWBpoKTRSezBP6tpGyLTKU7AJPV83RqHU6DlLhZWitLSHyM6YjUsgrhLKKn6fc-cNCuC3a8dAKwwCd0fA7tZhNcrXlJxq-ZiCA4SgRxoOCloC0qY_xOIQVz_y3obmxpRWYvAVYKMJW8KVatsJrAltmHJQN9RpmrJtWvwolsl_RUfGFWIojJXkx0KtGjw4uQpif5JtaBC9L_M2QUtOYyqrujwrl0AIlRULCbMqBmDjR4vBzuxj2gdt2eHuUoLo_mtYnvuoCoflE0kqUSxPpMfSmFT1CMuG5iJUcwNqpIjhBlJ1pg5JCCAXCGeg5QcD0sJXYoHSGd7-a1ZLDBD7FMCMEkvLYEQftQ76U9L5InJY6T4wV3ge9L_1sJiApEoi8Z2AKsYrUJ2TATWfWC0cOVZykgm4GKgRpI6rHTppRX5sETTPU8E67u1cInQS51U-S-PJ1-woGm40vNFucpkaYWZXw7kX44qGiMS-KLxIU492Eu65SvkKNiJIC0-9oMF_BJfk2OAicsb5xkzjR6WQuBKucXgKZuHksLcIkEuBT2a3Q0fSw49lR7xntgpAsCISEPkyEeUj0gbutFG_Qi71jA5ArAxSus_wX9TKGG6YGmXZCIRhkIa3B2XTV96NCrmi4FW-UbtDXOtJtvo0g6eAnv8C6g2bRWAslEpl7Tfkj5XVI9wLhNpggC31QyEOBvXB6gQT5fIj-cpJNmDlwmkfuDy5hg8x-H5nkUlX1M79oGQkm11Ucvm-bbP853Bs1yp4w2ePw-4QCanL25chGXxhveOQ67jiYW44yLdl_V5jku-cxGDXGeIOs7zeX6bmyd1hstz-5k6AHGV8aif_zh_NL0hyGU8FyfgveXbUutxP-V5freFOXYnxdz3XtUTdGbAczrPDQQta_J83-XZE23nAnwRc0rHtQQZKp1xtqagtuWssAN2ch3KBKkdEZVPi_4QODzHErbm6TdPMdRbvqDzFH1eF0egW7yHyz-t3Um21cU0sf9Q2-N5-1pxEG07hWvOQ_hT2PjXNoiemCYbmh_Z_UkCcY7Wn2td1LjMtMg1bJGIZ638kLL1c0_v3qS2ZnBP7xX7zy12xgz2dk_GCzYBqbF3vqDpzwUUNuyeWApErbWal9mSYse5m3WyUZ7Y5N6665e7Q9ncXw20TVsKwS1-T-Db1tKETEdy1OCtVZ_iAUV3illx9g6TZ-1mU3t9xIg-0l0S9bv7_mnmPy_xgZXO_Nk9QeuO-Dh7NkXPmUITsjf7e9Pi2VJW9u5gNDkpiHvB9dPlxWG1955nwxLa6B073aW8x7PEjK5Y3m60eA3fO5-0ZIGUvuXz9opzXy9d7idy3g7-Ccn9ey_vZjnFSe1TR5p4njhM4laf5FoeuZYtBu51nU0FsiLW01xWbVywdS638QwGm1qamdlMlibsMjRu1ngLT0hQKgElEZcLmlmrX-xij_p7Njs7Zr8Bu6ME066NWi8w3VLsPD0jVzMIDKd03y6mXy2vmzkokoXVWYdXXS8whmsM61Wr49VgGrl315DEub5pWWbQe2AEfjPMYgeu7RumY9i-_1Slt06vGNkr1cvdLb5jB1YPAnPkmqc57SYWZ2fLdZzs19GNajbXKr34brNGM23xetuO4VqmN2ozp2nVanSjeYGzgL2YJUsO7o5bDcd2ZjOKadtlPvReMMpX4OGX_GYaQWuvl-2a_Wz4_hhO0PPoOfidqkhcze7Ixe-GZfZut366-4Zre7MGuUnPzY7d3OpajpXNp2me4uXdD-bITTSn2dqomMHMo8ygObbrn0qObXnVK8VyBP-PcLJFZGrvxHsztzzOvu9VYwSeM5ynOVvgD99xLH92kTYahm3N06xVqzyR7HpuH9Nvow_XCuxyvva0Jcuad6BlPThBtYJim27OJ5_OVofVum_a7TTwnweVv2e9cOAWM89esmeZc_7iXnGLZRjFaIHl5jpcybPeg2V5htFKcee9OdwbzCntGdVtrj1cp1ktGNJbL94qnhV0w8wjB3b9j6dpmFb-ob1h3R9u9brE_LBznobpO32aXjNmMbtlddO0_Gp4zTy59A_ys_TOH9AdhuE4t_6SW7eMb7Dp9pmt0rJnBgc3hlg7m67lO8Y0ncftkc6BXx03cHx3BrbrGp7neJ47hnSJx7yZPajrhjbcp2T6j0TO5X_OB_nfmDdS6dcXOJtXR57Ds2spTm5Wd8cs1uWtNb6_yJAo_-OMxzqwW3mIvObXHNSg_EPP4YZQb-7TCDy090wwKEXn7ME_Zjw4I5-yP7jVvB7YhpfHTzkf55KN0c3aHuwzWZ9YYNh13Pq7Id380bwt9WH1K5EWGNU2jD7-rFPIL4FX-8s3x5v30kNYsvMNfgCL4407UhoHt9TxXQ2a97pecZw7yLZGUI0n_iDYwQ2mV8sw61fedbr5owTFN7K9JxWP8Wfs7PZSst-zbdiek2etgZu71c_OXb_sm49bYHTT8oZTRpul1pzr9A1q3R3d-TX1ZnsuX94-_Dxnc6exptB_KNsPPP9r-Au0-ikt3i3YuCEZeUpDVc1hOP9MN4flZ8cyz-9TYdiPQrY_oX_HcM37b_TAc-csf-jP6wZemVlM7KvG59awbKP_rd0OblHT6LtP_7DpTKce7PiozP_pa5lv6b3Vv2M079si3cq9l_z_f8_4wS7Xy9ff1o3c6aM73f0WBIZptpO2d9a_MN-xj-E9WcR1v8Oe0T3T7lY1NuwfpOnnx9N1vqR-y47xI_dSv8q9vnhbuhfrm3JoU_wrCixSDh4yCZeUErtFFozTNFzcMEHxtbyI_4sAJB_cbK4yUlpUZP1cnbmVzMVoQFfwfmWgBQpMPgwgkqAwiUlYMuwEYohNpqqzzyWEhIUPbtPFmHACXBchri9qQqHitoqUsKkhtAksJE1VswaNLIJCCATaYrYcSj8QIdSKIW-aihdClTUzayykjbxAFCwuJZaIglFDHptObfhMEfJ4aouU-HVSMbKSaLGvyYoVw_ISo8NHmz2TVfXGJSUvUVkczuIIy7gVaGQVhOMFVTlcLhW3hg7gCR40tgQHOMJ7l7EhsRPsa3ihkvliVVAU3KYIZ1XU4DeGisdarNOE70PFBiCLsBvA6HBoIIRCzBstAyRD1xJqfBnXJxUmjnBJyDGXORGbBKjYQ77ioINBBTSQpR2gyAaJ&uniformat=true&callback=Ya%5B4806786596893%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

