WEBSITE ANALYSIS REPORT

https://clinicadeolhosuchoa.com.br/67770/redirecteng.php#arel1@veltobox.net

20 Oct 2026 · 20:59:13.000 UTCpublic

Report tags: phishing suspicious telegram_bot
Submit tags: openphish

Request review

Phishing detected

6 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

20:58:40.260 GET 302 document 0 B 1333 ms 2 alerts

20:58:41.601 GET 200 document 430.7 KB 1477 ms 4 alerts

Transaction #17

Request / response

URL

GET HTTPS

https://pressanafm.com/099202/chi/engipfs.php?email=#arel1@veltobox.net

IP / ASN

217.174.153.64

AS57344 · Telehouse EAD

Requested by: Not recorded

Resource information

File type: HTML document, ASCII text, with CRLF line terminators
MIME type: text/html; charset=UTF-8
First seen (UTC): 20 Oct 2026 · 20:59:18.790 UTC
Last seen (UTC): 20 Oct 2026 · 20:59:18.790 UTC
Times seen: 1

Size: 430.7 KB (441054 bytes)
MD5: fa5804acb8b0f0426fa02e0c1667c900
SHA1: 58e1d265ac37b2865d1efcae1f1f66525ba8bb0b
SHA256: d90d99567ff59a86a0021f8cd9bdd288997fa442b982f6cd68f4be5368122dfb

Certificate information

Issuer: Let's Encrypt · YR2
Subject: *.pressanafm.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: F7:DB:BF:85:AE:C2:A0:FA:F2:DD:BA:DB:BD:A7:36:23:CB:20:6F:EF
Valid from: Fri, 16 Oct 2026 08:31:58 GMT
Valid until: Thu, 14 Jan 2027 08:31:57 GMT

Technology fingerprints

Axios:0.20.0 (JavaScript libraries)
cdnjs (CDN)
Cloudflare (CDN)
Apache HTTP Server (Web servers)
Bootstrap:4.0.0 (UI frameworks)
Font Awesome (Font scripts)
jQuery:2.2.4 (JavaScript libraries)
jQuery CDN (CDN)
Google Hosted Libraries (CDN)
Popper:1.12.9 (Miscellaneous)
BootstrapCDN:4.0.0 (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Known Phishing Kit detected	high	Phishing
urlquery Suspicious - Suspicious Javascript code	medium	Suspicious
YARAhub by abuse.ch Detects file containing Telegram Bot API	medium	malware
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /099202/chi/engipfs.php?email= HTTP/1.1
Host: pressanafm.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
content-length: 441054
content-type: text/html; charset=UTF-8
date: Tue, 20 Oct 2026 20:58:41 GMT
server: Apache
X-Firefox-Spdy: h2

20:58:43.274 GET 200 script 83.6 KB 95 ms —

20:58:43.276 GET 200 script 84.7 KB 306 ms —

20:58:43.278 GET 200 script 265.4 KB 73 ms —

20:58:43.280 GET 200 stylesheet 1.3 KB 76 ms —

20:58:43.281 GET 403 script 9 B 192 ms —

20:58:43.283 GET 200 script 68.0 KB 258 ms —

20:58:43.284 GET 200 script 18.7 KB 65 ms —

20:58:43.287 GET 200 script 47.8 KB 106 ms —

20:58:43.290 GET 200 script 49.8 KB 41 ms —

20:58:43.294 GET 200 script 13.9 KB 38 ms —

20:58:43.608 GET 403 script 9 B 145 ms —

20:58:43.801 GET 200 script 83.6 KB 22 ms —

20:58:43.850 GET 404 img 0 B 0 ms —

20:58:43.851 GET 404 img 0 B 0 ms —

20:58:43.870 GET 301 xhr 0 B 61 ms —

20:58:44.562 GET 200 img 103.6 KB 529 ms —

20:58:44.579 GET 200 font 76.3 KB 50 ms —

https://clinicadeolhosuchoa.com.br/67770/redirecteng.php#arel1@veltobox.net

Domain graph

Hostnames

Connections