{"report_id":"35867a21-6e5d-4cdd-876a-ed819d38d3fc","version":0,"status":"done","tags":["phishing","suspicious","telegram_bot"],"date":"2026-06-08T13:32:53Z","url":{"schema":"http","addr":"studentska-zadruga.ba/proctal/EN-G.html","fqdn":"studentska-zadruga.ba","domain":"studentska-zadruga.ba","tld":"ba"},"ip":{"addr":"185.212.108.35","port":0,"asn":200698,"as":"Globalhost d.o.o.","country":"Bosnia and Herzegovina","country_code":"BA"},"final":{"url":{"schema":"https","addr":"studentska-zadruga.ba/proctal/EN-G.html","fqdn":"studentska-zadruga.ba","domain":"studentska-zadruga.ba","tld":"ba"},"title":"Email Update","dom":{"size":6389,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"7ed926713f4212ed46a12fdd4a1c1387","sha1":"9bf87e7d88a443843d816025f7062560095143e3","sha256":"30be359621f4b8ceda74e4ebaf84233203c6fc2e87b9d3fe5594c20f48b5f3d6","sha512":"0466f498be1b128a96079e63eb90bec1eb75ef0f829ba99cf5d6877914910cab27657fd212c9d64f11fa35782d7279d67b720b74379da5e7b0b1e2fdd07bb7b7","ssdeep":"192:Br5/+rNFMEFpF/9OAjqDWFiLi3iebUnUn2iQuriyu4/:Br2FMEFpF+DWFiLi3i0UnpiQ6iyb","tlshash":"c2d1555b556708506aa3e1ec37e7a7093160c013ae4ac8647f5cb79c8f4ae96d8b33cd","dom_hash":"domhashfbad14c8bbe4416ad4933980c48ba9a8","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"studentska-zadruga.ba/proctal/EN-G.html","fqdn":"studentska-zadruga.ba","domain":"studentska-zadruga.ba","tld":"ba"},"ip":{"addr":"185.212.108.35","port":0,"asn":200698,"as":"Globalhost d.o.o.","country":"Bosnia and Herzegovina","country_code":"BA"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-13T13:32:53Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-08","alert":"Detects file containing Telegram Bot API","trigger":"studentska-zadruga.ba/proctal/EN-G.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"studentska-zadruga.ba","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"studentska-zadruga.ba","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"studentska-zadruga.ba","ip":{"addr":"185.212.108.35","port":443,"asn":200698,"as":"Globalhost d.o.o.","country":"Bosnia and Herzegovina","country_code":"BA"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-03-30T18:43:32.749547Z","last_seen":"2026-06-08T13:30:43.227418Z","alert_count":7,"request_count":2,"received_data":6733,"sent_data":1042,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"studentska-zadruga.ba/proctal/EN-G.html","fqdn":"studentska-zadruga.ba","domain":"studentska-zadruga.ba","tld":"ba"},"ip":{"addr":"185.212.108.35","port":443,"asn":200698,"as":"Globalhost d.o.o.","country":"Bosnia and Herzegovina","country_code":"BA"},"md5":"8918acc6787409a1a2912092052d5bee","sha1":"f38de2fe02bc49dc693e1be7496e58abc93e32cc","sha256":"6ed5678437eec8eda2ecdb6b2c6a2565185bcaf007c644ddd56d97cfb2685872","sha512":"18812a5470c358cfacae35d02804f2caa4650324f87a01d71f25c1cb7949c8a722149c933ec7c4204fc268498dee591afef5891ce67ddd0ef51cf600b43c7b73","size":3044,"token":"8114981394:AAFAr83SVVOfo8THcBa7FL66LV8tof_K4tc","is_revoked":false,"bot":{"token":"8114981394:AAFAr83SVVOfo8THcBa7FL66LV8tof_K4tc","user_id":"8114981394","username":"communicazonbot","first_name":"webdata","last_name":"","chat":{"chat_id":"-1003166747957","title":"Result __Box","type":"channel","bot_is":"administrator","total_users":2,"active_members":null,"admins":[{"user_id":8114981394,"username":"communicazonbot","first_name":"webdata","last_name":"","is_bot":true},{"user_id":6140282075,"username":"sleemdrfeelgood","first_name":"Perfect","last_name":"Peace","is_bot":false}]},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"studentska-zadruga.ba/proctal/EN-G.html","fqdn":"studentska-zadruga.ba","domain":"studentska-zadruga.ba","tld":"ba"},"ip":{"addr":"185.212.108.35","port":443,"asn":200698,"as":"Globalhost d.o.o.","country":"Bosnia and Herzegovina","country_code":"BA"},"introduction_type":"scriptElement","is_inline":true,"md5":"8918acc6787409a1a2912092052d5bee","sha1":"f38de2fe02bc49dc693e1be7496e58abc93e32cc","sha256":"6ed5678437eec8eda2ecdb6b2c6a2565185bcaf007c644ddd56d97cfb2685872","sha512":"18812a5470c358cfacae35d02804f2caa4650324f87a01d71f25c1cb7949c8a722149c933ec7c4204fc268498dee591afef5891ce67ddd0ef51cf600b43c7b73","ssdeep":"","tlshash":"3051119b211718e007b7e2ed324ba314316191273d85d460be1ce66a4f26da7f8b73ce","size":3044,"data":"","first_seen":"2026-06-08T13:32:54.334898Z","last_seen":"2026-06-08T23:55:44.949939Z","times_seen":2,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-08","alert":"Detects file containing Telegram Bot API","trigger":"studentska-zadruga.ba/proctal/EN-G.