{"report_id":"25695b8e-b4e8-4ff3-9c9a-cbbe3dcc570d","version":0,"status":"done","tags":["phishing","suspicious","telegram_bot"],"date":"2026-08-04T16:39:43Z","url":{"schema":"http","addr":"ftwdesign.com.hk/EngTgred.html","fqdn":"ftwdesign.com.hk","domain":"ftwdesign.com.hk","tld":"com.hk"},"ip":{"addr":"103.15.22.30","port":0,"asn":45910,"as":"i-System Technology Limited","country":"Hong Kong","country_code":"HK"},"final":{"url":{"schema":"https","addr":"ftwdesign.com.hk/EngTgred.html","fqdn":"ftwdesign.com.hk","domain":"ftwdesign.com.hk","tld":"com.hk"},"title":"Email Update","dom":{"size":6387,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"5c1b3da1c24c7a515d4913c97101da5e","sha1":"2258733de5873d341a5a5ff0479716c1e39c326f","sha256":"0dce4a30256218bd0e948902b40110d9a5356102bb1806348b2a0b9771f887e5","sha512":"8ad066d66b555aa4bc9592f56dc0f9e65e634710d30e0bb44446f58929468f697f2a23f59092f3289daeb5e7c9d4590fc97c712d43ddd01cd80f630d2061cc22","ssdeep":"192:Br5/+rNFMEFpF/9OAjqxt4FiLi3iebUnUn2iQuriyu4/:Br2FMEFpF+74FiLi3i0UnpiQ6iyb","tlshash":"08d1544b15670850a6a3e1fc37e7a7053560c013ae4ac8647f5ca79d8f4ae96d8b33cd","dom_hash":"domhashfbad14c8bbe4416ad4933980c48ba9a8","first_seen":"2026-07-29T13:00:39.882089Z","last_seen":"2026-08-04T16:40:13.73442Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ftwdesign.com.hk/EngTgred.html","fqdn":"ftwdesign.com.hk","domain":"ftwdesign.com.hk","tld":"com.hk"},"ip":{"addr":"103.15.22.30","port":0,"asn":45910,"as":"i-System Technology Limited","country":"Hong Kong","country_code":"HK"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-08T16:39:43Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-04","alert":"Detects file containing Telegram Bot API","trigger":"ftwdesign.com.hk/EngTgred.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"ftwdesign.com.hk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"ftwdesign.com.hk","ip":{"addr":"103.15.22.30","port":443,"asn":45910,"as":"i-System Technology Limited","country":"Hong Kong","country_code":"HK"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":5,"request_count":2,"received_data":7564,"sent_data":1019,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"ftwdesign.com.hk/EngTgred.html","fqdn":"ftwdesign.com.hk","domain":"ftwdesign.com.hk","tld":"com.hk"},"ip":{"addr":"103.15.22.30","port":443,"asn":45910,"as":"i-System Technology Limited","country":"Hong Kong","country_code":"HK"},"md5":"a08df5e4d351a3e371e9c3b09686e7be","sha1":"68c37fa2ca9b6b4c6d364919fb2cf99271aceaf5","sha256":"21b50024b1afcb957a321bc9f9b8cde78ce8d5be42ffb3ceca659dc3894e3868","sha512":"958a1de68bee53a1e6e409ad60f10980c431fc8ad7ff28cec22f6ca65018abf835d0dcecf905fc8549cb49c793c2a27212343615cbe4a79c9ff23645940ab05c","size":3040,"token":"8600508694:AAERk6OfmYaXaesXI1sf93zFllNFa8BoN8M","is_revoked":false,"bot":{"token":"8600508694:AAERk6OfmYaXaesXI1sf93zFllNFa8BoN8M","user_id":"8600508694","username":"ISHOSTTINBot","first_name":"ISHOSTTINbot","last_name":"","chat":{"chat_id":"1425685154","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"ftwdesign.com.hk/EngTgred.html","fqdn":"ftwdesign.com.hk","domain":"ftwdesign.com.hk","tld":"com.hk"},"ip":{"addr":"103.15.22.30","port":443,"asn":45910,"as":"i-System Technology Limited","country":"Hong Kong","country_code":"HK"},"introduction_type":"scriptElement","is_inline":true,"md5":"a08df5e4d351a3e371e9c3b09686e7be","sha1":"68c37fa2ca9b6b4c6d364919fb2cf99271aceaf5","sha256":"21b50024b1afcb957a321bc9f9b8cde78ce8d5be42ffb3ceca659dc3894e3868","sha512":"958a1de68bee53a1e6e409ad60f10980c431fc8ad7ff28cec22f6ca65018abf835d0dcecf905fc8549cb49c793c2a27212343615cbe4a79c9ff23645940ab05c","ssdeep":"","tlshash":"0c51119b111718a007b7a2ed324ba314316191273d85d460be1cd66a4f5aea6fcb73ce","size":3040,"data":"","first_seen":"2026-07-29T13:00:39.889055Z","last_seen":"2026-08-04T16:40:13.744713Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-04","alert":"Detects file containing Telegram Bot API","trigger":"ftwdesign.com.hk/EngTgred.