{"report_id":"03e14ce9-f08a-40de-965f-801afd518636","version":6,"status":"done","tags":[],"date":"2026-04-15T00:09:23Z","url":{"schema":"http","addr":"gemini.sp18.net","fqdn":"gemini.sp18.net","domain":"sp18.net","tld":"net"},"ip":{"addr":"85.137.174.79","port":0,"asn":6739,"as":"Vodafone Ono, S.A.","country":"Spain","country_code":"ES"},"final":{"url":{"schema":"https","addr":"gemini.sp18.net/","fqdn":"gemini.sp18.net","domain":"sp18.net","tld":"net"},"title":"Galaxy Trading System","dom":{"size":4144,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3717)","md5":"2e644cb4691ca5823075a7410a5207d6","sha1":"e02d670156cd62e3a36f072dbcbdf3ede587feaf","sha256":"de09f591fa3f909abd455eb56cfc081ca37b88b11b75b0448bb2dda09d5a6da6","sha512":"9c537a504ef1c30b6455620e3a4c7985c0ce635b3ec52508f2864ec82c7c616430b547aa8e5147d7f46820bfb11323c990720eade5c4da72826cf1bf76328bc7","ssdeep":"48:nGyXt7i7CKFfUQQeJtUFfWnqplnGbSXlnGF+gwIoMsrJdreoTezF5K4KyVUUAiwS:nGQt7wnScJSkUjZN8dRatWT","tlshash":"cf81943962115c3fa247438cf680f598206f83cacbaa81697055477fa760ee74c7f3a9","dom_hash":"domhashe1a9a4a858924299dbd610fb88772949","first_seen":"2026-04-15T00:09:35.732847Z","last_seen":"2026-04-15T00:11:17.126817Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"gemini.sp18.net","fqdn":"gemini.sp18.net","domain":"sp18.net","tld":"net"},"ip":{"addr":"85.137.174.79","port":0,"asn":6739,"as":"Vodafone Ono, S.A.","country":"Spain","country_code":"ES"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-20T00:09:23Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-15","alert":"Detects file containing Telegram Bot API","trigger":"gemini.sp18.net/assets/index-BYAKOR2e.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null},"summary":[{"fqdn":"gemini.sp18.net","ip":{"addr":"85.137.174.79","port":443,"asn":6739,"as":"Vodafone Ono, S.A.","country":"Spain","country_code":"ES"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":0,"request_count":4,"received_data":1728728,"sent_data":1788,"comment":"","tags":null,"fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"gemini.sp18.net/assets/index-BYAKOR2e.js","fqdn":"gemini.sp18.net","domain":"sp18.net","tld":"net"},"ip":{"addr":"85.137.174.79","port":443,"asn":6739,"as":"Vodafone Ono, S.A.","country":"Spain","country_code":"ES"},"introduction_type":"scriptElement","is_inline":false,"md5":"ede765e7184186b1cb1781e431261c1a","sha1":"78a8360cc6e0e3221d1d88ff910d1d3b99069a43","sha256":"d1e894001cf944820ca3798a9fd866a094ea2851bc316cec4e9c5bb2f46cea58","sha512":"6a1d191b3876039ce244d3ee09ffa853e8409f058d3bea502260997b056daea2ca155d9ca6f947c1f83d44a955233ee7a5ff64f8047008d273562a34453a372f","ssdeep":"49152:9IF8Pq1ZB+yTnkQpD2TMJQQ4m594AHEi9kVBPgpPNoVUXL5CWLX1IG9Ny5BFqLds:yWq1ZFs","tlshash":"cb754ca87254752a47a325b0447f040f723b295de40ec874f669d8ea2dbc44a763bfbc","size":1644392,"data":"","first_seen":"2026-04-15T00:09:35.74894Z","last_seen":"2026-04-15T00:11:17.149189Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-15","alert":"Detects file containing Telegram Bot API","trigger":"gemini.sp18.net/assets/index-BYAKOR2e.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"gemini.sp18.net/","fqdn":"gemini.sp18.net","domain":"sp18.net","tld":"net"},"ip":{"addr":"85.137.174.79","port":443,"asn":6739,"as":"Vodafone Ono, S.A.","country":"Spain","country_code":"ES"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-15T00:09:01.623Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gemini.sp18.