{"report_id":"38ae5777-8842-45fa-b49e-2268f46ec961","version":0,"status":"done","tags":["phishing","suspicious","telegram_bot"],"date":"2026-07-18T17:52:33Z","url":{"schema":"http","addr":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","fqdn":"spcoatingsinc.com","domain":"spcoatingsinc.com","tld":"com"},"ip":{"addr":"66.96.149.32","port":0,"asn":29873,"as":"BIZLAND-SD","country":"United States","country_code":"US"},"final":{"url":{"schema":"http","addr":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","fqdn":"spcoatingsinc.com","domain":"spcoatingsinc.com","tld":"com"},"title":"Mail","dom":{"size":39,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with no line terminators","md5":"086707e4369f60afedcafb16050a7618","sha1":"8216b0cc6876cbd44f01c158e7dff3833ceccd41","sha256":"a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e","sha512":"aade21843813e2cab329b99185c6f61db7907a556ea974e0315dcf3ad967cab20fee66d4f10db0d0ec43a71e086ce6d700d5524103deaefa3ce5f6be74ba5737","ssdeep":"","tlshash":"6a9000fee0a2000efc303bc00cc2238a0c28c3a830028e002ac038b8c80822bcc032c8","dom_hash":"domhash1f07f384c75181c66badb60ab1ec770b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","fqdn":"spcoatingsinc.com","domain":"spcoatingsinc.com","tld":"com"},"ip":{"addr":"66.96.149.32","port":0,"asn":29873,"as":"BIZLAND-SD","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-22T17:52:33Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":3,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-18","alert":"Detects file containing Telegram Bot API","trigger":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"spcoatingsinc.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"spcoatingsinc.com","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2011-11-02","domain_rank":0,"first_seen":"2026-06-29T06:53:05.633989Z","last_seen":"2026-07-18T07:33:55.552704Z","alert_count":8,"request_count":3,"received_data":7240,"sent_data":1436,"comment":"","tags":null,"fingerprints":null}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"http","addr":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","fqdn":"spcoatingsinc.com","domain":"spcoatingsinc.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"md5":"87e5f89861dd29360d33b2abeec83b5c","sha1":"158b525ee33e0f0f2c7f1faa9280a5055a03b081","sha256":"8a0a92d474dd2d39c6411489ceaeb5b59e2cafcdebb74a37e1a8b84e5a57b16a","sha512":"816170be433c4f9a929153dc9520335313b72a7ef8d7865e94abfbab3f26f1530dbf71df55dfda99c4f2416d3675cccc47c0202854d41d035683ce1b49348514","size":3040,"token":"8851636476:AAG_v6_gdqafA_3BbANsCf23jlz0Plt0fks","is_revoked":false,"bot":{"token":"8851636476:AAG_v6_gdqafA_3BbANsCf23jlz0Plt0fks","user_id":"8851636476","username":"Segun2020bot","first_name":"NEW-LOGS","last_name":"","chat":{"chat_id":"6071001706","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":0}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"http","addr":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","fqdn":"spcoatingsinc.com","domain":"spcoatingsinc.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"87e5f89861dd29360d33b2abeec83b5c","sha1":"158b525ee33e0f0f2c7f1faa9280a5055a03b081","sha256":"8a0a92d474dd2d39c6411489ceaeb5b59e2cafcdebb74a37e1a8b84e5a57b16a","sha512":"816170be433c4f9a929153dc9520335313b72a7ef8d7865e94abfbab3f26f1530dbf71df55dfda99c4f2416d3675cccc47c0202854d41d035683ce1b49348514","ssdeep":"","tlshash":"3651009b111718e007b7a2ed324ba314316191273d95d460be1ce26e4f26da6f8b73ce","size":3040,"data":"","first_seen":"2026-06-29T06:53:10.548952Z","last_seen":"2026-07-18T17:52:34.461847Z","times_seen":3,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-18","alert":"Detects file containing Telegram Bot API","trigger":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","fqdn":"spcoatingsinc.com","domain":"spcoatingsinc.com","tld":"com"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-18T17:51:57.591Z","timestamp":1784397117591,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /eaunrzy/inderrx0ee.html HTTP/1.1\r\nHost: spcoatingsinc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-19T05:20:40.687333Z","times_seen":17357419,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"spcoatingsinc.