{"report_id":"438801dd-9e12-4d56-bb94-4d970f9a3a96","version":0,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-08-25T20:48:48Z","url":{"schema":"http","addr":"techsysscanner.lol/","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"ip":{"addr":"157.230.180.90","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"techsysscanner.lol/","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"title":"Microsoft SysScan — Browser \u0026 System Diagnostic Scanner","dom":{"size":25343,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (386)","md5":"b7010e014304bb1fc4037e70694d783d","sha1":"e09a7f1e554b4d2990124f949bca679122e4fca3","sha256":"7bfe680ce4e27d5eee81aaa271be9a11bc38b3940ff7f74d4618b4b1b3ecf854","sha512":"423e30a1e97336d2c37a4a0305696a9a20fb6606bd67b003ab00d3d40d2a92054775a251e4e5b568cda3e1c39140f89abd649b7ffc009eb475358e28b70b2547","ssdeep":"384:Br0ohtg/f+kUCklnz3LzWPbaQPxTinX2KzUk:Se6+kLy7Lz0aixTinZr","tlshash":"c5b2f12061f9983780a745c9a6a26b7e6ef59703c90a1104f7ac4bf54fe3ccade37518","dom_hash":"domhash08d302c271cb6370cdaa731013fd5d30","first_seen":"2026-08-25T20:44:06.631528Z","last_seen":"2026-08-25T20:48:56.50321Z","times_seen":4,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"techsysscanner.lol/","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"ip":{"addr":"157.230.180.90","port":0,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T20:48:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-25","alert":"Detects file containing Telegram Bot API","trigger":"techsysscanner.lol/sysscan-scanner.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"techsysscanner.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"techsysscanner.lol","ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"domain_registered":"2026-08-17","domain_rank":0,"first_seen":"2026-08-25T20:45:01.87195Z","last_seen":"2026-08-25T20:45:01.87195Z","alert_count":7,"request_count":5,"received_data":139452,"sent_data":2418,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"api.fontshare.com","ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"domain_registered":"2003-10-01","domain_rank":604295,"first_seen":"2021-03-02T20:36:57Z","last_seen":"2026-08-23T06:51:27.846639Z","alert_count":0,"request_count":1,"received_data":3084,"sent_data":558,"comment":"","tags":null,"fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}]},{"fqdn":"ipapi.co","ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-08-20T02:37:52.187777Z","alert_count":0,"request_count":1,"received_data":2538,"sent_data":462,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"techsysscanner.lol/sysscan-scanner.js","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"md5":"2b28dbc96663ca601688b3d3db74e01a","sha1":"2ad02eb658c23805223ac396d83a5839c72dbc20","sha256":"023a8e632e0222d48648c418be75c527328559ba94bc2eca25c615b93036e7e8","sha512":"35b79bcf52787f3d3af063f9bd663fc92ceed1cf89aca8949d0034fbb83979f72c3f8e01e844680c53dc6cc46b5830b1ae3d38c278ced06cfc08a84c00d582dd","size":83063,"token":"8848000942:AAFxF-scU96x4pORGnnGwCycdXSvd8VUqs8","is_revoked":false,"bot":{"token":"8848000942:AAFxF-scU96x4pORGnnGwCycdXSvd8VUqs8","user_id":"8848000942","username":"comdpro24_bot","first_name":"\u003c\u003cDPRO24\u003e\u003e","last_name":"","chat":{"chat_id":"-1004422837797","title":"DPRO24","type":"supergroup","bot_is":"administrator","total_users":7,"active_members":null,"admins":[{"user_id":7161369195,"username":"lonewolf1re","first_name":"Lone