9af16b2fada2e33c04367e29b786f88da67cefe4e1a2e9c2ed47061748b3cd19

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech .maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net .captcha.yandex.net yastatic.net .maps.yandex.net .yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 20 Aug 2024 15:08:32 GMT
content-security-policy: upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
x-content-type-options: nosniff
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
content-encoding: gzip
x-yandex-req-id: 1724166512279840-7152011626544001065-balancer-l7leveler-kubr-yp-vla-247-BAL
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 20 Aug 2024 15:08:32 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://1275.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: Tue, 20 Aug 2024 15:08:32 GMT

GET
H2 200 watch.js Show response
mc.yandex.ru/metrika/ 157 KB
56 KB 735ms
363ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/watch.js

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

b57bea2adfc7b0808a369e963ee65d0f71c797309ef9d896886d3811ab8818ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://1275.ru/
Origin: https://1275.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Tue, 20 Aug 2024 13:57:42 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "66c4a0d6-ddff"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 56831
expires: Tue, 20 Aug 2024 16:08:33 GMT

GET
H2 200 1788970 Show response
yandex.ru/ads/meta/ 438 B
445 B 267ms
266ms XHR
application/json 2a02:6b8:a::a
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://yandex.ru/ads/meta/1788970?target-ref=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&pcode-version=1090447&pcodever=1090447&comboblock-unencoded-vast=1&ad-session-id=1752241724166512110&target-id=40692322&pcode-test-ids=918197%2C0%2C26%3B1071114%2C0%2C66%3B1078666%2C0%2C25%3B1034857%2C0%2C61%3B1076847%2C0%2C6%3B1076432%2C0%2C35%3B1077080%2C0%2C83%3B1065394%2C0%2C82%3B1035460%2C0%2C14%3B1071270%2C0%2C49%3B1083172%2C0%2C78%3B1087331%2C0%2C97%3B1082177%2C0%2C87%3B1059497%2C0%2C2%3B1037228%2C0%2C68%3B1082207%2C0%2C14%3B1078045%2C0%2C14%3B1051946%2C0%2C21%3B1085919%2C0%2C43%3B1090447%2C0%2C86&pcode-flags-map=eJy1WNly27gS%2FRc9R77cl7xBJCihxG1AULIy5UIpYyXxLS9TsZPJTcr%2Ffg9AaiFlk5nNL7JI9mGjl9On9WMSs4rMUiqjos6F5DRmnEZCspyU5eTtrz8mX7e3X3aTtxPBazp5M3naPT6xa3z3LcNxrMnz1ZvJilSyrqjM6lQwXqQp0HKh%2FqFcromIFjSWgmVUFklSUTGMa1uG7x9wORV8I4tc5lSsC76UlPOCDyO4nuOHGkG9tKiFLDnVfh09XLGYFrK934EzDfx18EI79I0RvFmdJDgtzUqxkSnLWB%2F0TyOuSsLif97DpMb%2FfxU1RyL%2BaU9fwfxb%2BXkZ89%2BLwF%2FNvqrwOSczmdJ8LhYdI%2FRXcGoWGIHhO0czKmRUV6LI5Coj5f5AckVStMMpkNc7VeC5tnfs3GpR1GmsPtaSRILhgLNaCHwwHJVES9zpHmf37fdTPNOwncA9ekYj%2BBQJAvuIUwJiaPEq9q7r2e3HLo7r%2BsHRMZprZkoLhIZejrjgOZ7naVPFRBsieS3jIiM4Q1JwSWIwyS81rUQ1yB0ACjwj6NBaTKqFzBR9iU1Je278dvvleie31x8evnVxfMeyjjTWulLk6UaFFdEZPo4fmEFj3UaBi5mckTxHlaUkn9dk3vekhxA4QXjMSSU0yoryCgnuFWfgmI7bs3YDMzwh4axYIY1sjmzMERCVXEGzasQFzwqPdV6SqlKtg0bRviAlqiCkKHQBj0AFgdWkVzddG4k6ZwnDbGG5oDwh0WBI3DCw2sGisjpb6tdXujwatlGJKbJZMYTi%2BaFjNCicYyit1YSqeS5JAh9klLJoKcWCF%2FV8MTylTNNwmhBXGeFCojprKullKWcpug40UnVq%2FtfJ3fbm9uLzF6D8b3t%2FvfuG%2F%2F9zc7f9uHvsXPq4vdNXrr%2Fv7pvHt19vnh6af%2B8uTr5c39%2B0VxXyAQEXPm%2B%2F3z58%2F9Te%2Fv65%2BfzyeXtxv%2Fvj8eyB%2F24f7m606VXniG7Q9gCmvoxpQpA8FMKcyrzOZpQPRdp3TbulyQ1B%2FQoWyYQi27O0QHgwcdYLFOELceJTNrWc0ASDTk1Ann63et%2Ft3ndHfydTy8U08K3WnkzdIHA8c2qahwsejuerF1x1SDr0zKZQkwrNUpQyYZdDxwxc2zZtbZHjjGgzkHBNUlWXGRFK%2Big1BQKUGc3rYSgntJqIqcKcl0JWEWflIHUGEFwtUcDjmFZLAaf3shARlpq5yhHCCUI0abiH4XRNeKxU3zljdsxCyzJO6BYvalu7qrjqhWFb23Eb24OK1e2HeCVMBa9PdWcArh3YB0bYg%2BwnqSKGuIhqhB2BFJwIOocUnVWUr4ZLN7Qctz3VK1SToDTUVBpxz9yTcIeftIJBZinN9YBCc3BdKCtWsRlLmTi4OYhvG27Q1Gr8bg%2B1pCkVY2EzA6vxa9%2FSCBcCREmmQUgKKmyL%2BcSlQwjpZZTWMfYFDt047KHnmG5nGC9IHitRwPJlm%2B1mvIs6Hzmsb7XFUpFMKYQ8ppftXB409A3fCztVVpQ0V%2FMYw6xEU2IYzup0OQgSuk47e%2FD4XC4oiYdLCOwTuJ6pTUi1yaNmPpya%2FJg87p4U353c1zpBz%2Be0QHW96d6jOLOuuu719kbvqtKlrwG8%2BgqWgzCaCyROisvebQSLsyVpts2zN0ZFsWR4SG2MLJ%2B%2F8lTJi4xV9OzFeqyo47de6p7pPdXrI61xodUR408Pj0%2BPKpjb29vJ1XMnE5BiYTupqxICu1JUHDMi10wsFFMc1mat79QDw6m1fGj5hivFgXawcKfFCr6xQmnfOAKDjsCA7Y%2FdccCpMGxPuUaJcN2L%2BIwW2mn1cJQSEN1IEVrYVY5HxyiTl4wg%2Fi%2Br6fPFwHJ992DeritKQrKEdGe24%2B622%2FemNw132w9Tx9%2Fa0%2Fe%2Bdz3dfnjvObjmXrtWZ9KqrSMMgpfAS8ojcPbpC4wLw3B%2FzjpK5t0uC01oNT%2B0Jm%2FNNxPbMKAjHcPEt%2BdXAFVf7KV20wzDUXJAME2UIkw9xJVv5Jxl2YjCx7BvV56jWTObphUSP2zsGlarU9TxlVzQwlqybESJu6bnGN1m0KrsNTHm2SEOaLu95Lm2YzVnXnNsr5mS8GCcVJK8Wo9VpRu6pnUqmVimmn9EaWG3s32%2Fv6cSSPWKpphOIHMMVazzIyCebTV5Vr2qX4z%2BpxWbYwATzki38iZ%2F3Dx9mn69ud49nC2atvsyzogD54alokyZjtSZF%2Bwn2YEHxZycqolW%2FnVgfv%2FGsBfcPz32wML9zq%2FqgBfrn%2FTet%2Fx2rCm7xnEIg2iJfulWjm2YFircVasp%2FvccVEy%2FjLDltmWsWu6oNdDIc8yAF5jA7Nnvm5ZnEGVkPrbShn6w32hyQlfSHBz7JrZov1dwGJwkjve%2FCFRpv1V%2Fe7o9%2F3XlCIKTqTW6mJH2qLpvy5T1msa4MHuB9wLnCFPVIIqNbnyAzTnFcj4jI33ne47d6btFTdaUSSuQgmZlCnk3fBT%2FMPh6k1j%2F%2BoQ9OE0xVPbO4S6JSanflBU47gi659r7nzw0eleVcprglIsxbrFdxzNeBDkAHDaEZudvp2yBANBuACz1g%2BKfRs%2FI5WG8Nhro9fo94iGBNI%2BQkoKzd1gYQaXNKjWSEdNql%2BwDifGs1JQ%2B0gm26Te1EOkexoKqRH8qYzVOlTKv5Moafjl2T9vsSGuWcKXOExTCjLTifuDHmXNEyzz5jackG7286f2V98TKx8%2Fb6xvwWn%2B0OG3HqiZVieZyprcNUWjpOeIA1ox2OhztX7Q8L7yD5T6VqPh0VkAGvpTJ84RglfY79tUvNeH0p4z9wHDcg9va26iIWzGp41dUutatkclsho53IJmTydLubRE%2BMa9Qo8jL%2BYJ%2Bnk83bFfgUvnT37tNA%2BICrNaxaS49Xz3%2FH9fdy98%3D&pcode-icookie=ZNfbLhdRmGeH1rJAF4PRGQlmKIesOEMZHubNMcIcHc8VDDk6QPjj8jUTnLff9kl6L%2FL0xsaNnRjr4Zwmuhet6LikVik%3D&imp-id=3&charset=utf-8&test-tag=500827546451970&tga-with-creatives=1&top-ancestor=https%3A%2F%2F1275.ru&top-ancestor-undetermined=0&layout-config=%7B%22win_width%22%3A1600%2C%22win_height%22