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"studentska-zadruga.ba/favicon.ico","fqdn":"studentska-zadruga.ba","domain":"studentska-zadruga.ba","tld":"ba"},"ip":{"addr":"185.212.108.35","port":443,"asn":200698,"as":"Globalhost d.o.o.","country":"Bosnia and Herzegovina","country_code":"BA"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://studentska-zadruga.ba/proctal/EN-G.html","date":"2026-06-08T13:32:30.480Z","timestamp":1780925550480,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"studentska-zadruga.ba","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 14 May 2026 05:24:36 GMT","end":"Wed, 12 Aug 2026 05:24:35 GMT"},"fingerprint":{"sha1":"A4:FD:98:79:D1:2C:8B:A4:01:B2:D9:2D:68:49:F1:83:63:BF:43:5D","sha256":"7F:67:42:6B:85:01:3A:E5:6D:FC:E2:29:1D:3F:12:35:A1:75:16:53:2D:A5:3F:62:A7:30:26:E8:BE:DE:BE:76"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: studentska-zadruga.ba\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://studentska-zadruga.ba/proctal/EN-G.html\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 500 \r\ncontent-type: text/html; charset=UTF-8\r\ndate: Mon, 08 Jun 2026 13:32:30 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"500","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":128,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T23:40:28.518186Z","times_seen":17325131,"resource_available":true,"data":null}},"time_used":150,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":150,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"studentska-zadruga.ba","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"studentska-zadruga.ba","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"studentska-zadruga.ba/proctal/EN-G.html","fqdn":"studentska-zadruga.ba","domain":"studentska-zadruga.ba","tld":"ba"},"ip":{"addr":"185.212.108.35","port":443,"asn":200698,"as":"Globalhost d.o.o.","country":"Bosnia and Herzegovina","country_code":"BA"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-08T13:32:29.718Z","timestamp":1780925549718,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"studentska-zadruga.ba","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Thu, 14 May 2026 05:24:36 GMT","end":"Wed, 12 Aug 2026 05:24:35 GMT"},"fingerprint":{"sha1":"A4:FD:98:79:D1:2C:8B:A4:01:B2:D9:2D:68:49:F1:83:63:BF:43:5D","sha256":"7F:67:42:6B:85:01:3A:E5:6D:FC:E2:29:1D:3F:12:35:A1:75:16:53:2D:A5:3F:62:A7:30:26:E8:BE:DE:BE:76"}}},"request":{"raw":"GET /proctal/EN-G.html HTTP/1.1\r\nHost: studentska-zadruga.ba\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nlast-modified: Tue, 26 May 2026 11:21:01 GMT\r\naccept-ranges: bytes\r\ncontent-length: 6402\r\ncontent-type: text/html\r\ndate: Mon, 08 Jun 2026 13:32:30 GMT\r\nserver: Apache\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":6402,"size_decoded":6605,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"bad3e94dd2d4e2a15a2707e4b6c4bb01","sha1":"92a4a19d9355b0d716594bfbe5c919ef3ab735b1","sha256":"3673d0586047cbf446d81e795f6c9ba7475a17b2565b90cd4ad2d131813249e3","sha512":"6b0e26cc2ba231d8ac75faa836dc9225f96a8a05268036bf93d53965bd607d2d1eead554bca66fa3225a7e3a2f156a2f81802306106e0063d6ec2bf4c5dbb0c6","ssdeep":"192:75/+rNFMEFpF/9OAjqDuFiLi3iebUnUn2iQuriyu4Vz:72FMEFpF+DuFiLi3i0UnpiQ6iyp","tlshash":"8cd1445b156708506693e1ec37e7a7093160c013ae8ac8647f5cb39d8f4ad96d8b33cd","first_seen":"2026-06-08T13:32:54.330318Z","last_seen":"2026-06-08T23:55:44.948142Z","times_seen":2,"resource_available":true,"data":null}},"time_used":399,"timings":{"blocked":-1,"dns":221,"connect":54,"send":0,"wait":63,"receive":0,"ssl":61},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-06-08","alert":"Detects file containing Telegram Bot API","trigger":"studentska-zadruga.ba/proctal/EN-G.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"studentska-zadruga.ba","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-06-08","alert":"Sinkholed","trigger":"studentska-zadruga.ba","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}}]}