Wolf","last_name":"","is_bot":false},{"user_id":8356788977,"username":"daniel_webb23","first_name":"Daniel","last_name":"Webb","is_bot":false},{"user_id":8848000942,"username":"comdpro24_bot","first_name":"\u003c\u003cDPRO24\u003e\u003e","last_name":"","is_bot":true},{"user_id":7137925447,"username":"cmystic1","first_name":"C","last_name":"mystic","is_bot":false}]},"pending_messages":6}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"techsysscanner.lol/sysscan-scanner.js","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"2b28dbc96663ca601688b3d3db74e01a","sha1":"2ad02eb658c23805223ac396d83a5839c72dbc20","sha256":"023a8e632e0222d48648c418be75c527328559ba94bc2eca25c615b93036e7e8","sha512":"35b79bcf52787f3d3af063f9bd663fc92ceed1cf89aca8949d0034fbb83979f72c3f8e01e844680c53dc6cc46b5830b1ae3d38c278ced06cfc08a84c00d582dd","ssdeep":"768:/gb9eRdU47sVJJjugaxCWmaASn1U9xqQTNv+zbJzX5/4P5iV:/KgRdLGJaFHj+9AUNWD45iV","tlshash":"0883946a9576293505a360ad5f9b61016321910b2e08fc4c3fce831c2f9d66f92f7bed","size":83063,"data":"","first_seen":"2026-08-25T20:44:06.641747Z","last_seen":"2026-08-25T20:48:56.52379Z","times_seen":4,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-25","alert":"Detects file containing Telegram Bot API","trigger":"techsysscanner.lol/sysscan-scanner.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"techsysscanner.lol/favicon.svg","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://techsysscanner.lol/","date":"2026-08-25T20:48:22.325Z","timestamp":1787690902325,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"techsysscanner.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 11:06:49 GMT","end":"Sun, 22 Nov 2026 11:06:48 GMT"},"fingerprint":{"sha1":"74:31:19:4E:6F:55:D9:BC:65:90:EA:BD:39:62:12:D1:73:E8:60:18","sha256":"41:81:8F:0A:D3:67:06:5B:F3:FA:04:81:96:23:AC:C5:14:C1:74:71:69:07:9B:5E:EF:6F:0C:91:3E:13:7C:AD"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: techsysscanner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://techsysscanner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:48:22 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 755\r\nlast-modified: Mon, 24 Aug 2026 10:23:45 GMT\r\netag: \"6a8c1bb1-2f3\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":755,"size_decoded":1027,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"484d76251c2e1278bfe341c96c4d2414","sha1":"badfd8212fc08f78acb3e892454427b554f57dbe","sha256":"f848aaa8c7599928b7910eaecec780051c1777940c7c3e530afa0bf148359bf7","sha512":"2e8ad60f015f8a843581ecabb4ec08c95e30e1d6fcc757d0abe45630450415ced0bb0d8de00903ff8f44cb3a3ead26c79ef5584eaaaadaf51f9b3aa6cd2e308e","ssdeep":"","tlshash":"0a016812e59c811bc304870dd60cb969338fa2d39ba68100b1986b2a1a385e75dde3bc","first_seen":"2026-08-25T20:43:57.447582Z","last_seen":"2026-08-25T21:38:40.290069Z","times_seen":17,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"techsysscanner.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"techsysscanner.lol/","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T20:48:21.120Z","timestamp":1787690901120,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"techsysscanner.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 11:06:49 GMT","end":"Sun, 22 Nov 2026 11:06:48 GMT"},"fingerprint":{"sha1":"74:31:19:4E:6F:55:D9:BC:65:90:EA:BD:39:62:12:D1:73:E8:60:18","sha256":"41:81:8F:0A:D3:67:06:5B:F3:FA:04:81:96:23:AC:C5:14:C1:74:71:69:07:9B:5E:EF:6F:0C:91:3E:13:7C:AD"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: techsysscanner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:48:21 GMT\r\ncontent-type: text/html\r\nlast-modified: Mon, 24 Aug 2026 10:23:46 