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Apr 2026 17:12:57 GMT","end":"Mon, 13 Jul 2026 17:12:56 GMT"},"fingerprint":{"sha1":"9E:0F:A4:42:69:1E:39:1B:C4:B2:2B:D7:C6:9D:30:BF:7C:59:2F:CC","sha256":"30:ED:87:08:F9:B4:01:E0:17:E0:80:17:45:83:38:8F:2B:D0:91:E4:CA:B9:D4:D5:AC:0C:F1:14:7F:B4:16:50"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: gemini.sp18.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\naccept-ranges: bytes\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0\r\ncontent-type: text/html; charset=utf-8\r\ndate: Wed, 15 Apr 2026 00:09:01 GMT\r\netag: W/\"1d7-19d8d0c364a\"\r\nlast-modified: Tue, 14 Apr 2026 17:31:21 GMT\r\nserver: Caddy\r\ncontent-length: 471\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":471,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text","md5":"fdf832873875fe80c3e9e6595b27670d","sha1":"859b2da430b8654105af92dbf07a51afac000b7c","sha256":"b5a72d03d04961c661a6f855ae7277d4afb18ceff9e66e51d58ff24baea55e2b","sha512":"1c93f96e9f0aebcdb4cf46a79cef739ad9c5c4489410a2197354890c32da8ec2a101127c0d7e4d1558e49f4945c72fd28b503f09e54603a2a9a87bd23f1bba1e","ssdeep":"","tlshash":"98f0dc0598a0ce19133043506ec1f8089e53e7878789ae0865eb607c4fc0b82ceef9bc","first_seen":"2026-04-15T00:09:35.735863Z","last_seen":"2026-04-15T00:11:17.146286Z","times_seen":2,"resource_available":false,"data":null}},"time_used":241,"timings":{"blocked":105,"dns":32,"connect":30,"send":0,"wait":32,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gemini.sp18.net/assets/index-CLhhTYlx.css","fqdn":"gemini.sp18.net","domain":"sp18.net","tld":"net"},"ip":{"addr":"85.137.174.79","port":443,"asn":6739,"as":"Vodafone Ono, S.A.","country":"Spain","country_code":"ES"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://gemini.sp18.net/","date":"2026-04-15T00:09:01.915Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gemini.sp18.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Apr 2026 17:12:57 GMT","end":"Mon, 13 Jul 2026 17:12:56 GMT"},"fingerprint":{"sha1":"9E:0F:A4:42:69:1E:39:1B:C4:B2:2B:D7:C6:9D:30:BF:7C:59:2F:CC","sha256":"30:ED:87:08:F9:B4:01:E0:17:E0:80:17:45:83:38:8F:2B:D0:91:E4:CA:B9:D4:D5:AC:0C:F1:14:7F:B4:16:50"}}},"request":{"raw":"GET /assets/index-CLhhTYlx.css HTTP/1.1\r\nHost: gemini.sp18.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gemini.sp18.net/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0\r\ncontent-encoding: gzip\r\ncontent-type: text/css; charset=utf-8\r\ndate: Wed, 15 Apr 2026 00:09:01 GMT\r\netag: W/\"13e08-19d8d0c3649\"\r\nlast-modified: Tue, 14 Apr 2026 17:31:21 GMT\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":81416,"size_decoded":0,"mime_type":"text/css; charset=utf-8","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"82d816c721ac11a69d96ae449c4e86f9","sha1":"2aaaee05ffbfc08b113c73341ffb7c773e17039c","sha256":"d506fb7c55a32306d2a4eabc644912a4289bf05d97d73373823fc33d89f31a8b","sha512":"405ecfbe9503dd8656e3243fbdef0b3ee4f828a96c7732ed56026909058345f12fd7aca4797bbe243e0f4c5a4c7382efe405189f74ecfc5e41fa0d238844c6cb","ssdeep":"1536:ruRBBCZGu1NG7+6LyJxOJdcxgQ8TNXFFhRgjJv24u:ruRBBCZGu1NG7+6Lyac2Q8TNXFFhRgja","tlshash":"90835370f1b195bb7c53b5bea3ece44c660a61d69c12a3bcfa61e40117c3af67897900","first_seen":"2026-04-15T00:09:35.740202Z","last_seen":"2026-04-15T00:11:17.129938Z","times_seen":2,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gemini.sp18.net/assets/index-BYAKOR2e.js","fqdn":"gemini.sp18.net","domain":"sp18.net","tld":"net"},"ip":{"addr":"85.137.174.79","port":443,"asn":6739,"as":"Vodafone Ono, S.A.","country":"Spain","country_code":"ES"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://gemini.sp18.net/","date":"2026-04-15T00:09:01.913Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gemini.sp18.