{"report_id":"27353659-5eaa-4cf9-857f-f6e00a618c9f","version":0,"status":"done","tags":["microsoft","phishing","suspicious"],"date":"2026-07-17T08:27:32Z","url":{"schema":"http","addr":"altamimitex.com/php","fqdn":"altamimitex.com","domain":"altamimitex.com","tld":"com"},"ip":{"addr":"208.91.198.106","port":0,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"altamimitex.com/php/","fqdn":"altamimitex.com","domain":"altamimitex.com","tld":"com"},"title":"Outlook","dom":{"size":78424,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (39839)","md5":"71102a1343bc5a188123230b5423aeee","sha1":"afd3aed321579fdaf6764a9a13d6ddb37a58f145","sha256":"831475cefbfb4a06f96822a54bc54a6f286972901084de505cd69b6fafcbb364","sha512":"a7ada3c87792496b74c6b5ae663d662a9c65156696fab3e2a44e3f47acb78979f09495aa0708de9232cd198d8b61b5ff3f9f88dd718cfa516e83cba49f7fa26d","ssdeep":"1536:cFZruGZHeKqYjsRxEfG1osobzHkqi5oJcA5+R1rk1:iuYHeKqY4P057HHiEXQW","tlshash":"3973e137e22a3c1213979d15c5696d883e22f9072c56cc01fe4c33889ff4a9465bbaf9","dom_hash":"domhash9e173f75caab78ebaab4ac15e373458c","first_seen":"2026-04-23T08:37:12.08221Z","last_seen":"2026-07-17T08:27:33.359857Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"altamimitex.com/php","fqdn":"altamimitex.com","domain":"altamimitex.com","tld":"com"},"ip":{"addr":"208.91.198.106","port":0,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T08:27:32Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-17","alert":"Detects file containing Telegram Bot API","trigger":"altamimitex.com/php/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"altamimitex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"altamimitex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"altamimitex.com","ip":{"addr":"208.91.198.106","port":443,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"domain_registered":"2018-09-09","domain_rank":0,"first_seen":"2026-03-24T15:54:41.22701Z","last_seen":"2026-07-17T01:44:31.000815Z","alert_count":11,"request_count":3,"received_data":79743,"sent_data":1485,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.29.8","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"jQuery:3.4.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]}]},{"fqdn":"ajax.googleapis.com","ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":3691,"first_seen":"2012-05-22T10:38:03Z","last_seen":"2026-07-13T08:23:46.111996Z","alert_count":0,"request_count":1,"received_data":89129,"sent_data":501,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"220afd743d9e9643852e31a135a9f3ae","sha1":"88523924351bac0b5d560fe0c5781e2556e7693d","sha256":"0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a","sha512":"6e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d","ssdeep":"1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe","tlshash":"338319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","size":88145,"data":"","first_seen":"2023-03-07T01:02:34Z","last_seen":"2026-08-11T04:02:34.848468Z","times_seen":138801,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"altamimitex.com/php/","fqdn":"altamimitex.com","domain":"altamimitex.com","tld":"com"},"ip":{"addr":"208.91.198.106","port":443,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"caf9708db2f8b86aa44b6bfb86955105","sha1":"eec8a629b766679223c7dd693c0a943f87fd3c7a","sha256":"da2a6255fe299d24676e77b3c8b9d05fe0c0b7b17b7b3af2bdcc52ad328c1ba0","sha512":"9be8b9f54d1c759ac5d8ff460e74343a63afaf6c3fdbdb3dd3608309cf1ba0a33a7af294d2395da0d87761be5f8fa874811ab2df18781d48b2b660f64921faf8","ssdeep":"192:fyKkaWlKkZKkaXzKkfKkpqgs95gsUdKkcgs+gs8s:J1rkw","tlshash":"be02f26ff97a0c310ad76ab720b9e6803423a4170d566c05f91c77558f50eaa20bbbca","size":8983,"data":"","first_seen":"2026-07-17T07:59:10.549939Z","last_seen":"2026-07-17T08:27:33.364311Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-17","alert":"Detects file containing Telegram Bot API","trigger":"altamimitex.com/php/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"","filename":"https://altamimitex.com/php/","line_number":45,"column_number":17}]},"http":[{"url":{"schema":"https","addr":"altamimitex.com/favicon.ico","fqdn":"altamimitex.com","domain":"altamimitex.com","tld":"com"},"ip":{"addr":"208.91.198.106","port":443,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://altamimitex.com/php/","date":"2026-07-17T08:26:29.196Z","timestamp":1784276789196,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"altamimitex.