{"report_id":"04d9c811-5081-4ca3-ab24-1910e8aeae3e","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-09-12T14:38:14Z","url":{"schema":"http","addr":"vht-sk.sk/Benachrichtigung/htm.html","fqdn":"vht-sk.sk","domain":"vht-sk.sk","tld":"sk"},"ip":{"addr":"193.163.77.77","port":0,"asn":29405,"as":"VNET a.s.","country":"Slovakia","country_code":"SK"},"final":{"url":{"schema":"https","addr":"vht-sk.sk/Benachrichtigung/htm.html","fqdn":"vht-sk.sk","domain":"vht-sk.sk","tld":"sk"},"title":"Raiffeisen - Anmeldung","dom":{"size":14062,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"87df8aac7133dbd4bba045d4e8cc8fac","sha1":"a777114bb1b88c445fd6dd5c37b7f342b839f84c","sha256":"85c19ebffa2ff7ed194c6ac67df68f6936a341d44ef5be6dec6a366455bb6c26","sha512":"f86f38b5b75bc2b3cde489f38a60078ceab5eba1aae9386698131b157b186d4e60b12029662e503282d626bdda341437435b901b09c9e1e02085890c9a15e58f","ssdeep":"192:b2Wx40ll9m6BLhAyJvZMQRIdHIeOfy9xtF8hmz/8dONzjzNKU8j:ZxsYeOfYbsOGUO","tlshash":"a052546a32e305a21993a87d3bd743413629c453cc1aed243bcc77a94f45e89aeb57cc","dom_hash":"domhash1c4b060e89e7d229d4b23537e7b0eb65","first_seen":"2026-09-12T14:38:15.879069Z","last_seen":"2026-09-12T20:12:06.596322Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"vht-sk.sk/Benachrichtigung/htm.html","fqdn":"vht-sk.sk","domain":"vht-sk.sk","tld":"sk"},"ip":{"addr":"193.163.77.77","port":0,"asn":29405,"as":"VNET a.s.","country":"Slovakia","country_code":"SK"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-17T14:38:14Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":1,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-12","alert":"Detects file containing Telegram Bot API","trigger":"vht-sk.sk/Benachrichtigung/htm.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"vht-sk.sk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":{"engine":"luna_v2","pattern_id":"suspicious_scripts.javascript.telegram_api_send_message"}}]},"summary":[{"fqdn":"vht-sk.sk","ip":{"addr":"193.163.77.77","port":443,"asn":29405,"as":"VNET a.s.","country":"Slovakia","country_code":"SK"},"domain_registered":"2023-03-28","domain_rank":0,"first_seen":"2026-09-12T14:24:47.58534Z","last_seen":"2026-09-12T14:24:47.58534Z","alert_count":4,"request_count":2,"received_data":16580,"sent_data":1022,"comment":"","tags":null,"fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"vht-sk.sk/Benachrichtigung/htm.html","fqdn":"vht-sk.sk","domain":"vht-sk.sk","tld":"sk"},"ip":{"addr":"193.163.77.77","port":443,"asn":29405,"as":"VNET a.s.","country":"Slovakia","country_code":"SK"},"md5":"88182898d6a33efbc63d7802cbe1c30f","sha1":"04841b81a5b755e859b494d21bfa1e280b2a91ee","sha256":"44e1977fcde736ca593df275dae92db393ed8d4cbb7e78238e25bbd25ef26d11","sha512":"8206f716ee0fd2e8c724eab6a8923a37838bc4bd81b8e7e517a37a64de1b7e30741a2dd3ca435232a077d58110ab13688b627cba1632ae73b317dbc322ffe1c3","size":6774,"token":"8856223001:AAFUM6FIflAyOyVerXDNyYl4HnnShLHFnMU","is_revoked":false,"bot":{"token":"8856223001:AAFUM6FIflAyOyVerXDNyYl4HnnShLHFnMU","user_id":"8856223001","username":"JatRzlta_bot","first_name":"JatRzlta","last_name":"","chat":{"chat_id":"8314651162","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":{"engine":"luna_v2","pattern_id":"suspicious_scripts.javascript.telegram_api_send_message"}}]},"javascript":{"script":[{"url":{"schema":"https","addr":"vht-sk.sk/Benachrichtigung/htm.html","fqdn":"vht-sk.sk","domain":"vht-sk.sk","tld":"sk"},"ip":{"addr":"193.163.77.77","port":443,"asn":29405,"as":"VNET a.s.","country":"Slovakia","country_code":"SK"},"introduction_type":"scriptElement","is_inline":true,"md5":"88182898d6a33efbc63d7802cbe1c30f","sha1":"04841b81a5b755e859b494d21bfa1e280b2a91ee","sha256":"44e1977fcde736ca593df275dae92db393ed8d4cbb7e78238e25bbd25ef26d11","sha512":"8206f716ee0fd2e8c724eab6a8923a37838bc4bd81b8e7e517a37a64de1b7e30741a2dd3ca435232a077d58110ab13688b627cba1632ae73b317dbc322ffe1c3","ssdeep":"96:0fNBbHoeGnijlxIiGqJSg1Z19xtF84smz/8dpUhNzjzbvimdKU6C:0HIeOfy9xtF8hmz/8dONzjzNKUf","tlshash":"11e1546a36c306b10af769ba37c74381362588479c16f8247b5cb72a0f50e4ae9b57cd","size":6774,"data":"","first_seen":"2026-09-12T14:38:15.882184Z","last_seen":"2026-09-12T20:12:06.599738Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-12","alert":"Detects file containing Telegram Bot API","trigger":"vht-sk.sk/Benachrichtigung/htm.