{"report_id":"07add8cd-20c0-4640-ae19-795b498e9d44","version":6,"status":"done","tags":["suspicious"],"date":"2026-04-20T22:06:13Z","url":{"schema":"http","addr":"soorgroup.ca/r/xifix/xinfini/","fqdn":"soorgroup.ca","domain":"soorgroup.ca","tld":"ca"},"ip":{"addr":"68.66.226.89","port":0,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"soorgroup.ca/r/xifix/xinfini/","fqdn":"soorgroup.ca","domain":"soorgroup.ca","tld":"ca"},"title":"Xfinity Login","dom":{"size":11475,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"6f01d8504f04cbf23f9fb41367eacfae","sha1":"7f59745e588a7858f2e9d45f03878afafe8bc89a","sha256":"dcfe33770e902dbcc97f52ede22c0f42370b8bdcae0311f96269e21b4b717af1","sha512":"6e0a3b0dc7d5b51845401e6943190ebce18c58c052b71d2e591c516866406f3e6aaf3cdc74ddaf0b438d938d87e59fa17d9b5ce6df3d2835924c1c41767a0e3e","ssdeep":"192:BrUIZJ8k+sK54a1+47Ry6w1eaNbSyGxEqwA+iWttYHAxAD9Ik9ftiIG4HIitKGSH:BrUI2HanoY4/cEL/U6UScixiAidiJ4i4","tlshash":"2732512a31e20491a213a4a83ad39b063674d503d54ad9a47dac4799dfcfe92cdf33cc","dom_hash":"domhash1340459ab69d6aeb3a54afc1bacadc91","first_seen":"2026-04-20T12:09:41.555693Z","last_seen":"2026-04-20T22:06:14.609877Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"soorgroup.ca/r/xifix/xinfini/","fqdn":"soorgroup.ca","domain":"soorgroup.ca","tld":"ca"},"ip":{"addr":"68.66.226.89","port":0,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-05-25T22:06:13Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-20","alert":"Detects file containing Telegram Bot API","trigger":"soorgroup.ca/r/xifix/xinfini/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"soorgroup.ca","ip":{"addr":"68.66.226.89","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"domain_registered":"2022-06-15","domain_rank":0,"first_seen":"2026-04-20T12:09:38.750611Z","last_seen":"2026-04-20T12:09:38.750611Z","alert_count":2,"request_count":4,"received_data":225350,"sent_data":1871,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"soorgroup.ca/r/xifix/xinfini/","fqdn":"soorgroup.ca","domain":"soorgroup.ca","tld":"ca"},"ip":{"addr":"68.66.226.89","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"1248bff9539b2e784c0bfd41a0863666","sha1":"f00c762f47049c1e4e2f06e0629f8094d166d23e","sha256":"f4be42ddd2bd0ea97a4d175076645cce86162842e07f1a315c14f66928d7c736","sha512":"f3426bef8fd4aa0ddd42d2ab1b403aeea2248c0d537ef95baa349fb28ae1d6baf5c9bd0b60d12dada5ab31fc33e14ca7616e4e629ca12fda16f4bbf089d0f982","ssdeep":"","tlshash":"3061db8b35e70878076b71be2a97d3063438c4032c06c8497d2c92269f66ea6d5f778c","size":3454,"data":"","first_seen":"2026-04-20T12:09:41.571325Z","last_seen":"2026-04-20T22:06:14.614371Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-20","alert":"Detects file containing Telegram Bot API","trigger":"soorgroup.ca/r/xifix/xinfini/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"soorgroup.ca/r/xifix/xinfini/login-logo.png","fqdn":"soorgroup.ca","domain":"soorgroup.ca","tld":"ca"},"ip":{"addr":"68.66.226.89","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://soorgroup.ca/r/xifix/xinfini/","date":"2026-04-20T22:05:49.207Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"soorgroup.ca","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 02 Apr 2026 08:49:48 GMT","end":"Wed, 01 Jul 2026 08:49:47 GMT"},"fingerprint":{"sha1":"63:A2:7A:2A:6D:CF:64:49:94:61:1D:EC:28:34:D8:2B:0F:72:D9:2F","sha256":"0C:C2:B8:4C:E5:58:76:84:11:57:2D:C2:34:CA:71:CF:33:8D:5D:C1:5D:95:7A:17:96:61:DF:FB:EA:B4:01:3B"}}},"request":{"raw":"GET /r/xifix/xinfini/login-logo.png HTTP/1.1\r\nHost: soorgroup.