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a8c1bb2-6297\"\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":25239,"size_decoded":6023,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (346)","md5":"3c4e2ca6cd1a82da8887fcdfb3734458","sha1":"f415b498a53ae7a437412c3b3dac635bdabe0a6d","sha256":"ed22c11e411356c143d022483a0d59cb026b1bb43b7618d050174eda8c4d9231","sha512":"2d0f5fce4f97acea32978803b2019e2893e10c9243506beb3872a0e2240f3423073ae6eca89dc4393e717ab1db430672388be46aa02ab94490fb7f23a14d0c92","ssdeep":"384:vrBootg/c8k48CkvtipEWtcLPVxTin72fzUy:tXD8kW1pEdL9xTinM5","tlshash":"57b2f02061f8983780a745c967a29b3e6ef59343ca0a1104f7ac4be50fe3ccade37559","first_seen":"2026-08-25T20:44:06.635634Z","last_seen":"2026-08-25T20:48:56.518624Z","times_seen":4,"resource_available":false,"data":null}},"time_used":302,"timings":{"blocked":-1,"dns":4,"connect":96,"send":0,"wait":99,"receive":0,"ssl":102},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"techsysscanner.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900\u0026f[]=jetbrains-mono@400,500,700\u0026display=swap","fqdn":"api.fontshare.com","domain":"fontshare.com","tld":"com"},"ip":{"addr":"194.242.11.186","port":443,"asn":34989,"as":"ServeTheWorld AS","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://techsysscanner.lol/","date":"2026-08-25T20:48:21.883Z","timestamp":1787690901883,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"api.fontshare.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Wed, 12 Aug 2026 11:02:22 GMT","end":"Tue, 10 Nov 2026 11:02:21 GMT"},"fingerprint":{"sha1":"69:47:B7:C8:96:DB:6E:32:43:04:72:6C:D2:39:29:8F:C3:31:33:36","sha256":"BA:97:33:5D:48:ED:D6:0F:A3:E5:33:7F:13:E8:CB:DC:E1:BE:18:1A:08:1E:1C:D1:BB:45:6E:E2:DD:DA:AF:15"}}},"request":{"raw":"GET /v2/css?f[]=satoshi@400,500,700,900\u0026f[]=jetbrains-mono@400,500,700\u0026display=swap HTTP/1.1\r\nHost: api.fontshare.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://techsysscanner.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 25 Aug 2026 20:48:21 GMT\r\ncontent-type: text/css; charset=utf-8\r\nvary: Accept-Encoding\r\nserver: BunnyCDN-NO1-830\r\ncdn-pullzone: 6318758\r\ncdn-requestcountrycode: NO\r\naccess-control-allow-headers: content-type, authorization, cookie\r\naccess-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=86400, stale-while-revalidate=604800\r\nx-request-id: GM8QEacVptY7fk0AAwVy\r\ncdn-proxyver: 1.62\r\ncdn-requestpullsuccess: True\r\ncdn-requestpullcode: 200\r\ncdn-cachedat: 08/25/2026 13:40:45\r\ncdn-edgestorageid: 830\r\ncdn-requestid: 32e76d5f1341623016b11e63f844f015\r\ncdn-cache: HIT\r\ncdn-status: 200\r\ncdn-requesttime: 0\r\ncontent-encoding: br\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bunny","description":"","website":"https://bunny.net","common_platform_enumeration":"","icon":"Bunny.svg","categories":["CDN"]}],"data":{"size":2340,"size_decoded":1290,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"3d4ac42804672f363857ac55e385c61c","sha1":"9daa3a3de3702e2050354be54b4b2daf9e0468be","sha256":"1c055fbceec7a16d9572093fa0f30a7c962790eab0e939e129f099bab9af6669","sha512":"ed6c585c1f44d19119b3e3e446ac2f1de242f95d856effde417130c4b1dde8bf7c792f8431f99921e3e9388d1794209627e060dd0ed9cfedb76f97e9a0ac69c8","ssdeep":"","tlshash":"a741014239e030c948732c0877db1eec8d4d68131045e47e369ecb2caebae45439ab5c","first_seen":"2024-11-09T08:52:50.208783Z","last_seen":"2026-08-25T21:38:40.291238Z","times_seen":178,"resource_available":false,"data":null}},"time_used":59,"timings":{"blocked":-1,"dns":37,"connect":14,"send":0,"wait":2,"receive":-1,"ssl":5},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"techsysscanner.lol/sysscan-styles.css","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://techsysscanner.lol/","date":"2026-08-25T20:48:21.885Z","timestamp":1787690901885,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"techsysscanner.