%3A1200%2C%22pixel_ratio%22%3A1%2C%22bandwidth%22%3A10%2C%22isInIframe%22%3Afalse%2C%22w%22%3A300%2C%22h%22%3A0%2C%22width%22%3A300%2C%22height%22%3A0%2C%22visible%22%3A0%2C%22fullscreenHeaderHeight%22%3A80%2C%22left%22%3A1050%2C%22top%22%3A1213%2C%22ad_no%22%3A0%2C%22safeArea%22%3A%7B%22top%22%3A0%2C%22bottom%22%3A0%2C%22left%22%3A0%2C%22right%22%3A0%7D%2C%22req_no%22%3A1%7D&grab-orig-len=5120&grab=eyJncmFiX3ZlcnNpb24iOjJ9ClKlkowjuY0B1NeBTVRL1J9_Pv-oy1SXpU6iTpw4iyZoW61VPjN_O5ag59OpyQI2aRNMUAOJajR4K1qd2Ab6y9qla9qugJ4I4BoW5p_-02hNqkVtR9DCzMLCIrDAwnRmEjyVwyUmwcutEJOousrNxJDqhqqz8UOA4eg4IRFEEISQQUzIDPkhAXJCvj_74PskKKIwEk5WW8hunAw1acnMqum4qs5ik4aVxVYzW4WaFCiKkqIgJkERWTBZBSes3MZkQk2Ky2KqfDVzcLlNzfySjcbgqiHzRblZgeSv4HCh9cL3HN-SGwZL4zSVz1QbuzSthODi8jPHzIWvZSYui83UkWz1ks2m8TUdH08lJSYpOhKZFaau5rcbFQRSHZfP1dlIw1MvZ_Yrt5K1pwjOudGBo2PSwKJj0uHRENMxQjrQIQ1MOjodQWoBQ8emw6Zj0EAkQdFibLImYpmvdA0dnFzQpK7I8HU2e8UyuFzygk3tNDs9oqwC3YhFLj0jKFJHBJWgGVy5KCezGa_O1ROfXBmaruJEXtuMjbuQoouEwX2OzdS55AUwdXx2UxkPBIU0JI0LbtMyRQdKKIgounQATFGDQ8egw6aBIkmhYHDFtJZproSTmZtW8UgpKRLl0ERPeRRqnlckouMFErLsKd0uzWk6W8gr9Zum6vU_q7_c3jSCkgXKUtTHxM8kUCoOriL_y6gMJh-XYXJ1Jl5IcQ68xuRHY8ZjcEx20--nmzE-S8Ph66waqg2f33DVBMGNtsYHe21t-0wW91bvag2HKV-XidvYMtSdD2g63L8G65_BpoHwe9AQ39vxJICjY0dfC3hTXx37MmSqgefLlHgUn1-abFIyO3xX-sJwRN46p-HnGNINlQQWGTJq-ElRSZniybHWLqbCVyBfWlp7NPLcZuYzTAeeDouGiA7sQ4tBB_oWgJVijC4zqOqcTBxYvKDzZjDdHbD3gTpl5aVnCJeYYN0buhASASxBuGG4-8E8u9h0-DRQEpuYdzeY9zIdfQd47RljJxf7W4v9sV0_Lj_0xA_jm7o8MOiYIR1h6iH6nGLTwFo3vSDmBdwmVwYjpIGWGEQst9FfGGH0AR3-ZQG3rKKMS4i1rNBAlevTQH-B9xHRYR0gOh0eyjDxXZGp3DbDRG-gQ5EHeCEdQFbwLQF9T7nUTLQHkwb6OQMTOdBADs8E5kOBuZVPIVhLuX9NFokgpY2RzhTSEaSsEUa2hImGCRJBYjslGGmISYcTEuDlUuREUQpT26AjXmdsdCXvn4VUES4N5BdFF5ZM05ks-GzA2RRf_qJTglsS6EuDcglQkhiF3ghSEOCE6aQIDggnUQmdDuyDgnHKJJntwk_UT7RJ_XVJisqyAanOZoDDI0GBK7gk2HyVVflIJrIAmWMju5GxGL-hxsfTvxNfLpxQEa3Iy6DwtSyWZatfxXMtupZrIvmTZTpZhSRkP0JWeEhKDEEzD8EyQsJo-MyUSDRqdktKVNHulPWTVlHA7BzsKvqCiaZUzkC-_iQlhuya6WPF0pgxVQ6uxuLozKg8YThn70UhQuLCQO4uKTGUrFXXTBjgNEiJIYFywABHh5SYAHIiHwb49cRvDodCm0hgk-cUbT8p_fv-h5AOaKpp3QbSaK4NkDFOuCsYUbLKneuVhU1DRAMx2iIYypBFKwT6EIgW7OcW6yLg0kBMwwgiDbCRN9YrwY1mGbcaYVKHcNZUU_nba9zHFYowjT9mnKrtrV3BTqrtye2-JrBYIbQQQUoIDUrKBEQlsYTW9HRBDwkIiaAkQpmK7abvvj_6G-mULdZrg_A8EIdpdcGIex0H_fOe-CNKUy7eXR7lbmJRlQUGNWhxkoXsUhfrBeGmqXoL_a1vVQg-RBCH0C7Rhw5r6y1ZZ5mCvfo5rcKKPYEGeGgSzUCK5Bng6ABKB9Q1OGgpEWBpoKTRSezBP6tpGyLTKU7AJPV83RqHU6DlLhZWitLSHyM6YjUsgrhLKKn6fc-cNCuC3a8dAKwwCd0fA7tZhNcrXlJxq-ZiCA4SgRxoOCloC0qY_xOIQVz_y3obmxpRWYvAVYKMJW8KVatsJrAltmHJQN9RpmrJtWvwolsl_RUfGFWIojJXkx0KtGjw4uQpif5JtaBC9L_M2QUtOYyqrujwrl0AIlRULCbMqBmDjR4vBzuxj2gdt2eHuUoLo_mtYnvuoCoflE0kqUSxPpMfSmFT1CMuG5iJUcwNqpIjhBlJ1pg5JCCAXCGeg5QcD0sJXYoHSGd7-a1ZLDBD7FMCMEkvLYEQftQ76U9L5InJY6T4wV3ge9L_1sJiApEoi8Z2AKsYrUJ2TATWfWC0cOVZykgm4GKgRpI6rHTppRX5sETTPU8E67