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"vht-sk.sk/Benachrichtigung/htm.html","fqdn":"vht-sk.sk","domain":"vht-sk.sk","tld":"sk"},"ip":{"addr":"193.163.77.77","port":443,"asn":29405,"as":"VNET a.s.","country":"Slovakia","country_code":"SK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-12T14:37:46.657Z","timestamp":1789223866657,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vht-sk.sk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:44:55 GMT","end":"Wed, 21 Oct 2026 15:44:54 GMT"},"fingerprint":{"sha1":"63:25:5F:EF:1D:F0:6A:0E:F6:42:86:FC:3F:D2:23:39:29:5C:E6:DC","sha256":"57:89:61:C3:64:D1:B4:EF:D3:08:22:2C:CD:9C:D3:D6:BE:55:91:B0:E1:64:4F:17:78:09:B2:9F:30:90:65:5E"}}},"request":{"raw":"GET /Benachrichtigung/htm.html HTTP/1.1\r\nHost: vht-sk.sk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\netag: \"38a1-6aa22063-2c08703;br\"\r\nlast-modified: Thu, 10 Sep 2026 03:13:39 GMT\r\ncontent-type: text/html\r\ncontent-length: 2893\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ndate: Sat, 12 Sep 2026 14:37:46 GMT\r\nserver: LiteSpeed\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":14497,"size_decoded":3356,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"a4814ee809675a89ac3a46650c190620","sha1":"dcece4efc2c1da03c0a1afa5a08465197a68d593","sha256":"6fa4065bbcc6a5ac746319ce44a65a8ff2ac7bd51d1a7b2e70329eb17062481c","sha512":"9a8957196a6b5936d53fc035c4879b7156b3ca07ff47127c0b2600651d61751f3cd58ad2da8e8d4991dc9904418afbddafab07c2c8ae36c1ebf9db5fe4b9df77","ssdeep":"192:ndZpffKbi3qO91sItD9rLJGM3eBKlXLJw6q+oEf7ls+Gu1UH:dzHK+qpI5lXLHzFUH","tlshash":"3b5263167281099215b3a779bfe38388ff1a8167c90285253bfc77a60f71d449a66fcc","first_seen":"2026-09-12T14:38:15.880451Z","last_seen":"2026-09-12T20:12:06.59812Z","times_seen":2,"resource_available":false,"data":null}},"time_used":161,"timings":{"blocked":-1,"dns":3,"connect":34,"send":0,"wait":39,"receive":0,"ssl":84},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-09-12","alert":"Detects file containing Telegram Bot API","trigger":"vht-sk.sk/Benachrichtigung/htm.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"vht-sk.sk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":{"engine":"luna_v2","pattern_id":"suspicious_scripts.javascript.telegram_api_send_message"}}]}},{"url":{"schema":"https","addr":"vht-sk.sk/favicon.ico","fqdn":"vht-sk.sk","domain":"vht-sk.sk","tld":"sk"},"ip":{"addr":"193.163.77.77","port":443,"asn":29405,"as":"VNET a.s.","country":"Slovakia","country_code":"SK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://vht-sk.sk/Benachrichtigung/htm.html","date":"2026-09-12T14:37:46.985Z","timestamp":1789223866985,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"vht-sk.sk","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 23 Jul 2026 15:44:55 GMT","end":"Wed, 21 Oct 2026 15:44:54 GMT"},"fingerprint":{"sha1":"63:25:5F:EF:1D:F0:6A:0E:F6:42:86:FC:3F:D2:23:39:29:5C:E6:DC","sha256":"57:89:61:C3:64:D1:B4:EF:D3:08:22:2C:CD:9C:D3:D6:BE:55:91:B0:E1:64:4F:17:78:09:B2:9F:30:90:65:5E"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: vht-sk.sk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://vht-sk.sk/Benachrichtigung/htm.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 \r\ncontent-type: text/html\r\ncache-control: private, no-cache, max-age=0\r\npragma: no-cache\r\ndate: Sat, 12 Sep 2026 14:37:46 GMT\r\nserver: LiteSpeed\r\ncontent-encoding: gzip\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":1236,"size_decoded":1089,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"30a9aa3e2018df9e4d5a7dea65c283f6","sha1":"6abb0707a87dd0140ae3488c3f2a378726e2ca53","sha256":"230d91b44ffd4de6a3cfe521b2560e5ed59763df51a5de76fc01513787fb1682","sha512":"8f81262c4a373aac14e4bb31bcd26fc4e706d7a2d8b2f71b7822444307d2d3ffa44f6602b6902a2d471bc2ecb96f48a43a4901b3c63e940f68c949a3b9f18e7f","ssdeep":"","tlshash":"db21423ec1c1150a80271154fb91e2982619825192470fa1778e7167b6cc0f756937c8","first_seen":"2023-03-07T14:32:05Z","last_seen":"2026-09-12T20:12:06.599148Z","times_seen":3035,"resource_available":true,"data":null}},"time_used":41,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":41,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-12","alert":"Sinkholed","trigger":"vht-sk.sk","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}