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 11:06:49 GMT","end":"Sun, 22 Nov 2026 11:06:48 GMT"},"fingerprint":{"sha1":"74:31:19:4E:6F:55:D9:BC:65:90:EA:BD:39:62:12:D1:73:E8:60:18","sha256":"41:81:8F:0A:D3:67:06:5B:F3:FA:04:81:96:23:AC:C5:14:C1:74:71:69:07:9B:5E:EF:6F:0C:91:3E:13:7C:AD"}}},"request":{"raw":"GET /sysscan-styles.css HTTP/1.1\r\nHost: techsysscanner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://techsysscanner.lol/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:48:21 GMT\r\ncontent-type: text/css\r\nlast-modified: Mon, 24 Aug 2026 10:23:47 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a8c1bb3-6dd4\"\r\nexpires: Wed, 26 Aug 2026 08:48:21 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":28116,"size_decoded":6634,"mime_type":"text/css","magic":"Unicode text, UTF-8 text","md5":"e4f3ec6a5c986b999957e171cf7146a5","sha1":"0b9bbbe545fc341e66950ec1cc87382beae7873c","sha256":"91fd7b43da266a1d3b2fc76fc4e814e598c1601018466118a9b8be7e2c54f543","sha512":"03b60c37ea34990faf0d7484ffa200fd73637a0dd477108c375de7e92ad620ef4f9a6e1556e9398fffeb185ba4b9f4923b720e2bd7380b6c2fdb2e8ef8e8b60d","ssdeep":"384:ioqHpBRtW51SiCBBNIU/zx+yY2EK3nVayKF4XrCypKc:ioqHdtW51SiCbNIULwy4wVaq9","tlshash":"18c26792233452747d27ea7476875b4e735ca102990edabc6fe4100cdec93fa6663b8c","first_seen":"2026-08-25T20:43:57.45646Z","last_seen":"2026-08-25T21:38:40.291797Z","times_seen":17,"resource_available":false,"data":null}},"time_used":98,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"techsysscanner.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"techsysscanner.lol/sysscan-scanner.js","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://techsysscanner.lol/","date":"2026-08-25T20:48:21.887Z","timestamp":1787690901887,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"techsysscanner.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 11:06:49 GMT","end":"Sun, 22 Nov 2026 11:06:48 GMT"},"fingerprint":{"sha1":"74:31:19:4E:6F:55:D9:BC:65:90:EA:BD:39:62:12:D1:73:E8:60:18","sha256":"41:81:8F:0A:D3:67:06:5B:F3:FA:04:81:96:23:AC:C5:14:C1:74:71:69:07:9B:5E:EF:6F:0C:91:3E:13:7C:AD"}}},"request":{"raw":"GET /sysscan-scanner.js HTTP/1.1\r\nHost: techsysscanner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://techsysscanner.lol/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:48:21 GMT\r\ncontent-type: application/javascript\r\nlast-modified: Mon, 24 Aug 2026 10:23:47 GMT\r\nvary: Accept-Encoding\r\netag: W/\"6a8c1bb3-14479\"\r\nexpires: Wed, 26 Aug 2026 08:48:21 GMT\r\ncache-control: max-age=43200\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":83065,"size_decoded":23073,"mime_type":"application/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (315)","md5":"2b28dbc96663ca601688b3d3db74e01a","sha1":"2ad02eb658c23805223ac396d83a5839c72dbc20","sha256":"023a8e632e0222d48648c418be75c527328559ba94bc2eca25c615b93036e7e8","sha512":"35b79bcf52787f3d3af063f9bd663fc92ceed1cf89aca8949d0034fbb83979f72c3f8e01e844680c53dc6cc46b5830b1ae3d38c278ced06cfc08a84c00d582dd","ssdeep":"768:/gb9eRdU47sVJJjugaxCWmaASn1U9xqQTNv+zbJzX5/4P5iV:/KgRdLGJaFHj+9AUNWD45iV","tlshash":"0883946a9576293505a360ad5f9b61016321910b2e08fc4c3fce831c2f9d66f92f7bed","first_seen":"2026-08-25T20:44:06.641747Z","last_seen":"2026-08-25T20:48:56.52379Z","times_seen":4,"resource_available":true,"data":null}},"time_used":193,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":193,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-08-25","alert":"Detects file containing Telegram Bot API","trigger":"techsysscanner.lol/sysscan-scanner.js","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"techsysscanner.