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 29 May 2026 07:03:57 GMT","end":"Thu, 27 Aug 2026 07:03:56 GMT"},"fingerprint":{"sha1":"FF:44:B6:AA:C4:05:BB:22:2C:F1:AB:9D:DF:FD:7F:51:4C:92:F6:77","sha256":"DA:77:3E:92:BF:9A:16:41:A4:C4:47:16:69:A1:2B:CF:24:29:CB:F4:E6:59:FD:F1:49:86:1B:16:DE:2F:28:9C"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: altamimitex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://altamimitex.com/php/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 404 \r\ndate: Fri, 17 Jul 2026 08:26:29 GMT\r\nserver: nginx/1.29.8\r\ncontent-type: text/html\r\ncontent-length: 355\r\nlast-modified: Wed, 16 Mar 2022 19:21:15 GMT\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"","fingerprints":[{"name":"Nginx:1.29.8","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":583,"size_decoded":610,"mime_type":"text/html","magic":"HTML document, ASCII text","md5":"59f6ae7c7f154ec74d418d4ed6fc5b0e","sha1":"674860108a41ab23ba5f73635749332bd8a46b7e","sha256":"50e0767f2731da7ddb56d719dc85a7f830c4a860d8f09d0f25401d3dc7097d7d","sha512":"501f35d5347bd1f20024a1c76172874e0026289f6dd60de6a1f83ef2deb0fff07cd75c45b4dcf693a7c2ff903528bedbd05c2b9f9bb439d294f5f904427173f7","ssdeep":"","tlshash":"fbf0eb671c62c4436521c68a33e1ee2c58983213d109ed6ab6de522ccb89bdc88d3a39","first_seen":"2023-03-10T19:53:58Z","last_seen":"2026-08-10T21:40:21.720783Z","times_seen":11863,"resource_available":true,"data":null}},"time_used":156,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":156,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"altamimitex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"altamimitex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"altamimitex.com/php","fqdn":"altamimitex.com","domain":"altamimitex.com","tld":"com"},"ip":{"addr":"208.91.198.106","port":443,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T08:26:27.610Z","timestamp":1784276787610,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"altamimitex.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 29 May 2026 07:03:57 GMT","end":"Thu, 27 Aug 2026 07:03:56 GMT"},"fingerprint":{"sha1":"FF:44:B6:AA:C4:05:BB:22:2C:F1:AB:9D:DF:FD:7F:51:4C:92:F6:77","sha256":"DA:77:3E:92:BF:9A:16:41:A4:C4:47:16:69:A1:2B:CF:24:29:CB:F4:E6:59:FD:F1:49:86:1B:16:DE:2F:28:9C"}}},"request":{"raw":"GET /php HTTP/1.1\r\nHost: altamimitex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 301 \r\ndate: Fri, 17 Jul 2026 08:26:28 GMT\r\nserver: nginx/1.29.8\r\ncontent-type: text/html; charset=iso-8859-1\r\ncontent-length: 276\r\nlocation: https://altamimitex.com/php/\r\nx-server-cache: false\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"301","status_text":"","fingerprints":[{"name":"Nginx:1.29.8","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-11T03:57:29.375322Z","times_seen":17829662,"resource_available":true,"data":null}},"time_used":839,"timings":{"blocked":-1,"dns":260,"connect":136,"send":0,"wait":164,"receive":0,"ssl":279},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"altamimitex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"altamimitex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"altamimitex.com/php/","fqdn":"altamimitex.com","domain":"altamimitex.com","tld":"com"},"ip":{"addr":"208.91.198.106","port":443,"asn":46606,"as":"UNIFIEDLAYER-AS-1","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T08:26:28.459Z","timestamp":1784276788459,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"altamimitex.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Fri, 29 May 2026 07:03:57 GMT","end":"Thu, 27 Aug 2026 07:03:56 GMT"},"fingerprint":{"sha1":"FF:44:B6:AA:C4:05:BB:22:2C:F1:AB:9D:DF:FD:7F:51:4C:92:F6:77","sha256":"DA:77:3E:92:BF:9A:16:41:A4:C4:47:16:69:A1:2B:CF:24:29:CB:F4:E6:59:FD:F1:49:86:1B:16:DE:2F:28:9C"}}},"request":{"raw":"GET /php/ HTTP/1.1\r\nHost: altamimitex.