IP 104.17.112.233:443
CertificateIssuerCLOUDFLARE, INC. Subjecttinyurl.com Fingerprint03:08:05:69:A4:32:76:A1:E0:7D:9C:C9:E7:67:50:7D:B0:85:A3:0D ValidityFri, 20 Dec 2024 12:05:30 GMT - Sat, 20 Dec 2025 12:11:56 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /29zu8dtn HTTP/1.1
Host: tinyurl.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Fri, 11 Apr 2025 06:45:51 GMT
content-type: text/html; charset=utf-8
location: https://gosuslugi.ru/snet/67a9a82d9267243e13d18199
referrer-policy: unsafe-url
x-robots-tag: noindex
x-tinyurl-redirect-type: redirect
cache-control: max-age=0, must-revalidate, no-cache, no-store, private
x-tinyurl-redirect: eyJpdiI6ImF5U2pmZW9haVVoRTU5RlN0clRURFE9PSIsInZhbHVlIjoibzVHT1gzVXRMK2hGWWh4c0JGWElVR2xtR1RFK2FqM2xYc2lwMGlBVnhiZ0VldE1NQ3BQRE96SUVFVXQyL0llc1NsU1U0Z2F5eFp6dVJhRnBaV0lkT2c9PSIsIm1hYyI6ImZkMDk0YmMxZTAwNmQwODllYjhkMTlkN2VhYWZjY2Y1ZGI1M2E2OWQxNDA5ZDllNWUxNmZlMmEzNmJhZmFiMzYiLCJ0YWciOiIifQ==
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cf-cache-status: HIT
set-cookie: __cf_bm=.Gpbm9J3AwVatGMUAAZwY7UkF7_MDphCUuV0OXJV7pg-1744353951-1.0.1.1-5vjH32ZxOrEr9PEwMmS_tDdbBROUHLPPTcJj4dHDyDwqd.0vDeaAD6Ye3iJiXMBPwnKaySYjPLLADY24sor2btdctTFU.ClXVFkWcS32Dvs; path=/; expires=Fri, 11-Apr-25 07:15:51 GMT; domain=.tinyurl.com; HttpOnly; Secure; SameSite=None
server-timing: cfCacheStatus;desc="HIT"
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
cf-ray: 92e88600dc3cb4f3-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
|
| GET gosuslugi.ru/snet/67a9a82d9267243e13d18199 | 213.59.253.7 | 200 OK | 9.4 kB |
URL User Request GET gosuslugi.ru/snet/67a9a82d9267243e13d18199 IP 213.59.253.7:443
CertificateIssuerGlobalSign nv-sa Subject*.gosuslugi.ru Fingerprint5B:D7:7A:F0:2C:EC:41:90:37:BD:AE:6D:B8:AA:14:53:4C:DB:9F:CE ValidityTue, 22 Oct 2024 10:37:08 GMT - Sun, 23 Nov 2025 09:08:08 GMT
File typeHTML document, Unicode text, UTF-8 text, with very long lines (2099) Hash0d849f724dfcbd86391afe0b812f6a6d 8400f557018171b31ddbb00f1b596b4e3f052cf8 1d8fd9af92029911fb4023153434cb51bd2da78a69d8c0435cadd376a36735e6
GET /snet/67a9a82d9267243e13d18199 HTTP/1.1
Host: gosuslugi.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 11 Apr 2025 06:45:51 GMT
Content-Type: text/html
Content-Length: 9376
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Tue, 11 Mar 2025 14:42:14 GMT
ETag: "67d04bc6-24a0"
Expires: Fri, 11 Apr 2025 06:45:50 GMT
Cache-Control: no-cache
Accept-Ranges: bytes
Strict-Transport-Security: max-age=16070400
|
| GET gu-st.ru/portal-st/lib-assets/fonts/Lato-Regular.woff2 | 46.235.186.70 | 404 Not Found | 146 B |
URL GET gu-st.ru/portal-st/lib-assets/fonts/Lato-Regular.woff2 IP 46.235.186.70:443
ASN#34879 OOO Sovremennye setevye tekhnologii
Requested byhttps://gosuslugi.ru/snet/67a9a82d9267243e13d18199 CertificateIssuerGlobalSign nv-sa Subjectwww.gu-st.ru FingerprintB6:9B:51:F6:4B:08:F1:60:F1:6D:99:8A:B6:2B:F5:53:8D:61:D1:B9 ValidityThu, 18 Apr 2024 13:27:02 GMT - Fri, 16 May 2025 02:14:33 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash8eec510e57f5f732fd2cce73df7b73ef 3c0af39ecb3753c5fee3b53d063c7286019eac3b 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
GET /portal-st/lib-assets/fonts/Lato-Regular.woff2 HTTP/1.1
Host: gu-st.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gosuslugi.ru/
Origin: https://gosuslugi.ru
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
server: nginx
date: Fri, 11 Apr 2025 06:45:51 GMT
content-type: text/html
vary: Accept-Encoding, Accept-Encoding
strict-transport-security: max-age=157680000
content-encoding: gzip