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Apr 2026 17:12:57 GMT","end":"Mon, 13 Jul 2026 17:12:56 GMT"},"fingerprint":{"sha1":"9E:0F:A4:42:69:1E:39:1B:C4:B2:2B:D7:C6:9D:30:BF:7C:59:2F:CC","sha256":"30:ED:87:08:F9:B4:01:E0:17:E0:80:17:45:83:38:8F:2B:D0:91:E4:CA:B9:D4:D5:AC:0C:F1:14:7F:B4:16:50"}}},"request":{"raw":"GET /assets/index-BYAKOR2e.js HTTP/1.1\r\nHost: gemini.sp18.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gemini.sp18.net/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0\r\ncontent-encoding: gzip\r\ncontent-type: text/javascript; charset=utf-8\r\ndate: Wed, 15 Apr 2026 00:09:01 GMT\r\netag: W/\"191768-19d8d0c364a\"\r\nlast-modified: Tue, 14 Apr 2026 17:31:21 GMT\r\nserver: Caddy\r\nvary: Accept-Encoding\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":1644392,"size_decoded":0,"mime_type":"text/javascript; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (42198)","md5":"90eccde7d23f2727d053bcdb8f7aada0","sha1":"90dc3bcb32a014816dfd88a47dbc9bbac500879b","sha256":"54652e8962436561d4025e15361c3eb53dd3395b87f81a44291e180714037d07","sha512":"11258a34c5abb472c62f8e449e59169299a8e7602f0b9e9872e8f5ee50c4e931518e6630eed539695016fe155ba35ca1a59d873e59bff266301d8d879a8f0958","ssdeep":"24576:A+fIF8Pq1ZBdwyTegkQpD2TMJQQ4m594D:9IF8Pq1ZB+yTnkQpD2TMJQQ4m594D","tlshash":"80254bec7255742643a325b0007f150bb33a691aa40dc478f659d8ea3dfc84a667bfbc","first_seen":"2026-04-15T00:09:35.742982Z","last_seen":"2026-04-15T00:11:17.128374Z","times_seen":2,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"gemini.sp18.net/favicon.svg","fqdn":"gemini.sp18.net","domain":"sp18.net","tld":"net"},"ip":{"addr":"85.137.174.79","port":443,"asn":6739,"as":"Vodafone Ono, S.A.","country":"Spain","country_code":"ES"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://gemini.sp18.net/","date":"2026-04-15T00:09:02.494Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"gemini.sp18.net","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Tue, 14 Apr 2026 17:12:57 GMT","end":"Mon, 13 Jul 2026 17:12:56 GMT"},"fingerprint":{"sha1":"9E:0F:A4:42:69:1E:39:1B:C4:B2:2B:D7:C6:9D:30:BF:7C:59:2F:CC","sha256":"30:ED:87:08:F9:B4:01:E0:17:E0:80:17:45:83:38:8F:2B:D0:91:E4:CA:B9:D4:D5:AC:0C:F1:14:7F:B4:16:50"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: gemini.sp18.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://gemini.sp18.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0\r\ncontent-encoding: gzip\r\ncontent-type: image/svg+xml\r\ndate: Wed, 15 Apr 2026 00:09:02 GMT\r\netag: W/\"495-19d8d0c364a\"\r\nlast-modified: Tue, 14 Apr 2026 17:31:21 GMT\r\nserver: Caddy\r\nvary: Accept-Encoding\r\ncontent-length: 461\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Caddy","description":"","website":"https://caddyserver.com","common_platform_enumeration":"cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*","icon":"caddy.svg","categories":["Web servers"]}],"data":{"size":1173,"size_decoded":0,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"e39eed64be4d9c550b2fbbc5e32c5c94","sha1":"d55c1db6a733e97899fd2bfd57ce5d4a1f2fb75f","sha256":"0d930d6580ba36a2b5cce59443655f4ceda18dfa38a869d56024e7292a14a4b9","sha512":"6843f54fdb2d7dabce1807726bdead4e9621401cd5ddfd99b8d8afe5d2c5361f46551bb792997621d6bfb482d876b835b1827ac278b818cd2950786c93d07412","ssdeep":"","tlshash":"90216b09a3ac9836d215c20ce6a8d538261e42c35e699121b15d9f6f9b245db9c3b3fc","first_seen":"2026-04-15T00:09:35.746025Z","last_seen":"2026-04-15T00:11:17.133057Z","times_seen":2,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":32,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}