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://soorgroup.ca/r/xifix/xinfini/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=604800, public\r\nexpires: Mon, 27 Apr 2026 22:05:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 01 Jul 2025 07:56:44 GMT\r\naccept-ranges: bytes\r\ncontent-length: 3160\r\ndate: Mon, 20 Apr 2026 22:05:49 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":3160,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 177 x 66, 8-bit/color RGBA, non-interlaced","md5":"72f9a786dd4d2248ef7c19918579d400","sha1":"643005a3395e4cfcced2ebeaf4716ba797f6fb5e","sha256":"e11d74aaa1040bea2d76cf714c39ec9f612c6fcaf98f1b62ceecabdf64513deb","sha512":"29512e45674fcf68e2743b965b431ee718041baade7c0c8e4fd838706a60350eaf47a6809b52bb2136c74cf6c2f2a2a3ed882757dab5cdb487b4eb5615c6f0fd","ssdeep":"","tlshash":"bc516cfb2b113cec5ed830f930597388a662cfcd301e68659c066ae539c7cd816e1887","first_seen":"2025-08-17T13:36:40.441168Z","last_seen":"2026-07-30T15:25:33.856782Z","times_seen":50,"resource_available":false,"data":null}},"time_used":598,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":598,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"soorgroup.ca/r/xifix/xinfini/image.png","fqdn":"soorgroup.ca","domain":"soorgroup.ca","tld":"ca"},"ip":{"addr":"68.66.226.89","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://soorgroup.ca/r/xifix/xinfini/","date":"2026-04-20T22:05:49.209Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"soorgroup.ca","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 02 Apr 2026 08:49:48 GMT","end":"Wed, 01 Jul 2026 08:49:47 GMT"},"fingerprint":{"sha1":"63:A2:7A:2A:6D:CF:64:49:94:61:1D:EC:28:34:D8:2B:0F:72:D9:2F","sha256":"0C:C2:B8:4C:E5:58:76:84:11:57:2D:C2:34:CA:71:CF:33:8D:5D:C1:5D:95:7A:17:96:61:DF:FB:EA:B4:01:3B"}}},"request":{"raw":"GET /r/xifix/xinfini/image.png HTTP/1.1\r\nHost: soorgroup.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://soorgroup.ca/r/xifix/xinfini/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncache-control: max-age=604800, public\r\nexpires: Mon, 27 Apr 2026 22:05:49 GMT\r\ncontent-type: image/png\r\nlast-modified: Tue, 01 Jul 2025 07:56:32 GMT\r\naccept-ranges: bytes\r\ncontent-length: 207574\r\ndate: Mon, 20 Apr 2026 22:05:49 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":207574,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 921 x 812, 8-bit/color RGBA, non-interlaced","md5":"c1e7ee0a6c73babcd516dd427e250011","sha1":"ae4ad375c7739e75b032755f4e23d2f22214cc80","sha256":"d36a29adf5cff78f0d0d7086d8508a9e5377ecec856cc5e833a17c473954c08a","sha512":"9fb451f2c2c044f258ce9d2cc7341bccb055b12c3ce37cc577ddfb66c368d6c24437adc6cefb4a0d83216b7664505ab864b83f08a7e0904fb23c7884a8d78ec7","ssdeep":"3072:DGJKmz/3FdnT3jjUIOJqN0+ewyYbvImNNW33OwceVPto4z+D7wUI9ye1Asz82:qwM7b3esXewyKAmNNJwcSe4i3LMz82","tlshash":"8914124e547b9c06c682cfe02efb88db133581a78e81027ddad075887244879e7bda5f","first_seen":"2025-08-17T13:36:40.436062Z","last_seen":"2026-07-30T15:25:33.858198Z","times_seen":49,"resource_available":false,"data":null}},"time_used":603,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":303,"receive":300,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"soorgroup.ca/favicon.ico","fqdn":"soorgroup.ca","domain":"soorgroup.ca","tld":"ca"},"ip":{"addr":"68.66.226.89","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://soorgroup.ca/r/xifix/xinfini/","date":"2026-04-20T22:05:49.462Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"soorgroup.ca","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 02 Apr 2026 08:49:48 GMT","end":"Wed, 01 Jul 2026 08:49:47 GMT"},"fingerprint":{"sha1":"63:A2:7A:2A:6D:CF:64:49:94:61:1D:EC:28:34:D8:2B:0F:72:D9:2F","sha256":"0C:C2:B8:4C:E5:58:76:84:11:57:2D:C2:34:CA:71:CF:33:8D:5D:C1:5D:95:7A:17:96:61:DF:FB:EA:B4:01:3B"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: soorgroup.