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"http","addr":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","fqdn":"spcoatingsinc.com","domain":"spcoatingsinc.com","tld":"com"},"ip":{"addr":"66.96.149.32","port":80,"asn":29873,"as":"BIZLAND-SD","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-18T17:52:00.736Z","timestamp":1784397120736,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /eaunrzy/inderrx0ee.html HTTP/1.1\r\nHost: spcoatingsinc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 18 Jul 2026 17:52:00 GMT\r\nContent-Type: text/html\r\nContent-Length: 2208\r\nConnection: keep-alive\r\nSet-Cookie: request_id=6b0511f9-9d12-4c6b-8e82-8f23a5576ab6; Max-Age=3600; Path=/; HttpOnly\r\nLast-Modified: Sun, 28 Jun 2026 16:57:41 GMT\r\nETag: \"197e-655533d65eb40-gzip\"\r\nAccept-Ranges: bytes\r\nCache-Control: max-age=3600\r\nExpires: Sat, 18 Jul 2026 18:52:00 GMT\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nAge: 0\r\nX-Request-ID: 6b0511f9-9d12-4c6b-8e82-8f23a5576ab6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":6526,"size_decoded":2705,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with CRLF line terminators","md5":"22b7c7789a4d13ffb77c3740f0779aea","sha1":"dd9092ecb988d15e5ec1759779c166737a473904","sha256":"1418eeef05ee22e7979dbeba5c82cbfaf87ec283e5e94de2d81e1c5c8da8bd15","sha512":"eb3210c18821705196f251f9befbddc5197629196eeb2e42817d202ec5e5f8d1d83d17247999748b88a5604019bd501dd95655dc62b792e58d5a0aac9101358c","ssdeep":"96:cJFZ9TuoFt19ayFt9q/FXT8i6inuigsYUQm7ATYanIihHcZihhSUC:c19dFb9amg1oi6inuiaU9YnIiRwirSh","tlshash":"8dd1645a9102084066b3e3fc7ba3630df6518053ab4181347faca39a4f7ad55d973bdc","first_seen":"2026-06-29T06:53:10.540058Z","last_seen":"2026-07-18T17:52:34.461285Z","times_seen":3,"resource_available":true,"data":null}},"time_used":282,"timings":{"blocked":-1,"dns":5,"connect":99,"send":0,"wait":177,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-07-18","alert":"Detects file containing Telegram Bot API","trigger":"spcoatingsinc.com/eaunrzy/inderrx0ee.html","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"spcoatingsinc.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Generic phishing","verdict":"phishing","severity":"medium","comment":"","tags":["phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"http","addr":"spcoatingsinc.com/favicon.ico","fqdn":"spcoatingsinc.com","domain":"spcoatingsinc.com","tld":"com"},"ip":{"addr":"66.96.149.32","port":80,"asn":29873,"as":"BIZLAND-SD","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"http://spcoatingsinc.com/eaunrzy/inderrx0ee.html","date":"2026-07-18T17:52:01.197Z","timestamp":1784397121197,"http_version":"HTTP/1.1","security_state":"insecure","security_info":null,"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: spcoatingsinc.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: http://spcoatingsinc.com/eaunrzy/inderrx0ee.html\r\nCookie: request_id=6b0511f9-9d12-4c6b-8e82-8f23a5576ab6\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sat, 18 Jul 2026 17:52:01 GMT\r\nContent-Type: image/x-icon\r\nContent-Length: 0\r\nConnection: keep-alive\r\nCache-Control: max-age=86400\r\nAge: 0\r\nX-Request-ID: 6b0511f9-9d12-4c6b-8e82-8f23a5576ab6\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":217,"mime_type":"image/x-icon","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-19T05:20:40.687333Z","times_seen":17357419,"resource_available":true,"data":null}},"time_used":108,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":108,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-07-18","alert":"Sinkholed","trigger":"spcoatingsinc.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}}]}