{"report_id":"188ffc09-0198-4844-a98d-53779874ed1e","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-07-28T17:01:48Z","url":{"schema":"http","addr":"activity.octofrost.com/SHIPMENT_DHL.html","fqdn":"activity.octofrost.com","domain":"octofrost.com","tld":"com"},"ip":{"addr":"195.216.58.38","port":0,"asn":57084,"as":"Bjare Kraft ekonomisk forening","country":"Sweden","country_code":"SE"},"final":{"url":{"schema":"https","addr":"activity.octofrost.com/SHIPMENT_DHL.html","fqdn":"activity.octofrost.com","domain":"octofrost.com","tld":"com"},"title":"Email Verification","dom":{"size":35344,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (13837)","md5":"bbbb7e5383d228d37f91f0287a9bd012","sha1":"3f7bcc801004964cf3eb845cb495581ee2d34f6b","sha256":"cf49f737f61ab451a0e536b40441ca5943c5d4a91cb33ece15efaaead606701a","sha512":"29499a6e15a209ca2e77b0e60340f257d9c20c1cf95a9a78169443c29fdfd42e2e1ec7793194674588e54fbd2ba99a2923739e8f8b84d29a914f0033cd6fde5f","ssdeep":"768:rY/bPAv9b4kcyHfGgVSYxY4EDGmHYJBi1xF:rYDNyHfrgYFLJ0jF","tlshash":"76f25b312f550d261767476f63ab31c0fd2d6713da4e88aeb05d05a6bff2d4182e8931","dom_hash":"domhash115d912c75305b755106836b54c044b3","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"activity.octofrost.com/SHIPMENT_DHL.html","fqdn":"activity.octofrost.com","domain":"octofrost.com","tld":"com"},"ip":{"addr":"195.216.58.38","port":0,"asn":57084,"as":"Bjare Kraft ekonomisk forening","country":"Sweden","country_code":"SE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-01T17:01:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-28","alert":"Detects file containing Telegram Bot API","trigger":"activity.octofrost.com/SHIPMENT_DHL.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"activity.octofrost.com","ip":{"addr":"195.216.58.38","port":443,"asn":57084,"as":"Bjare Kraft ekonomisk forening","country":"Sweden","country_code":"SE"},"domain_registered":"2006-12-04","domain_rank":0,"first_seen":"2026-07-28T13:39:40.711633Z","last_seen":"2026-07-28T13:39:40.711633Z","alert_count":2,"request_count":2,"received_data":36305,"sent_data":1045,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"activity.octofrost.com/SHIPMENT_DHL.html","fqdn":"activity.octofrost.com","domain":"octofrost.com","tld":"com"},"ip":{"addr":"195.216.58.38","port":443,"asn":57084,"as":"Bjare Kraft ekonomisk forening","country":"Sweden","country_code":"SE"},"md5":"3c80e02288b491cc831bef81b1174526","sha1":"8c2a01cade5dc74e1eaccc07f3b3b46c446dc637","sha256":"7d8ea39e12593f70792f5ccd97ab30ad2a56ad64f24a29ba56c92787a9d8c54e","sha512":"cd2f6ff8452fc70a8d607989dacf4b47a7f7782b6ca18e4cd6b3464b4c1a855281b31bc622b8d58b9bdb4e5a10c3f38cdd7a60da6acb1f9352d820558775a828","size":7457,"token":"8846109076:AAHM3rLrKtob3JEuvyuI43g8gF3a8O86DnE","is_revoked":false,"bot":{"token":"8846109076:AAHM3rLrKtob3JEuvyuI43g8gF3a8O86DnE","user_id":"8846109076","username":"Greatnessonly1Bot","first_name":"greatnessonly","last_name":"","chat":{"chat_id":"8704137369","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"activity.octofrost.com/SHIPMENT_DHL.html","fqdn":"activity.octofrost.com","domain":"octofrost.com","tld":"com"},"ip":{"addr":"195.216.58.38","port":443,"asn":57084,"as":"Bjare Kraft ekonomisk forening","country":"Sweden","country_code":"SE"},"introduction_type":"scriptElement","is_inline":true,"md5":"3c80e02288b491cc831bef81b1174526","sha1":"8c2a01cade5dc74e1eaccc07f3b3b46c446dc637","sha256":"7d8ea39e12593f70792f5ccd97ab30ad2a56ad64f24a29ba56c92787a9d8c54e","sha512":"cd2f6ff8452fc70a8d607989dacf4b47a7f7782b6ca18e4cd6b3464b4c1a855281b31bc622b8d58b9bdb4e5a10c3f38cdd7a60da6acb1f9352d820558775a828","ssdeep":"96:RcvnklH42nPLLqCo7vk0zf52hHcPxvhu7DMTFBizlvFgAuEirwhrgAFlfqWrpZBe:RcPY4EDG+JHYJBizRBuRwhfRpM","tlshash":"b8f164623f014e8927469bff733b71c0e00da507290698aaf10d59683f62e57f6d6671","size":7457,"data":"","first_seen":"2026-07-28T13:39:42.241307Z","last_seen":"2026-07-28T17:01:49.141814Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-28","alert":"Detects file containing Telegram Bot API","trigger":"activity.octofrost.com/SHIPMENT_DHL.