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://soorgroup.ca/r/xifix/xinfini/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 404 Not Found\r\ncache-control: private, no-cache, no-store, must-revalidate, max-age=0\r\npragma: no-cache\r\ncontent-type: text/html\r\ncontent-length: 796\r\ndate: Mon, 20 Apr 2026 22:05:49 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":796,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, LF line terminators","md5":"265e51037981a14ed99a5fc8c5ec1b51","sha1":"d12ac588953298fdaf46dd5b4af8eb4cf6b06f0a","sha256":"c4b07931b3fc37bc80d56a367783e7fa7c04ced4befec7f57ed079c38c960400","sha512":"b18aa610811c5f9bc1dd829ad90a95568e81a41e1fd1472983dc00147f65045fd91fbc498b5263ce4f4c88b041be21f186ed2ce357d3bcf86c0429ca18991151","ssdeep":"","tlshash":"1101f12ac182a80fe0231070fa91e37451594212629b4f647b9ff676f6ce1ab56b22cc","first_seen":"2024-02-05T05:35:22Z","last_seen":"2026-08-04T17:01:03.705084Z","times_seen":52948,"resource_available":true,"data":null}},"time_used":151,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":151,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"soorgroup.ca/r/xifix/xinfini/","fqdn":"soorgroup.ca","domain":"soorgroup.ca","tld":"ca"},"ip":{"addr":"68.66.226.89","port":443,"asn":55293,"as":"A2HOSTING","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-04-20T22:05:48.583Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"soorgroup.ca","organization":""},"issuer":{"commonName":"R13","organization":"Let's Encrypt"},"validity":{"start":"Thu, 02 Apr 2026 08:49:48 GMT","end":"Wed, 01 Jul 2026 08:49:47 GMT"},"fingerprint":{"sha1":"63:A2:7A:2A:6D:CF:64:49:94:61:1D:EC:28:34:D8:2B:0F:72:D9:2F","sha256":"0C:C2:B8:4C:E5:58:76:84:11:57:2D:C2:34:CA:71:CF:33:8D:5D:C1:5D:95:7A:17:96:61:DF:FB:EA:B4:01:3B"}}},"request":{"raw":"GET /r/xifix/xinfini/ HTTP/1.1\r\nHost: soorgroup.ca\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ncontent-type: text/html\r\nlast-modified: Wed, 08 Apr 2026 09:26:41 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\ncontent-length: 2834\r\ndate: Mon, 20 Apr 2026 22:05:48 GMT\r\nserver: LiteSpeed\r\nstrict-transport-security: max-age=63072000; includeSubDomains\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\ncache-control: max-age=3600, must-revalidate\r\nalt-svc: h3=\":443\"; ma=2592000, h3-29=\":443\"; ma=2592000, h3-Q050=\":443\"; ma=2592000, h3-Q046=\":443\"; ma=2592000, h3-Q043=\":443\"; ma=2592000, quic=\":443\"; ma=2592000; v=\"43,46\"\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":11869,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"80db2a729bf6f972aace68eb4f7264ff","sha1":"7777ff05349c25048e266d67c1f0d7ed1c057ffe","sha256":"50c882a857263ed3e896011c9ee11f9ca9e182ad83108add86933b694cf84a1d","sha512":"7449dee871721a901d4fdff96b57f1b47d14057f0187724911a5b47e0d0e4de800111934066cca1f0d8d1771f0085fb02f1b6d71fc77ccc21871f7ad52565758","ssdeep":"192:TIwToIVoV8eTt3X1xsm1sx5T+JucpUFd472i80UcOL5SXtmLiqLi1ULimLiXE4zZ:TIwpCrVsWwcKtivUZLNisi16iIif3ip+","tlshash":"f732412a31810451a233a6b8ba93c70afa758113d64695643dec574a9fbfe11cdb3bcc","first_seen":"2026-04-20T12:09:41.567566Z","last_seen":"2026-04-20T22:06:14.61315Z","times_seen":2,"resource_available":false,"data":null}},"time_used":782,"timings":{"blocked":312,"dns":12,"connect":146,"send":0,"wait":156,"receive":0,"ssl":151},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-04-20","alert":"Detects file containing Telegram Bot API","trigger":"soorgroup.ca/r/xifix/xinfini/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}}]}