u1cInQS51U-S-PJ1-woGm40vNFucpkaYWZXw7kX44qGiMS-KLxIU492Eu65SvkKNiJIC0-9oMF_BJfk2OAicsb5xkzjR6WQuBKucXgKZuHksLcIkEuBT2a3Q0fSw49lR7xntgpAsCISEPkyEeUj0gbutFG_Qi71jA5ArAxSus_wX9TKGG6YGmXZCIRhkIa3B2XTV96NCrmi4FW-UbtDXOtJtvo0g6eAnv8C6g2bRWAslEpl7Tfkj5XVI9wLhNpggC31QyEOBvXB6gQT5fIj-cpJNmDlwmkfuDy5hg8x-H5nkUlX1M79oGQkm11Ucvm-bbP853Bs1yp4w2ePw-4QCanL25chGXxhveOQ67jiYW44yLdl_V5jku-cxGDXGeIOs7zeX6bmyd1hstz-5k6AHGV8aif_zh_NL0hyGU8FyfgveXbUutxP-V5freFOXYnxdz3XtUTdGbAczrPDQQta_J83-XZE23nAnwRc0rHtQQZKp1xtqagtuWssAN2ch3KBKkdEZVPi_4QODzHErbm6TdPMdRbvqDzFH1eF0egW7yHyz-t3Um21cU0sf9Q2-N5-1pxEG07hWvOQ_hT2PjXNoiemCYbmh_Z_UkCcY7Wn2td1LjMtMg1bJGIZ638kLL1c0_v3qS2ZnBP7xX7zy12xgz2dk_GCzYBqbF3vqDpzwUUNuyeWApErbWal9mSYse5m3WyUZ7Y5N6665e7Q9ncXw20TVsKwS1-T-Db1tKETEdy1OCtVZ_iAUV3illx9g6TZ-1mU3t9xIg-0l0S9bv7_mnmPy_xgZXO_Nk9QeuO-Dh7NkXPmUITsjf7e9Pi2VJW9u5gNDkpiHvB9dPlxWG1955nwxLa6B073aW8x7PEjK5Y3m60eA3fO5-0ZIGUvuXz9opzXy9d7idy3g7-Ccn9ey_vZjnFSe1TR5p4njhM4laf5FoeuZYtBu51nU0FsiLW01xWbVywdS638QwGm1qamdlMlibsMjRu1ngLT0hQKgElEZcLmlmrX-xij_p7Njs7Zr8Bu6ME066NWi8w3VLsPD0jVzMIDKd03y6mXy2vmzkokoXVWYdXXS8whmsM61Wr49VgGrl315DEub5pWWbQe2AEfjPMYgeu7RumY9i-_1Slt06vGNkr1cvdLb5jB1YPAnPkmqc57SYWZ2fLdZzs19GNajbXKr34brNGM23xetuO4VqmN2ozp2nVanSjeYGzgL2YJUsO7o5bDcd2ZjOKadtlPvReMMpX4OGX_GYaQWuvl-2a_Wz4_hhO0PPoOfidqkhcze7Ixe-GZfZut366-4Zre7MGuUnPzY7d3OpajpXNp2me4uXdD-bITTSn2dqomMHMo8ygObbrn0qObXnVK8VyBP-PcLJFZGrvxHsztzzOvu9VYwSeM5ynOVvgD99xLH92kTYahm3N06xVqzyR7HpuH9Nvow_XCuxyvva0Jcuad6BlPThBtYJim27OJ5_OVofVum_a7TTwnweVv2e9cOAWM89esmeZc_7iXnGLZRjFaIHl5jpcybPeg2V5htFKcee9OdwbzCntGdVtrj1cp1ktGNJbL94qnhV0w8wjB3b9j6dpmFb-ob1h3R9u9brE_LBznobpO32aXjNmMbtlddO0_Gp4zTy59A_ys_TOH9AdhuE4t_6SW7eMb7Dp9pmt0rJnBgc3hlg7m67lO8Y0ncftkc6BXx03cHx3BrbrGp7neJ47hnSJx7yZPajrhjbcp2T6j0TO5X_OB_nfmDdS6dcXOJtXR57Ds2spTm5Wd8cs1uWtNb6_yJAo_-OMxzqwW3mIvObXHNSg_EPP4YZQb-7TCDy090wwKEXn7ME_Zjw4I5-yP7jVvB7YhpfHTzkf55KN0c3aHuwzWZ9YYNh13Pq7Id380bwt9WH1K5EWGNU2jD7-rFPIL4FX-8s3x5v30kNYsvMNfgCL4407UhoHt9TxXQ2a97pecZw7yLZGUI0n_iDYwQ2mV8sw61fedbr5owTFN7K9JxWP8Wfs7PZSst-zbdiek2etgZu71c_OXb_sm49bYHTT8oZTRpul1pzr9A1q3R3d-TX1ZnsuX94-_Dxnc6exptB_KNsPPP9r-Au0-ikt3i3YuCEZeUpDVc1hOP9MN4flZ8cyz-9TYdiPQrY_oX_HcM37b_TAc-csf-jP6wZemVlM7KvG59awbKP_rd0OblHT6LtP_7DpTKce7PiozP_pa5lv6b3Vv2M079si3cq9l_z_f8_4wS7Xy9ff1o3c6aM73f0WBIZptpO2d9a_MN-xj-E9WcR1v8Oe0T3T7lY1NuwfpOnnx9N1vqR-y47xI_dSv8q9vnhbuhfrm3JoU_wrCixSDh4yCZeUErtFFozTNFzcMEHxtbyI_4sAJB_cbK4yUlpUZP1cnbmVzMVoQFfwfmWgBQpMPgwgkqAwiUlYMuwEYohNpqqzzyWEhIUPbtPFmHACXBchri9qQqHitoqUsKkhtAksJE1VswaNLIJCCATaYrYcSj8QIdSKIW-aihdClTUzayykjbxAFCwuJZaIglFDHptObfhMEfJ4aouU-HVSMbKSaLGvyYoVw_ISo8NHmz2TVfXGJSUvUVkczuIIy7gVaGQVhOMFVTlcLhW3hg7gCR40tgQHOMJ7l7EhsRPsa3ihkvliVVAU3KYIZ1XU4DeGisdarNOE70PFBiCLsBvA6HBoIIRCzBstAyRD1xJqfBnXJxUmjnBJyDGXORGbBKjYQ77ioINBBTSQpR2gyAaJ&uniformat=true&callback=Ya%5B6841491502867%5D