access-control-allow-origin: *
X-Firefox-Spdy: h2
|
| GET gu-st.ru/portal-st/lib-assets/fonts/Lato-Bold.woff2 | 46.235.186.70 | 200 OK | 185 kB |
URL GET gu-st.ru/portal-st/lib-assets/fonts/Lato-Bold.woff2 IP 46.235.186.70:443
ASN#34879 OOO Sovremennye setevye tekhnologii
Requested byhttps://gosuslugi.ru/snet/67a9a82d9267243e13d18199 CertificateIssuerGlobalSign nv-sa Subjectwww.gu-st.ru FingerprintB6:9B:51:F6:4B:08:F1:60:F1:6D:99:8A:B6:2B:F5:53:8D:61:D1:B9 ValidityThu, 18 Apr 2024 13:27:02 GMT - Fri, 16 May 2025 02:14:33 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 184912, version 2.983 Size185 kB (184912 bytes) Hashcccb897485813c7c256901dbca54ecf2 a53ca00171f545b9d9d1ccefc210b6fe0fde1064 ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6
GET /portal-st/lib-assets/fonts/Lato-Bold.woff2 HTTP/1.1
Host: gu-st.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gosuslugi.ru/
Origin: https://gosuslugi.ru
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Fri, 11 Apr 2025 06:45:51 GMT
content-type: font/woff2
last-modified: Wed, 19 Mar 2025 14:41:13 GMT
etag: W/"67dad789-2d250"
expires: Fri, 28 Mar 2025 11:55:17 GMT
cache-control: max-age=7200
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-headers: X-Origin, Accept, Authorization, Cache-Control, Content-Type, DNT, If-Modified-Since, Keep-Alive, Origin, User-Agent, X-Mx-ReqToken, X-Requested-With, X-TimeZone-Offset, X-Origin, Accept, Authorization, srcUrl, DNT, X-Mx-ReqToken, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, X-Cache-Date, X-Atmosphere-tracking-id, X-B3-Spanid, X-Atmosphere-Framework, X-TimeZone-Offset, X-Atmosphere-Transport, test-scope, schema, x-order-id, x-form-id, X-B3-TraceId, X-B3-SpanId, X-B3-ParentSpanId, X-B3-Sampled, X-B3-Podname, *
access-control-expose-headers: X-Cache-Date,Authorization,Accept
strict-transport-security: max-age=157680000
access-control-allow-origin: *
x-ngenix-cache: UPDATING, EXPIRED
X-Firefox-Spdy: h2
|
| GET gosuslugi.ru/__jsch/static/script.js | 213.59.253.7 | 200 OK | 43 kB |
URL GET gosuslugi.ru/__jsch/static/script.js IP 213.59.253.7:443
Requested byhttps://gosuslugi.ru/snet/67a9a82d9267243e13d18199 CertificateIssuerGlobalSign nv-sa Subject*.gosuslugi.ru Fingerprint5B:D7:7A:F0:2C:EC:41:90:37:BD:AE:6D:B8:AA:14:53:4C:DB:9F:CE ValidityTue, 22 Oct 2024 10:37:08 GMT - Sun, 23 Nov 2025 09:08:08 GMT
File typeJavaScript source, ASCII text, with very long lines (43151), with no line terminators Hash9dd1a66703c49f6edf01634cc1c4c576 56639202c042d29277de4ebd6cebbe9de418703f 4672adf4946dc86afd8517cf7af5c73fc6458e60ffa4270fa699c1242006117b
Analyzer | Verdict | Alert | Public Nextron YARA rules | malware | Unique code from Jetriz, Swid & Jeniva of the Tetris framework |
GET /__jsch/static/script.js HTTP/1.1
Host: gosuslugi.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gosuslugi.ru/snet/67a9a82d9267243e13d18199
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 11 Apr 2025 06:45:51 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=10
Last-Modified: Wed, 16 Mar 2022 14:01:25 GMT
Vary: Accept-Encoding, Accept-Encoding
ETag: W/"6231edb5-a88f"
Expires: Fri, 11 Apr 2025 06:45:50 GMT
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: X-Origin, Accept, Authorization, srcUrl, DNT, X-Mx-ReqToken, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, X-Cache-Date, X-Atmosphere-tracking-id, X-Atmosphere-Framework, X-TimeZone-Offset, X-Atmosphere-Transport, test-scope, schema, *
Access-Control-Expose-Headers: X-Cache-Date,Authorization,Accept
Content-Encoding: gzip
Strict-Transport-Security: max-age=16070400
|