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ftwdesign.com.hk/EngTgred.html","fqdn":"ftwdesign.com.hk","domain":"ftwdesign.com.hk","tld":"com.hk"},"ip":{"addr":"103.15.22.30","port":443,"asn":45910,"as":"i-System Technology Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-04T16:39:14.860Z","timestamp":1785861554860,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ftwdesign.com.hk","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 04:18:03 GMT","end":"Sat, 10 Oct 2026 04:18:02 GMT"},"fingerprint":{"sha1":"50:A6:06:2E:AD:8D:11:7C:BE:45:6C:1A:05:47:38:01:32:CA:86:9D","sha256":"49:76:69:AB:59:F8:21:E1:8D:E7:A9:14:5B:7F:12:1C:CB:F6:14:BC:5F:80:3E:2B:A6:1D:03:96:61:C4:71:D2"}}},"request":{"raw":"GET /EngTgred.html HTTP/1.1\r\nHost: ftwdesign.com.hk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Tue, 04 Aug 2026 16:39:16 GMT\r\nContent-Type: text/html\r\nContent-Length: 6398\r\nConnection: keep-alive\r\nLast-Modified: Mon, 03 Aug 2026 08:25:58 GMT\r\nAccept-Ranges: bytes\r\nCache-Control: max-age=0\r\nExpires: Tue, 04 Aug 2026 16:39:16 GMT\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6398,"size_decoded":6674,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"01ba28af943e1d491b0b6c20385dcf64","sha1":"ae49fdce58a71c17fb1c288867f208e5e98bf009","sha256":"6c6e885cf8393d64ffe379e3bdf123fb0bb0c0eaffa64a694d93a682cfcd4539","sha512":"7f4d7634514a7c8fadcdbfd503ff76acfc64b1c1b58b6bd7cfbf1b5b2b42efd34f8c6ec60cd099e139c8db11afca02e412e350008d1250928bb0d08478b4f019","ssdeep":"192:L5/+rNFMEFpF/9OAjq/tSFiLi3iebUnUn2iQuriyu4Vz:L2FMEFpF+FSFiLi3i0UnpiQ6iyp","tlshash":"dcd1445b15670850a6a3e1fc3be7a7053160c013ae4ac8647f5ca39d8f4ae96d9b33cd","first_seen":"2026-07-29T13:00:39.884993Z","last_seen":"2026-08-04T16:40:13.7387Z","times_seen":3,"resource_available":false,"data":null}},"time_used":1565,"timings":{"blocked":-1,"dns":683,"connect":211,"send":0,"wait":242,"receive":0,"ssl":429},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-04","alert":"Detects file containing Telegram Bot API","trigger":"ftwdesign.com.hk/EngTgred.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"ftwdesign.com.hk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"ftwdesign.com.hk/favicon.ico","fqdn":"ftwdesign.com.hk","domain":"ftwdesign.com.hk","tld":"com.hk"},"ip":{"addr":"103.15.22.30","port":443,"asn":45910,"as":"i-System Technology Limited","country":"Hong Kong","country_code":"HK"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ftwdesign.com.hk/EngTgred.html","date":"2026-08-04T16:39:16.635Z","timestamp":1785861556635,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.ftwdesign.com.hk","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 12 Jul 2026 04:18:03 GMT","end":"Sat, 10 Oct 2026 04:18:02 GMT"},"fingerprint":{"sha1":"50:A6:06:2E:AD:8D:11:7C:BE:45:6C:1A:05:47:38:01:32:CA:86:9D","sha256":"49:76:69:AB:59:F8:21:E1:8D:E7:A9:14:5B:7F:12:1C:CB:F6:14:BC:5F:80:3E:2B:A6:1D:03:96:61:C4:71:D2"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: ftwdesign.com.hk\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ftwdesign.com.hk/EngTgred.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 500 Internal Server Error\r\nServer: nginx\r\nDate: Tue, 04 Aug 2026 16:39:16 GMT\r\nContent-Type: text/html; charset=iso-8859-1\r\nContent-Length: 710\r\nConnection: keep-alive\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"Internal Server Error","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":710,"size_decoded":890,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"68d544222a66fc7b15cd04fa0c0144ca","sha1":"2618fe116e3365e79b48be889d448321913fc4b2","sha256":"567ab3b5991c7f881c5b7e1be5ee071a919e5ade9a94a9c26282b17da2ba5aa9","sha512":"beed50575ab7555a41d10b016edaf5e8ab2ebf9c9729f9d3ea8281473f950d1093e95007a36db45a79772769d07fb81ca9e9ad12de2836a3f735a98ea1d20189","ssdeep":"","tlshash":"b3017baf834a23235171b688b88121c47f10203625e199985254997bb2c69d9db3a7ec","first_seen":"2026-08-04T16:40:13.740247Z","last_seen":"2026-08-04T16:40:13.740247Z","times_seen":1,"resource_available":false,"data":null}},"time_used":221,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":221,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-04","alert":"Sinkholed","trigger":"ftwdesign.com.hk","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}