Requested by

Host: yandex.ru
URL: https://yandex.ru/ads/system/context.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8:a::a Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

27f99a9362ef7ee86a63fe755e6f0f9461f479f86e75882684745910db7e4349

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech .maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net .captcha.yandex.net yastatic.net .maps.yandex.net .yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

content-security-policy: upgrade-insecure-requests; default-src 'none'; base-uri 'none'; script-src 'report-sample' 'unsafe-inline' 'self' yandex.ru an.yandex.ru api-maps.yandex.ru mc.yandex.ru yastatic.net pcode.yads.tech *.maps.yandex.net; style-src 'unsafe-inline' yastatic.net; img-src 'self' data: avatars.mds.yandex.net favicon.yandex.net *.captcha.yandex.net yastatic.net *.maps.yandex.net *.yandex.ru avatars.yads.tech; media-src blob: strm.yandex.ru *.strm.yandex.net; font-src yastatic.net; connect-src 'self' blob: abs.yandex.ru an.yandex.ru yandex.ru mc.yandex.ru yastatic.net log.strm.yandex.ru display.yads.tech display-logs.yads.tech; frame-src yandexadexchange.net yandex.ru an.yandex.ru; report-uri https://csp.yandex.net/csp?from=yabs&project=yabs&yandex_login=&platform=
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 20 Aug 2024 15:08:33 GMT
nel: {"report_to": "network-errors", "max_age": 100, "success_fraction": 0.001, "failure_fraction": 0.1}
x-yandex-req-id: 1724166513608088-15050623201255032119-balancer-l7leveler-kubr-yp-vla-247-BAL
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 20 Aug 2024 15:08:33 GMT
accept-ch: Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Platform, Sec-CH-UA-Full-Version, Viewport-Width, DPR, Device-Memory, RTT, Downlink, ECT
report-to: { "group": "network-errors", "max_age": 100, "endpoints": [{"url": "https://dr.yandex.net/nel", "priority": 1}, {"url": "https://dr2.yandex.net/nel", "priority": 2}]}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://1275.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: Tue, 20 Aug 2024 15:08:33 GMT

GET
H2

200

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10467.x3zl4kFCZV7tGTtMcPN5n6ij9duLE_XttvSjM-8_jLi3pNl1kpacf_uLtNutiOQt.p2k3Ss42eeEhnDhpQvom7rhArnw%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10467.p_xgF5ktivuASxc_YNWR51Qj_cJzlbPsq2Pnk1RbtqzSVhjl8SNFRRZ-AL3gt-7tNWca8kpYyzI72T7ze4xlP8NepNHM6_Rhk9_pf3mnmjaRaRF5nMFWo4a3St4TKeGf4CiIleHv7-...

43 B
696 B

192ms
192ms

Image
image/gif

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=10467.p_xgF5ktivuASxc_YNWR51Qj_cJzlbPsq2Pnk1RbtqzSVhjl8SNFRRZ-AL3gt-7tNWca8kpYyzI72T7ze4xlP8NepNHM6_Rhk9_pf3mnmjaRaRF5nMFWo4a3St4TKeGf4CiIleHv7-Ay6G_EZRWMqJSDPbBnkY9uEZ5QAn44Cx1Ce8eS6FVvv-HSQUw-mLvJquTPpPHlm712qf16qzURCxTfo08MmNkQzt6g_68u_34%2C.p__8Fg-ca8oqeOCoeRnJedgB6zI%2C

Requested by

Host: 1275.ru
URL: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 20 Aug 2024 15:08:35 GMT
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=10467.p_xgF5ktivuASxc_YNWR51Qj_cJzlbPsq2Pnk1RbtqzSVhjl8SNFRRZ-AL3gt-7tNWca8kpYyzI72T7ze4xlP8NepNHM6_Rhk9_pf3mnmjaRaRF5nMFWo4a3St4TKeGf4CiIleHv7-Ay6G_EZRWMqJSDPbBnkY9uEZ5QAn44Cx1Ce8eS6FVvv-HSQUw-mLvJquTPpPHlm712qf16qzURCxTfo08MmNkQzt6g_68u_34%2C.p__8Fg-ca8oqeOCoeRnJedgB6zI%2C
date: Tue, 20 Aug 2024 15:08:35 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 metrika_match.html
mc.yandex.com/metrika/ Frame C659 0
0 523ms
180ms Document
text/html 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/metrika/metrika_match.html

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://1275.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: *
cache-control: max-age=3600
content-encoding: br
content-length: 1046
content-type: text/html
date: Tue, 20 Aug 2024 15:08:35 GMT
etag: "66c4a0d6-416"
expires: Tue, 20 Aug 2024 16:08:35 GMT
last-modified: Tue, 20 Aug 2024 13:57:42 GMT
strict-transport-security: max-age=31536000
timing-allow-origin: *

GET
H2

200

1 Show response
mc.yandex.com/watch/1788970/
Redirect Chain

https://mc.yandex.com/watch/1788970?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A5hhtnd...
https://mc.yandex.com/watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A5hht...

547 B
774 B

192ms
192ms

Fetch
application/json

2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A5hhtndq4m7gdrr9ncc0y4hs3h7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1410%3Acn%3A1%3Adp%3A0%3Als%3A1653917653514%3Ahid%3A549223940%3Az%3A-600%3Ai%3A20240820050834%3Aet%3A1724166514%3Ac%3A1%3Arn%3A240842279%3Au%3A1724166514884118485%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1724166508538%3Arqnl%3A1%3Ast%3A1724166515%3At%3ALifting%20Zmiy%20APT%20IOCs%20-%20SEC-1275-1&t=clc%280-0-0%29aw%281%29rcm%281%29cdl%28na%29eco%28565312%29ti%281%29

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

29d821da8fefa3b6eeb203a8e0889eb12eb94c2c8b92dd55b7fd479e60446162

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 20 Aug 2024 15:08:35 GMT
x-content-type-options: nosniff
last-modified: Tue, 20-Aug-2024 15:08:35 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://1275.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 547
x-xss-protection: 1; mode=block
expires: Tue, 20-Aug-2024 15:08:35 GMT

Redirect headers

pragma: no-cache
date: Tue, 20 Aug 2024 15:08:35 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 20-Aug-2024 15:08:35 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
access-control-allow-origin: https://1275.ru
location: /watch/1788970/1?wmode=7&page-url=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&nohit=1&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A5hhtndq4m7gdrr9ncc0y4hs3h7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1410%3Acn%3A1%3Adp%3A0%3Als%3A1653917653514%3Ahid%3A549223940%3Az%3A-600%3Ai%3A20240820050834%3Aet%3A1724166514%3Ac%3A1%3Arn%3A240842279%3Au%3A1724166514884118485%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1724166508538%3Arqnl%3A1%3Ast%3A1724166515%3At%3ALifting%20Zmiy%20APT%20IOCs%20-%20SEC-1275-1&t=clc%280-0-0%29aw%281%29rcm%281%29cdl%28na%29eco%28565312%29ti%281%29
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Tue, 20-Aug-2024 15:08:35 GMT

POST
H3 204 rum Show response
1275.ru/cdn-cgi/ 0
135 B 44ms
42ms XHR
text/plain 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Tue, 20 Aug 2024 15:08:35 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://1275.ru
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8b634cb1e838a4f4-MIA