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 08:26:28 GMT\r\nserver: nginx/1.29.8\r\ncontent-type: text/html\r\nlast-modified: Tue, 14 Jul 2026 06:56:18 GMT\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-server-cache: false\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"jQuery:3.4.1","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Google Hosted Libraries","description":"Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.","website":"https://developers.google.com/speed/libraries","common_platform_enumeration":"","icon":"Google Developers.svg","categories":["CDN"]},{"name":"Nginx:1.29.8","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":78425,"size_decoded":51842,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (39840)","md5":"75206c6cb4f8041fbe2ae394cdd68842","sha1":"e47547d9e5f1589a93c1b63d69c9d48b8a74d062","sha256":"711ff3ea1d8b05318c87a0b9ffa0eeefb8c130537ff69bdd3b1924c84b30b768","sha512":"9c5e0c48b8de4dd491c283adc96008031e5a16d13a15009d3cb0ff31c5c32735b55c480e0077b8f6398af6cf290a970d6d37562e46f7e4b9ef9c02852f1b0d58","ssdeep":"1536:+FZruGZHeKqYjsRxEfG1ohobzHkqiEoJcA5+i1rkw:suYHeKqY4P056HHixXQy","tlshash":"c573e137e22a3c1213979d15c4696d883e22f9072c56cc01fe4c338c9fe4a9465bbaf9","first_seen":"2026-04-23T08:37:12.095196Z","last_seen":"2026-07-17T08:27:33.362234Z","times_seen":4,"resource_available":true,"data":null}},"time_used":160,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":160,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-17","alert":"Detects file containing Telegram Bot API","trigger":"altamimitex.com/php/","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"altamimitex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"altamimitex.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js","fqdn":"ajax.googleapis.com","domain":"ajax.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.74","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://altamimitex.com/php/","date":"2026-07-17T08:26:29.044Z","timestamp":1784276789044,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 29 Jun 2026 08:39:27 GMT","end":"Mon, 21 Sep 2026 08:39:26 GMT"},"fingerprint":{"sha1":"50:37:CF:61:33:A1:EE:47:D9:3D:A6:5E:07:BA:4C:FF:F7:25:9F:76","sha256":"7D:4D:21:06:63:E2:5E:F0:8C:59:8E:EB:B7:94:2B:81:70:11:D3:F4:C0:A0:81:A6:1B:E7:27:FD:56:10:1A:11"}}},"request":{"raw":"GET /ajax/libs/jquery/3.4.1/jquery.min.js HTTP/1.1\r\nHost: ajax.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://altamimitex.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\ncontent-encoding: gzip\r\naccess-control-allow-origin: *\r\ncontent-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers\r\ncross-origin-resource-policy: cross-origin\r\ncross-origin-opener-policy: same-origin; report-to=\"hosted-libraries-pushers\"\r\nreport-to: {\"group\":\"hosted-libraries-pushers\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers\"}]}\r\ntiming-allow-origin: *\r\ncontent-length: 30774\r\nx-content-type-options: nosniff\r\nserver: sffe\r\nx-xss-protection: 0\r\ndate: Sat, 11 Jul 2026 06:46:16 GMT\r\nexpires: Sun, 11 Jul 2027 06:46:16 GMT\r\ncache-control: public, max-age=31536000, stale-while-revalidate=2592000\r\nage: 524413\r\nlast-modified: Mon, 13 May 2019 14:37:17 GMT\r\ncontent-type: text/javascript; charset=UTF-8\r\nvary: Accept-Encoding\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":88145,"size_decoded":31758,"mime_type":"text/javascript; charset=UTF-8","magic":"JavaScript source, ASCII text, with very long lines (65451)","md5":"220afd743d9e9643852e31a135a9f3ae","sha1":"88523924351bac0b5d560fe0c5781e2556e7693d","sha256":"0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a","sha512":"6e722fce1e8553be592b1a741972c7f5b7b0cdafce230e9d2d587d20283482881c96660682e4095a5f14df45a96ec193a9b222030c53b1b7bbe8312b2eae440d","ssdeep":"1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe","tlshash":"338319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","first_seen":"2023-03-07T01:02:34Z","last_seen":"2026-08-11T04:02:34.848468Z","times_seen":138801,"resource_available":true,"data":null}},"time_used":81,"timings":{"blocked":-1,"dns":3,"connect":15,"send":0,"wait":15,"receive":15,"ssl":33},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}