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"activity.octofrost.com/favicon.ico","fqdn":"activity.octofrost.com","domain":"octofrost.com","tld":"com"},"ip":{"addr":"195.216.58.38","port":443,"asn":57084,"as":"Bjare Kraft ekonomisk forening","country":"Sweden","country_code":"SE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://activity.octofrost.com/SHIPMENT_DHL.html","date":"2026-07-28T17:01:22.603Z","timestamp":1785258082603,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"activity.octofrost.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 23:51:56 GMT","end":"Wed, 23 Sep 2026 23:51:55 GMT"},"fingerprint":{"sha1":"6D:61:DF:F0:43:7C:1C:E7:69:41:49:31:28:D9:ED:24:61:0F:0A:32","sha256":"3E:32:E9:82:79:A6:B7:7C:71:6D:E4:AD:27:35:73:D6:EC:A6:4A:BD:8B:95:9B:D1:8D:A3:C7:AF:B5:B7:6E:F2"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: activity.octofrost.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://activity.octofrost.com/SHIPMENT_DHL.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nServer: nginx\r\nDate: Tue, 28 Jul 2026 17:01:22 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":355,"size_decoded":487,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"4525b2d648f7c457a689fd96421783a5","sha1":"11bfe30ce44585a15a38e86bc094224ddfe2c08e","sha256":"cc0b4e42510d49c6decd464123ecf3b14ae9b47f9b4ed2ee64893e2d6520a264","sha512":"94e3e8246cf38ff7740e51aa115c8c455b14f78e672c2686b782c0ce30b6fa2dbd91a78b29b3964d9c0414aabd4b9391fd5db326665e25b4b8e73dae60ffe979","ssdeep":"","tlshash":"71e0c04f4057b3474011a2907dc01291e505236b38a152f93ac09467500897dc4aa2dd","first_seen":"2025-12-09T03:51:58.5943Z","last_seen":"2026-07-30T19:32:46.472057Z","times_seen":51077,"resource_available":true,"data":null}},"time_used":22,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":22,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"activity.octofrost.com/SHIPMENT_DHL.html","fqdn":"activity.octofrost.com","domain":"octofrost.com","tld":"com"},"ip":{"addr":"195.216.58.38","port":443,"asn":57084,"as":"Bjare Kraft ekonomisk forening","country":"Sweden","country_code":"SE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-28T17:01:22.223Z","timestamp":1785258082223,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"activity.octofrost.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 25 Jun 2026 23:51:56 GMT","end":"Wed, 23 Sep 2026 23:51:55 GMT"},"fingerprint":{"sha1":"6D:61:DF:F0:43:7C:1C:E7:69:41:49:31:28:D9:ED:24:61:0F:0A:32","sha256":"3E:32:E9:82:79:A6:B7:7C:71:6D:E4:AD:27:35:73:D6:EC:A6:4A:BD:8B:95:9B:D1:8D:A3:C7:AF:B5:B7:6E:F2"}}},"request":{"raw":"GET /SHIPMENT_DHL.html HTTP/1.1\r\nHost: activity.octofrost.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 28 Jul 2026 17:01:22 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nLast-Modified: Mon, 27 Jul 2026 22:09:19 GMT\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":35487,"size_decoded":17350,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (13837), with CRLF line terminators","md5":"145690f592d92f63be7efc81fc4696a3","sha1":"cffd6ae2ed3715df9156dca27cdd314d56a2684d","sha256":"82655cbcec06fa8de34dc62cb50543639b2d6ff073cf62dc1f78dde8c195da1a","sha512":"8eb37b048bf51e6949783fbbb47098dc06ec100972b2724ef3a6cb4b90b6a341c8783599221a9a541e3778985fe8e4b54035e2e02c6fdbc094ea55635ae1a2f4","ssdeep":"768:5YHbPAv9b4kcyHfGymJsrY4EDGmHYJBi1t+:5Y7NyHftwszLJ0P+","tlshash":"94f25b312f410d2613778b6f63ab61c0fd2d67239a4e88aeb05d15a7bff2d4182e5931","first_seen":"2026-07-28T13:39:42.237076Z","last_seen":"2026-07-28T17:01:49.14124Z","times_seen":3,"resource_available":false,"data":null}},"time_used":146,"timings":{"blocked":-1,"dns":60,"connect":20,"send":0,"wait":41,"receive":0,"ssl":24},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-28","alert":"Detects file containing Telegram Bot API","trigger":"activity.octofrost.com/SHIPMENT_DHL.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}}]}