GET
H3 200 1275.svg
1275.ru/ 2 KB
2 KB 47ms
46ms Other
image/svg+xml 172.67.140.84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1275.ru/1275.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.140.84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30d219fdd2c143bf6199edb608a596f51e3bb692e5cd8803057a0c478a9140a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://1275.ru/ioc/3619/lifting-zmiy-apt-iocs/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 20 Aug 2024 15:08:35 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4967
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
last-modified: Sun, 17 Jul 2022 14:47:18 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5v4gHTtDLOpnPHf7yc%2BExnZaGQDihULcVEl18q96x28LUYoaHu921Q5Yx0lMHIo3f7LnT9qwlzmz6YY97syFJkbc%2BKQEfMxuAyfBOSNLTRmzK2loLCeyk%2F5"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 8b634cb30a07a4f4-MIA
priority: u=1,i

GET
H2 200 sync_cookie_image_check
mc.yandex.com/ 43 B
90 B 260ms
259ms Image
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_check

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 20 Aug 2024 15:08:36 GMT
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

POST
H2 200 1
mc.yandex.com/watch/1788970/ 43 B
74 B 217ms
216ms Ping
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/1788970/1?page-url=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1724166515_a663c1e75078ca682efd52e7de9fc65a1c2425e6af6ecec6311ebd6ed75eae43&browser-info=pa%3A1%3Aar%3A1%3Avf%3A5hhtndq4m7gdrr9ncc0y4hs3h7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1410%3Acn%3A1%3Adp%3A1%3Als%3A1653917653514%3Ahid%3A549223940%3Az%3A-600%3Ai%3A20240820050835%3Aet%3A1724166516%3Ac%3A1%3Arn%3A688456301%3Arqn%3A1%3Au%3A1724166514884118485%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Afp%3A2038%3Ads%3A0%2C152%2C516%2C364%2C4%2C0%2C%2C838%2C32%2C6946%2C6946%2C0%2C1986%3Aco%3A0%3Acpf%3A1%3Ans%3A1724166508538%3Arqnl%3A1%3Ast%3A1724166516&t=mc(p-1-h-1)clc(0-0-0)rqnt(1)lt(81600)aw(1)rcm(1)cdl(na)eco(565312)ti(0)&force-urlencoded=1&site-info=%7B%22__ym%22%3A%7B%22adSessionID%22%3A%221752241724166512110%22%7D%7D

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 20 Aug 2024 15:08:35 GMT
last-modified: Tue, 20-Aug-2024 15:08:35 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://1275.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 20-Aug-2024 15:08:35 GMT

POST
H2 200 1788970
mc.yandex.com/watch/ 43 B
232 B 198ms
186ms Ping
image/gif 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/1788970?page-url=https%3A%2F%2F1275.ru%2Fioc%2F3619%2Flifting-zmiy-apt-iocs%2F&charset=utf-8&cnt-class=1&uah=chm%0A%3F0&hittoken=1724166515_a663c1e75078ca682efd52e7de9fc65a1c2425e6af6ecec6311ebd6ed75eae43&browser-info=pv%3A1%3Aar%3A1%3Avf%3A5hhtndq4m7gdrr9ncc0y4hs3h7%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1410%3Acn%3A1%3Adp%3A1%3Als%3A1653917653514%3Ahid%3A549223940%3Az%3A-600%3Ai%3A20240820050835%3Aet%3A1724166516%3Ac%3A1%3Arn%3A492480098%3Arqn%3A2%3Au%3A1724166514884118485%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Aco%3A0%3Acpf%3A1%3Ans%3A1724166508538%3Arqnl%3A1%3Ast%3A1724166516%3At%3ALifting%20Zmiy%20APT%20IOCs%20-%20SEC-1275-1&t=mc(p-1-h-1)clc(0-0-0)rqnt(2)lt(81600)aw(1)rcm(1)cdl(na)eco(565312)ti(0)&force-urlencoded=1

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/watch.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://1275.ru/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 20 Aug 2024 15:08:36 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 20-Aug-2024 15:08:36 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://1275.ru
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 20-Aug-2024 15:08:36 GMT