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"techsysscanner.lol/favicon.svg","fqdn":"techsysscanner.lol","domain":"techsysscanner.lol","tld":"lol"},"ip":{"addr":"157.230.180.90","port":443,"asn":14061,"as":"DIGITALOCEAN-ASN","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://techsysscanner.lol/","date":"2026-08-25T20:48:22.104Z","timestamp":1787690902104,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"techsysscanner.lol","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Aug 2026 11:06:49 GMT","end":"Sun, 22 Nov 2026 11:06:48 GMT"},"fingerprint":{"sha1":"74:31:19:4E:6F:55:D9:BC:65:90:EA:BD:39:62:12:D1:73:E8:60:18","sha256":"41:81:8F:0A:D3:67:06:5B:F3:FA:04:81:96:23:AC:C5:14:C1:74:71:69:07:9B:5E:EF:6F:0C:91:3E:13:7C:AD"}}},"request":{"raw":"GET /favicon.svg HTTP/1.1\r\nHost: techsysscanner.lol\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://techsysscanner.lol/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 20:48:22 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 755\r\nlast-modified: Mon, 24 Aug 2026 10:23:45 GMT\r\netag: \"6a8c1bb1-2f3\"\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":755,"size_decoded":1027,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"484d76251c2e1278bfe341c96c4d2414","sha1":"badfd8212fc08f78acb3e892454427b554f57dbe","sha256":"f848aaa8c7599928b7910eaecec780051c1777940c7c3e530afa0bf148359bf7","sha512":"2e8ad60f015f8a843581ecabb4ec08c95e30e1d6fcc757d0abe45630450415ced0bb0d8de00903ff8f44cb3a3ead26c79ef5584eaaaadaf51f9b3aa6cd2e308e","ssdeep":"","tlshash":"0a016812e59c811bc304870dd60cb969338fa2d39ba68100b1986b2a1a385e75dde3bc","first_seen":"2026-08-25T20:43:57.447582Z","last_seen":"2026-08-25T21:38:40.290069Z","times_seen":17,"resource_available":false,"data":null}},"time_used":97,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":97,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"techsysscanner.lol","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://techsysscanner.lol/","date":"2026-08-25T20:48:22.106Z","timestamp":1787690902106,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 09:56:10 GMT","end":"Wed, 11 Nov 2026 10:56:07 GMT"},"fingerprint":{"sha1":"F3:18:40:3B:2F:29:8F:72:5D:C9:F9:8D:83:FF:1A:13:26:F5:A1:7A","sha256":"17:EB:45:1D:BC:F6:67:CB:CB:85:0A:03:6F:55:93:30:F8:33:F4:78:1A:C0:46:17:64:09:C8:78:62:38:02:5D"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://techsysscanner.lol/\r\nOrigin: https://techsysscanner.lol\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Tue, 25 Aug 2026 20:48:22 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: POST, GET, HEAD, OPTIONS, OPTIONS\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://techsysscanner.lol\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://challenges.cloudflare.com/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=R2pXvJijaMuATQuICKtm4t4K8yKyCBFa1KnSPZ5T8Pvmej1iZzVokPcB%2BikIt2MgGdZvfmFFSeTMwUABD5AW%2FE15%2F%2Fy63eGEj%2B42BdhtzJ%2Fs9WTH8VQsSyzM\"}]}\r\ncontent-encoding: br\r\ncf-ray: a30d750a4ff60b49-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":742,"size_decoded":2149,"mime_type":"application/json","magic":"JSON text data","md5":"c9a83cf7b79bb169afa15370aaa9d642","sha1":"e0fb50e54473bf4468fe35add9fd6f777c8633dc","sha256":"9513f5d1cb329721ac415720ce53669e0e98329f191ef9bacb323dd35b4134c1","sha512":"b937a919074c16e74b79086e2d1037911cd8578d04669f9bb90914c0cf579bf200fee329b8282a3c700eddfe26dbe73407141bd88a949e219f394fdc0d672e41","ssdeep":"","tlshash":"5a01df68e4780f7b9cb813587078691b113422176e563a8e7bd4a74d0f8d8bf30b135e","first_seen":"2026-08-17T05:59:44.876786Z","last_seen":"2026-08-26T00:21:54.362989Z","times_seen":316,"resource_available":false,"data":null}},"time_used":283,"timings":{"blocked":0,"dns":3,"connect":1,"send":0,"wait":264,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}