Verdicts & Comments Add Verdict or Comment

213 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
1275.ru/	1970-01-21 08:22:01	Name: _pk_id.97eED41Ee1b3d80.a7b8 Value: 805fc35e7179cbe2.1724166511.
1275.ru/	1970-01-20 22:56:08	Name: _pk_ses.97eED41Ee1b3d80.a7b8 Value: 1
.yandex.ru/	1970-01-21 08:32:06	Name: i Value: RuQ7ont2f+293yqxipSbfsf+/OY13hN6Az4/sw5BxE+5yZtbs3bK4y7OOjnf/EzcuOXfYWlU7bxOyqO98uU7UML9Hqc=
.yandex.ru/	1970-01-21 08:32:06	Name: yandexuid Value: 4557709711724166511
.yandex.ru/	1970-01-21 07:41:42	Name: yashr Value: 1028379311724166511
.yandex.ru/	1970-01-21 07:41:42	Name: receive-cookie-deprecation Value: 1
.1275.ru/	1970-01-21 07:41:42	Name: cf_clearance Value: q3EKERhTb8Uexf_TpQ53R6TY9rht9s13R.wG6SCTREQ-1724166511-1.2.1.1-PRR.0Ma5N2kUqKigz1cYWsg4mVsaZNjbzYa1mntehe2KGS9vbZL.U1yoilsGYG8AsJ8lnWP1W01i2iLUQgwLsy073VVTUTNy896RHiIngvZCMSxyanAz_KPCENh5_DK4Mnqct0fqLVdCjUb.IWUY.7tf7zROrFDzcjCxwY_Y6oGoXXwzXlajaft_dgtSSkft4Nl0Fc0N9jHR0zpmFnkqgxLQ3ZIzqeUXZcGxzJdyr0PYCdQaNoSf5WX2viP1o.KNiZY2TiAcFCHMrUjuy76vD00LhuhkKToy.bg.Q_08ZH7jRwZtTX6JMyQTTpU9WkgCkyBHpynVhbN6PhlXauA8FtdESV_j.Pv1NENchsP8oXjN1QClG1PYyaoakJX4ZmNGsTpnIPOyGCIPwwpZyPk1oQD3axDB1GZyHLQkXr9Yn1Y
.mc.yandex.com/	1970-01-20 22:56:07	Name: sync_cookie_csrf Value: 1041151930fake
.yandex.com/	1970-01-21 07:41:42	Name: yashr Value: 7805474691724166515
.mc.yandex.ru/	1970-01-20 22:56:07	Name: sync_cookie_csrf Value: 612309663fake
.yandex.com/	1970-01-21 07:41:42	Name: yandexuid Value: 4557709711724166511
.yandex.com/	1970-01-21 07:41:42	Name: yuidss Value: 4557709711724166511
.yandex.com/	1970-01-21 08:32:06	Name: i Value: RuQ7ont2f+293yqxipSbfsf+/OY13hN6Az4/sw5BxE+5yZtbs3bK4y7OOjnf/EzcuOXfYWlU7bxOyqO98uU7UML9Hqc=
.yandex.com/	1970-01-21 08:32:06	Name: yp Value: 1724252915.yu.9269062481724166515
.mc.yandex.com/	1970-01-20 22:57:32	Name: sync_cookie_ok Value: synced
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 432552461724166515
.yandex.com/	1970-01-21 07:41:42	Name: ymex Value: 1726758515.oyu.9269062481724166515#1755702515.yrts.1724166515
.yandex.com/	1970-01-21 07:41:42	Name: receive-cookie-deprecation Value: 1
.yandex.com/	1970-01-21 08:32:06	Name: bh Value: KgI/MGDz4pK2Bg==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1275.ru
mc.yandex.com
mc.yandex.ru
static.cloudflareinsights.com
waos-soft.ru
yandex.ru
yastatic.net
172.67.140.84
172.67.190.175
2606:4700:3030::6815:5ed7
2606:4700::6810:5049
2a02:6b8:20::215
2a02:6b8::1:119
2a02:6b8:a::a
00685798a2be74d85eb048b2ad280413434fe055a0d61cc0673cd06b5a414f32
033696b7f1ac04d1dcc102be84550e146236ceffc25a6cabc12aa51a6ee410b9
17df1f2891553baf6c74c4eef8cd0dd9fb73a5669f9f89d67183a8bfe41acfd2
255df06063ef8b4f994c1ae9d232d7c4f27c95b853a68fd9c03e31f4dd6b0031
27f99a9362ef7ee86a63fe755e6f0f9461f479f86e75882684745910db7e4349
29d821da8fefa3b6eeb203a8e0889eb12eb94c2c8b92dd55b7fd479e60446162
30d219fdd2c143bf6199edb608a596f51e3bb692e5cd8803057a0c478a9140a3
34806ef573086241dd1a596a860b0295b51c24f1c37eab36eb9d0665683abb55
401503518894f575673732c689a7885c78bb615900c0c3f726765eb4ce6aa799
40224b5e5c035530d53cc19a7392ff201afd08733a4bd9b78d7b65ae4086c626
4192547933c47032776c86cc04805a86655e4580d0c82b46787a120fcd96c146
43b2d78c3171c07f14fdcf811e1bb5857e7969f545bec24405d16e2b374f5654
49681cf629185b67be2aa28ab7a821f4fbd9dad0d38e19928401818aa2914f0d
5178676c00ad6f11e9f3a1dff9d68ae2151b96036ba549e77eda6b236e903870
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
57b706ad8e6cf27d0734cf87efeef7e4151e6ceb6eb92c854e719e1baf7c5e8e
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
6b5acb20b58ca9f25a996cd5f44fcbde42154bb94cd95666197a59d4b539f07d
6e9cca040634f071c068f7f483dfeef82d8589b4082c8cbdc5301951647ba71b
73b97bfdfe358a9f5b3a0f58ebc73b0551f82ec1b1ce8544795b0b93bc45021f
81f7a0f38e6f900023a1d75f0b1417721e1ee06ea456d7975de4dc1f0d814011
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
8a77ab6376bf1e6fa1182199bec8be63db1cd7cd0fdf0ec8dfcd3ba28f9845c5
9387807e98875575d1c4f5c12d5b0088c30f9f16cd72d63306db0d841e3a8609
973408bd1a1da181c7eaa9293c0cd095f3836a76b626bc76af21e1cd96b5dcde
9af16b2fada2e33c04367e29b786f88da67cefe4e1a2e9c2ed47061748b3cd19
9e412b51cdf6a3a40d9b73b08bfc2fb4ed3bac0bd3a675c3fed7df77e6c13908
a2f1b190e5d5a3063c35b75b1a00c039b13e171eb7b099299dcb67e9e4fe65cd
a9501cc809fac65ba3bc7fdc1686f8cc6651018b290308eddd1e46454063bf5f
b3f3db2e6ac9e2b19172879a80a8605f4db7a179745be21a0828e3c1e49510ee
b57bea2adfc7b0808a369e963ee65d0f71c797309ef9d896886d3811ab8818ed
b6898945c1cd627102a395524e84b7b9a80cdce29286005498fd9710c69764df
c420f32b3ac8ca4dad29c471fd2149bf221ac03740c7816154c9703b38f6907c
ccbf2f4e5fbf785849fc7574c8e39c72fff9ec545d446bcaab031ccc9abb125f
d5aab9ecebd2bc2f003980fdde59b97aad0fd105312d99fa50fcab580099aaf3
d6ae8dbff96469621efbc79f5d44c1f6d6c13460ed12e34e826af9b0308424aa
d73c2f35cf104b9eec6c97b351fd1bb05bc19c11a253d8f9cd191671d45460af
df75746a57ad1c39a4e5661b2ea445bbf16b9100724361672d67553465d93e71
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fd057d7db4c5263a87501a7d8a59729dcaa1496e669def1f418cae4c817a1a8f

1275.ru Open in urlscan Pro 2606:4700:3030::6815:5ed7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

40 Requests

93 %HTTPS

71 %IPv6

6 Domains

7 Subdomains

8 IPs

2 Countries

700 kBTransfer

2212 kBSize

19 Cookies

2 Outgoing links

Redirected requests

40 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

1275.ru Open in urlscan Pro
2606:4700:3030::6815:5ed7 Public Scan

Screenshot
Live screenshot

Full Image

40
Requests

93 %
HTTPS

71 %
IPv6

6
Domains

7
Subdomains

8
IPs

2
Countries

700 kB
Transfer

2212 kB
Size

19
Cookies

40 HTTP transactions
9 data transactions